German payroll software certification: the ITSG Systemuntersuchung and what "systemgeprüft" means

Why there is no way around it: § 95b SGB IV

The mandate is one sentence of statute: "Meldepflichtige haben Meldungen und Beitragsnachweise durch Datenübertragung aus systemgeprüften Programmen oder systemgeprüften elektronischen Ausfüllhilfen zu erstatten" — "persons obliged to report must submit reports and contribution statements by data transmission from system-examined programs or system-examined electronic completion aids" (our translation, § 95b Abs. 1 SGB IV). The same rule extends to applications and certificates wherever SGB IV or the AAG says so. There is no state licence and no paper fallback — the channel itself is the enforcement.

Two design choices make this airtight:

• The check happens on every transmission. A certified program carries a Produkt-/Modifikations-Identifikation (Prod-/Mod-ID) in the communication data set (DSKO, or the Kommunikationsdaten element in XML procedures) of every data delivery. The Annahmestellen check it each time to confirm the data originate from a systemuntersuchtes program.
• Full payroll programs must compute machine-side. § 95b Abs. 2 requires Entgeltabrechnungsprogramme to perform calculations, data generation and checking by machine; Ausfüllhilfen merely support manual capture (more on that lane below). The examination covers the complete application — but expressly not the employer's own hardware, operating systems or internal communication software.

The examination is conducted by the GKV-Spitzenverband — which has commissioned the ITSG (Informationstechnische Servicestelle der Gesetzlichen Krankenversicherung GmbH) — with participation of the pension-insurance carriers, the accident-insurance carriers and the Bundesagentur für Arbeit, acting for all social-insurance umbrella organisations (§ 95b Abs. 4). The ITSG puts its own monopoly plainly: the examination "kann in Deutschland nur von dem Kernteam der ITSG zusammen mit Vertretern der Renten- und Unfallversicherung sowie der Bundesagentur für Arbeit durchgeführt werden" — "can in Germany only be performed by the ITSG core team together with representatives of the pension and accident insurance and the Federal Employment Agency" (our translation).

The rulebook underneath is the Gemeinsame Grundsätze für die Systemprüfung nach § 22 DEÜV — common principles issued under § 22 DEÜV by the six named Spitzenorganisationen (GKV-Spitzenverband, DRV Bund, DRV Knappschaft-Bahn-See, Bundesagentur für Arbeit, DGUV and ABV), approved by the Federal Ministry of Labour and Social Affairs after hearing the employers' confederation (BDA). The version in force applies from 1 January 2026 (Fassung vom 11.09.2025, BMAS-approved 19 November 2025). § 22 DEÜV also fixes the module architecture: Basismodule every program must implement, Zusatzmodule that are optional.

The Systemuntersuchung: how a payroll engine gets certified

The Systemuntersuchung has three parts — Systemprüfung, Pilotprüfung and Qualitätssicherung — and it starts before go-live: the application must reach the ITSG "vor Einsatz des Entgeltabrechnungsprogramms beim Anwender" — before the payroll program is deployed at any user (our translation, Grundsätze 2.1).

• The Systemprüfung. The software is examined against the ITSG's Pflichtenheft — a requirements specification the ITSG's own staff describe as roughly 600 pages — and the common test tasks of the social-insurance umbrella organisations: contribution calculation and settlement, determination and transmission of Meldedaten and Beitragsnachweis data, the application and certificate procedures, and retrieval of social data, including the per-procedure error checks and (for XML procedures) the prescribed schema validations. Per the ITSG's account, the first certification takes several days, on site, with the ITSG core team plus representatives of the Deutsche Rentenversicherung and the statutory accident insurance in the room.
• The Pilotprüfung. First-time certification additionally requires live proof: pilot checks at at least two different real employer users, demonstrated within nine months of completing the Systemprüfung, on real data (Echtdaten) after the program has run there for at least three payroll months — under the lead (Federführung) of the Deutsche Rentenversicherung, per the ITSG. Only then is the program certified.
• The result. The GKV-Spitzenverband issues a formal Bescheid; the ITSG issues the GKV certificate "systemuntersucht" and assigns the Prod-/Mod-ID for the examined program version — the identifier that must ride along on every future transmission.

Scope is broader than classic payroll vendors: the regime covers Entgeltabrechnungsprogramme, Zahlstellenabrechnungsprogramme (paying offices for pension-type payments), electronic Ausfüllhilfen — and, since 1 January 2022, time-recording systems insofar as they let employers retrieve eAU (electronic sick-note) data. Component-built systems sold as one product are examined as one complete program.

And the price? "Die gesetzlich vorgeschriebenen Prüfungen sind für alle Software-Ersteller grundsätzlich kostenfrei" — "the statutorily prescribed examinations are in principle free of charge for all software creators" (our translation, ITSG). The cost is not a fee — it is the engineering.

Certification never finishes: the annual quality-control treadmill

The third arm, Qualitätssicherung, is permanent — and it has teeth. The Qualitätskontrolle (QK) re-examines the program via ITSG test cases whenever the law changes, modules are extended, SV-relevant components are re-programmed or the data basis changes; the ITSG evaluates results "mindestens einmal jährlich" — at least once a year (our translation). Each passed QK yields a new Mod-ID for the checked version.

The ITSG states the validity rule in one breath with its consequence: the Prod-MOD-ID is valid "ein Jahr lang – bis zur nächsten Prüfung" — one year, until the next examination — and "Ist die Version nicht mehr gültig, werden die Meldungen abgewiesen" — "if the version is no longer valid, the reports are rejected" (our translation). Certification in Germany is not a plaque on the wall; it is a perishable credential checked by machines on every wire delivery, resynchronised to the 1-January law cycle every year.

The failure path is equally concrete. If a QK does not demonstrate the required quality, the maker must either remedy the defects without delay or tell its users that data transmission with the program becomes inadmissible three months after the negative finding; the GKV-Spitzenverband then initiates the Entzug der Zulassung — formal withdrawal of the admission, effective on that same three-month clock, by Bescheid after a hearing under § 24 SGB X.

Feeding the treadmill is a quality-management loop that reaches outside the lab: error statistics from the Annahmestellen and program defects identified in DRV Betriebsprüfungen (employer audits) land in an ITSG quality-management database, where the software maker must document each defect's cause and remedy. A calculation bug found in a customer's audit becomes the vendor's certification problem.

The lighter lane: § 95a Ausfüllhilfen and the SV-Meldeportal

For employers without a certified payroll program, the law provides a second — deliberately narrow — lane: the elektronische Ausfüllhilfe. Ausfüllhilfen serve "ausschließlich der maschinellen Übermittlung von manuell erfassten Meldungen und Beitragsnachweisen" — exclusively the machine transmission of manually captured reports and contribution statements (our translation, Grundsätze 4). They are certified by the ITSG too, against their own Pflichtenheft and the same Basismodul requirements — and machine-feeding payroll data into an Ausfüllhilfe is not permitted (the design point being: if your data are machine-generated, your generator belongs in the full examination).

The official specimen is the SV-Meldeportal, the completion aid the social insurance itself offers under § 95a Abs. 1 SGB IV — which the ITSG examines like any other. Per the DRV's 2026 guidance it computes neither pay nor contributions, requires an ELSTER-Organisationszertifikat to register and log in, and charges a usage fee in advance for 36 months: €36 net for one Betriebsnummer, €99 net for several, each plus VAT.

The tax side: no certificate, but two hard conformity gates

The Systemuntersuchung stops at the social-insurance boundary. The ITSG says so itself: the examination checks contribution determination and the subsequent reports to the social-insurance carriers — "um das korrekte Abführen von Steuern kümmert sie sich nicht" — "it does not concern itself with the correct remittance of taxes" (our translation). On the tax side there is no product certification at all. Instead, a German payroll engine passes two practical gates:

• The channel gate: ELSTER and ERiC. The Lohnsteuer-Anmeldung must be transmitted authenticated, per officially prescribed data set, by remote data transmission — the ELSTER rail. To build against it, the software maker registers as a Hersteller/Entwickler; the IuK unit of the Bayerisches Landesamt für Steuern verifies that software production is intended and grants developer-area access (credentials within a few days), the maker applies for a Hersteller-ID, and integrates ERiC (ELSTER Rich Client) — a C library with interface specification that the tax administration provides free of charge for integration into tax, finance and payroll programs. ERiC plausibility-checks the tax data and transmits them encrypted to the fiscal administration's acceptance servers; the user-facing surface is entirely the software maker's job.
• The calculation gate: the Programmablaufplan. Machine wage-tax calculation is not free-form. Under § 39b Abs. 6 EStG the Federal Ministry of Finance must draw up and publish a Programmablaufplan (PAP) for the machine calculation of the Lohnsteuer — and payroll engines implement it. The current set, announced by BMF-Schreiben of 12 November 2025, governs wage-payment periods ending after 31 December 2025 and before 1 January 2027 — i.e. calendar-2026 — and encodes Lohnsteuer, Solidaritätszuschlag and the base measure for church wage tax. Mid-year re-issues happen (the 2025 PAP was re-issued in January 2025, mandatory from March), so the redeploy path can't assume 1 January.

Conformity on the tax side is enforced through the PAP specification, ERiC's server-side validations and the employer's own liability — not through a certificate that can be revoked. That asymmetry is worth internalising: the SV side gates the product, the tax side gates the output.

What a certified system must actually run

"Systemgeprüft" is not a badge on a calculation engine — it certifies a live, bidirectional data-exchange machine. The Basismodul, which every certified payroll program must implement, is a catalogue of roughly 30 machine capabilities (DRV "Meldungen", Jahresausgabe 2026, mirroring the Grundsätze): machine contribution calculation from current pay, from one-off payments including the Märzklausel and from Kurzarbeitergeld; the Übergangsbereich and minijob mechanics; retro-calculation at least back to April of the previous year with automatic roll-up; machine-kept Entgeltunterlagen; creation and transmission of Meldungen and Beitragsnachweise; UV master-data reconciliation and the elektronischer Lohnnachweis; the AAG reimbursement applications; insurance-number queries at the DSRV; the A1 e-application; eAU retrieval; the EEL and prior-illness dialogues; rvBEA including the Elterngeld use case; euBP data delivery; and the Bundesagentur's BEA certificates — which moved from optional to Basismodul on 1 January 2026. Zusatzmodule (optional) add Sofortmeldungen, Altersteilzeit, Zahlstellen, the Kurzarbeitergeld e-application (KEA), seafarer and aircrew procedures, and more.

Four of those procedures shape the architecture of a compliant engine:

• The weekly polling duty. The health insurance and the DSRV each operate a Kommunikationsserver that bundles outbound traffic and return messages. The employer must retrieve carrier messages (certificate requests, answers to retrievals, error messages) at least once a week and acknowledge receipt — staged messages are deleted 42 days after acknowledgement, or 42 days after staging if never acknowledged. A certified system therefore needs a stateful polling worker with an acknowledgement flow and a well-under-42-day pickup SLA, per server.
• eAU — the retrieval direction. Since the electronic sick note, the employer fetches incapacity data from the competent Krankenkasse (for minijobbers: the actual insuring Kasse, not the Minijob-Zentrale) — and § 109 SGB IV anchors that retrieval in a § 95b systemgeprüftes program, only where the employee is employed and has reported the absence.
• rvBEA and DaBPV — the request direction. The pension insurance (and, via it, the Elterngeld offices) can request pay-certificate data from the employer, who must answer electronically from systemgeprüfte programs — for Elterngeld "unverzüglich, spätestens aber mit der nächsten Entgeltabrechnung" — without delay, at latest with the next payroll run (our translation). And the DaBPV query for long-term-care child counts, riding DSRV → ZfA → BZSt on the employee's tax ID, is mandatory since 1 July 2025.
• euBP — the audit feed. Employers using a systemgeprüftes program must deliver audit-relevant payroll data electronically ahead of the DRV Betriebsprüfung (§ 28p Abs. 6a SGB IV); financial-accounting data joined the duty on 1 January 2025, and on a change of payroll program or service provider the not-yet-audited periods must be pushed to the DSRV at switch time (Abs. 6b). The opt-out is dying: waiver on application exists only for periods up to 31 December 2026 — for all settlement cases from 1 January 2027 delivery is unconditional. The DRV's FAQ is categorical: "Eine Ausnahmeregelung existiert nicht" — no exemption exists (our translation).

What happens if you transmit uncertified

The regime enforces itself in layers, and the first layer needs no regulator at all:

• The wire says no. There is no lawful alternative channel, and the Annahmestellen check the Prod-/Mod-ID on every delivery — "Ist die Version nicht mehr gültig, werden die Meldungen abgewiesen." An uncertified or stale-certified engine simply cannot file, which cascades into the missed-lodgement consequences: the Einzugsstelle may estimate contributions on a missing Beitragsnachweis, and late payment draws Säumniszuschläge of 1% per month.
• Fines. Under § 111 SGB IV, filing a Meldung "nicht, nicht richtig, nicht vollständig, nicht in der vorgeschriebenen Weise oder nicht rechtzeitig" — not, not correctly, not completely, not in the prescribed manner or not on time — is an Ordnungswidrigkeit with a fine of up to €25,000; the prescribed manner being, in substance, the machine channel described above. Failing to keep or retain Entgeltunterlagen reaches €50,000.
• Losing the credential. For a software operator, a failed QK is an existential clock: three months to remedy, or transmission with the program becomes inadmissible and the Zulassung is withdrawn.
• Above it all, criminal law. Intentionally withholding employee contribution shares from the Einzugsstelle is punishable under § 266a StGB with up to five years' imprisonment (more in especially serious cases). Notably for the SV/tax boundary, the statute itself carves out amounts withheld as Lohnsteuer — the tax side has its own late-filing and estimation machinery (Verspätungszuschlag up to €25,000, Säumniszuschläge, estimation) covered in our lodgement guide.

Quick answers

Related