EOR Compliance Mistakes That Trigger Permanent Establishment Risk (2026): How to Fix Them
Quick answer
An Employer of Record only removes one of the four ways your company can trigger permanent establishment (PE) risk — employment-based PE. It does nothing about a client-facing hire signing or negotiating contracts (dependent-agent PE), a country manager or sales leader making decisions from abroad (management PE), or a remote worker who now fails the OECD's 2026 home-office test. Most EOR compliance mistakes come from treating "we hired through an EOR" as a complete answer instead of a partial one.
The fix in every case below is the same shape: know which PE category the role is actually exposed to, put explicit limits on authority in writing, and review exposure by role — not just by headcount — every time you add a client-facing or leadership hire in a new country.
The 6 Mistakes at a Glance
Each of these shows up independently of how good your EOR provider is — they're decisions your company makes about which roles you route through an EOR and how those roles operate, not something an EOR's own compliance team can catch for you.
| Mistake | PE type it triggers | Fastest fix |
|---|---|---|
| Treating the EOR as full coverage | Any — false sense of security | Map each role against the four PE types, not just employment status |
| Client-facing hires can sign contracts | Dependent-agent PE | Strip signing/negotiating authority in writing; approvals happen at HQ |
| Country manager or sales lead via EOR | Management PE / dependent-agent PE | Route strategic and revenue-owning roles through an entity, not an EOR |
| Ignoring the 2026 home-office test | Fixed-place-of-business PE | Track working-time %, document the commercial reason for presence |
| No entity-graduation trigger | Compounding exposure over time | Set a headcount/revenue threshold that forces an entity review |
| No documentation trail | Makes any of the above harder to defend | Keep job descriptions, approval logs, and org charts current |
Why "We Use an EOR" Isn't a Complete Answer
An Employer of Record legally employs your international hires through its own local entity, which is genuinely effective at closing one specific gap: it means the act of employing someone in that country doesn't create a taxable presence for you, because you're not the legal employer of record — the EOR is. That's real protection, and it's why EORs exist as a category.
Where the confusion sets in is assuming that protection extends to everything the employee does. It doesn't. Oyster HR's own guidance and Deel's guidance on this are consistent on the point: if the worker is closing deals, representing the company in negotiations, or running local operations in a way that would independently create PE, the EOR structure does not shield you from that finding. PE law looks at what the person actually does and the authority they actually hold — not which entity issues their paycheck.
In practice, PE exposure comes from four distinct triggers, and an EOR only neutralizes the first one:
- Employment PE — created simply by having employees on the ground. An EOR removes this.
- Dependent-agent PE — created when someone habitually concludes contracts, or plays the principal role in contracts that get finalized without material changes, on your behalf. An EOR does not remove this.
- Management / fixed-place-of-business PE — created when core business decisions are made from a location, or a home office is used regularly enough and for a commercial reason. An EOR does not remove this.
- Business-activity PE — created by sustained revenue-generating activity in a country over time, independent of who technically employs the people involved. An EOR does not remove this.
The rest of this guide walks through the specific mistakes companies make against triggers two through four, and what to do differently.
Treating the EOR Contract as a PE Force Field
This is less a single event and more a default assumption that quietly shapes every other decision: legal or HR signs off on international hires because "they're on an EOR, so we're covered." It's the mistake behind the other five, because once that assumption is in place, nobody separately checks whether the specific role being hired sits in one of the three PE categories an EOR doesn't touch.
It's an easy assumption to make because EOR marketing leans hard into "compliant global hiring," and that's true for payroll, local labor law, and benefits administration. It's not true for tax presence created by what the role does. The two get bundled together in most buyers' minds because the same vendor solves both — but they're separate legal questions with separate answers.
Before approving any international hire through an EOR, ask one question that's separate from "is this role compliant to employ": does this role sign contracts, run local operations, or make company-wide decisions? If yes, the EOR question and the PE question need to be evaluated independently. If you're still comparing providers for the employment side of this, our EOR provider decision framework covers the vetting questions that matter — but it's a separate checklist from the one in this article.
Letting Client-Facing EOR Hires Negotiate or Sign Contracts
A dependent-agent PE arises when a person in another country habitually concludes contracts on your behalf, or habitually plays the principal role leading to contracts that get finalized without material changes by the company. The operative word tax authorities look for is habitually — a single one-off transaction rarely creates PE on its own, but a sales rep who closes deals every month from their EOR-employed seat abroad is a textbook pattern. Agent-PE guidance from cross-border employment specialists is blunt about which roles carry the most exposure here: sales roles face stricter limits than almost any other function, precisely because the dependent-agent route is the fastest path to a PE finding.
The mistake isn't hiring salespeople abroad through an EOR — plenty of companies do this safely. It's not putting any limit on what "safely" means before the role starts operating.
Write explicit limits into both the EOR service agreement and the employee's internal role documentation: no authority to negotiate binding terms, no authority to sign, and every deal routes back to an authorized signer at headquarters for final approval. This isn't a formality — it's the fact pattern regulators actually look at. If the local hire's role is materially different from an account executive who closes deals (for example, an engineer who never touches contracts), that's a much lower-risk profile for the same EOR structure; see how that risk difference plays out in practice in Deel vs. Rippling for global engineering teams.
Routing a Country Manager or Sales Leader Through an EOR
This is mistake two's more expensive cousin. A country manager or regional sales director doesn't just occasionally touch a contract — the role usually is making commercial decisions, directing local strategy, and representing the company as its face in that market. That's a stronger management-PE fact pattern than a standard sales hire, because it adds "core business decisions are made here" on top of "contracts get concluded here."
If there are clear PE-risk indicators for a specific hire — a C-level title, a mandate to run the local business, or authority over pricing and strategy — most EOR guidance is consistent that an EOR is the wrong vehicle for that specific role, even if it's the right vehicle for the rest of the team. Consulting a tax advisor before the hire, not after it starts operating, is the difference between a five-minute conversation and a multi-year cleanup.
Segment your international roster by decision-making authority, not just by title. Individual contributors and support roles are generally low-risk on an EOR. Anyone with authority to set local strategy, own P&L, or act as the company's public representative in-market should trigger a mandatory tax review — and often belongs on a local entity or a structure evaluated specifically for that purpose. If you're weighing an EOR against a PEO for a leadership hire, the two solve different problems; see EOR vs. PEO: what's the difference and which does your team need for where that line actually falls.
Missing the 2026 OECD Home-Office Test
This is the newest mistake on this list, and the one most compliance teams haven't updated their internal policies for yet. In November 2025, the OECD published its first comprehensive revision to the Model Tax Convention's Article 5 commentary since 2017, adding explicit guidance on when a remote worker's home office counts as a permanent establishment of their employer. It's a two-part test, as summarized by EY's analysis of the update:
- The 50% working-time threshold. A home office generally isn't treated as a place of business of the employer if the person works from it for less than 50% of their total working time over any rolling 12-month period. Actual conduct — not the employment contract's stated terms — is what gets measured.
- The commercial-reason test. If the 50% threshold is exceeded, a PE only follows if there's a commercial reason for the person's presence there — such as facilitating access to local customers, suppliers, or resources. The updated commentary explicitly rules out employee preference, talent retention, and office-cost savings as commercial reasons.
The example the OECD's own commentary uses is direct: an employee who works from home in another country 80% of the time and regularly visits local clients from that home base meets both parts of the test — the home office is a PE of the employer in that country. A fully remote engineer who works from home 80% of the time but never interacts with local clients or business activity generally does not meet the commercial-reason half of the test, even at the same working-time percentage.
Track working-time location data for remote employees on a rolling 12-month basis, not just their registered home country at hire. For anyone who both exceeds 50% time in one location and has a plausible business reason for being there (client visits, supplier meetings, revenue activity), document that the presence is not commercially motivated where that's genuinely true, and flag the role for tax review where it isn't.
What Actually Happens If a Tax Authority Finds a PE
PE risk is a factual determination made after the fact, based on what employees did and where they did it — which is what makes it dangerous compared to most compliance failures: you often don't know it's happened until years of exposure have already accumulated.
Once a PE is established, the company must undertake a profit-attribution exercise under the standard used by most tax treaties: the PE is treated as a distinct and separate enterprise, with profit attributed based on the functions performed, assets used, and risks assumed in that location. That's a transfer-pricing exercise, and it typically requires outside specialists to defend the numbers. Where the same profit ends up taxed in two countries as a result, companies can seek relief through the Mutual Agreement Procedure (MAP), where the two countries' tax authorities negotiate a resolution — but MAP cases commonly take well over a year to resolve and don't guarantee full relief.
If You Think You're Already Exposed: The Remediation Sequence
If the mistakes above already describe how your company has been operating, the fix isn't to panic — it's to sequence the response correctly, because doing it out of order (registering before you've quantified exposure, for example) can lock in a worse outcome than necessary.
- Fact-find internally first. Before contacting any tax authority, map exactly which roles, in which countries, over which time periods, plausibly meet a PE trigger. This is an internal legal and tax exercise, not a filing.
- Bring in local tax counsel and a transfer-pricing specialist. PE exposure is jurisdiction-specific — the thresholds, look-back periods, and available relief differ by country, and generic guidance (including this article) can only tell you what to check, not what your specific exposure is worth.
- Quantify the exposure before you register anything. How many years, how much profit would be attributed, and what would the tax-plus-penalty range look like. This number drives every decision that follows, including whether a voluntary program is worth pursuing.
- Check for a voluntary disclosure or regularization route. Many jurisdictions offer some form of reduced-penalty program for companies that come forward before an audit starts rather than after. Availability and terms vary widely by country, which is another reason step 2 comes before this one.
- Register, file, and pay. Once the exposure is quantified and the disclosure path decided, the formal registration and back-filing happens with counsel managing the process.
- Fix the underlying practice going forward. Remediating the historical exposure without changing the role structure that caused it just restarts the clock. This is where the fixes described in the six mistakes above apply prospectively.
A Quarterly Self-Audit Checklist
This doesn't require a law firm to run — it's a review any HR or legal ops team can do every quarter to catch drift before it compounds:
- List every international hire made through an EOR in the last quarter, with title and function.
- Flag anyone whose role involves negotiating, closing, or signing on the company's behalf.
- Flag anyone with "manager," "director," "lead," or "head of" in a country/regional title.
- For flagged roles, confirm the EOR employment contract explicitly excludes contract-signing authority.
- Pull rolling 12-month location data for remote employees who work outside their contracted base country.
- Cross-check flagged roles against your current headcount and revenue thresholds for that country.
- Confirm job descriptions and org charts still match what the role actually does day to day.
When to Stop Relying on an EOR Entirely
An EOR is a starting structure, not a permanent one for every market. As headcount, revenue, or role seniority grow in a specific country, the economics and the risk profile both shift toward setting up a local entity — full ownership of a country's operations, direct control over contracting, and none of the role-by-role PE questions this article covers, at the cost of the setup time and ongoing compliance overhead an entity requires. There's no single universal headcount number where that trade tips, because it depends on local incorporation cost, how revenue-generating the roles are, and how long you expect to operate there — but a rising count of client-facing or leadership hires in one country through an EOR is the clearest signal it's time to run that comparison, not to add another EOR seat by default. We cover the cost side of that trade-off — EOR fees versus the cost of standing up a foreign entity — in a separate breakdown, since the two options rarely compete on compliance alone.
Frequently Asked Questions
Can an EOR completely eliminate permanent establishment risk?
No. An EOR removes employment-based PE risk — the exposure created simply by having employees on the ground — because it, not your company, is the legal employer. It does not remove dependent-agent PE (contract signing/negotiating), management PE (decisions made from that location), or business-activity PE (sustained revenue-generating activity), all of which depend on what the role does, not who employs it.
What is the OECD's new 50% rule for remote workers in 2026?
The OECD's November 2025 update to the Model Tax Convention commentary says a home office generally isn't a PE if the employee works from it less than 50% of their total working time over any rolling 12-month period. If that threshold is exceeded, a second test applies: whether there's a genuine commercial reason for the person's presence there, such as serving local clients — employee preference or cost savings don't count.
What triggers dependent-agent permanent establishment?
A dependent-agent PE is triggered when someone habitually concludes contracts on your company's behalf in another country, or habitually plays the principal role in getting contracts finalized with no material changes made afterward. A single deal closed abroad rarely creates PE on its own; a recurring pattern of doing so is what tax authorities look for.
What happens if my company is found to have an unregistered PE?
You generally owe corporate income tax retroactively for every year the PE existed, based on a profit-attribution analysis that treats the PE as a separate enterprise. That commonly means a tax rate in the 20–35% range on attributed profits, plus penalties, interest, and five-figure-or-higher professional fees to run the transfer-pricing work — and if the same income gets taxed in two countries, resolving it through the Mutual Agreement Procedure can take well over a year.
Should a country manager or head of sales be hired through an EOR?
Generally, this is the highest-risk role type to route through an EOR. A country manager or sales director typically both concludes contracts and makes local business decisions, which stacks dependent-agent and management PE exposure on the same role. Most guidance recommends a tax review before this specific hire, and often a local entity or a structure evaluated for that purpose instead of an EOR.
References and sources
- Deel, 2026 Enterprise Guide to Permanent Establishment Risk Management — checked September 2026.
- Deel, How EORs Protect Companies From Permanent Establishment Risk — checked September 2026.
- Oyster HR, How an EOR Protects Against Permanent Establishment Risk — checked September 2026.
- Boundless HQ, Permanent Establishment Risk Triggers in 2026 — checked September 2026.
- EY, OECD 2025 Update: New Rules on Permanent Establishment for Remote Work — analysis of the November 2025 OECD Model Tax Convention commentary update, checked September 2026.
- Thomson Reuters Tax & Accounting, Permanent Establishment Risk for Remote Workers: 2026 Guide — checked September 2026.
- wfa.team, Agent Permanent Establishment: Sales Agent PE Risk — checked September 2026.
Technology consultant with 10+ years in the Japanese tech industry. Specializing in SaaS evaluation, workflow automation, and B2B tool integration.