EOR legal risks and compliance: what transfers to the provider and what stays with you

Using an employer of record (EOR) is legal everywhere the provider is properly registered, and it shifts most day-to-day compliance risk, labor law, tax withholding, worker classification, benefits and immigration paperwork, onto the EOR. It costs more than running payroll in-house, and on its own it does not remove permanent establishment risk or the engagement-length limits that some countries impose.

Yes, working with an employer of record is legal: the EOR is registered in the country of hire and holds the licenses, registrations and permits local law requires to employ workers there, which makes the arrangement a recognized way to put staff on payroll without your own legal entity.

Because the EOR is the official employer, your company stays shielded from direct liability in most employee disputes while the EOR manages visa and work-permit requirements, keeps employment contracts to legal standard, and tracks changing regulations. The EOR's expertise in staying current with local labor, tax and immigration law is what keeps the arrangement compliant, and it lets you hire across borders without opening a legal entity in every market.

An EOR fits when you need to hire in a country fast without setting up your own legal entity, a PEO fits when you already have a legal entity there and want shared HR support, a local entity fits long-term, high-headcount operations, and common law employer status describes the role your company keeps under any of these arrangements when you direct a worker's daily tasks. For a fuller side-by-side of these options, see EOR vs your own entity, COR and BPO.

Common law employment is not a fourth hiring method. It is a legal doctrine that decides who directed the work when a dispute arises. Under an EOR arrangement, the EOR is the registered legal employer, but your company is the common law employer because it directs the employee's day-to-day tasks, and liability splits along that same line.

For a deeper comparison of the first two rows, see EOR vs PEO.

An EOR takes on six recurring compliance responsibilities: labor law, tax law, immigration law, worker classification, employee benefits and the licensing needed to legally hire in each market, and it carries out each one directly rather than advising your team on how to do it. Each responsibility carries its own balance of benefit and drawback, which shapes how much risk actually transfers to the EOR versus staying with your company.

Beyond the table, an EOR also provides the underlying contract paperwork, runs payroll to a fixed schedule, and schedules required medical checks for employees where local law calls for them. It advises on worker classification rather than simply applying a default label, which matters because misclassification exposes both your company and the worker to disputes over benefits and protections.

Statutory notice periods for termination differ widely by country: the median across our dataset is 4.3 weeks per our Global Employer Burden Index (198 countries), and it runs as high as 26 weeks in Gambia, which is the kind of detail an EOR is expected to track on your behalf. See our termination cost index for how these notice periods translate into cost by country.

The businesses that feel this most are the ones juggling differing regulations, complex tax systems, language barriers and limited internal resources across several countries at once. That combination is the main reason companies bring in an EOR rather than build compliance expertise in-house for every market.

Permanent establishment (PE) risk arises when EOR-employed workers generate revenue, negotiate contracts, make high-level decisions, or otherwise create a fixed place of business in the country where they work, and the local tax authority can determine your company has a PE there and impose local corporate tax obligations as a result. Using an EOR does not shield your company from this risk on its own. Risk rises further if the employee holds signature authority or acts as a dependent agent, the OECD Model Tax Convention concept under which a person with authority to conclude contracts in a company's name creates PE. For senior hires in sales, business development or executive roles, get tax counsel advice before assigning the role through an EOR.

Several countries also cap how long an EOR-style engagement can run, separate from PE exposure. Germany's AÜG imposes an 18-month cap on employee-leasing arrangements. Poland limits engagements to 18 months within any 36-month period. France permits engagements of up to 36 months under Portage Salarial. Norway banned staffing-agency hiring for "work of a temporary nature" in April 2023, with limited exceptions. Confirm both the PE exposure and any engagement-length limit for each country before assigning revenue-generating or contract-signing responsibilities to an EOR-employed worker.

An EOR calculates salaries, withholds taxes, and files and pays employment taxes and social security contributions under the law of the country where the employee works, then keeps payroll records and reports for your company. This service typically costs more than managing tax compliance in-house, a pricing pattern we break down on our EOR cost page, but it avoids tax penalties and administrative errors and becomes especially useful once you have employees in more than one country.

Tax withholding itself works the same way in principle everywhere: an employee earning $3,000 per month has a portion deducted for federal, state and local taxes, so the employee receives $2,500 and the employer sends the remaining $500 to the tax authorities. An EOR runs that calculation correctly under each country's rules, then reports it on schedule.

The scale of that variation between countries is why this is worth outsourcing rather than tracking yourself, figures drawn from our Global Employer Burden Index. Managing payroll through an EOR shifts that administrative burden off your team.

Regulatory reporting requires an EOR to submit financial, tax and employment-related reports to government authorities on schedule, and the EOR carries primary legal liability when those reports go wrong because it is the registered legal employer responsible for contracts, payroll, tax filings and worker classification. Your company shares liability only for mistakes tied to how you direct the employee's day-to-day work. Governments use these reports to confirm that businesses pay the correct taxes, treat employees fairly and follow labor and business law, and a company that skips or misfiles them faces fines, audits, legal action or a suspended right to operate in that country.

The difficulty is that every country runs its own reporting cycle and rules, and those rules change often. An EOR absorbs that complexity directly instead of leaving your team to track it market by market.

Meeting these requirements consistently also makes it easier to get approvals for new projects and expansion, since a track record of clean reporting supports rather than delays growth.

Even when the EOR is legally responsible for an error, your business still bears financial and reputational risk. A misclassification mistake can trigger penalties, fines and legal disputes, and because your business depends on the EOR's expertise, an EOR error still creates risk for the company that hired it.

An EOR is the wrong choice once its fees cost more than opening your own entity would, once you need full control over benefit design, or once its standardized contracts and processes no longer fit how your business operates. Higher cost is the most common trigger, particularly for smaller companies with limited budgets.

Miscommunication between your company and the EOR is the common thread behind several of these limitations, since it produces payroll errors and slows the resolution of employee issues. If your plans call for a large, permanent team in one country, the math usually shifts toward opening your own local entity instead of paying EOR fees indefinitely.

Healthcare and pharmaceutical companies, and retail and service businesses, carry the highest compliance stakes when using an EOR because tight patient-safety regulations, specialized licensing and multi-market retail expansion each raise the cost of a compliance mistake. The stakes vary by sector, but in each case a misstep carries outsized cost, from patient-safety violations to a slowed market entry.

An EOR for a medical company or an EOR for a healthcare company works the same way as it does for retailers: it takes on the employment law risk specific to that sector so your team can focus on patients, products or stores rather than paperwork.

Choosing a compliant EOR starts with checking country coverage, data-security practices, pricing transparency and the provider's track record before you sign a contract. A reliable provider follows global data privacy laws such as GDPR and can show a clear plan for preventing data breaches or unauthorized access to employee data.

Pricing matters just as much: look for a transparent model that lists service fees, payroll costs, compliance expenses and any extra charges up front, so there are no surprises once you are hiring. Prioritize reputation and depth of local knowledge over a generic feature list, and if your business has unusual needs, favor a provider that offers custom solutions and a full suite of HR services rather than a rigid, one-size package.

Once you know what to check, the next step is comparing providers directly against those criteria rather than against marketing claims. See how to choose the right EOR for the full checklist before you shortlist providers, then compare shortlisted providers side by side in our review of the best employer of record providers.