EOR compliance best practices: duties and controls

Key takeaways

An employer of record (EOR) label does not determine whether an arrangement fits the rules in a particular location. Start with the actual work, the entity that employs or supplies the worker, and the local regime that applies. A UK employment business and an employment agency have different functions; German employee-leasing rules apply only where the arrangement falls within their scope.
Do not rely on the contract label alone. The actual working relationship matters in a US employment-tax classification review, and ILO inspector training likewise directs attention to the facts of work and remuneration where they conflict with a document.
Make the service agreement operational. Name who provides terms and work-risk information, who checks it, who corrects an error, and where the record is kept. In covered Great Britain agency work, the hirer can retain responsibility for failures caused by its information, even where a temporary work agency is also involved.
Build a repeatable control cycle for the location and arrangement: review changes to the worker's role, location, pay and conditions; verify the actual paying and reporting entity; and map personal-data roles separately for each processing activity. A provider contract needs its own review when a controller–processor relationship applies.
Treat a provider or entity change as an employment-continuity project. Before moving employees, identify the records, accrued rights and local transfer rules that may apply. In the UK, a change of EOR or provider does not by itself establish that the Transfer of Undertakings (Protection of Employment) Regulations (TUPE) apply.

What EOR compliance actually covers

EOR compliance is the work of keeping the real employment arrangement, its records and its day-to-day operation aligned with the rules that apply where the work is done. The service agreement matters, but it is only one part of that work. You also need to know who employs the worker, who directs the work, who supplies the information needed to administer the engagement, and which obligations stay with your company.

The checks start before the hire and continue through employment terms, payroll, data handling and exit. Their legal detail changes by country and arrangement. Ask the provider to show how its proposed structure works for this role and location.

How the EOR arrangement works

For an EOR arrangement, the client still has to understand the service chain: the legal employer, any intermediary, the client business that receives the work, and the worker. Those roles determine which questions must be answered before work begins.

The same commercial description can sit over different legal structures. In the UK, for example, an employment business engages a work-seeker and supplies that person to work under someone else’s supervision, while an employment agency primarily finds work for a hirer. In the employment-business model, the business is responsible for paying the temporary worker it supplies even if the hirer has not paid or approved a timesheet. Those are UK rules for that model, not a universal description of every EOR engagement.

For each location, ask the provider to identify the employing entity, any partner involved, the legal basis for the arrangement and the party responsible for each employment process. Then test those answers against the role, supervision, worksite and expected duration. This gives your legal, HR and finance teams a practical record to use when something changes.

Where a contract cannot settle legal responsibility

A contract can allocate work between the client and provider, set reporting steps and require cooperation. It cannot make the underlying facts disappear. ILO inspector training states that actual work and remuneration can take priority over a contradictory civil or commercial contract label; this is an international inspection principle rather than an EOR rule for every country.

Local rules can also leave more than one party exposed. In covered Great Britain agency work, liability for an equal-treatment breach can rest with the temporary work agency, the hirer or both, according to the part each caused. Incorrect information from the hirer can therefore remain the hirer’s responsibility.

Use the agreement to make responsibility visible rather than to assume it has been transferred. Record who supplies worker and terms data, who reviews it, who has authority to correct an issue and how the correction is documented. When the role, pay, location, manager or working conditions change, revisit that map before the change takes effect.

Choose the employment model before the provider

Start with the work you need done, then determine the employment model that fits it in the relevant location. A provider shortlist is useful only after that decision. A commercial label does not establish the legal classification of an arrangement, and the same label can cover different service chains.

Write down the role, where it will be performed, who will direct it, the intended duration and the conditions the worker will receive. These facts give local advisers and prospective providers something concrete to assess. They also keep a hurried hiring decision from becoming a contract-label exercise.

Employee or independent contractor?

Do not decide the engagement solely by calling someone a contractor. In a US federal employment-tax classification review, the IRS considers behavioral control, financial control and the relationship between the parties; the contract label alone does not decide the status. A US business that misclassifies an employee as a contractor can be liable for employment taxes.

The practical question is whether the proposed engagement matches how the work will actually be run. Capture the direction given to the worker, the financial arrangements and the ongoing relationship before selecting the contract. An ILO online-work observation illustrates why this matters: the individual was labelled an independent contractor, while the client set weekday hours, tracked time and allocated tasks. It is an observed case, not a general classification test.

The Netherlands provides a separate European decision gate. Dutch guidance assesses false self-employment from how the work is performed; using an intermediary or a separate business entity does not by itself remove that risk. This is a Dutch rule, but it is a reason to reassess a contractor route whenever the practical direction of work changes.

What matters is the actual reality of what’s happening with this contractor.
— Miranda Zolot, General Counsel at Oyster

EOR, payroll provider, PEO or local entity?

The four labels describe different questions about employment, administration and control. For a professional employer organization (PEO) or any other option, establish who will employ the worker and which responsibilities remain with your company before you choose a provider.

Model	Who employs the worker in the evidenced example?	What to verify before choosing it
EOR arrangement	In the Germany/Netherlands practitioner model, the EOR is the formal employer, signs the worker contract and the client directs day-to-day work.	Check that the provider actually signs the worker contract and that the local legal structure recognizes the arrangement. This is a practitioner description, not a universal legal form.
Payroll service provider	In the US federal employment-tax example, the client’s employer remains the employer while the provider administers paychecks or filings.	Use this administrative model only after identifying the employing entity. The client employer remains responsible for its employment-tax obligations and liability in the IRS example.
PEO	In the US federal employment-tax example, the PEO performs some or all withholding, reporting and payment functions for workers serving the client.	Review the contract, employer status and tax allocation. PEO status alone does not establish that it is the sole legal employer; a certified PEO has a distinct IRS status that must be verified.
Local entity or direct hire	In the Dutch direct-hire example, the client’s own business is the employer.	Use this route where your business will register as employer, keep payroll records and enter employment terms with staff. Confirm the local duties for the actual country.

The word “payroll” needs extra care. A US payroll service provider administers the client employer’s payroll; Dutch payrolling is different, because the payroll company formally employs people recruited and supervised by the client. In that Dutch arrangement, the client can still be liable if the payroll company does not remit payroll tax, and covered staff receive at least comparable employment terms. Do not translate either model into a global definition.

For the shortlist, compare the evidence each option can supply for the model you have chosen: the employing entity, applicable permissions, responsibility map, payroll and reporting ownership, worker terms, and how a future transition would be handled. A polished product description cannot fill in any of those points.

When control and time horizon change the answer

The level of direction, the nature of the work and the expected length of the engagement can change the questions you need to ask. Begin with the actual facts, then have the local structure reviewed before onboarding. That sequencing is especially useful where the client will supervise the day-to-day work or where an engagement may continue for a long period.

Track foreseeable changes from the beginning. A role may acquire new duties, move to another country, gain a different manager or extend beyond the original term. Each change can affect the facts on which the original model was assessed, so it should trigger a review of the service chain and the applicable local rules.

In some regimes, duration is itself a legal control. For German employee leasing within the scope of the AÜG, assignment of the same worker to the same user undertaking is generally limited to 18 consecutive months, subject to statutory and collective-agreement qualifications. That does not mean every German EOR arrangement is employee leasing; first establish whether the regime applies.

Verify the local structure before signing

Before you sign, turn the proposed EOR arrangement into a location-specific file. The file should describe the actual role and supervision, name every entity in the chain, identify the local regime that may apply, and show which permissions or pre-hire checks are required. If a provider cannot give a clear answer, pause the hire until you have local advice.

A coverage list cannot establish that the proposed structure works for this worker and role. The service chain and the facts of the engagement still need local review.

Decision diagram: describe the real work, identify the employing or supplying entity, check the applicable local regime, then document required checks or seek local legal review. — Use the actual role, entity and local regime to decide what must be documented before signing; national examples apply only when their legal regime fits the arrangement. IRS: Worker Classification 101 · UK Government: Employment agencies and businesses · German Federal Employment Agency: temporary agency work permit · UK Government: right to work checklist

Identify the employing entity and service chain

Ask for names, not categories. Record the entity that will employ or supply the worker, your own contracting entity, every partner or intermediary, and the entity that receives and directs the work. Then map the contracts between them. This gives you a starting point for checking responsibility for employment terms, payroll, work authorization, information sharing and records.

Record what each entity will actually do. In a UK arrangement, for example, whether an entity finds work or engages and supplies a worker can change the applicable duties. This functional account belongs beside the contract map.

Keep the service-chain record with the proposed contract. It should be updated if the provider changes partner, employer, payroll entity or work location. A new name in the chain can require a new legal and operational review.

Check permissions, role limits and assignment rules

Ask which local regime the provider says applies, what permission or registration that regime requires, and who is responsible for maintaining it. Request the evidence before the worker starts. If the answer depends on the role, sector, worksite, client control or assignment duration, document those facts and set a review date.

Do not convert one country’s rule into a global provider requirement. Some arrangements may fall outside a specific local regime, while others may be subject to permissions, limits or comparable-terms rules. The useful test is whether the provider can explain why the proposed structure fits the role and location, and what will trigger a reassessment.

For longer engagements, add duration and role changes to your control calendar. A move to a different user undertaking, a change in supervision or an extension of the assignment may be legally relevant even when the service agreement stays the same.

Test work authorization and immigration support

Do not assume that an EOR arrangement answers the worker’s right-to-work question. Identify the legal employer in the chain, then ask which party owns the immigration assessment, the prescribed check, record retention and any renewal or change notification. Confirm the answer for the specific country before the worker begins.

The UK provides a clear example of why ownership matters: an employer must perform a prescribed right-to-work check before covered work starts to establish a statutory excuse against a civil penalty. The identity of that employer has to be established in the actual chain. That is UK guidance, so obtain local advice for other jurisdictions rather than extending the process automatically.

Ask the provider to state the limits of its support in writing. A useful response identifies the documents it will request, the party that makes the final decision, the timing of any check and the procedure if the worker’s location or right to work changes.

A Germany example: employee leasing only when the law applies

Germany illustrates why the local classification comes before the commercial product name. Where an arrangement is employee leasing within the scope of the AÜG, the agency generally needs a permit before leasing begins. That rule does not establish that every German EOR arrangement is employee leasing.

If the AÜG applies, the same temporary agency worker generally may not be assigned to the same user undertaking for more than 18 consecutive months. The statute includes qualifications, including statutory and collective-agreement qualifications, so do not use the headline limit without checking the current arrangement.

For a German hire, ask the provider to explain whether it treats the structure as employee leasing, what legal basis it relies on and what records it will keep. If the answer is uncertain, obtain German legal advice before onboarding rather than trying to solve the question through contract wording.

Make the three-party responsibility map operational

An EOR arrangement creates an operating relationship between the client, the provider and the worker. Make that relationship usable by recording each required input, decision, correction and record in one responsibility map. The map should name an owner at the client and provider, set the trigger for action and show what evidence remains after the action is complete.

This is more useful than a generic division of responsibilities in the service agreement. It gives your HR, finance, legal and line managers a route for resolving a changed pay rate, a missing document, a workplace issue or a worker question while the facts are still clear.

Process diagram: confirm the local arrangement, send terms and work-risk information, check applicable payroll and working terms, assign correction ownership, then record changes and evidence. — A client and provider need a dated handoff of applicable terms and risks, named correction ownership and retained records; the UK examples shown apply only where their regimes fit. UK Government: Agency Workers Regulations 2010 guidance · HSE: roles of suppliers and end-user businesses · HMRC: employment intermediaries

Separate statutory duties from contractual promises

Start with two columns. In the first, list duties that may be imposed by the applicable regime. In the second, list the services and response times promised in the contract. A contractual promise can define who does the work, but it does not automatically remove a statutory responsibility from another party.

Covered Great Britain agency work is a useful example. The hirer is responsible for day-one access to facilities and vacancy information. For an equal-treatment breach, liability can rest with the temporary work agency, the hirer or both, to the extent each caused the failure. Those rules apply only where the arrangement is covered, but they show why the client should identify its own actions rather than treat the provider as the sole owner of compliance.

For every duty on the map, state the jurisdiction and arrangement it depends on. Where the legal allocation is unclear, record the open question, assign a local-review owner and do not replace that review with a broad contractual statement.

Name owners for information, decisions and corrections

Information needs a handoff, a recipient and a deadline. Build a working register for data that can affect the engagement: role and location, pay and leave terms, working conditions, timesheets, changes in supervision, safety risks and right-to-work updates. For each item, identify who supplies it, who checks it, who can approve a change and who corrects an error.

In covered Great Britain agency work, the temporary work agency needs information from the hirer about basic terms, including pay and leave, to apply equal treatment. UK guidance also recommends reminders and notices when the hirer changes basic conditions or pay rates. Use that example to design a dated change log for the local arrangement you actually operate.

Clearly defined contracts between the host company, the EoR, and the employee are crucial to delineate roles and responsibilities.
— Lisa-Lorraine Christ, LL.M., lawyer at Küttner Rechtsanwälte, and Christiaan Zweipfenning, LL.M., lawyer at Pallas Advocaten

The map should also specify the correction path: who tells the worker, who recalculates an affected item, who updates the record and who confirms closure. A handoff without a correction owner leaves the same gap that the map was meant to expose.

Check workplace safety and permanent-establishment exposure

Assign workplace-risk responsibilities to the party that can act on them. In the HSE’s UK gig, agency and temporary-worker context, day-to-day health and safety normally lies with the end user that directs the work and may control the premises. The supplier and end user must exchange information about the assignment and health and safety risks before placement. Apply this example only where its UK context fits; use local advice for other arrangements and locations.

The map should cover remote work as well as a physical worksite. The OECD explains that cross-border remote work can raise permanent-establishment questions under an applicable tax treaty, depending on the location and facts. Flag a change in work country, duties, authority or work pattern for tax review instead of assuming the EOR structure resolves that question.

Give each risk a practical owner: one person to gather facts, one to decide whether local advice is required and one to retain the resulting record. This turns a concern raised by HR or a manager into a traceable decision.

Give workers a usable complaint route

Workers need to know where to raise a payroll question, a change in terms, a workplace concern or a problem with documents. Provide a route that is easy to find, identifies who receives the issue and gives the worker a way to follow up. It should work whether the concern begins with the client, the EOR or another entity in the chain.

Connect that route to the responsibility map. The receiving team should log the issue, identify the responsible party, preserve the relevant information and tell the worker what will happen next. Escalate issues that may affect statutory rights, safety, work authorization or data to the named legal or compliance owner.

Test the route before it is needed. Use a sample query to check that the complaint reaches the right team, that responsibility is accepted and that the final action is recorded. Then repeat the test when the provider, employing entity, worksite or worker terms change.

Get employment terms right from offer to exit

The employment documents and the operating record need to describe the same job. Before an offer is accepted, align the worker’s terms with the facts already reviewed: employing entity, role, location, manager, working pattern, pay, leave and the route for changes. Keep the client’s source information and the provider’s issued documents together so you can trace a term back to its owner.

Recheck the terms when the work changes and prepare for exit while the employment record is current. Ask the provider to identify the local requirements for the arrangement you are putting in place.

Contracts, language and required notices

Ask for the worker-facing contract and any required notices early enough to review them before signature. Check that the employing entity, role, location, start date, pay basis, working pattern, leave and complaint route match the approved engagement. Request an explanation of any local language, delivery or notice requirement that applies to the individual hire.

The UK employment-business model provides an example of why worker documents belong in the compliance file. The UK government lists written terms of engagement and a key information document alongside paid holiday and minimum-wage obligations for workers in that model. It is a UK example, so it does not establish the documents needed for every EOR arrangement.

Give the worker a clear route to raise a question before work begins. A mismatch between the offer, the provider’s payroll setup and the day-to-day role is easier to correct before the first payroll cycle than after it has affected pay or leave.

Pay, working time, leave and benefits

Build a location-specific terms sheet that distinguishes the client’s commercial decisions from conditions required by the applicable regime. Include the pay components, working time, leave, benefits, approval source and the date each term was last confirmed. Send changes through the responsibility map before they reach payroll.

Some rules depend on the structure and duration of the assignment. In covered Great Britain agency work, equal treatment in basic pay and working conditions applies after 12 weeks in the same job with the same hirer. In German employee leasing within the AÜG’s scope, comparable essential working conditions, including pay, apply subject to stated collective-agreement qualifications. Neither rule is a global EOR standard.

Use the provider’s local analysis to set the right review points. A promotion, new allowance, change in working time or extension of the assignment can change the terms that need to be checked. Keep the evidence behind each update with the worker record.

Changes in role, location or comparable conditions

Treat a material change as a new compliance input, even if the employment contract itself is not being replaced. Before a worker moves country, changes role, starts reporting to a new manager or receives a different pay or leave arrangement, update the facts shared with the employing entity and ask whether the local structure or required documents need to change.

The handoff should be dated. In covered Great Britain agency work, guidance recommends that hirers notify temporary work agencies when they amend basic working and employment conditions, while agencies use reminders to keep those terms current. Apply the same discipline to your own arrangement after checking which local rules apply.

Keep a decision record for each change: the requested change, the effective date, the parties consulted, the local assessment, the worker communication and the payroll or document update. This gives you a way to reconcile the written terms with what the worker is actually doing.

Termination and accrued rights

Plan the exit in the employment record from the start. The file should show who initiates a termination decision, who communicates with the worker, which local advice is required, who calculates accrued amounts and how the final documents and records are retained. Do not assume a provider can make an exit routine simply because it employs the worker.

When employment moves to another employer, check whether a local transfer regime applies before changing terms or closing the old record. Where UK TUPE applies, the new employer takes over existing employment terms, past rights failures, holiday entitlement and continuous employment. A change of EOR or provider alone does not establish that TUPE applies.

If the move is within TUPE’s scope, the transfer itself generally cannot be the reason to change terms, subject to limited other bases described in the guidance. For every other country or structure, obtain advice on the applicable exit rules and document the treatment of outstanding pay, leave, benefits and employment records.

Verify each payroll and contribution cycle

Payroll compliance depends on the data that reaches the payroll run, the party that is legally responsible in the local chain and the evidence retained after payment. Treat each cycle as a control sequence: approve the inputs, compare the outputs with those inputs and resolve any difference through a named owner.

The EOR may operate parts of the process, but your team still needs enough visibility to ask the right questions. For each country, establish who is the employer, who pays, who reports, which contributions apply and which records the provider will return. Do not assume the allocation is the same across every location or structure.

Approve source data before payroll closes

Set a fixed handoff for the information that affects the run. Depending on the arrangement, that can include the worker’s active status, role and location, approved pay changes, working-time information, leave and any adjustment from an earlier cycle. Identify the client owner who validates each input and the provider owner who confirms receipt.

Use a dated approval record rather than relying on chat messages or an informal spreadsheet update. The record should show the payroll period, each change submitted, the supporting decision and the person who approved it. If an item is incomplete or disputed, decide before the cut-off whether it belongs in the current run or needs a documented follow-up.

This review is also a checkpoint for changes that could affect the local structure. A worker who has changed country, role or manager may need more than a payroll update, so route the change back to the responsibility map where necessary.

Reconcile payslips, filings and contributions

Compare the completed output with the approved source data and the local responsibility map. Ask the provider to identify the payslip, payment confirmation, filing or reporting record and contribution evidence available for the arrangement. Your finance and HR owners should be able to trace each material item from approved input to worker-facing output and, where applicable, to the relevant filing or remittance record.

The UK intermediary rules show why the responsible entity must be identified rather than inferred. An employer normally operates Pay As You Earn (PAYE) in a tax-relevant UK intermediary chain, while agency rules can require an intermediary to operate PAYE, subject to conditions and exceptions. In a specified non-PAYE reporting situation, an employment intermediary must report to HMRC at least every three months. These are conditional UK rules, not a universal allocation for EOR payroll.

Use the provider’s local explanation to set the reconciliation frequency, filing schedule and records required for each country. Retain the explanation alongside the cycle records so a later reviewer can see why the team accepted the allocation.

Correct errors and retain proof

Give every payroll error a defined route from discovery to closure. The log should capture what was wrong, the affected period, the worker impact, the party responsible for the correction, the approval required and the final evidence that the record was updated. Keep the worker informed through the route established for questions and complaints.

Do not close an issue when a number has merely been changed in a system. Reconcile the revised output against the approved correction, then check whether a related payslip, filing, contribution record or worker communication also needs to change. If the answer depends on local rules, obtain the provider’s explanation or local advice before finalizing the record.

Retain the original input, the correction request, approvals and final proof together. That gives the client and provider a shared audit trail and makes the next payroll review more reliable when the same type of issue appears again.

Protect employee data and intellectual property

Data and intellectual property travel through the same employment chain, but they need separate reviews. A worker’s records may move between the client, employing entity, payroll provider and other service providers. The rights to work created by that worker may depend on different documents and local rules. Map both before the engagement begins, then revisit them when the worker, provider or location changes.

For each data activity and work product, identify the responsible party, the supporting contract and what happens at the end of the engagement.

Map data roles by processing purpose

Create a data inventory for the actual activities in the arrangement. Separate, for example, the processing needed for the employment relationship, payroll, benefits, access to client systems and offboarding. For each activity, record the personal data involved, the entities with access, the purpose, the instructions used and the local privacy regime that applies.

The UK ICO advises that controller and processor roles depend on who decides the purposes and manner of the specific processing activity. One organisation can therefore have different roles for different data. That is UK GDPR guidance; use the applicable local privacy framework for other jurisdictions.

Put the inventory under joint ownership of the teams that use it. HR may know the worker data, finance the payroll data and IT the access data. A single owner should coordinate changes so that a new system, provider or work location does not create an unreviewed flow.

Check access, transfers, retention and incident response

Review access as a set of practical questions: who can see the data, who can change it, which subprocessors receive it, where it is stored and when access ends. Tie those answers to the operating process, especially onboarding, payroll changes and offboarding. A permissions list that is disconnected from the service chain is hard to validate when an incident occurs.

Where a UK GDPR controller–processor relationship applies, the ICO identifies contract areas including documented instructions, confidentiality, security, subprocessor controls, assistance with rights, end-of-contract data and audits. The same guidance is under review, so check the current requirements and use it only where that role classification fits.

For a UK GDPR restricted international transfer, first determine whether the transfer rules apply and then identify a valid route. The ICO’s January 2026 guidance uses a three-step test. For every other privacy regime, have the appropriate team confirm the transfer, retention and incident-response requirements before data moves.

Trace the chain of intellectual-property rights

Build an IP record alongside the employment file. Identify the work the person is expected to create, the entities that may receive it, the documents that address rights in that work and the point at which each document is signed. Keep versions of the employment terms, client agreements and any project-specific documents together.

Do not assume that a clause used in one country settles ownership, assignment, moral rights or required formalities in another. Ask local counsel to confirm the rules for the relevant jurisdiction and engagement before relying on any chain of rights.

German employee-created software shows why the employing entity matters. Where an employee creates a computer program while performing duties or following employer instructions, German law gives the employer alone the right to exercise the economic rights in that program unless otherwise agreed. The rule is limited to German law, employee-created software and its statutory conditions.

If an EOR is the German employing party in that example, trace the client’s rights through the employee’s duties and agreement, the EOR’s statutory position and an express licence or transfer to the client. Request the worker agreement, the scope of duties, the EOR–client rights clause and deliverable records. Do not treat the German rule as automatic client title or as a rule for other work or countries.

At offboarding, remove access, identify the work product, retain required records and resolve outstanding documents. Keep the chain of rights available for later legal and operational review.

Test the provider and service agreement

Provider diligence should test whether the proposed service can operate the arrangement you have already defined. Read the service agreement alongside the local structure file, responsibility map and payroll controls. Each document should name the same entities, give compatible responsibilities and provide a workable route when the facts change.

Ask for evidence that answers your specific hiring case. A provider’s general materials cannot tell you whether it can support the role, location, work pattern and transition plan you have in mind. Keep the evidence and the final decision in the engagement record.

Local capability, partners and escalation

Ask the provider to identify the employing entity and every partner or intermediary that will take part in the engagement. Request the local basis for the structure, the scope each party handles and the contact responsible for a legal or operational escalation. Match those answers against the service-chain map you prepared before the provider selection.

Test the escalation path with a realistic scenario: a changed work location, an urgent question about a worker’s terms or a missing document before onboarding. The provider should be able to say who receives the question, who decides the next step and how the decision is recorded. Record any dependency on a local partner so it is visible to the client team.

Revisit the answers if the employing entity or partner changes. A change in the delivery chain can affect the local review, data map, payroll controls and the worker’s documents.

Service levels, remedies and financial resilience

Turn broad service promises into operational commitments. For each critical process, define the request channel, the owner, the response and resolution target, the escalation point and the evidence that closes the request. Prioritize issues that can affect onboarding, pay, worker documents, compliance deadlines and a planned exit.

Read remedies in the context of the operational problem they are meant to address. A credit or other contractual remedy may matter commercially, but it does not correct a worker record, complete a required check or answer an open legal question. Keep the correction owner and the remedy route separate in the responsibility map.

Ask the provider what evidence it can provide about its ability to keep operating through a material issue, and have finance assess that evidence under your company’s own approval process. Record the outcome and set a trigger for reviewing it again if the engagement expands or the provider’s service chain changes.

Security evidence, records and audit access

Match the provider’s security evidence to the data inventory and access map. Ask which systems and subprocessors will handle worker data, what access each party receives, how access is removed and which records can be provided after an incident or at the end of the service. Then compare those answers with the contract terms and the operational workflow.

Where a controller–processor relationship applies under UK GDPR, the ICO identifies documented instructions, confidentiality, security, subprocessor controls, assistance with rights, end-of-contract provisions and audits among the relevant contract areas. This is conditional UK guidance, so confirm the equivalent requirements for the applicable privacy regime.

Make audit access specific. Identify the records you may need, the format, the person who can request them and the time at which they must be available. Test this before signing with a sample record request that does not expose unnecessary worker data.

Price and exit terms in the full operating cost

Review price terms together with the work needed to operate the arrangement. List the fees, payment timing, currencies, approval steps, change charges and exit-related charges that are stated in the proposal or agreement. Then ask how each term applies to the countries, roles and expected duration in your plan.

Do the same for exit. The agreement should identify the notice process, the party responsible for worker communications, access removal, data return or deletion, record delivery and support for a transfer or termination. Align those terms with the continuity review for the relevant jurisdiction.

Keep a single decision record that brings together the commercial terms, local-structure analysis and exit plan. It gives procurement, finance, HR and legal teams a shared view of what the arrangement will require during normal operations and when it changes.

Keep compliance current after onboarding

After onboarding, review changes in the worker’s facts, local rules, the provider’s service chain and your own operating model. Assign an owner and date to each review, then retain the decision.

Use the same local-structure and responsibility maps throughout the relationship. A change that looks minor to a line manager can affect employment terms, payroll, work authorization, data access or a local legal assessment.

Review law changes and worker changes

Assign one owner to receive changes from the provider and local advisers, and another owner at the client to assess what they mean for active workers. Keep the review focused on the actual arrangement: employing entity, role, location, supervision, work pattern, terms and the data or payroll processes connected to it.

Worker changes need the same discipline. A revised pay rate, leave entitlement, manager, worksite or assignment length should trigger a dated notice to the relevant provider team. In covered Great Britain agency work, UK guidance recommends reminders and notices when a hirer changes basic conditions or pay rates affecting agency workers. Apply that example only where the arrangement falls within its scope.

Record the conclusion of each review, including any change to worker documents, payroll inputs, provider instructions or the local legal analysis. An unresolved question should have an owner and a deadline rather than being left in an inbox or a chat thread.

Run a location-specific control calendar

Create a calendar for each location and arrangement, rather than one global list of deadlines. Include the review points identified in the local analysis: payroll approvals, filing or reporting checks where applicable, work-authorization renewals, assignment-duration reviews, data-access reviews, worker-term changes and provider-performance checks.

The calendar should show the trigger, the responsible person, the supporting record and the escalation route. It also needs an exception process for changes that occur between planned dates, such as an unexpected relocation or an urgent correction to a worker’s terms.

Review the calendar with the provider on a regular schedule and when the service chain changes. Compare the completed controls with the responsibility map so that every task still has a named owner and every open item is visible.

Test incidents, complaints and audit records

Test the operating process with realistic scenarios: a payroll discrepancy, a missing worker document, a change in work location, a data-access issue or a worker complaint. The test should show who receives the issue, who determines the next step, how the worker is updated and where the final record is stored.

For a workplace concern, assign the party with the practical ability to act. In the HSE’s UK gig, agency and temporary-worker context, day-to-day health and safety normally lies with the end user that directs the work and may control the premises. Keep this example within its stated UK scope and seek local advice for other arrangements.

Treat audit readiness as a record-retrieval exercise. Select a completed worker change or payroll cycle and check whether the team can retrieve the source input, approval, provider communication, final output and correction record, if any. Use the gaps found in that exercise to improve the calendar and the responsibility map before a real incident exposes them.

Plan the EOR exit before it is needed

An exit plan belongs in the original EOR operating file, even when no change is expected. It gives the client, provider and worker a clear process if the company establishes a local entity, selects another provider, changes the role or ends the employment. Without that plan, a commercial decision can force a rushed review of employment continuity, records, access and accrued obligations.

Build the plan by location and worker group. It should identify the decision owner, the local legal review needed, the worker communication path, the documents and records to be delivered, and the controls that stay active until the transition is complete.

Triggers for a local entity or new provider

Set the triggers before the engagement changes. They may include a planned local-entity launch, a provider or employing-entity change, a shift in the role or work location, an expanded worker population, a material service issue or a revised commercial requirement. Each trigger should start a structured review rather than an automatic move.

For each trigger, ask whether the local structure, worker terms, payroll allocation, work authorization, data flows and rights to work product will need to change. Assign owners across legal, HR, finance, IT and the provider, and record the decision that follows the review.

Keep the worker’s experience in the plan. Decide who will explain the proposed change, answer questions and coordinate any new documents. The person receiving the worker’s question should have access to the same current transition record as the teams making the decision.

Preserve employment continuity where required

Do not treat a switch of provider or employing entity as a purely administrative transfer. First determine whether a local employment-transfer regime applies, then identify the rights and obligations that the transition must preserve. The answer depends on the jurisdiction and facts of the arrangement.

The UK TUPE guidance provides a limited example. Where TUPE applies, the new employer takes over existing employment terms, past rights failures, holiday entitlement and continuous employment. A switch of EOR or provider does not by itself show that TUPE applies.

Where the transfer is within TUPE’s scope, the transfer itself generally cannot be the reason to change employment terms, subject to limited other bases in the guidance. For other arrangements, obtain local advice before communicating the change or issuing new terms. Record the assessment and the treatment of each affected worker.

Transfer records, access and open obligations

Create a transition inventory before the effective date. It should cover employment terms and notices, payroll inputs and outputs, leave and other accrued records, work-authorization material, data-processing records, system access, provider contacts and any open question or complaint. Give each item a source, destination, owner and completion check.

Sequence the work so that the incoming arrangement can operate before the outgoing one is closed. Confirm that the required records have arrived, that the new owners can access the information they need and that the worker knows who to contact. Remove or change access only when the receiving process is ready and the local review permits it.

Close the transition with a joint review. Check final payroll and worker communications, resolve open obligations, retain the evidence required for the applicable arrangement and update the responsibility map. This creates an auditable record of the change and a clearer starting point for the next operating cycle.

Frequently asked questions

Does an EOR remove all client liability?

No. The client still needs to understand its responsibilities in the local arrangement and operate the controls assigned to it. In covered Great Britain agency work, for example, liability for an equal-treatment breach can rest with the temporary work agency, the hirer or both, to the extent each caused the failure. A service agreement should make responsibilities visible, but it does not replace a review of the applicable legal duties.

Is an EOR the same as a payroll provider?

Do not answer this from the label alone. Ask who employs the worker, who supplies the worker, who directs the work, who runs payroll and reporting, and which local structure applies. The UK distinguishes an employment business, which engages and supplies a work-seeker, from an employment agency, which primarily finds work for a hirer. That distinction is UK-specific, but it illustrates why functions and service chains need checking before you choose a model.

Can an EOR hire in every country and role?

Do not assume that a provider’s coverage claim resolves the question. Verify the actual role, location, employing entity, service chain, local regime, required permissions and work-authorization process before onboarding. In Germany, employee leasing generally requires an AÜG permit before leasing begins where that regime applies; it does not follow that every German EOR arrangement is employee leasing.

Who handles payroll errors and worker complaints?

Set this out before the first payroll cycle. Your responsibility map should identify the party that receives the issue, verifies the facts, approves a correction, updates the worker, retains the record and escalates a legal or compliance question. In a UK employment-business model, the business is responsible for paying the temporary worker it supplies even if the hirer has not paid or approved a timesheet. Check the corresponding allocation for the specific local arrangement.

Can employees move from an EOR to our own entity?

They may be able to move, but the transfer needs local review before you change employment terms or close the old record. Where UK TUPE applies, the new employer takes over existing employment terms, past rights failures, holiday entitlement and continuous employment. A move from an EOR or another provider does not by itself establish that TUPE applies. Prepare a transition record for worker communications, accrued items, payroll, data, access and outstanding obligations.

Build a compliance process you can evidence

Each important decision needs a record that can be found months later. It should identify the work and local structure, the entities and their duties, worker terms, payroll inputs and outputs, and the route for changes or complaints.

Start with a small operating file for every location and update it as the arrangement changes:

the local-structure assessment, including the employing or supplying entity, service chain, applicable regime and open local-review questions;
the responsibility map for information, decisions, corrections, workplace risks and worker communications;
the worker’s current terms, approved changes and the supporting records used for payroll and other operating controls;
the data and access inventory, including the relevant contracts, subprocessors, retention and offboarding steps;
the provider-evidence record, escalation contacts, service commitments and transition plan.

Give each record an owner and a review trigger. A change in the worker’s role, location, pay, manager, work pattern, employing entity or provider should cause the relevant maps to be checked again. That is how a compliance process stays connected to the arrangement people are actually operating.

Keep national examples within their scope. A UK agency-worker rule, German employee-leasing requirement or UK GDPR control can be a useful prompt for the questions to ask, but it is not a global answer. When the structure, legal employer, transfer treatment or local duty is uncertain, pause the decision long enough to obtain the local review it requires.

Select a recent change, payroll cycle or worker query and trace it from original information to final action. If the responsible party, decision record or final proof is missing, update the map and test the route again.

EOR compliance best practices: verify the structure, duties and controls