Public CbCR 2026
EU public country-by-country reporting is no longer a future obligation. Early filers in Romania, Croatia and Spain, and Australia’s parallel regime, have already shown what good looks like, where groups stumble and who is reading. Here is what in-scope multinationals should take from the first wave while there is still time to act.
Key takeaways
- For calendar year-end groups, FY2025 is the first reportable year across the EU, and publication is due by 31 December 2026. Some Member States run shorter clocks: Spain allows six months and Slovenia eleven.
- The first public reports, from Romania’s early adoption, have already been independently scored. Roughly six in ten were solid; about a quarter disclosed Romania-only data because the parent withheld group figures.
- The Directive is a minimum standard. Deadlines, languages, deferral rights, website publication and even which countries must be shown separately vary by Member State.
- EU-parented groups must publish in XHTML with Inline XBRL using the Commission’s template and taxonomy. Your tax data is becoming machine-readable and comparable.
- Confidential CbCR, EU public CbCR, Australian public CbCR and Pillar Two safe-harbour work draw on similar-looking numbers prepared on different bases. Unexplained gaps will be found.
- The narrative is where reputations are won or lost, and almost none of the early filers used it.
Quick Answer
The first EU public CbCR reports are due by 31 December 2026 for calendar year-end groups (earlier in some states: six months in Spain, eleven in Slovenia). Early filers in Romania have already been independently scored: about 60% filed solid, complete reports, while roughly a quarter disclosed only Romania-level data because their parent withheld group figures. The Directive sets a floor, not a ceiling, deadlines, languages, deferral rights and penalties all vary by Member State, so a single “EU report” often still means navigating multiple rulebooks.
Public CbCR is not a tax return. It is a publication.
For ten years, country-by-country reporting has been a private exchange. Under OECD BEPS Action 13, multinationals give tax authorities a jurisdiction-by-jurisdiction view of revenue, profit and tax, and those authorities share it among themselves. The public never sees it.
EU Directive 2021/2101 changes the audience, not just the form. It amends the EU Accounting Directive and requires groups with consolidated revenue of at least €750 million in each of the last two consecutive financial years to publish income tax information for every EU Member State and for every jurisdiction on the EU’s list of non-cooperative jurisdictions (or on its grey list for two consecutive years). Everything else can be aggregated as ‘rest of world’. The obligation reaches EU-parented groups and non-EU groups that operate in the EU through medium-sized or large subsidiaries or qualifying branches.
Because public country-by-country reporting lives in company law rather than tax law, the mechanics are corporate: filing with a commercial register, publication on a website (typically for five years), a statutory auditor confirming whether the company was in scope and published, and penalties set by each Member State. The readers change too. They are journalists, NGOs, investors, ESG raters, employees and competitors, and, increasingly, the software they use to compare companies.
If you need a refresher on how the public report differs from the confidential one, start with our guide to CbCR vs Public CbCR for UK groups. This article goes further: what the first filings tell us, and the decisions that determine whether your first report is a non-event or a headline.
Your first deadline may be earlier than you think
The EU rules apply, at the latest, to financial years beginning on or after 22 June 2024, with publication due within 12 months of the balance sheet date. The group revenue test must be met for both the reportable year and the year before. What that means in practice depends on your year-end, and on where your qualifying entities sit.
Year-end | First EU reportable year | General deadline (12 months) | Watch-outs |
30 June | 1 July 2024 – 30 June 2025 | 30 June 2026 | Already passed. If nothing has been published, treat it as remediation. |
30 September | 1 October 2024 – 30 September 2025 | 30 September 2026 | Imminent. |
31 December | 1 January – 31 December 2025 | 31 December 2026 | Spain: 30 June 2026 (passed). Slovenia: 30 November 2026. |
31 March | 1 April 2025 – 31 March 2026 | 31 March 2027 | Spain: 30 September 2026. |
Early adopters brought the rules forward: Romania for financial years starting on or after 1 January 2023, Croatia from 1 January 2024 and Sweden from 1 June 2024. Australia’s separate public CbC regime applies to reporting periods starting on or after 1 July 2024, so December year-end groups there also face a 31 December 2026 deadline.
Which Deadline Actually Applies to You?
The general rule is 31 December 2026, but Spain, Slovenia, Hungary and several others run shorter clocks. Get a free 15-minute call to pin down your group’s actual first deadline before you plan backward from the wrong date.
Lesson 1: The scorecard is already public
Romania implemented the Directive two years early, and a quirk of its rules meant the first wave caught non-EU-headquartered groups with sizeable Romanian subsidiaries. Their FY2023 reports began appearing at the end of 2024, with no central repository and no specific penalties in Romanian law.
That did not stop anyone from reading them. The Fair Tax Foundation tracked down 137 of these reports and rated each one. Its findings are the closest thing we have to a preview of how the 2026 wave will be judged:
- About 60% were solid attempts to follow the rules.
- About 26% disclosed Romania-only figures because the parent company had not provided group data to its Romanian subsidiary.
- About 7% disclosed only EU-listed tax havens rather than Member States.
- Headquarters mattered. UK- and Japan-headquartered groups produced solid reports around three-quarters of the time; US and Swiss groups managed it in fewer than half of cases.
- Sector mattered. Pharmaceuticals had the weakest record, with automotive and food and beverage also lagging; industrials, chemicals and consumer goods performed above average.
- Context was almost absent. Even groups that disclosed full data rarely used the template’s explanatory section.
At least one US group explained in its Romanian report that the machine-readable format requirement, with no published structure at the time, had added real complexity. That was a fair complaint in 2024. It is a much weaker one in 2026: the Commission’s template, taxonomy and report generator are available and have already been revised.
What this means for your FY2025 report
The Romania-only approach has run out of road. It relied on a single early Member State, no penalties and immature technical standards. For FY2025, every Member State applies the rules and many have teeth: fines of up to €250,000 in Germany, asset-based penalties in Slovakia and Czechia, and the possibility of removal from the trade register in Finland. A statement that the parent withheld data is itself a public disclosure, and increasingly an expensive one.
You will be benchmarked whether you like it or not. Civil society built a rating framework from the very first batch. Expect sector league tables, year-on-year comparisons and questions from ESG raters once hundreds of groups publish in the same month.
Silence gets filled by someone else. A row of numbers without context invites the least charitable reading.
Lesson 2: One Directive, many rulebooks
The Directive sets a floor, not a ceiling. Member States used optional clauses, added requirements and set their own penalties, and there are no priority rules for when those choices collide. For EU-parented groups, the home Member State’s rules apply. For non-EU groups, the default obligation sits with each qualifying subsidiary or branch, so every divergence becomes your problem.
Area | What varies | Selected examples |
Deadline | Shorter than 12 months | Spain six months; Slovenia 11 months; Hungary shorter (four to five months) |
Language | National language vs English | National language expected in Germany, France, Poland, Romania and Slovakia; English accepted in Austria, Cyprus, Czechia, Denmark, Greece and Italy; any EU language in Luxembourg, Malta, the Netherlands, Portugal and Spain |
Safeguard clause | Whether sensitive data can be deferred | Not available in Belgium, Estonia, Greece, Hungary or Italy; four years maximum in Germany; register court can review deferrals in Austria; Denmark also bars deferral for EU high-risk third countries |
Website publication | Whether register filing is enough | No website exemption in countries including Bulgaria, Estonia, Finland, France, Hungary, Italy, Malta, the Netherlands, Poland, Portugal and Sweden; Denmark expects publication on the reporting entity’s own website |
Countries shown separately | EEA and national lists | Iceland, Liechtenstein and Norway shown separately in Austria, Denmark, and several other states; Belgium adds its own tax-haven and Global Forum lists |
Extra content | Mandatory explanations | Hungary and Greece require an explanation of differences between tax accrued and tax paid |
Local trigger | Subsidiary size tests | Thresholds vary within the permitted range; Ireland, Spain and Malta had not yet adopted the updated Accounting Directive thresholds at the time of KPMG’s mid-2025 survey; Italy applies no specific subsidiary size threshold |
Enforcement | From nominal to severe | Germany up to €250,000; Luxembourg board members €500–€25,000; Slovakia up to 2% of assets (capped at €1m); Czechia asset-based penalties; in the Netherlands and France, third parties can ask a court to compel publication |
Summarised from public trackers current to mid-2026, cross-checked against KPMG’s EU Tax Centre tracker. Local rules continue to evolve; confirm with advisers before filing.
Two details deserve special attention. First, Italy’s lack of a subsidiary size threshold means a small Italian entity may trigger a local obligation that a 2023 scoping exercise missed. Second, the updated Accounting Directive thresholds and the two-year rule for changing size class mean scoping has to be redone on local statutory figures, not on the numbers in your confidential CbC report, which are usually prepared under the parent’s GAAP.
Which of These Rulebooks Apply to Your Footprint?
Language, safeguard clause, website publication and penalties all vary by Member State. Book a free 15-minute call to map which of these rules apply to the entities you actually have in the EU.
Lesson 3: For non-EU groups, the nomination decision is strategy, not admin
The Directive offers non-EU groups a shortcut. If the ultimate parent publishes the report on its website and designates one EU subsidiary or branch to file it with a national register, the group’s other EU entities are exempt. On paper, one filing covers the EU.
In practice, Member States implemented that multiple reporting exemption in three broad ways: by simple reference to the Directive; only where the report also meets that state’s own national requirements; or barely at all, so a local filing is needed regardless. Some add procedure on top, Austria, for example, expects a notification when the exemption is used, and France only brought the exemption into its law through a decree at the end of December 2025.
The upshot is that a ‘single’ EU report can still require translations, extra rows, additional explanations, a second register filing and a Spanish six-month clock. The groups that navigate this well treat nomination as a design decision.
Our recommendation: build to the strictest rulebook, then file once where you can
- Map every qualifying EU presence first, using local statutory accounts and local thresholds, including prior-year size classifications.
- Identify the strictest requirement in each category across that footprint: deadline, language, rows, explanations and deferral rights.
- Build one master dataset to that standard. Show EEA states separately, include the explanation of accrued versus paid tax, and plan translations where required.
- Choose your nomination hub on practicalities: register mechanics, language, format acceptance and local team capacity. Germany is a frequent candidate because its company register already accepts reports prepared in XHTML using the EU taxonomy.
- Run your data calendar to the earliest deadline in your footprint, for many groups with a Spanish presence, that means six months, not twelve.
- Document every safeguard-clause decision by jurisdiction, explain it and discuss it with your statutory auditor, remembering that several states do not allow deferral at all.
Lesson 4: Your tax data is about to become machine-readable
Commission Implementing Regulation (EU) 2024/2952, adopted on 29 November 2024, sets a common template and electronic reporting formats for financial years starting on or after 1 January 2025. Groups whose ultimate parent is in the EU must publish in XHTML with Inline XBRL tags drawn from the public CbCR taxonomy. Non-EU groups have more latitude under the Regulation, but registers may expect structured files and using the standard removes a question mark.
The technical package has moved quickly. The Commission published its taxonomy and an Excel-based report generator in December 2025, opened a review cycle in January 2026, published a corrigendum to the Regulation on 5 May 2026 and released updated documentation dated 24 July 2026. If your team built a template early in the year, check it against the current version before generating a final file.
Structured data changes the risk profile of a disclosure. Once hundreds of reports carry the same tags, nobody needs to read your PDF to compare you with your peers, they can query the dataset. That makes the technical layer a reputational layer. A wrong scale factor, a sign error on a loss, a value tagged to the wrong jurisdiction or an inconsistent currency is no longer a typo buried on page 40. It is a data point that flows straight into someone else’s analysis. Anyone who lived through the early years of ESEF or UK iXBRL filing will recognise the pattern: structured-data errors are easy to make and hard to spot by eye. (We looked at the tagging errors regulators still find in UK filings here.)
The Commission’s generator is a helpful starting point for a simple, single-language report. Groups that need several local variants, translations, review workflows, validation and an audit trail will want more than a spreadsheet.
Lesson 5: Four regimes, four sets of ‘right’ numbers
Many groups in scope for EU public CbCR now produce several overlapping jurisdictional datasets: the confidential OECD CbC report, the EU public report, Australia’s public CbC report where they have a material Australian presence, and Pillar Two calculations. The Transitional CbCR Safe Harbour, which leans on CbC data, was extended by a year in the OECD’s January 2026 Side-by-Side package before a permanent Simplified ETR Safe Harbour takes over. In the US, ASU 2023-09 has pushed disaggregated income taxes paid into the financial statements of public business entities from 2025 year-ends.
| OECD CbCR (confidential) | EU public CbCR | Australian public CbCR |
Audience | Tax authorities | The public, via registers and websites | The public, via ATO publication on data.gov.au |
Jurisdictions shown | Every jurisdiction | EU Member States and EU-listed jurisdictions, plus national extensions; rest aggregated | Australia and around 40 specified jurisdictions (including Singapore, Hong Kong and Switzerland) at minimum, or a full breakdown; rest aggregated |
Basis of data | Aggregated entity data | Aggregated, per the EU template | Audited consolidated financial statements |
Narrative | None | Optional context; mandatory explanations in some states | Mandatory approach-to-tax statement; explanation of accrued tax vs statutory rate |
Format | OECD XML schema | XHTML with Inline XBRL | ATO XML schema |
First public deadline (Dec year-end) | Not public | 31 December 2026 | 31 December 2026 |
Maximum penalty | Varies by country | Varies by Member State | Up to AUD 825,000 |
KPMG’s comparison of these regimes reaches a blunt conclusion: one set of CbC numbers may not satisfy them all. The risk, then, is not one wrong number. It is several legitimately different numbers that nobody has reconciled or explained. A journalist comparing your EU report with the Australian dataset, or an analyst comparing public CbCR profit with your annual report, will find the gap before your communications team does.
The practical answer is a single tax data layer with regime-specific mappings, a documented bridge from consolidated accounts to each report, and pre-written explanations for predictable differences: intra-group dividends in aggregated revenue, accrued versus paid timing, FTE definitions and the treatment of permanent establishments.
Lesson 6: The narrative is the new compliance
The EU template leaves room for context. In the first wave, almost nobody used it; the minority who explained their numbers did so in separate tax transparency reports. Australia has gone the other way and made a statement of the group’s approach to tax mandatory, with the ATO expecting to publish the first reports in late 2026.
Public CbCR data is easy to misread. Tax paid can look low against tax accrued because of instalment timing or refunds. Profit can look high in a holding or principal-company jurisdiction. Revenue can look large against a handful of employees in a regional distribution hub. None of these is necessarily a problem. All of them are potential headlines.
The headline test
For every row of your report, ask: what is the most unflattering accurate headline someone could write from this line? If your team cannot answer that in two sentences, the report needs context, in the template, on your website or in a tax transparency statement.
This is also why public CbCR cannot be signed off by the tax team alone. Finance, legal, investor relations, communications and sustainability all have a stake, particularly where the report sits alongside CSRD disclosures or GRI 207 reporting.
12 decisions to lock before 31 December
Scope
1. Confirm the group test for both FY2024 and FY2025, including local-currency thresholds such as Denmark’s DKK 5.6 billion, Romania’s RON 3.7 billion and Sweden’s SEK 8 billion.
2. Re-test every EU entity against local size thresholds, using statutory accounts and the two-year size rule.
Route
3. Choose your route: nomination under the multiple reporting exemption, local filings, or a mix, mapped Member State by Member State.
4. Select your hub and confirm register mechanics, language and file-format acceptance.
Content
5. Build the master dataset to the strictest requirements in your footprint.
6. Decide and document safeguard-clause deferrals, and agree the rationale with your auditor.
7. Reconcile to consolidated accounts, confidential CbCR, Pillar Two data and any Australian report.
Publication
8. Write the narrative, run the headline test and secure cross-functional sign-off.
9. Generate the XHTML/iXBRL file against the current taxonomy, validate it and review the rendered output.
10. Translate wherever a Member State requires its national language.
11. File and publish: register filing, website publication on the right entity’s site where required, and a plan to keep it live for five years.
12. Brief your statutory auditor, who will be asked to confirm whether you were in scope and whether you published.
Beyond 2026: what comes next
Year two is about comparison. Once FY2025 reports are public, FY2026 reports will be read against them. Shifts in profit allocation, headcount or tax paid will need explaining.
Spain moves first again. Its six-month deadline puts FY2026 reports for calendar year-end groups on a 30 June 2027 clock, and Spanish audit reports will address public CbCR compliance for financial years starting on or after 22 June 2025.
The perimeter is widening. The EEA Joint Committee decided on 13 June 2025 to bring the Directive into the EEA Agreement, pending constitutional steps in Iceland, Liechtenstein and Norway. Moldova has introduced its own rules requiring disclosure for every jurisdiction in which a group operates.
Don’t wait for simplification. The Commission’s June 2026 tax simplification package, the Tax Omnibus and the DAC recast, proposes changes to a range of direct tax directives and to administrative cooperation. Public CbCR sits in the Accounting Directive and is not among the directives the Omnibus proposes to amend.
How DataTracks helps
Public CbCR sits where DataTracks has worked for years: at the intersection of tax data and structured regulatory reporting. We build iXBRL filings for HMRC and Companies House, ESEF reports, OECD CbC reports and Pillar Two GloBE Information Returns through Oxbow, our HMRC-recognised Pillar Two platform.
For public CbCR, that means preparing your report in XHTML with Inline XBRL against the current Commission taxonomy; validating it before it reaches a register; producing local variants and language versions from one master dataset; generating the ATO’s Public CBC XML for groups that also report in Australia; and keeping your public CbCR, confidential CbCR and Pillar Two data consistent on a single platform. DataTracks is XBRL-certified and holds ISO 27001 and SOC 2 Type II credentials.
Not Sure How Many Filings Your EU Footprint Triggers?
Book a free 15-minute Public CbCR scope and readiness review with our team, get a clear view of your deadlines, route, and format requirements across every jurisdiction you’re in.
Frequently asked questions
When is the first EU public CbCR report due?
For calendar year-end groups, the first reportable year is 2025 and the general deadline is 31 December 2026. Shorter national deadlines apply in some Member States, six months in Spain and 11 months in Slovenia, and groups with non-calendar year-ends may face earlier dates.
Can a non-EU group file one report for the whole EU?
Often, but not always. The multiple reporting exemption lets EU subsidiaries and branches rely on a report published by the ultimate parent and filed by one designated EU entity. Some Member States, however, require that report to meet their own national rules too, and a few require local filing regardless.
Which EU countries do not allow the safeguard clause?
Belgium, Estonia, Greece, Hungary and Italy did not implement it. Germany limits deferral to four years, and no Member State allows deferral for information on jurisdictions on the EU’s non-cooperative lists.
Can we simply publish our confidential OECD CbC report?
No. The jurisdictions shown, the basis of preparation, the data points and the format all differ. Estonia is an exception in mechanism only: rather than requiring a separate report, its tax authority publishes CbC reports filed with it.
What format must the public CbCR report be in?
Under Implementing Regulation (EU) 2024/2952, EU-parented groups must use the common template in XHTML with Inline XBRL. Non-EU groups have more flexibility under the Regulation but should check the requirements of each register where they file.
What happens if we don't publish?
Penalties are set nationally and range widely: from modest, fixed fines to up to €250,000 in Germany, asset-based fines in Slovakia and Czechia, personal fines for board members in Luxembourg and potential removal from the register in Finland. In the Netherlands and France, third parties can also go to court to compel publication.
If we report in Australia, do we still need an EU report?
Yes. Australia’s regime is separate, with its own jurisdiction list, data basis, narrative requirements and XML format. Reports are lodged with the ATO, which publishes them on data.gov.au.
Are banks and insurers in scope?
EU credit institutions and investment firms that already publish country-by-country information under the Capital Requirements Directive are exempt. That carve-out is tied to CRD reporting, so other financial groups, such as insurers, should test their scope rather than assume they are exempt.
This article is for general information and does not constitute tax or legal advice. Requirements are summarised as at September 2026 and continue to evolve; confirm local rules with your advisers.
