Employer of record risks: how to check and reduce them

Key takeaways

If you are weighing an employer of record for a cross-border hire, these are the checks that decide whether the arrangement holds up. Each one is jurisdiction-specific, so treat them as a framework to run against the actual worker, location and provider chain rather than as universal rules.

• The EOR entity, not your company, is the legal employer. A UK government consultation describes an Employer of Record as the legal employer hired to employ and pay a worker for another organisation. In a German employee-leasing arrangement, the Federal Employment Agency guidance is equally direct: the supplier remains the worker's employer throughout the assignment. Your company may direct daily work; check how that division operates in the actual chain.
• A contract does not move every duty to the provider. Under US federal third-party-payer guidance, the IRS is not bound by an agreement between a common-law employer and a third party that purports to transfer employment-tax obligations. UK health and safety guidance puts day-to-day responsibility during an assignment on the end user because it directs the work. UK data-protection guidance keeps ultimate responsibility with the controller even when record keeping is outsourced. Ask which obligations the provider carries and which may remain with you under the applicable law.
• Your tax position depends on what the worker does, not on who employs them. The OECD's 2025 model commentary treats a worker's home as generally not the enterprise's place of business only when the individual works there less than 50% of total time for the enterprise over a relevant twelve-month period, subject to exceptions; at or above that level, facts and circumstances decide. Respondents to the UK Office of Tax Simplification consultation cautioned that shifting payroll to an intermediary may still leave client permanent-establishment exposure from work performed on the client's behalf. That is reported perception, not a measured incidence rate, and it is not a ruling on your case.
• Permitted does not mean permitted everywhere. Where an arrangement is classified as German employee leasing, supplying within an economic activity generally requires the supplier's permission before supply begins, and assignment to the same hirer is generally limited to 18 consecutive months unless an exception applies, with assignment periods documented per worker. UK agency legislation may or may not reach your chain, depending on its substance and structure. Confirm the classification and permission with local advisers before the offer, not after the first invoice.
• Who pays the wages and who owes the employment taxes are two separate questions. Under the US section 3401(d)(1) exception, a third party is the wage-payment employer only if it has exclusive legal control of wage payment; where payment depends on the common-law employer's funding, that employer retains control and the obligations that go with it. For covered UK umbrella labour-supply chains and wages paid from 6 April 2026, the contracting agency, or the end client where no agency is involved, must ensure PAYE is operated correctly, and HMRC can recover an underpayment from that party. That guidance has listed exclusions and a separate manual route for chain members outside the UK, so check whether your chain is in scope at all.
• Contract wording does not override the reality of the relationship. UK employment-status guidance states that if the wording does not reflect the reality of the agreement, it does not change the person's legal employment status. In US federal tax, the legal test is the right to direct and control the means and details of the work. If you want a contractor arrangement, the working pattern has to look like one, not just be named that way.
• Worker-facing terms need to be checked in writing before the start date. In the UK, an employer must give employees and workers a written statement of their main employment conditions, including the employer's name, pay, holiday entitlement, other benefits and notice periods. Where agency-worker legislation is in scope, access to shared facilities and vacancy information starts on day one, and after a qualifying 12 weeks in the same role with the same hirer the worker gains the same basic working terms as a direct hire. On immigration, a licensed sponsor must assign a certificate only when the job is suitable; an EOR label establishes nothing.
• Trace the rights chain for work the employee creates. Under UK guidance, where a qualifying work is made by an employee in the course of employment, the employer is first owner of the copyright unless agreed otherwise, and a commissioned work does not automatically belong to the commissioner. Read both the employee-to-employer and employer-to-client instruments, and keep records of who created what and under which agreement. Non-copyright rights follow their own rules.
• Map data roles before asking for a security questionnaire. Where an employer outsources HR or payroll records, the controller keeps ultimate responsibility for the processing, including what a processor does on its behalf. In a controller-processor relationship, sub-processors need prior written authorisation, downstream terms of equivalent obligations, breach notification to the regulator, and terms allowing the controller to choose deletion or return of personal data at the end, unless law requires storage.
• Rehearse the exit while you still have negotiating power. UK employment-business rules allow a direct-hire transfer fee only in specified circumstances, and require transfer fees and conditions to be set out in the hirer contract. Where a transfer of employment protections applies, employees move with their length of service and contract terms, and the new employer informs them of the change in writing. Ask what employment, pay, benefits, rights and data records you can export, and how the worker is told, before you sign.
• The practical sequence is short. Identify the employing entity and every local partner; classify the arrangement as it actually works; check local permission and assignment limits; document who directs the work; screen the worker's functions for tax exposure; assign a named owner and a proof document to each critical duty; then run a payroll-error and provider-change scenario. Any step you cannot close with evidence belongs in front of local counsel or a tax adviser before the offer goes out.

What changes when an employer of record hires your worker?

In the EOR model, a named local entity employs and pays the worker for the client. The client may direct daily work. Identify both parties and the duties each actually carries before relying on the model.

Who employs the worker and who directs the work?

Legal employment is the first question; daily work direction is the second. The UK Office of Tax Simplification report on hybrid and distance working describes an Employer of Record as the legal employer hired to employ and pay a worker for another organisation, and asks separately whether the worker's own activities create taxable presence for that client. Germany's Federal Employment Agency guidance is more direct still: in employee leasing, the employer of the leased worker is the supplier, and stays the supplier throughout the assignment.

The second question is who directs the work in practice. In the agency and temporary-worker setting described by the UK health and safety regulator, the end user directs the work and may control the premises, so day-to-day responsibility for health and safety during the assignment lies with the end user business, not with the supplier. The regulator's expectation is that the supplier and the end user liaise before work starts and agree who does what during the placement.

For a buyer in the United States, control is the tax test. The IRS manual on third-party payer arrangements puts it plainly: the legal test is whether there is a right to direct and control the means and details of the work. A label on a contract does not settle it, and a service label alone does not decide employment status. Check who has the right to direct the work in the actual arrangement.

In the described EOR model, a named employing entity employs the worker; identify who directs daily work in the proposed chain. Whether the employing entity is a local entity you have never heard of, a partner in another country, or a provider's own payroll company, you should be able to name it, see the contract that creates it, and confirm that it holds whatever permission its jurisdiction requires. If the employing entity is not visible on paper, you have not identified your employer yet.

How is an EOR different from payroll, a PEO, an agency or a contractor arrangement?

These models get confused because they all sit in the same procurement conversation. The differences that matter for your risk are who is the legal employer and who controls the payment of wages.

Payroll processing. When a payroll service provider prepares or files returns using the client's employer identification number, the client remains the employer. The IRS manual is explicit that the employer and client remain liable for timely filing and for deposits and payments made on time. A payroll vendor calculates; your company employs.

A certified professional employer organisation. A CPEO has a distinct statutory treatment in US federal employment tax: it is treated as the only employer and assumes all employment-tax liability and responsibilities for the remuneration it pays to worksite employees. That is a specific statutory category with its own conditions, and it cannot be assumed for an ordinary PEO or for any EOR. Check which category the payer actually is rather than what the contract calls it.

Agency or umbrella labour supply. This is where local labour-supply law bites. German employee leasing in an economic activity is generally prohibited unless the supplier holds the corresponding permission, and a contract formally described as a work contract does not prevent leasing-law consequences when workers are actually supplied to a third party. In Great Britain, whether employment-agency legislation reaches your chain turns on the substance of the arrangement and how the relationship is structured, including the end client's day-to-day control. UK PAYE rules for covered umbrella labour-supply chains place responsibility for operating PAYE correctly on the contracting agency, or on the end client where no agency is involved, and HMRC can recover an underpayment from that party. Those rules carry listed exclusions and a separate route for chains with non-UK members.

A contractor arrangement. Here the test runs the other way. UK employment-status guidance states that where contract wording does not reflect the reality of the agreement, it does not change the person's legal employment status. A genuine contractor relationship is a different working pattern with different documentation and different tax treatment; it is not a cheaper way to write the same employment.

For vendor diligence, distinguish the legal employer from the payroll processor, PEO or agency model and any genuine contractor relationship. Whichever one you are buying, the questions below — who employs, who directs, who pays, who owes the tax — need answered in writing for the specific chain in front of you.

Is an EOR the right route for this hire?

An EOR may suit a role that requires local employment through a separate employing entity. A genuine contractor relationship calls for a different model; a large or long-term operation is a reason to compare an EOR with your own entity.

Compare an EOR, your own entity and a genuine contractor arrangement

An EOR, your own entity and a genuine contractor arrangement create different employment relationships. Compare the named employer, actual work control, applicable obligations and exit terms for the hire. A contractor arrangement depends on the working pattern, not its label.

The test that decides between an EOR and a contractor arrangement is the relationship itself, not the paperwork. UK employment-status guidance puts it directly: where contract wording does not reflect the reality of the agreement, it does not change the person's legal employment status. In US federal tax, the legal test is whether there is a right to direct and control the means and details of the work. If the role follows the same hours and supervision as your staff, assess its status under the applicable law. Which party bears classification exposure depends on the jurisdiction and the actual chain.

An EOR and your own entity both involve employment, but the employing entity and allocation of duties differ. Compare the local permission, statutory employer obligations, dispute route and costs in the proposed jurisdiction. Neither label alone resolves the client’s taxable-presence question. In a German employee-leasing structure, the employing supplier needs permission and the assignment term to the same hirer is generally capped at 18 consecutive months unless an exception applies, with each worker's assignment periods documented. That employee-leasing limit does not by itself describe direct employment through your own entity.

There is no universal break-even threshold for these routes. A practitioner view on choosing between employer and agent of record routes gives the shape of the trigger without a threshold: for a very large or long-term operation, it might eventually make sense to set up your own entity.

for a very large or long-term operation, it might eventually make sense to set up your own entity

— Kate Thompson, associate and cross-border attorney, Ogletree Deakins

The comment gives no headcount or cost threshold. Revisit the route as the operation changes.

Revisit the route as the role or local footprint changes

Three changes should put the route back on the agenda: the role itself, the length of the assignment, and the size of the local footprint.

The role. A senior commercial role that signs contracts with local customers or suppliers is a different hire from a support specialist, and the difference is not just seniority. The OECD's 2025 model commentary treats a commercial reason as present where the individual directly engages with customers or suppliers and that engagement is facilitated by the enterprise being located in that state. A worker whose activity touches the local market is a question for a tax adviser, not for a vendor's standard answer about employing entities.

The length of the assignment. Where the arrangement is German employee leasing, the general limit is 18 consecutive months for the same hirer, with deviations possible under certain conditions and a documentation duty per worker. A hire you planned as a short stint and are keeping for years can run into the edge of the structure it was bought on.

The footprint. Each additional country requires a fresh check of the employing chain, payroll, data roles and records. Compare provider costs and the effort of managing the chain with the costs and responsibilities of your own entity. Set the review point using your own costs and operating capacity.

Set a review date and revisit the model when the role, assignment term or local footprint changes. Ask whether the worker still performs the planned function, whether the structure permits the remaining assignment, and whether your own entity would now meet the need at a manageable cost. If you choose to move, plan the transition before any applicable assignment limit is reached.

Check whether the hiring chain is permitted

Whether the proposed EOR chain can employ the worker depends on its classification and the local rules that apply. The check has three parts: name the employing entity and every partner behind it, test the local permission and assignment rules against the actual arrangement, and record which duties your company still performs once the work begins.

Identify the employing entity and every local partner

Start with a name and a contract. The employing entity is the party that signs the worker's employment contract in the target country; the provider's brand on a proposal is not that party. In Germany's employee-leasing model, the supplier is the employer of the leased worker and remains so throughout the assignment, which means the supplier itself — its specific legal entity, not the group it belongs to — is the employer your worker has. Ask for the employing entity's registration, its role in the chain, and the contract that creates it.

Then map the layers behind that entity. EOR chains commonly add a local partner, an aggregator or a payroll operator, and each layer can carry its own permission requirement, its own employment terms and its own access to worker data. The German Federal Employment Agency's guidance draws the substance point precisely: naming a contract as something else does not prevent leasing-law consequences when workers are actually supplied to a third party. So classify the arrangement by what happens in practice, not by what the paper calls it.

Whether legislation applies at all depends on that structure. A UK practitioner on employer of record arrangements frames the classification question this way:

Whether the legislation applies will turn on the substance of the arrangement, and in particular, how the relationship is structured

— Razia Begum, Senior Associate, Charles Russell Speechlys

Two questions settle this stage. Which entity employs the worker, in which country, and is it permitted to employ in that country for this kind of work? And what does the chain look like behind that entity — a local partner, an aggregator, a subcontracted payroll operator — with a document for each layer? If the provider cannot name the employing entity or produce the documents behind it, the arrangement is not verified, whatever the sales material says.

Test local permissions, assignment limits and actual control

Three checks sit here, and they apply to the arrangement you actually have.

Permission. Where the arrangement is classified as German employee leasing within an economic activity, supplying is generally prohibited unless the supplier holds the corresponding permission. The permission, the holder and its validity are the first things to verify with local counsel for a German hire.

Assignment limits. For German employee leasing to the same hirer, the assignment period is generally limited to 18 consecutive months, with deviations possible under certain conditions, and the supplier must document each worker's actual assignment periods. Longer plans, extensions and renewals all need checking against the limit in the relevant country, not against the provider's standard term sheet.

Actual control. What the parties do matters more than how they describe it. Under US federal third-party payer guidance, the legal test is whether there is a right to direct and control the means and details of the work, and the IRS is not bound by an agreement between a common-law employer and a third party that purports to transfer employment-tax obligations. If your company sets the hours, approves the work and decides who does what — which is normal for a manager managing a remote hire — then the control question is live in your own arrangements and needs a deliberate answer rather than an assumption.

Two things are worth writing down while you are here. First, whether the applicable law is the one you assumed: legal categories are not interchangeable across jurisdictions, and the UK umbrella, UK agency and German leasing regimes are three different tests. Second, what you will do if the chain turns out to be something else. A structure that is misclassified after the first year of employment is a materially worse problem than one that is re-papered before the offer.

Record the duties the client still performs

Employing the worker is the provider's job. Directing the work is not, and the two overlap more often than a signed contract suggests.

In the UK agency and temporary-worker setting described by the health and safety regulator, day-to-day responsibility for health and safety during the assignment lies with the end user business because it directs the work and may control the premises. The regulator also expects the supplier and the end user to liaise before work starts and to agree and be clear on who does what during the placement. The same pattern repeats elsewhere: outsourcing record keeping to a processor leaves ultimate responsibility with the controller, including for processing done on its behalf.

So build a short list of the duties your company keeps, and attach a name and a document to each one. Work direction and site safety. Approval of tasks and who performs them. Equipment, access and the working environment. The data your company holds about the worker, and who may see it. The first response when something goes wrong.

Duty your company performs	Evidence to request	Named owner
Day-to-day direction of work and site safety	Written allocation of duties agreed with the provider before start
Approval of tasks, assignments and access	Task and approval records for the first three months
Worker data held by your company	Data-processing terms, access list, sub-processor list
First response to an employment or payroll problem	Named contact, response route, escalation time

The table is a verification tool, not a statement of how liability is allocated in your jurisdiction. Check the applicable statutory position for each duty; a private agreement cannot be assumed to settle it. What the table does is force the conversation: if a duty has no named owner and no document behind it, you will discover the gap during a payroll error or a workplace incident, which is the worst possible moment to find out.

Assess corporate tax, payroll and payment exposure

An employer of record moves the employment relationship and, usually, the operational payroll, to a local entity in the worker's country. It does not settle your tax position, and it does not transfer every payroll duty to the provider. Two separate questions have to be answered separately: whether the worker's own activity creates taxable presence for your company, and who legally owes the wages, the withholding and the contributions.

Could the worker's activities create a taxable presence?

An EOR does not, by itself, remove taxable-presence risk. Assess the worker’s actual functions under the applicable treaty and local law. Employing through an EOR is not a safe harbour.

The OECD's 2025 model commentary provides a screening question for a worker using a home office. The commentary states that a worker's home generally is not the enterprise's place of business when the individual works there for less than 50% of total time for the enterprise over any twelve-month period, subject to exceptions; at or above 50%, the question is decided by the facts and circumstances. That is model commentary for treaty analysis, not a ruling on your case, and the exceptions matter.

The screen escalates when the role has commercial content. The same commentary treats a commercial reason as present where the individual directly engages with customers or suppliers and that engagement is facilitated by the enterprise being located in that state. A salesperson or a country lead in a market-facing role is a different question from an engineer working only on internal systems.

Consultation evidence points the same way, with a caveat on its weight. Respondents to the UK Office of Tax Simplification's review of hybrid and distance working cautioned that while an employer might transfer its payroll responsibilities to an intermediary, a permanent establishment can still arise through the work performed on its behalf. That is reported perception from a qualitative consultation, not a measured rate of EOR-related exposure and not a tax authority decision. The consultation drew on 39 meetings, 50 written submissions and a 425-person survey, and reports no EOR-specific denominator.

So the practical answer to “does an EOR remove permanent establishment risk” is no, not on its own. Three things decide it: the actual functions the worker performs, the treaty and local law that apply, and the jurisdiction in question. If the worker holds contract-signing authority, engages local customers or suppliers, or has an office and a team reporting to them, take it to a tax adviser before the deployment, and take it to them again when the role changes. Document the worker's functions and review them when the role changes.

Who calculates, remits and verifies wages and contributions?

Three parties can be involved, and each answer is different. The employer is the legal employing entity in the local jurisdiction. The payroll operator calculates and processes. Your company funds the arrangement and may hold contractual indemnity rights. Identify the statutory payer under the applicable legal regime. In the US federal common-law employment-tax context, a private agreement purporting to shift obligations does not bind the IRS.

In US federal employment tax the answer depends on who controls the payment of wages. Under the section 3401(d)(1) exception, a third party is treated as the wage-payment employer only if it has exclusive legal control over the payment of wages; where payment of wages is contingent on the common-law employer's transfer of funds, the IRS treats that employer as retaining control and the obligations that come with it. The manual states the underlying limit plainly: the IRS is not bound by any agreement or contract between a common-law employer and a third party that purports to transfer the employment-tax obligations. A payroll service provider that prepares or files for a client using that client's employer identification number does not take on the liability — the employer and client remain liable for timely filing, deposits and payments.

Great Britain applies a different rule with a narrower scope. For covered umbrella labour-supply chains and wages paid on or after 6 April 2026, the contracting agency, or the end client where no agency is involved, is responsible for making sure PAYE is operated correctly, and HMRC can recover any underpayment from that party. HMRC lists exclusions from the rule and directs chain members outside the UK to separate manual guidance, so this is not a general EOR rule and not something to extend to other jurisdictions.

What to collect, per country and per entity in the chain:

What to verify	Evidence to request	Why it matters
Which entity is the statutory employer	Employment contract and local registration	Determines whose obligation applies
Who operates PAYE or equivalent	Payroll operator's scope, filings and deadlines	Incorrect operation attracts recovery
Who is the wage-payment employer under the local rule	Written explanation of the funding and control structure	Control, not labels, sets the tax position
Whether the chain falls in scope of local rules	Written applicability confirmation for the specific chain	UK 2026 rule has listed exclusions
Deposit and filing proof	Deposit receipts, filing confirmations, reconciliation reports	Verification without proof is not verification

Request deposit confirmations and filing receipts for each period rather than relying only on the provider's assurance.

What happens when pay or withholding is wrong?

Someone pays for the error, and the answer depends on whose obligation it was.

Under US guidance, if a payroll service provider fails, the employer can remain liable for unpaid tax, penalties and interest, subject to any available relief; the IRS manual identifies EFTPS as the control that lets employers verify payments being made on their behalf by authorised third-party payers. For covered UK umbrella chains and wages paid from 6 April 2026, HMRC may recover from the contracting agency, or from the end client where there is no agency; the rule has exclusions and a separate route for non-UK chain members.

A contractual indemnity may allocate costs between parties, but it does not replace the statutory analysis or a correction procedure. In the US payroll-service-provider case described above, the employer can remain liable for unpaid tax, penalties and interest.

Three things to settle before signature. First, the correction route and who executes it: the provider's payroll team, a local firm, or your own provider, and how long it takes. Second, the verification you will run yourself: deposit receipts and filing confirmations checked against your own records each period, rather than a quarterly summary email. Third, the worker-facing path, because a wrong deduction is a problem for the person receiving the pay as well as for the company. UK agency-worker survey data illustrates the pattern: 22% of umbrella-paid respondents, compared with 9% of agency-paid respondents, said it had not been made clear who would pay them. Those are separate survey subgroups of agency and umbrella workers, not EOR hires or a causal EOR rate. Use the question to make the payer and correction contact clear to your worker.

Put the payroll-error rehearsal into the pre-signature checklist rather than the operations manual. Take a worked example from a previous period, run it end to end with the provider — wrong deduction, late deposit, missed social contribution — and write down what happens to the worker's next payslip, what the tax authority sees, who files the correction, and how long the worker waits. Record any gap the rehearsal reveals and resolve it before signature.

Protect employment terms and the worker experience

The worker's employment contract with the employing entity sets the terms that matter: pay, leave, benefits, working time and notice. Compare your offer with the terms the employing entity signs, and tell the worker who employs and pays them and where to take questions. Resolve any difference before the start date.

Check the contract, benefits, leave and working time

Ask for the worker's employment contract, or a redacted version of it, before the offer goes out. Not the master services agreement with the provider — the employment contract with the entity that employs the worker. If the provider will not show it, that is the answer to your diligence question.

In the UK, an employer must give employees and workers a written statement of the main conditions of employment, including the employer's name, how much and how often they are paid, holiday entitlement, any other benefits and notice periods. That document is the worker's own reference point, and it should name the entity that employs them. Where the arrangement falls within agency-worker legislation, entitlements attach on a timeline: access to shared facilities and information on job vacancies from day one, and after a qualifying 12 weeks in the same role with the same hirer, the same basic working terms as a direct hire. Whether an EOR chain is in scope has to be tested for your specific arrangement, and the answer decides whether your company sits in the comparator set.

In the EU, workers covered by the transparent working-conditions rules are entitled to written information between the first and the seventh working day: the parties to the employment contract, the place of work, the role, the start date, the initial basic salary, and the normal working hours with any overtime and shift-change arrangements. Local implementation and any applicable collective agreement still shape the detail, so the EU rules give you a baseline to compare against rather than the local answer itself.

Leave illustrates the need to check the local terms. Under EU working-time rules the employer must provide at least four weeks of paid annual leave, while national law and collective agreements can alter the details and add protections. The UK statement carries holiday entitlement as one of the principal terms. Ask the employing entity which entitlement the worker has and which rules establish it.

Check the remaining terms against local law and the signed contract. Sick pay and its waiting period, probation, notice on the employer's side and on yours, public holidays in the worker's country, benefit enrolment and any pension or social-contribution treatment: each of these is settled in the employing entity's terms or in local law, and each of them needs an answer in writing before the start date. Your own company policy is one input to the offer, not the document the worker signs.

Working time also needs a separate check. Where the worker sits in a country with working-time limits, overtime rules and rest requirements, those rules attach to the employment relationship and to the working pattern. If your team expects availability outside the worker's usual hours as a matter of course, put that expectation in the contract and in the working-time record rather than leaving it to the provider to interpret.

Confirm immigration and termination requirements

Check the proposed immigration route against the employing entity's actual authority. In the UK, a licensed sponsor must assign a certificate of sponsorship only when the job is suitable for sponsorship, and the sponsor carries duties that can see the licence downgraded, suspended or withdrawn. So an EOR label establishes nothing: ask whether the employing entity holds a sponsor licence, whether this role is at the right skill and salary level for it, and who files and monitors the application. For workers who do not need sponsorship, ask what work authorisation they hold and who verifies it — record who checks the document and when.

Before the start date, establish in writing who issues the notice, on what grounds, with what notice period, under which country's law, and what happens to accrued leave, equipment, system access and work in progress. Check how local employment law and your service notice each apply, and who tells the worker first.

Also document what happens at the end of the assignment. What happens to the worker's status, and on what notice, when the assignment ends or the provider changes? Set out the answer in the employment contract and the service schedule: the notice period that applies, what information the worker receives, and where they go with questions about their own terms and entitlements. You cannot promise a particular outcome, because local law and the signed documents govern it, but you can make sure the question has an answer before it is asked.

Set support, approvals and employee escalation paths

Support may involve the employing entity, the provider's operations team and your own manager. Give the worker a clear route for each type of question.

The worker-facing route. When something is wrong — a missing deduction, an unclear payslip, a holiday request, a question about who employs them — the worker needs one place to start and a named person to escalate to. UK agency-worker survey data shows why the ambiguity matters: 22% of umbrella-paid respondents, compared with 9% of agency-paid respondents, said it had not been made clear who would pay them. Those are separate survey subgroups of agency and umbrella workers, not EOR hires or a causal EOR rate. Ask your worker directly who they understand will pay them.

Your internal approvals. Work with the provider to fix the ordinary decisions in advance and write them down: who approves a new task, who approves leave, who can change a rate, who approves access to a system, and what response each takes. Put the approver and response route in the service schedule.

The escalation route. Write down the path for a problem the provider's normal support does not solve: the named contact, the response you expect, who at your company is told, and what the worker is told in the meantime. The UK health and safety regulator's expectation is a usable model for the whole chain: the supplier and the end user should liaise before work starts and remain clear on who does what during the placement. Confirm the escalation route before the worker starts.

Record a named owner and supporting document for employment, payroll, the worker contract, employee questions and escalations. Resolve any unassigned duty before the start date.

Secure work product and worker data

An EOR arrangement needs two documented chains. The first carries rights in what the worker creates: the code, the design, the model, the document. The second carries the personal data the employment relationship generates — pay records, leave, identity documents, sick leave. Identify each entity involved and check the documents governing its role.

Trace intellectual property rights through the employment chain

A worker may create work for your company while employed by another entity. Check who first owns each right under the applicable law and how it reaches your company.

The initial rights position depends on the jurisdiction, the work and the worker’s actual employer. In Great Britain, where a qualifying literary, dramatic, musical or artistic work, or a film, is made by an employee in the course of employment, the employer is first owner, subject to any agreement to the contrary; the same guidance is explicit that commissioned work does not belong to the commissioner unless that is agreed in writing. In the United States, a work prepared by an employee within the scope of employment can be a work made for hire, whose author is the employer — though whether a particular worker and a particular piece of work meet that test depends on the actual relationship and the work itself. Neither rule alone proves that the client owns a particular employee-created work; inspect the actual contracts and work.

Trace three links. The employment contract between the worker and the employing entity, including what it says about inventions, works and any moral rights. The contract between the employing entity or the provider and your company, which is where a licence or an assignment to you must appear. And the evidence that connects them: the UK Intellectual Property Office advises employers to keep careful records of which person created the work and of the applicable contractual agreements, so retain those records for later verification.

Non-copyright rights follow their own rules. Inventions, designs, database rights and the treatment of open-source contributions are governed by the law of the worker's country and by your own agreement with the provider, and a copyright assignment says nothing about them. A cross-border practitioner on IP assignments puts the working rule plainly:

there are so many different requirements per country that it’s always better to analyze the IP assignment depending on where the workforce is located.

— Lina Fernandez, cross-border attorney, Ogletree Deakins

Review any global assignment clause against the rules of each relevant country. Ask for the assignment terms that apply in each country where a worker creates work, and check them against what the project actually needs. Also ask what happens to work in progress when the assignment ends or the provider changes, and who can grant the client a licence if the chain breaks. Make sure the records of who created what, and under which agreement, exist before you need them.

Map data roles, partner access and incident response

Map worker data by processing activity. Payroll data goes to the employing entity and its payroll operator. Employment records go to the provider and to whoever stores them. Recruitment documents and identity data may sit with a local partner. Your own systems hold a copy of some of it too, because you manage the work. Each flow is a separate relationship with a separate role, and the role decides the obligations.

Start by establishing, per flow, who is controller and who is processor — because the same entity can hold both roles for different operations. The European Data Protection Board's controller-processor guidelines make that point for EU data: an employer is generally a controller for processing its own workers' personal data, and the same entity may be controller for certain processing operations and processor for others. Assess the role for each data flow. Where a UK controller outsources HR or payroll record keeping to a processor, guidance is clear on what remains: the controller retains ultimate responsibility, including for processing done by a processor on its behalf. Outsourcing the work does not outsource the accountability.

Check the controller–processor contract. Under UK guidance, a processor needs prior written authorisation before engaging another processor, equivalent obligations downstream, breach assistance and terms allowing the controller to choose return or deletion at the end, subject to lawful retention. The EDPB guidelines state the same choice for EU data: at the controller's choice, delete or return all the personal data, unless EU or Member State law requires further storage.

That return-or-deletion right has a role-dependent limit. It arises from a controller-processor relationship, so it does not follow automatically where the employing entity processes the worker's data as an independent controller for its own employment purposes — the client has no automatic copy of the file under that processor rule. Negotiate any needed access. A return clause also needs an operational handover: ask what a return actually contains, in what format, and who bears the effort of extracting it, because a set of PDFs in a portal that closes at the end of the contract is a poor substitute for a structured file.

Beyond the contract, ask what access looks like. Which people at the provider and at the local partner can open a worker's file, for what, and is that access logged? Where does the data physically sit, and is it transferred out of the country where the worker lives? A cross-border transfer question is a separate analysis from the controller-processor question, and answering one does not answer the other.

Make the clause operational. For incidents, record a named person on each side, a contact channel and notification timing under the applicable obligations. For exit, test whether records are retrievable in a usable format within an agreed period.

For each flow, name the parties, the legal role, the contract that covers it and the document that proves it. Where one of the four is missing, you have found a gap before an incident rather than during one.

Test cost and service before signing

A quoted monthly fee leaves other costs and service duties to check. Before you sign, you want two things in writing: the full cost of the arrangement under the scenarios you actually expect, and evidence that the provider will do what it says when something needs fixing.

Build a full-cost scenario, including changes and exit

A monthly fee per worker is the easiest number to quote and the least useful one to rely on. Build the number from the components you can see, then add the ones you cannot yet price, because those are the ones that surface later.

The components to ask for:

Component	What to request	Why it belongs in the scenario
Fee per worker	Rate card with what is included and excluded	Baseline, but only meaningful with its exclusions
Employer costs	Statutory employer charges in the worker's country, itemised	Changes the total cost
Worker deductions	Deductions applied between gross and net pay, with a sample payslip	Affects the worker's take-home and their trust
Employer setup and local registration costs	One-off charges per country and per entity	Concentrated cost at the wrong time if unplanned
Currency and payment terms	Currency of the fee, conversion basis, payment deadlines	Affects the amount you actually pay
Changes	Cost of a rate change, role change, headcount change, extension	The scenario you will actually hit
Exit	Notice period, transition or direct-hire fee conditions, record export	The cost of reversing the decision

For worker deductions, ask what appears on the payslip, who authorises each deduction and whether the worker sees the same breakdown.

Check the exit row against the proposed contract. Under the UK employment-business regime, a business may sometimes charge a direct-hire transfer fee, and only in specified circumstances, and it must include all transfer fees and conditions in its contract with the hirer. So a fee for moving a worker from the provider to your own payroll is a contractual term, not an inevitability, and it can be negotiated before you sign. Ask what the provider charges to transfer a worker to direct employment, under what conditions, and what happens to the worker's terms if you do.

A scenario is more useful than a single number. Run it for one hire, for five, for ten. Add a role change, a currency move, an extension past the assignment limit your structure allows, and a full exit to your own entity. Compare the totals across those scenarios and see which number actually governs your decision. If the exit scenario drives the total, compare the route against your planned hiring horizon before signing.

Verify local expertise, records and response routes

Test service by asking how the provider handles a specific error and what record proves the response.

Local expertise, asked concretely. Which entity in which country employs the worker, and is that entity staffed in that country? Who handles a local employment dispute, a local public holiday, a local benefit enrolment, a local tax filing? If the answer names a shared service desk in another time zone rather than local employment expertise, that is a design choice you are making with your eyes open.

Records, asked concretely. Ask for a sample of what the provider holds about a worker: the employment contract, the file of submitted documents, the payroll records and reconciliations, the correspondence trail. Ask for a sample worker file — redacted — and look at it. A provider that cannot show a file cannot produce one under pressure either. The regulator's expectation in a related chain is instructive: the supplier and the end user should liaise before work starts and remain clear on who does what during the placement. Records are what keep that clarity possible when someone is on leave or a partner changes.

Response routes, asked concretely. Before the start date, get a named contact and a response route for the four failures you would actually call about: a wrong payslip, a missing document, a worker dispute, and an urgent request that the worker made to the wrong entity. Then get something measurable: what the provider commits to in the contract, how it is measured, and what you can see without asking. The verification detail matters more than the promise. Where a third party is authorised to make payments on an employer's behalf, the IRS manual identifies EFTPS as the control that lets the employer verify payments being made on its behalf. The principle generalises: prefer a checkable record over a reassurance.

The failure drill. Run a service test before signature. Take a payroll error from a previous period and run it through: who detects it, who tells the worker, who corrects the deposit, how long the correction takes, and what the worker sees on the next payslip. Then take a provider-side incident — a partner no longer operating in the worker's country, or a payroll operator resigning mid-cycle — and walk the same path. If the provider cannot explain that second route, require a documented continuity plan.

Write the outcome into the contract where you can: the named contacts, the response commitments, the record-export format, the notice period, the transition support, and the direct-hire fee conditions. Everything above is evidence you gather to build those clauses, not a substitute for them.

Plan for a provider change or direct employment

Before a provider change or direct hire, check which records you can obtain, whether employment transfers under the applicable law, and how the worker will be informed. Resolve these questions against the signed documents before a transition is needed.

Preserve payroll, benefits, rights and data records

Request employment, pay, rights and data records before a provider change. Check which party holds them and what the contract lets you obtain.

Specify the format and access route for four sets of records:

Employment records. The employment contract and its amendments, the written statement of employment particulars where one is required, the policies applied to the worker, disciplinary and leave history, and any settlement. This is the set that establishes what the worker was entitled to, which matters if the employment moves to another employer.

Payroll and benefits. Pay history, payslips, deposit and filing confirmations, social contribution records, benefit enrolment and provider details, and the reconciliation between what was contracted and what was actually paid. In the United States, the employer with the federal employment-tax duty keeps records that include wage amounts and dates, dates and amounts of tax deposits, filed returns and fringe benefits, and generally retains them for at least four years after filing the year's fourth quarter. That is the legally responsible employer's recordkeeping duty, so ask what the employing entity retains, in what form, and on what basis you or a successor can obtain it — the retention period is theirs, not an export right for you.

Rights evidence. Records of who created which work and under which agreement, the signed assignment instruments from the worker to the employing entity and from that entity to you, and the licence or assignment between you and the provider. UK guidance on copyright ownership is worth reading as a chain rather than a single document: the employer is first owner of a qualifying work made by an employee in the course of employment unless agreed otherwise, and the guidance advises employers to keep careful records of which person created the work and of the applicable contractual agreements. Where the work is commissioned instead, it does not belong to the commissioner unless that is agreed in writing. Keep the creation and assignment records available through any transition.

Worker data. Employment records and personal data held by the provider, in a portable form, with the return or deletion terms you negotiated. UK data-protection guidance on controller-processor contracts requires terms letting the controller choose deletion or return of the personal data at the end of the contract, unless UK law requires it to be stored, and the EDPB guidelines state the same choice for EU data, subject to further storage required by EU or Member State law. These rights arise from a controller-processor relationship, so where the employing entity processes worker data as an independent controller, access has to be negotiated rather than assumed. Ask what a return actually contains and who bears the effort of extracting it.

Set the retrieval terms before signing: a defined export format, a delivery window, a notice period that accounts for the export, and support during the transition. These belong in the contract, not in a request you make in the last week of the arrangement.

Check transfer conditions, worker communication and continuity

Does the employment transfer at all? Test the transaction against the relevant local regime; neither of these examples applies by default. In Great Britain, where a transfer of employment protections applies — TUPE — employees transfer automatically to the new employer with their length of service and their employment contract terms, and the new employer must inform them in writing of the change; whether the regime reaches your transaction is a fact question, not a default. In the EU, for a qualifying transfer of an undertaking in a member state, rights and obligations under existing employment contracts pass from the former employer to the new employer; a simple provider change or a single direct hire is not established as a qualifying transfer by that rule, and other local employment rules may apply instead. Ask whether this transaction meets the regime’s conditions. If neither cited regime applies, check other applicable local employment rules governing continuity, terms and notice, then address the remaining questions in the signed contracts.

What does it cost? In the UK employment-business regime a direct-hire transfer fee may sometimes be charged, only in specified circumstances, and all transfer fees and conditions must be included in the contract with the hirer. That rule does not set a general EOR exit fee or the price for this provider’s direct-hire process. Ask for the provider's own terms — the amount, the conditions and the payment timing — and settle them in the contract you sign now, while the alternative is still theoretical.

How does the worker hear about it? Where a transfer regime applies, written notification is part of the framework: in Great Britain the new employer must inform employees in writing of the change, and for a qualifying EU transfer of an undertaking, representatives and in some cases employees themselves must be told the date, reasons and implications of the transfer and the measures envisaged. Build the communication plan on top of that: who writes the letter, who explains the change, what the worker is told about their terms and their service, what happens if they do not want to move, and where they go with questions. Give the worker a timely answer to “who employs me now” as part of the communication plan.

Continuity of service. While the transfer runs, pay has to keep arriving on time, benefits have to keep running, access has to keep working, and work in progress has to keep moving. Name who owns each of those during the transition window, and set a cutover date for each system rather than assuming one date moves everything together. If a local partner sits in the chain, confirm whether it appears in the transition at all — the partner may be the party whose continuity actually matters, and a plan that assumes the provider coordinates them is a plan with an untested step.

Test the exit plan with a concrete question: if the provider called today and said it is ending the arrangement in ninety days, could you produce this worker's records, protect their rights and their data, keep their pay arriving, and tell them what is happening? Where you cannot answer yes, the missing items belong in the contract before signature, not in the incident plan.

Run a pre-offer and pre-signature risk check

Before an offer, identify the employing chain and legal model. Before signing, assign duties and proof documents, then rehearse a payroll error and provider exit.

Gate the role, location and employment model before the offer

The gate runs on four questions, in order, and it runs before an offer letter is drafted rather than after it is signed.

Who employs the worker? Name the legal entity in the worker's country, see the document that creates it, and confirm it holds whatever permission its jurisdiction requires. In a German employee-leasing structure, the supplier is the employer of the leased worker and remains so throughout the assignment, and the permission requirement applies before supply begins. A provider that cannot name the employing entity has not answered the question.

Which model is it, actually? Classify the arrangement by what happens in practice. Whether UK employment-agency legislation reaches your chain turns on the substance of the arrangement and how the relationship is structured, and German guidance is equally clear that a contract formally called something else does not prevent leasing-law consequences when workers are actually supplied to a third party.

What is permitted here, and for how long? Local permissions, assignment limits and exceptions, and the documentation the supplier keeps per worker. For German employee leasing to the same hirer, the assignment period is generally limited to 18 consecutive months, with deviations possible under certain conditions.

What does the worker actually do? Screen the functions for tax exposure and for control. Under US federal third-party payer guidance, the legal test is the right to direct and control the means and details of the work, and the IRS is not bound by an agreement purporting to transfer employment-tax obligations. The OECD's 2025 model commentary treats the worker's home as generally not the enterprise's place of business below a 50% threshold over a relevant twelve-month period, subject to exceptions, and escalates the question where the individual directly engages with customers or suppliers.

Use the worker's location and the actual arrangement to decide which of these tests apply. Resolve what you cannot close with local advisers or a tax adviser before the offer goes out; an EOR does not settle your client's tax position on its own.

Keep a responsibility and evidence ledger

For each critical duty, record four things: the party who acts, the legal or contractual basis for it, the document that proves performance, and the person who escalates when it goes wrong. The ledger is a verification tool for your own diligence, not a statement of how liability falls in any particular jurisdiction — that comes from the law of the country where the worker sits.

Duty	Party who acts	Legal or contractual basis	Proof of performance	Escalation owner
Day-to-day work direction and site safety
Statutory employer duties in the worker's country
Payroll operation, withholding and contributions
Employee terms, benefits and leave
Immigration or work authorisation
Rights in work created by the employee
Worker personal data and records
First response to a payroll or employment failure

Two lines in that table need a check against the applicable law. In the UK agency and temporary-worker setting described by the health and safety regulator, day-to-day responsibility for health and safety during the assignment lies with the end user business, because it directs the work and may control the premises; the supplier and the end user are expected to liaise before work starts and remain clear on who does what during the placement. And where a UK controller outsources HR or payroll record keeping to a processor, guidance says the controller retains ultimate responsibility, including for processing done on its behalf. A provider clause cannot be assumed to change either of those statutory allocations.

Keep the ledger live rather than static. A role change, a rate change, a new country or a new partner in the chain moves one or more rows, and the row that has not been reviewed in a year is the one that will fail. Review it on the same schedule as the payroll reconciliation.

Rehearse a payroll error and provider exit

Two rehearsals, both before signature, both with a written outcome.

The payroll error. Take a real worked example from a previous period — a wrong withholding rate, a missed social contribution, a late deposit — and run it end to end with the provider. Who detects it, who tells the worker, who files the correction, how long the correction takes, and what the worker sees on the next payslip. Then check the statutory layer separately, because it belongs to whoever the law names rather than to whoever indemnifies you: under US guidance the employer can remain liable for unpaid tax, penalties and interest where a payroll service provider fails, subject to applicable relief. For covered UK umbrella chains and wages paid from 6 April 2026, HMRC may recover PAYE underpayment from the contracting agency, or from the end client where no agency is involved; exclusions and non-UK chain rules need checking. A contractual indemnity covers cost between you and the provider after the event; it does not shorten the correction cycle or protect the worker's tax position.

The provider exit. Assume the provider gives ninety days' notice, or a local partner stops operating in the worker's country. Can you produce the employment records, the payroll and benefits history, the rights evidence and the worker data in a usable format? Are the terms and service continuity protected, and does the worker hear about the change from a person with an answer? Where the transfer of employment protections applies, employees move with their length of service and contract terms and the new employer informs them in writing; whether it applies to your transaction is a fact question, and where it does not, continuity is a term you had to negotiate earlier. The direct-hire fee, if one can lawfully be charged, belongs in the contract now rather than in the exit negotiation.

Write both rehearsals down as procedures with names against them: who runs the drill, how often, what the last one found, and which clause you changed as a result. Use the results to amend the contract while the terms are still negotiable.

Frequently asked questions

What risks remain when an EOR is the legal employer?

The EOR entity is the legal employer in the proposed model, but the client may retain duties arising from its actual role. In the UK agency and temporary-worker setting described by the health and safety regulator, day-to-day responsibility for health and safety during the assignment lies with the end user business because it directs the work and may control the premises. US federal guidance is equally clear that the IRS is not bound by an agreement between a common-law employer and a third party that purports to transfer employment-tax obligations. Where a UK controller outsources HR or payroll record keeping to a processor, guidance keeps ultimate responsibility with that controller, including for processing done on its behalf.

Check the duties the applicable law assigns to your company, the worker's functions and possible tax exposure, the local chain and the exit terms. The EOR label alone resolves none of these.

Does an EOR remove permanent establishment risk?

No, not on its own. It depends on the worker's actual functions, the treaty and local law that apply, and the jurisdiction. The OECD's 2025 model commentary treats a worker's home as generally not the enterprise's place of business when the individual works there for less than 50% of total time for the enterprise over any twelve-month period, subject to exceptions; at or above that level, facts and circumstances decide, and a commercial reason is present where the individual directly engages with customers or suppliers and that engagement is facilitated by the enterprise being located in that state. UK consultation respondents cautioned that transferring payroll responsibilities to an intermediary may still leave client permanent-establishment exposure from work performed on the client's behalf — reported perception, not a ruling and not a measured rate. Treat a market-facing role, a home office and a local entity as tax questions for an adviser, before deployment and again when the role changes.

Who pays the employee and employment taxes?

Identify the employing entity, the operational payroll payer and the party responsible under the relevant tax law. Your company may fund the arrangement and hold contractual indemnity rights, but these do not establish the statutory payer. Under US federal third-party payer guidance, a third party is the wage-payment employer only if it has exclusive legal control over the payment of wages; where payment depends on the common-law employer's transfer of funds, that employer retains control and the obligations that go with it, and a payroll service provider filing on the client's employer identification number leaves the client liable for timely filing, deposits and payments. For covered UK umbrella labour-supply chains and wages paid from 6 April 2026, the contracting agency, or the end client where no agency is involved, must ensure PAYE is operated correctly, and HMRC can recover an underpayment from that party — a rule with listed exclusions and a separate route for chains outside the UK. Verify deposits and filings yourself; the proof is what tells you whether the third party actually paid.

Can an EOR sponsor a work visa?

Sometimes, and only if the employing entity actually holds the right licence and the role qualifies. In the UK, a licensed sponsor must assign a certificate of sponsorship only when the job is suitable for sponsorship, and the sponsor carries duties that can see the licence downgraded, suspended or withdrawn. An EOR label establishes nothing: ask which entity holds the licence, whether this role is at the right skill and salary level for it, who files and monitors the application, and what happens to the worker's status if it is refused. Where sponsorship is not required, work authorisation still has to be verified by someone in the chain, and the same question applies: who checks it, and where is the document.

When should a company use its own entity instead?

Consider your own entity when your local footprint, assignment term and operating costs warrant a fresh comparison. Set the decision point from your own costs and capacity. Three changes trigger the review: the role becoming market-facing or authority-bearing, the assignment running past the term the structure supports — German employee leasing to the same hirer is generally limited to 18 consecutive months unless an exception applies — and a local footprint whose provider costs warrant comparison with direct employment. A practitioner on choosing between employer and agent of record routes gives the direction without a threshold: for a very large or long-term operation, it might eventually make sense to set up your own entity. Put a review point in the calendar and a standing agenda item for every new country, so the decision is revisited deliberately rather than discovered late.

What happens to an employee when the EOR changes?

It depends on the transaction and on what you wrote down in advance. Where the transfer of employment protections applies — in Great Britain, TUPE — employees transfer automatically to the new employer with their length of service and their employment contract terms, and the new employer must inform them in writing of the change; whether the regime reaches your transaction is a fact question, not a default. If TUPE does not apply, check other applicable local employment rules and the signed contracts for continuity of service, terms and notice before the change.

The worker's experience depends on three things you control. Whether they receive their pay on time during the transition, whether their records, benefits and data follow them, and whether a person tells them what is happening and answers what it means for them. Records portability is a contract term: ask for the export format and the retrieval window while you still have leverage. And in the UK employment-business regime a direct-hire transfer fee may sometimes be charged, only in specified circumstances, and all transfer fees and conditions must be included in the contract with the hirer — so the cost of the exit is negotiable before the exit, not after it.

Sources

• Fachliche Weisungen Arbeitnehmerüberlassungsgesetz (AÜG) — Bundesagentur für Arbeit (German Federal Employment Agency), 22 May 2026
• Roles of suppliers and end user businesses — Health and Safety Executive (UK)
• Third-Party Payer Arrangements for Employment Taxes, IRM 5.1.24 — Internal Revenue Service (US), 24 March 2025
• Hybrid and distance working report: exploring the tax implications of changing working practices — UK Office of Tax Simplification / GOV.UK, 2022
• Employment status and employment rights: guidance for HR professionals, legal professionals and other groups — GOV.UK (UK)
• PAYE rules for labour supply chains that include umbrella companies, from 6 April 2026 — HM Revenue & Customs / GOV.UK (UK), updated 19 June 2026
• The 2025 update to the OECD Model Tax Convention — OECD, November 2025
• Agency Workers Regulations 2010: guidance for recruiters — GOV.UK (UK), updated 25 March 2026
• Written statement of employment particulars — GOV.UK (UK)
• Your responsibilities as a sponsor — GOV.UK (UK)
• Employment terms and conditions — European Commission, Your Europe
• Working hours and annual leave — European Commission, Your Europe
• Ownership of copyright works — UK Intellectual Property Office
• Work Made for Hire — US Copyright Office
• Using employment records — Information Commissioner's Office (UK)
• What needs to be included in the contract between controllers and processors — Information Commissioner's Office (UK)
• Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1 — European Data Protection Board
• Fees to hiring companies and transfer fees — GOV.UK (UK)
• Transferring to your new employer — Acas (UK)
• Transfer of undertakings — European Commission, Directorate-General for Employment, Social Affairs and Inclusion
• Employment tax recordkeeping — Internal Revenue Service (US)
• Agency Worker Survey — UK Department for Business and Trade, published 4 March 2025
• Employer of Record arrangements: navigating employment law risks and liabilities — Solicitors Journal, 20 October 2026 (Razia Begum, Charles Russell Speechlys)
• Cross-Border Catch-Up: Global Hiring — Choosing Between Employer and Agent of Record — Ogletree Deakins podcast transcript, 19 September 2025 (Kate Thompson)
• Cross-Border Catch-Up: IP Assignments Around the World — Ogletree Deakins podcast transcript, 18 October 2024 (Lina Fernandez)