Paper Employers, Real Exposure: Auditing Employer-of-Record Cover Before an Overseas Appointment

Employer-of-record (EOR) arrangements have become a familiar route for UK mid-market companies seeking to hire abroad without incorporating locally. The appeal is straightforward: a provider employs the individual on local terms, runs payroll and absorbs much of the administrative burden, while the UK business directs the work. For a first hire in a new market, that can look like a sensible bridge.

It is not, however, a transfer of accountability. The EOR provider may be the employer on paper, but local courts, tax authorities and regulators tend to examine the commercial reality. Where the UK firm controls day-to-day work, sets pay and determines continued engagement, the paper employer may not be treated as the only employer. For boards, the question is therefore not whether EOR is convenient, but whether the arrangement has been audited before the first overseas payroll cycle begins.

Why the arrangement deserves board attention

EOR is often presented as a compliance solution. In practice, it is an allocation of employment duties across a contractual chain. The provider may accept responsibility for local payroll, statutory benefits and employment documentation, but the UK company usually retains operational control. That split can create misclassification risk, permanent-establishment exposure and termination liabilities that are not obvious from the sales literature.

The risk is heightened in 2026 because more UK firms are using EOR for sales, engineering and professional roles that involve significant autonomy. A salesperson working from a home office in a new market may be treated as an employee of the UK business under local law, notwithstanding an EOR contract. A technical consultant may create a taxable presence. A country manager may bind the company in negotiations. None of these outcomes is necessarily fatal, but each should be understood before the hire is made.

Mapping the contractual chain

A pre-hire audit should begin with visibility. Boards should require a complete map of the documents that will govern the engagement: the master services agreement with the EOR provider, the local employment contract, any assignment or secondment letter, the intellectual-property assignment, the data-processing agreement and any indemnity or insurance provisions.

The UK company may not be a party to the local employment contract, but it should still review the terms that affect cost and control. Who determines salary and bonus? Who approves leave? Who bears statutory severance? Who may terminate, and on what grounds? Does the provider have authority to settle claims? Are there restrictions on the UK company recruiting the individual directly later?

Particular attention should be paid to indemnities. A provider may offer broad assurances that it will handle all employment claims, but such clauses are only as good as the provider’s balance sheet and the governing law. The audit should test whether the indemnity survives a change of control, whether it is capped, and whether it covers tax and social-security liabilities as well as employment claims.

Testing local-law assumptions

EOR providers often operate from standardised templates. Employment law is not standardised. Notice periods, probationary rules, severance entitlements, works-council obligations, statutory bonus payments and restrictions on fixed-term contracts vary considerably across markets. A term that is lawful in one jurisdiction may be unenforceable or costly in another.

The audit should therefore test the provider’s local-law assumptions rather than accept them. Is the provider registered or licensed where required? Does it have a local entity, or is it subcontracting to a third party? Who is the legal employer for tax purposes? What happens if the provider’s local entity becomes insolvent?

Permanent-establishment risk deserves separate attention. An EOR employee working from a home office can, in some jurisdictions, create a fixed place of business or a dependent-agent presence for the UK company. Tax advice should be obtained before the hire, not after the first tax return. The same applies to social-security coordination and payroll withholding.

Data protection and the payroll perimeter

Overseas hiring inevitably involves personal data: payroll records, bank details, health information, background-check results and performance data. Under the UK GDPR, the UK company is likely to be a controller for at least some of that processing, even where the EOR provider handles payroll.

The audit should confirm that the provider’s data-processing terms meet UK requirements, including international transfer mechanisms, sub-processor lists, breach-notification timelines and data-retention rules. It should also establish who responds to subject-access requests and who bears the cost of a data breach. Where local law requires employee monitoring or record-keeping, the UK company should understand whether the provider’s systems are compatible with its own policies.

Pricing the exit before entering

EOR arrangements are often sold on monthly fees, but the real cost may sit in the exit. The audit should model termination before the first anniversary, after three years and in a redundancy scenario. It should identify notice periods, statutory severance, repatriation costs, garden-leave obligations and any transition fee charged by the provider.

If the UK company later establishes a local entity, it may wish to transfer the employee. The audit should confirm whether the provider will cooperate, whether local law permits transfer without severance, and whether the provider imposes a non-poach or introduction fee. A exit that is expensive or obstructive can turn a flexible arrangement into a long-term commitment.

A pre-hire audit checklist

Before signing, boards should be able to answer eight questions. Who is the legal employer in the relevant jurisdiction? What control does the UK company retain, and how is that documented? Which local statutory liabilities are borne by the provider, and which flow back? Has permanent-establishment risk been assessed by a tax adviser? Is the provider’s data-processing agreement UK GDPR-compliant? Are IP assignments effective under local law? What is the all-in cost of termination in year one and year three? And who reviews the arrangement annually?

EOR can be a useful instrument for UK mid-market firms entering unfamiliar markets. It should not be treated as a veil. The board remains accountable for the commercial reality behind the paperwork, and a disciplined audit before the first hire is the most reliable way to keep that reality in view.