EOR Compliance: Your Provider Is the Legal Employer, Your Standup Is the Factual One

An employer-of-record contract does not decide who your employees are. In Germany, Spain and France, a labour inspector decides — and the document they read is your sprint board, not your master services agreement.

I sign employment contracts for a living. Conectia directly employs its engineers across 14 countries, so when one of them joins your team we are the name on the contract and we carry what happens if that paper is wrong. Take the bias as declared: I run one of the arrangements this post compares. I'm writing it anyway, because the failure I keep meeting on calls isn't "the client picked the wrong provider" — it's that the client believed compliance was a thing a provider could hold on their behalf.

What prompted this was Papaya Global's EOR compliance best-practices guide, updated 1 July 2026. Its list is correct and I'd sign every line: regular audits, accurate worker classification, local tax filings, compliant benefits, real-time tracking of legal changes, GDPR-grade data handling. Every item on it is something a platform can see. The liabilities that reach the client are generated in your standup, your Jira board and your holiday approvals, where no dashboard is looking.

What an EOR does route is real, and it is worth paying for

A local employment contract that survives local scrutiny. Payroll and withholding in the right currency to the right authority. Statutory benefits calibrated per country. Filings on local deadlines. A termination process that follows the local procedure instead of your handbook. And no subsidiary: you hire one engineer in Colombia without incorporating in Colombia.

That is a lot of specialist work, and for one engineer in a country where you have no entity, incorporating is the worse decision by a wide margin. Papaya projects a $6.6 billion EOR market by 2028; it's a vendor figure, so treat it as directional.

The mistake is reading the structure as a transfer of liability when what it transfers is administration.

Every jurisdiction that matters tests direction, not documents

Spain writes the test into statute. Article 43.2 of the Estatuto de los Trabajadores defines illegal assignment of workers as arising whenever any one of these is true: the service contract between the two companies amounts to a mere putting-at-disposal of workers; the supplying company has no activity or stable organisation of its own; it lacks the means to carry out its activity; or it does not exercise the functions inherent to being an employer. Read that last clause twice: it is the whole EOR question, compressed into one line of Spanish labour law.

Three consequences follow. Article 43.3 makes both companies jointly and severally liable for obligations to the worker and to Social Security, criminal responsibility included. Article 43.4 gives the worker the right to become a permanent employee of whichever of the two companies they choose, with seniority counted from the day the illegal assignment started. On top of that, LISOS article 8.2 classes it as a very serious infraction, and article 40.1.c) prices very serious infractions at €7,501–€225,018, with the maximum band running €120,006–€225,018.

Germany reaches the same place by a different route. Orrick's guidance on EORs in Germany is blunt: the model qualifies as employee leasing under the AÜG because the customer exercises the right of instruction and the employee is "integrated into the work organization of the EOR's customer as the 'factual' employer". That requires a leasing licence, caps the same employee at the same client at 18 months, and carries fines of up to €30,000 per violation. Without the licence, an employment relationship between client and employee "arises automatically by operation of law" — you never hired them, and they are now your employee.

France criminalises the same shape: article L8241-1 prohibits any for-profit operation whose exclusive object is lending labour, outside the licensed temporary-work and portage regimes, and the penalty is two years' imprisonment and a €30,000 fine, with a court able to bar you from subcontracting labour for two to ten years. The Netherlands is adding a gate: under the Wtta, in force 1 January 2027, any company supplying workers needs admission from the new labour-supply authority backed by a €100,000 guarantee — and hirers may not engage a supplier that lacks it.

Your EOR is the legal employer. Your standup is the factual one. When those two disagree, every regulator above sides with the standup.

The tests these bodies apply are mundane, which is what makes them dangerous. Who assigns the tickets. Who sets the sprint. Who approves the holiday. Who runs the performance review. Whose laptop, whose VPN, whose Google Workspace. Who decides the promotion. Who would sit in the room if there were a disciplinary conversation. If the honest answer to six of those seven is "us", no clause in the MSA changes what a court sees.

For most engineering hires an EOR is the right instrument and the risk is small

Most of the penalties above land on the provider, not the client. Spanish inspectors pursue mere-supply structures, not every cross-border engineer. Germany's 18-month cap resets after a cooling-off period of three months and a day, with collective-agreement exceptions in some sectors. One backend engineer, six months, no signing authority, in a country where nobody else on your payroll sits: low-risk profile, and an EOR is the correct tool for it.

Exposure is a product of four variables — duration × headcount in one jurisdiction × the person's seniority and authority × how directly you manage them. One engineer for six months sits at one end. Five engineers in Germany for two years, on your laptops, in your standup, carrying your job titles in their email signature, sits at the other, and that is not an EOR arrangement — it's a de facto branch with a payroll vendor attached.

Permanent establishment is decided by what your people do, not by whose payroll they sit on

The dependent-agent rule in Article 5(5) of the OECD Model was widened by BEPS Action 7 in 2017, from someone who "habitually concludes contracts" to someone who habitually plays the principal role leading to the conclusion of contracts. Nothing in that sentence asks who runs the payroll.

KPMG's 2025 survey of PE risk in a remote-work era puts numbers on how unsettled this is: only 25% of jurisdictions surveyed have issued specific guidance on permanent establishment and remote work, while 84% already have an agency-PE concept in domestic law. Denmark has found a PE from executives working regularly from a home office with no other business activity in the country. The newly introduced 50% time threshold, the survey notes, is "rarely expected to be treated as a binding safe harbour".

For an engineer who never signs anything, PE risk is low, and I'd rather say that than inflate it. It concentrates in the roles companies most like to hire through an EOR because entity setup felt slow: the country lead, the first salesperson, the regional GM. Seniority and decision authority are what assessors weigh, which makes the fix cheap and paperwork-shaped.

The IP chain has one more link than you think it has

Your assignment chain is not employee → you. It is employee → the local entity that signs the employment contract → the EOR you contracted with → you. Many EORs subcontract the in-country employment to a local partner, which quietly adds a fourth link, and each one has to hold.

Germany makes this concrete. Under the Act on Employee Inventions the inventor initially owns the invention, future inventions cannot be pre-assigned in the employment contract, and the employer has to claim each one through a formal process and pay compensation beyond salary. Moral rights in Germany, France and Spain also survive the blanket waiver a US-style clause assumes. If the entity doing the claiming is your provider's local partner and the chain up to you was never papered, the invention sits in someone else's cap table.

Regulators are moving the liability up the chain, toward the client

From 6 April 2026, if a UK umbrella company fails to pay over PAYE and Class 1 NIC, the shortfall becomes the joint and several liability of the recruitment agency closest to the end client — or of the end client itself where there is no agency in the chain. The mechanism is a new Chapter 11 of Part 2 ITEPA 2003, and the reasonable-care defence that softens IR35 does not apply here.

The Dutch tax authority moved first, resuming enforcement against false self-employment on 1 January 2025 after years of moratorium. And Directive (EU) 2024/2831, which member states must transpose by 2 December 2026, installs a rebuttable presumption of employment wherever the facts indicate direction and control, and puts the burden of proof on the party arguing otherwise. That directive governs platform work, not EOR — I'm citing the doctrine, not claiming the rule reaches you. But three legislatures wrote down the same principle in the same two-year window: facts beat paper, and the party with the money is in scope.

What I'd do this quarter if I were your CTO

1. Build the register. Every EOR-employed person: country, start date, the legal entity that signs their contract, contract end. Flag anyone in Germany past month 12.
2. Ask for the licence numbers in writing. The AÜG licence for Germany, NAU admission before 1 January 2027 for the Netherlands, and the name of the local entity if your provider subcontracts it.
3. Audit your own direction footprint against the seven questions above, and write down the honest answers rather than the contractual ones.
4. Cap signing authority. No EOR-employed person negotiates or signs customer contracts, or plays the principal role leading to one. Put it in the offer letter and the board minutes, because that's where an assessor looks.
5. Trace the IP chain end to end, including Germany's invention-claiming process and whether the assignment survives termination of the MSA. While you're in the file: your EOR is a data controller in its own right for the employment relationship, not your processor, so the DPA is a separate document from the MSA and employment data leaving the EEA needs its own transfer terms.
6. Choose the instrument per role, not per company. An EOR for the short, single, non-signing hire. A services contract — where the provider directs its own people and owes an outcome, with its own organisation and its own means — for the team you intend to keep for years. That is Spain's article 43.2 test read forwards instead of backwards.
7. Re-run all of it annually, or whenever the law moves in a country where you employ. That cadence is Papaya's advice and it's right.

EOR compliance is not a product you buy once. It's a set of facts your team generates every week, and the contract only records who pays. If you'd rather end this conversation with a structure than with a checklist, talk to a CTO — or read how we handle security and compliance in nearshore teams.