EU 2024/1028 short-term rental: 2026 guide

What is Regulation (EU) 2024/1028?

The full title is "Regulation (EU) 2024/1028 of the European Parliament and of the Council of 11 April 2024 on the collection and sharing of data concerning short-term accommodation rental services and amending Regulation (EU) 2018/1724" (CELEX 32024R1028). As a regulation, it is directly applicable in all member states without transposition — although operational implementation still requires national development acts.

The scope covers every online short-term rental platform offering services in the EU and every host offering short-term accommodation. Hotels, apartment hotels, motels, hostels, campgrounds and recreational vehicle parks are expressly excluded — their regime was always distinct from peer-to-peer rental and was never part of the regulatory problem this measure is intended to solve.

The operative definition of "short-term accommodation rental service" is the paid provision, for short periods, of a furnished housing unit to a guest who does not establish their main residence there. The definition is deliberately functional — it captures the economic reality of the Airbnb-style phenomenon without binding itself to a specific civil-law characterization of the contract.

When does the regulation apply and what dates should a host track?

The regulation follows the classical cadence of EU legislation: adoption by Parliament and Council on 11 April 2024, publication in the Official Journal on 20 May 2024 (entry into force), and full application two years later on 20 May 2026. The two-year window gave member states time to build their national registries, plug the SDEP into the Single Digital Gateway (Regulation 2018/1724), and platforms time to adapt their verification systems.

Spain used the window to develop Real Decreto 1312/2024 of 23 December, in force from 2 January 2025. It created the Single Rental Registry (RUA), of which the NRUA sub-register specific to short-term tourist rentals was part, and the Single Digital Window for Rentals (VUDA) as the Spanish SDEP. The NRUA became mandatory on 1 July 2025 and Orden VAU/1560/2025 approved at the end of 2025 the informative models that holders and operating companies must file.

On 21 May 2026, STS 620/2026 (Third Chamber) partially annulled RD 1312/2024: it declared void only the Single Rental Registry — that is, the NRUA number processed through the Property Registry — for lack of state competence. The ruling left fully in force the Single Digital Window (VUDA, Art. 7), the platform data-sharing duty, the statistical provisions (Art. 11) and the entire Regulation (EU) 2024/1028, whose state competence the court confirmed. Operationally, the verifiable number Spain feeds into the European system is no longer the NRUA but the regional tourist-register code that each property already holds.

What obligations does the regulation impose on the host?

Article 4 of the regulation requires each member state to operate a registration procedure that is accessible, free of charge or at a "reasonable and proportionate cost". The host must register before marketing the unit on any online platform — without a valid registration number the platform cannot publish the listing (Article 7).

The minimum data the regulation requires at registration include: the exact address of the unit, the cadastral reference in jurisdictions that use it, the type of unit (entire home or rooms), the maximum number of guests, an indicator of whether the unit is the host's main residence or a second home, and a host identifier (NIE or DNI in Spain). Data minimization applies — only what is necessary for the purposes of the regulation.

The annual informative declaration is an aggregated and anonymized list of stays for the previous calendar year. In Spain the first filing was due in February 2026 covering FY 2025 in line with Orden VAU/1560/2025. The declaration carries no personal data about guests — those flow through the SES Hospedajes channel (SES guide) and not through the 2024/1028 system.

• Have the regional tourist-register code for each unit before listing it on Airbnb, Booking, Vrbo or any other platform (the national NRUA was annulled by STS 620/2026).
• Provide the exact address, cadastral reference, type of unit, capacity and host NIE/DNI.
• State whether the unit is a primary residence or a second home — a key data point for cross-checks with municipal zoning rules.
• File the annual informative declaration (VAU/1560/2025 model) within the deadline set by the VUDA.
• Update the regional tourist-register code whenever capacity, ownership or operating modality changes.
• Verify that the number is published correctly on each listing: platform verification fails when the exact string does not match.

What do Articles 7-9 impose on the platforms?

The regulation makes platforms a central piece of the system. Before publishing a listing they must verify the existence of the national registration number, ideally through the real-time API that each SDEP must expose (Article 7.1). If the API does not return a confirmation, the regulation allows reliance on host self-declaration plus subsequent random-sample checks (Article 7.2) — the "random sample check".

Articles 8 and 9 set out the data-sharing regime. Platforms transmit to the SDEP of the member state where the unit is located, on a monthly basis, data such as total number of nights booked, number of guests per stay (without identifying them), type of unit and address of the unit. For small platforms — defined as those with fewer than 4,250 total EU listings in the previous 12 months — the cadence is quarterly. The format is machine-readable (standardized XML/JSON via the Single Digital Gateway 2018/1724).

If a national authority notifies the platform that a number is invalid, the platform must remove the listing without delay ("expeditiously" in the English text) — the practice consolidated since summer 2025 is removal within 48 hours of the administrative notification. The regulation does not require pre-notice to the host: keeping the registration code current — in Spain, the regional tourist-register code — is the host's responsibility, and the platform may act directly upon authority notification.

What is the Single Digital Entry Point and how does Spain implement it?

The SDEP fulfills three interconnected functions. First, it receives the bulk data platforms transmit monthly or quarterly. Second, it exposes a real-time API for platforms to validate the registration number before publishing. Third, it distributes the received data to the competent authorities in each member state — and in Spain that involves a split between the state level (the VUDA, for statistical purposes), the autonomous communities (regional tourism registries such as the RTA in Andalusia, the RTC in Catalonia, the RGTC in the Canaries, or the Valencian Community tourism registry) and the municipalities with active zoning powers.

The SDEP is part of the European Single Digital Gateway created by Regulation (EU) 2018/1724. That Gateway already provided eIDAS-recognized electronic identification between member states, so the SDEP can reuse the existing infrastructure to authenticate hosts, platforms and the final destination authorities alike.

In Spain, the VUDA is accessible from the Ministry of Housing portal (mivau.gob.es). Registry management is carried out by the College of Property Registrars, which already operated the Land Registry and held the cadastral base cross-referenced with commercial information. That institutional choice explains why the NRUA required the exact cadastral reference — the system performed an automatic check against the Cadastre before assigning the number, until STS 620/2026 annulled the registry.

How does Spain compare with other EU member states on registries and penalties?

European harmonization focuses on the registration procedure and on data sharing, not on penalties — the regulation merely requires that member states establish "effective, proportionate and dissuasive" sanctions without setting bands. Each member state retains the power to legislate the penalty regime. In Spain, RD 1312/2024 never came to include a unified NRUA-specific penalty framework, and once STS 620/2026 annulled the registry the question became moot: sanctioning power sits with the regional tourism regimes.

In practice, the most feared operational consequence in Spain is the automatic removal of the platform listing (Article 9 of the EU regulation), which freezes the reservation pipeline until the regional tourist code is evidenced. To that add the regional tourism penalties — up to 600,000 EUR in Andalusia and Valencia, up to 400,000 EUR in the Balearics, up to 600,000 EUR in Catalonia — and the specific penalties under the guest-data regime (Ley Orgánica 4/2015, SES Hospedajes) that can reach 30,000 EUR.

Italy is the useful contrast. Law 191/2023 and subsequent acts established specific penalties for the CIN: between 800 and 8,000 EUR for listing without a CIN, and up to 5,000 EUR for failing to display it on the listing. That sanctioning clarity has accelerated compliance. In Spain, after STS 620/2026 annulled the NRUA, that sanctioning role falls to the regional regimes, which already operate consolidated penalty bands of their own.