EU Social Security Rules Are Now in Force: What Changed on 1 November 2026 and What Waits Until 2028

On 1 November 2026, the revised EU rules on social security coordination formally entered into force. Regulation (EU) 2026/2359, which amends Regulation (EC) No 883/2004 and its implementing Regulation (EC) No 987/2009, was published in the Official Journal of the European Union on 27 October 2026, closing a legislative process that began with the Commission's proposal in 2016.

For Romanian employers that send staff to other Member States, the date matters for a reason that is easy to miss. Most of the headline changes on postings and multi-state work do not apply yet. They take effect on 2 November 2028, and until then the current rules on which country's social security system covers a cross-border worker continue to apply. But a small number of provisions are live now, and one of them changes how A1 applications are assessed from this month.

This article sets out what changed on 1 November 2026, what is deferred to 2028, and how to use the next 24 months.

What applies from 1 November 2026

Two changes apply straight away, according to the published text and early practitioner analysis.

The first concerns the A1 certificate itself. Under the amended Article 19(3) of Regulation 987/2009, the institution issuing an A1 must carry out a proper assessment of the relevant facts and confirm that the information in the certificate is correct. In Romania, A1 certificates are issued by the National Public Pension House (CNPP) and its territorial pension houses. In practice, employers should expect more detailed questions about the nature of the activity, the work location pattern, the employee's links to the Romanian system and the consistency of the posting documents. Light-touch or last-minute applications are likely to become harder to manage.

The second concerns aircrew. The existing home base rule for flight and cabin crew is now expressly linked to the definition of home base used in EU aviation safety rules (Annex III, Subpart FTL to Commission Regulation (EU) No 965/2012). Airlines and crew leasing companies should check that the home base recorded for each crew member matches the operational roster.

Some advisers also read the new definition of business trip as relevant from this date. It describes a temporary activity in the employer's interest that does not involve providing services or delivering goods, such as meetings, conferences and training. How each Member State applies the definition before 2028 is still unclear, so it is a point to watch rather than act on immediately.

What waits until 2 November 2028

The operational core of the reform is deferred by 24 months. From 2 November 2028:

• the A1 for a posting must be applied for before the posting starts, with an automatic acknowledgement of receipt serving as proof where the certificate is not issued immediately
• a limited exemption from prior application covers business trips and activities of up to three days within a 30-day period, but construction is excluded
• people recruited specifically to be posted must have been insured in the sending state for at least three months before the employment starts
• a two-month break applies after a 24-month posting before the same employee can be posted to the same Member State again, or another worker sent to replace them
• multi-state A1 certificates are issued for up to 24 months, based on the projected work pattern for the next 12 months, with periodic reassessment
• a stricter test applies to whether the employer's registered office or place of business can determine the applicable legislation for multi-state workers
• enhanced cooperation procedures apply where a host-state institution doubts the validity of an A1

Until that date, a Romanian company posting an engineer to Germany or a construction crew to Austria works under the rules it uses today, subject to the stricter A1 assessment described above.

Why waiting until 2028 is the wrong reading

The deferral is a preparation window, not a pause. Building the processes the 2028 rules require takes longer than most employers expect, because the work sits across several functions:

• recruitment needs to know about the three-month prior insurance rule before offering contracts for roles that involve immediate travel abroad
• project and travel managers need to flag postings early enough for an A1 application to be filed before departure
• payroll needs to track posting durations and break periods per employee and per host country
• travel tools need to count business trip days if the three-days-in-30 exemption will be relied on

Several clarifications are also expected over the next 12 months, including a revised practical guide on applicable legislation and possible Commission proposals on telework. Employers should follow these developments, but the internal mapping work does not depend on them.

A 24-month action plan for Romanian employers

A sensible approach is to split the window into three phases.

Now to early 2027: map every current arrangement. List posted workers, frequent business travellers, cross-border commuters and multi-state employees. For each, record the A1 basis, expiry date and the work pattern stated in the application, then compare it with what the employee actually does. Given the stricter assessment now applied by issuing institutions, gaps between the application and reality are the first thing to fix.

2027: design the new process. Decide who owns the A1 request, how far in advance postings must be notified internally, how travel days are captured and where evidence is stored. Align HR, payroll and any external providers on one data set.

2028: test and switch. Run new postings through the future workflow before 2 November 2028, brief managers on the construction exclusion and the two-month break, and confirm that systems can produce the acknowledgement of receipt or exemption evidence on request.

Employers with staff in the UK, Switzerland or EEA states should assess those arrangements separately, as the EU changes do not automatically apply in the same way outside the Union.

How Nestlers Group Supports Cross-Border Social Security Compliance

Nestlers Group's Payroll and HR Compliance team handles A1 applications to the Romanian pension authorities for posted and multi-state employees, prepares the supporting documentation the stricter assessment now requires, and maintains the posting records that payroll and inspectors rely on. The team also manages ITM posted worker notifications and the monthly social security filings that accompany each assignment.

Our Immigration Advisory team reviews existing posting and multi-state arrangements against both the current rules and the 2028 requirements, identifying where recruitment practices, travel patterns or registered office set-ups will need to change. For non-EU nationals employed in Romania and posted within the EU, the team coordinates the social security position with work authorisation, so that the A1 and the residence permit tell the same story.

Where a client does not have a Romanian entity, Nestlers Group's Employer of Record service can act as the legal employer, carrying the A1, payroll and posting obligations directly.

Sources: Regulation (EU) 2026/2359 amending Regulations (EC) No 883/2004 and 987/2009, Official Journal of the EU, 27 October 2026; European Commission, Updated EU rules on social security coordination enter into force, 1 November 2026; Council of the EU, Social security coordination: Council gives final green light to updated rules, 28 September 2026; KPMG GMS Flash Alert 2026-272, 28 October 2026; EY, EU social security reform: what employers should do next, 29 October 2026