EU member states collect data on PNRR contractors, but are not required to publish it systematically

European rules require states to publish at least the 100 largest final recipients of money from the Recovery and Resilience Facility, but the data collected for audit and control go further and include contractors and subcontractors. The Commission says this information can be used in audits and investigations, while the European Court of Auditors warns that public information still does not allow the money to be fully traced.

European Union member states collect information about recipients of RRP funds, contractors and subcontractors, but the legal framework does not oblige them to systematically publish all this data, the European Commission explained on October 8. For the public, the common EU-level obligation is narrower: each state must maintain a portal listing the 100 final recipients who received the largest amounts and update the information twice a year.

In brief

1.Each member state must publish the 100 final recipients who received the largest amounts from the Recovery and Resilience Facility.

2.For audit and control purposes, states must also collect data on contractors and subcontractors when the final recipients are contracting authorities.

3.According to the Commission, this additional information does not have to be systematically published under the current regulation.

4.The European Court of Auditors considers that publishing the 100 largest recipients does not provide a complete picture of the money trail, especially when funds pass through public bodies to private companies.

5.Romania publishes information on thousands of beneficiaries and the amounts received through its RRP dashboard, but this is a separate issue from the systematic publication of the entire chain of contractors and subcontractors.

Maciej Berestecki, a spokesperson for the European Commission, explained at the press briefing in Brussels that the system is not limited to the 100 names visible to the public. In accordance with the Recovery and Resilience Facility Regulation, member states collect broader data on the use of funds. However, this information is not systematically published because current legislation does not require it, he specified, but it can be made available when needed for audits or investigations.

The difference stems from two distinct obligations under the regulation. Article 25a requires each state to create a user-friendly public portal listing the 100 final recipients receiving the largest amounts. For each of them, the name or legal designation, a tax identifier when available, the amount received and the relevant RRP measure must be published. The Commission then consolidates the information in the Recovery and Resilience Scoreboard.

Article 22 goes further regarding the control of money. States must collect and allow access to standardized data on final recipients, contractors and subcontractors when the recipient is a contracting authority, as well as the beneficial owners of recipients or contractors. The purpose of this obligation is to audit, control and protect the Union's financial interests, including preventing, detecting and correcting fraud, corruption and conflicts of interest. However, the obligation to collect this information is not equivalent to a general obligation to publish it.

This difference is one of the issues identified by the European Court of Auditors. In the special report on the traceability and transparency of the Recovery and Resilience Facility published in May 2026, auditors concluded that public information on recipients, actual costs and results achieved is insufficient. The audit covered ten member states, including Romania.

The Court drew particular attention to the list of the 100 largest recipients. In many cases, the final recipient displayed is a public body, while a significant portion of the expenditure is subsequently contracted to private companies that carry out works or provide services. In this situation, a list that stops at the public body does not, by itself, show the full economic trail of the money. Auditors pointed to Bulgaria as an example of a state where the public portal provides greater visibility into contracts awarded by final recipients.

Romania already publishes more than a simple list of 100 entries at the beneficiary level. The official RRP dashboard allows searches among thousands of beneficiaries and presents, among other things, the tax identifier, repayable and non-repayable support, and European funds received. However, this broader transparency regarding beneficiaries should not be confused with the systematic publication, in a single data chain, of all contractors, subcontractors and beneficial owners that authorities may have in the records used for control.

The Commission maintains that the information collected allows the use of money to be verified even if not all of it is public. Berestecki indicated that Commission services conduct regular audits in all member states and said that, since the mechanism was launched, more than 2,700 audit recommendations have been issued. According to data presented by the Commission at the briefing, member states had addressed 94% of these recommendations by mid-September 2026.

The dispute is therefore less about the existence of the information than about who can see it. The current framework allows auditors and investigative bodies to access a broader data set than the one required to be public. The Court of Auditors considers that future European funding instruments should provide for the systematic collection, use and publication of all relevant information concerning the flow of funds, so that public oversight does not stop at the first visible recipient of the money.

https://2eu.brussels/ro/news/statele-ue-colecteaza-date-despre-contractantii-pnrr-dar-nu-sunt-obligate-sa-le-publice-sistematic