Working-Time Records: What EU Law Wants From a 40-Person Company

An ex-employee's lawyer writes in March asking for the hours their client worked between January and August of last year. You have Slack, a holiday calendar, and a Google Sheet that someone stopped filling in around week six. Whatever you send now, you are reconstructing it, and the other side knows that.

This is the part of employment law that software companies assume is for factories.

A scoping note, up front rather than in a footer: this is orientation, not legal advice. What binds you is your own country's implementing act, and several of them are stricter than the EU floor. Everything below was checked in August 2026.

The ruling that changed the default

On 14 May 2019 the Court of Justice decided CCOO v Deutsche Bank (C-55/18). Spanish law at the time only required employers to log overtime. The Court said that was not enough: without a record of ordinary hours, a worker cannot prove their rest breaks and weekly limits were respected, so the Working Time Directive has no teeth. Member States must require employers to run an objective, reliable and accessible system that measures each worker's daily working time.

Three words, and each one is doing real work. Keep them; the rest of this post is mostly about them.

What happened next depended on the country. Spain moved first, with Royal Decree-Law 8/2019: a daily record for every company, any size, any sector, any contract type, kept for four years. Germany did not legislate at all, and then in September 2022 the Federal Labour Court decided the duty already existed anyway, reading the occupational health and safety act in light of the CJEU judgment (BAG, 1 ABR 22/21). Poland never needed the ruling — article 149 of the Labour Code has required an ewidencja czasu pracy for decades, and since 2019 the file has to survive ten years past the end of the calendar year the employment ended.

So the answer to "does this apply to us" is almost always yes, and the follow-up question is which national version.

Who is actually exempt

Worth knowing before you buy anything, because the exemptions are real and they cover a lot of small software companies.

Poland is the clearest case. Article 149 §2 drops the hour-by-hour record for people on a task-based working time system (zadaniowy czas pracy), for those managing the business on the employer's behalf, and for anyone paid a flat allowance in place of overtime and night work. A twelve-person product studio where the engineers are on task-based contracts and the two founders run the company may have no one left to record. That is a legitimate answer, not a loophole.

The catch is that people misremember which bucket they are in. Task-based time has conditions attached; it is not a label you apply because the work feels autonomous. Confirm it per person, once, in writing, and then you know the size of the problem.

Why the spreadsheet fails all three tests

Objective rules out a system where the number comes from whoever benefits from the number. A monthly sheet filled in from memory on the 30th is a recollection with a total at the bottom.

Reliable rules out silent edits. If March can be changed in April and nothing shows that it was, then March is a claim. This is the one most tools quietly fail, because "let the manager fix the timesheet" is such an obvious feature to build.

Accessible means the worker can get their own record when they ask for it. In Poland that is written into article 149 §1 directly. A file on the office manager's laptop is not accessible in any sense a labour inspector recognises.

There is a second, duller failure that shows up long before an inspection. Nobody can answer "was Thursday short?" without knowing what Thursday was supposed to be. Hours worked are meaningless on their own; you need them against that person's schedule, minus their approved leave, with public holidays at zero. Most spreadsheets have the first half and none of the second.

What a record that survives contact looks like

Write the events, not the totals. Clock-in, break start, break end, clock-out, each with an instant. Take the instant from the server, not the browser, so a laptop with a wrong clock cannot move a punch.

Never edit a punch. When a correction is genuinely needed, and it will be — people forget to clock out, phones die — add records that explain the change and leave the original in place. The history should show both what was recorded and what was later decided, with who decided it. An audit trail that can be overwritten is not one.

Derive the expected day from the person's work schedule and their approved absences, so a short day is measured against something real rather than against eight.

And accept the boring corollary: whatever you use has to be usable in four seconds on a phone, or the record will be honest and empty.

Where SquadBear keeps this

The Attendance module records exactly the ledger above. Every clock action writes an immutable punch stamped with server time. Corrections are requests: the employee proposes times, a manager approves or rejects with a reason, and the approval applies the proposed times without letting the reviewer retype them — so a wrong proposal gets sent back rather than quietly amended. The originals are never modified.

Alongside the punches, each work session keeps a shift with worked and break totals already calculated, and expected time comes from the person's work schedule minus approved leave, with holidays at zero. The review queue raises short days, missed breaks, work on approved leave, and work on a public holiday, and stays silent for anyone without a schedule instead of generating noise. One workspace can run several attendance policies at once, bound to a person, a team, or a country, which is what you need when the Warsaw office and the Berlin office answer to different rules.

Two honest limits. Attendance records presence and break compliance; it does not calculate pay, overtime entitlement, or your compliance for you. And there is no attendance report screen and no CSV button — wider reads go through the API or a connected agent:

"Show me every attendance review item still open in the Platform team, oldest first, and say which ones are short days."

The Attendance overview covers what the module records and how it differs from project time tracking; Attendance review has the manager queue and the policy resolution order.

Start free for up to five people, or open the demo and clock in as somebody else's employee for a minute.

Related reading: surveillance-free timesheets, on the difference between recording hours and watching people, and the Bradford Factor, for when the question moves from presence to absence.