Case Study: Cross-border employment in Europe

Cross-border employment in Europe is a legal minefield that catches even experienced multinationals off guard. When an employee works across two or more European jurisdictions, at least three parallel legal regimes apply simultaneously: labour law, social security coordination and tax residency rules. Each regime follows its own logic, and a mismatch between them can generate years of back-assessed contributions, penalties and reputational damage. This article maps the binding legal framework, identifies the most common structural errors, and provides a practical decision guide for businesses operating across European borders.

The core challenge is that European Union law harmonises only part of the picture. Regulation (EC) No 883/2004 on the coordination of social security systems and Directive 96/71/EC on the posting of workers, as amended by Directive 2018/957/EC, set minimum floors. But labour contracts, termination rights and tax treaties remain largely national. A company that assumes EU membership creates a unified employment zone will face a rude awakening when a German works council, a French mandatory notice period and a Dutch 30% ruling all apply to the same employee simultaneously.

This analysis covers: the applicable law framework for cross-border employment, the social security coordination mechanism, the posted worker regime, the employer of record model as an alternative structure, tax residency and permanent establishment risk, and a practical FAQ for business decision-makers.

The starting point for any cross-border employment arrangement in Europe is Rome I Regulation (EC) No 593/2008, which governs the law applicable to contractual obligations. Under Article 8 of Rome I, the parties may choose the governing law of an employment contract, but that choice cannot deprive the employee of protections afforded by the mandatory rules of the country where the employee habitually works.

Habitually works is the operative phrase. European Court of Justice case law has interpreted this broadly: it is the place where the employee performs the substance of their duties, not merely the place named in the contract. A sales manager nominally employed under English law but spending four days a week visiting clients in the Netherlands will trigger Dutch mandatory employment protections, including notice periods under the Dutch Civil Code (Burgerlijk Wetboek), the statutory severance payment known as the transitievergoeding, and works council consultation requirements under the Works Councils Act (Wet op de ondernemingsraden).

A common mistake made by international employers is drafting a single-jurisdiction employment contract and assuming it governs the entire relationship. In practice, the employee can invoke the mandatory protections of the habitual work jurisdiction regardless of the contractual choice of law. This creates a layered obligation: the employer must comply with both the chosen law and the mandatory rules of the actual work location.

Practical scenarios illustrate the exposure clearly. A UK-based fintech company hires a business development manager who works primarily from Amsterdam. The contract is governed by English law. When the company terminates the employee, Dutch mandatory notice periods and transitievergoeding apply. The employer, unaware of this, pays only the English contractual notice. The employee brings a claim before the Dutch courts, which have jurisdiction under Brussels I Recast Regulation (EU) No 1215/2012, Article 21, because the work was habitually performed in the Netherlands. The employer faces a damages award plus legal costs.

A second scenario involves a French company with a remote employee based in Poland. The employer treats the arrangement as a standard French employment contract. Polish labour law, however, mandates specific written contract terms, minimum wage compliance under the Polish Labour Code (Kodeks pracy), and mandatory social insurance registration with ZUS (Zakład Ubezpieczeń Społecznych). Failure to register creates joint liability for unpaid contributions.

To receive a checklist on applicable law compliance for cross-border employment in Europe, send a request to info@vlolawfirm.com.

Social security coordination in the EU is governed by Regulation (EC) No 883/2004 and its implementing Regulation (EC) No 987/2009. The fundamental principle is that an employee is subject to the social security legislation of only one member state at a time. This prevents double contributions but also means that the employer must correctly identify which state';s system applies.

The general rule under Article 11 of Regulation 883/2004 is that a person working in one member state is subject to that state';s legislation. For employees working in two or more member states simultaneously, Article 13 applies: if a substantial part of the activity - defined in practice as at least 25% of working time or remuneration - is performed in the state of residence, that state';s legislation applies. If the substantial part test is not met, the legislation of the employer';s registered seat applies.

The A1 certificate (previously E101) is the document that certifies which country';s social security legislation applies to a given worker. It is issued by the competent institution of the sending state and is binding on the receiving state';s authorities under Article 5 of Regulation 987/2009. Without a valid A1 certificate, the host state';s social security authority may demand contributions retroactively, sometimes covering several years.

A non-obvious risk arises with multi-state workers. A consultant employed by a German GmbH (Gesellschaft mit beschränkter Haftung) who works 30% of the time from home in Belgium and 70% at client sites across Europe presents a complex coordination problem. The 25% threshold for the state of residence is met, so Belgian social security applies. The German employer must register with the Belgian National Social Security Office (Office National de Sécurité Sociale / Rijksdienst voor Sociale Zekerheid) and pay Belgian contributions. Many employers discover this obligation only after a cross-border audit.

The A1 certificate mechanism also has temporal limits. For posted workers, Article 12 of Regulation 883/2004 allows the sending state';s legislation to continue for up to 24 months. Beyond that period, the host state';s legislation applies automatically. Employers who extend postings beyond 24 months without restructuring the arrangement face retroactive contribution demands in the host state.

For non-EU jurisdictions - Switzerland, Norway, Iceland and Liechtenstein - bilateral social security agreements replicate much of the EU coordination framework, but the specific rules differ. A Swiss employer posting an employee to France must comply with the EU-Switzerland Agreement on the Free Movement of Persons and the associated social security coordination protocol.

The cost of non-compliance is significant. Social security contributions in high-contribution states such as France (where employer contributions can reach 40-45% of gross salary) or Belgium represent a material financial exposure when assessed retroactively over two or three years. Penalties for late registration add to the burden.

The posted worker regime is a distinct legal framework that applies when an employer established in one EU member state temporarily sends an employee to work in another member state. Directive 96/71/EC, as substantially amended by Directive 2018/957/EC (the Enforcement Directive), defines the hard core of terms and conditions that must be applied to posted workers regardless of the law governing the employment contract.

Under Article 3 of the amended Directive, posted workers are entitled to the host state';s rules on: maximum work periods and minimum rest periods, minimum paid annual leave, remuneration including all mandatory components, health and safety conditions, and equal treatment protections. The 2018 amendment replaced the concept of minimum rates of pay with the broader concept of remuneration, meaning that all components of pay that are mandatory under the host state';s law or universally applicable collective agreements must be applied.

The long-term posting rule introduced by Directive 2018/957/EC is particularly significant for businesses running extended cross-border projects. After 12 months - extendable to 18 months on a reasoned notification - the posted worker is entitled to virtually all employment conditions of the host state, with the exception of rules on conclusion and termination of contracts and supplementary occupational pension schemes. This effectively converts a long-term posting into near-local employment.

Enforcement is the area where many businesses underestimate exposure. The Enforcement Directive 2014/67/EU requires member states to impose effective, proportionate and dissuasive penalties. Several member states, including France, Germany and Austria, have implemented strict administrative cooperation and liability chains. In France, the principal contractor bears joint and several liability for a subcontractor';s failure to comply with posted worker obligations under Article L.1262-4-3 of the French Labour Code (Code du travail). In Germany, the Act on Mandatory Working Conditions for Posted and Locally Employed Workers (Arbeitnehmer-Entsendegesetz) imposes similar liability.

A practical scenario: a Spanish construction company wins a contract in Germany and posts 15 workers for 14 months. The company applies Spanish wage rates, which are below the German minimum wage set by the Minimum Wage Act (Mindestlohngesetz) and the applicable German sectoral collective agreement. German customs authorities (Finanzkontrolle Schwarzarbeit) conduct an audit. The Spanish company faces back-pay orders, administrative fines and potential exclusion from future public procurement in Germany.

The notification obligation is a procedural trap. Most EU member states require prior notification of a posting to the host state';s labour authority. In Germany, notification is made to the customs authority. In France, to the SIPSI online portal administered by the Ministry of Labour. Failure to notify triggers fines independent of whether the substantive employment conditions were correctly applied.

The employer of record (EOR) model has become a widely used solution for businesses that want to employ workers in a European jurisdiction without establishing a local legal entity. Under an EOR arrangement, a locally registered company formally employs the worker, handles payroll, social security registration and compliance with local labour law, and provides the services of that worker to the client company under a commercial services agreement.

The EOR model addresses several structural problems simultaneously. It eliminates the risk of creating a permanent establishment (PE) through an employed individual, ensures correct social security registration from day one, and provides a compliant local employment contract. For a startup expanding from the United States into Germany, France or the Netherlands, an EOR can compress the time to compliant employment from several months to a few weeks.

However, the EOR model carries its own legal risks that are frequently underappreciated. The most significant is the risk of reclassification. If the client company exercises direct control over the worker - setting working hours, assigning tasks, integrating the worker into the client';s organisational structure - labour authorities or courts in several jurisdictions may reclassify the arrangement as a direct employment relationship between the client and the worker. In the Netherlands, the Supreme Court (Hoge Raad) has developed a multi-factor test for determining whether a genuine employment relationship exists, focusing on authority, integration and economic dependency rather than contractual labels.

A second risk is that the EOR model does not eliminate all tax exposure. If the EOR worker';s activities create a fixed place of business or habitually conclude contracts on behalf of the client company, a permanent establishment may arise under Article 5 of the applicable OECD Model Tax Convention, triggering corporate income tax obligations in the host state.

The cost economics of the EOR model are relevant to the business decision. EOR providers typically charge a service fee of 10-20% on top of the total employment cost, or a flat monthly fee per employee. For a single employee earning EUR 80,000 per year in Germany, total employment costs including employer social contributions reach approximately EUR 95,000-100,000. An EOR fee adds EUR 10,000-20,000 annually. Against the cost of establishing a German GmbH (minimum share capital EUR 25,000, notarial and registration costs, ongoing accounting and compliance), the EOR model is economically rational for up to three to five employees and a planning horizon of one to two years.

To receive a checklist on evaluating the employer of record model for European cross-border employment, send a request to info@vlolawfirm.com.

Tax is the dimension of cross-border employment in Europe that generates the largest financial exposure and the longest tail of liability. Three distinct tax risks arise: personal income tax obligations for the employee, permanent establishment risk for the employer, and withholding tax obligations on employment income.

Personal income tax residency in Europe is determined by domestic law, not EU law. Most European jurisdictions apply a combination of physical presence tests (typically 183 days in a calendar year or tax year) and qualitative tests based on habitual abode, centre of vital interests or domicile. An employee who spends more than 183 days in France in a calendar year becomes a French tax resident under Article 4B of the French General Tax Code (Code général des impôts) and is subject to French income tax on worldwide income. The employer must operate French payroll withholding (prélèvement à la source) from that point.

The 183-day rule is widely known but frequently misapplied. Many employers count only working days, excluding weekends and holidays. French, German and several other jurisdictions count all days of physical presence, including transit days. An employee who commutes weekly from Brussels to Paris, spending Monday through Friday in France, can accumulate 183 days well before the calendar year ends.

Permanent establishment risk is the corporate tax dimension. Under Article 5 of the OECD Model Tax Convention, a PE arises when a company has a fixed place of business in another jurisdiction through which it carries on its business, or when an agent habitually concludes contracts on behalf of the company in that jurisdiction. A senior employee working from home in the Netherlands on behalf of a UK company, with authority to negotiate and conclude contracts, creates a strong argument for a Dutch PE. The Dutch Tax and Customs Administration (Belastingdienst) has increased scrutiny of home office PE situations following the expansion of remote work.

The consequences of an unrecognised PE are severe. The host state';s tax authority can assess corporate income tax on profits attributable to the PE, going back several years depending on the applicable statute of limitations. In Germany, the statute of limitations for tax assessments is four years under the German Fiscal Code (Abgabenordnung), extendable to ten years in cases of tax evasion. Interest on unpaid tax accrues at 1.8% per year under current German rules.

Withholding tax on employment income creates a compliance obligation for the employer even where the employee handles their own tax filing. If an employer is deemed to have a PE or is treated as the economic employer under the host state';s rules, it must register as an employer for payroll tax purposes and withhold income tax at source. Failure to withhold creates joint liability for the employer in most EU jurisdictions.

A practical scenario involving a mid-sized Swiss technology company illustrates the compounding risk. The company employs a sales director who lives in Austria and works primarily from Vienna, visiting clients across Germany and Switzerland. The company has no Austrian entity. After two years, the Austrian tax authority (Finanzamt) determines that the sales director constitutes a PE in Austria, that Austrian payroll tax should have been withheld, and that corporate income tax is due on profits attributable to Austrian sales activities. The assessment covers two years of back taxes, interest and penalties. The total exposure runs into six figures in EUR.

The solution in this scenario was not obvious at the outset. The company should have either established an Austrian branch (Zweigniederlassung), used an EOR to employ the sales director locally, or restructured the sales director';s authority to avoid PE-triggering activities. Each option has different cost and operational implications, and the choice depends on the volume of Austrian business, the planned duration of the arrangement and the company';s appetite for administrative complexity.

Managing cross-border employment risk in Europe requires a structured approach that addresses the applicable law, social security, posted worker and tax dimensions simultaneously. A piecemeal approach - fixing one dimension while ignoring others - typically generates new exposure in the areas left unaddressed.

The first step is a jurisdiction mapping exercise. For each employee working across borders, the employer must identify: the state of habitual work for labour law purposes, the state of social security affiliation under Regulation 883/2004, the state of tax residency for the employee, and whether the employer has or risks creating a PE in any host state. This mapping should be refreshed whenever an employee';s work pattern changes materially.

The second step is selecting the appropriate employment structure. The main options are: direct employment under the host state';s law with a local entity, an EOR arrangement, a posting under the Directive 2018/957/EC framework with an A1 certificate, or a genuine independent contractor arrangement where the legal and factual conditions for self-employment are met. Each structure has different cost, control and compliance implications.

A common mistake is treating the independent contractor structure as a low-cost alternative to employment. Most European jurisdictions apply substance-over-form tests to contractor arrangements. In Spain, the concept of falso autónomo (false self-employed) triggers reclassification with retroactive social security contributions and labour law protections. In Germany, the Scheinselbstständigkeit (bogus self-employment) doctrine leads to similar outcomes. The risk of reclassification is highest where the contractor works exclusively or predominantly for one client, integrates into the client';s operations and has no independent business infrastructure.

The third step is documentation and ongoing compliance. This includes: obtaining A1 certificates before postings begin, filing host state posting notifications within the required timeframes (typically before the first day of work), maintaining compliant employment contracts in the applicable language, and running payroll through the correct jurisdiction';s system. Many businesses underappreciate the importance of contemporaneous documentation. In a cross-border audit, the employer must demonstrate compliance at the time of the arrangement, not reconstruct it retrospectively.

Cost of non-specialist mistakes in this area is substantial. A retroactive social security assessment covering two years of contributions in France or Belgium, combined with penalties and interest, can easily reach EUR 50,000-150,000 per employee. Legal fees to defend against such assessments add further costs. Against this, the cost of upfront legal structuring - typically in the low to mid thousands of EUR per arrangement - represents a rational investment.

The business economics of compliance also depend on the value of the underlying commercial relationship. For a EUR 500,000 annual services contract delivered by cross-border employees, the cost of compliant employment structuring is a small fraction of the contract value. For a EUR 50,000 arrangement, the compliance cost-benefit calculation is tighter, and simpler structures such as EOR or a genuine contractor arrangement may be more appropriate.

To receive a checklist on cross-border employment compliance for European jurisdictions, send a request to info@vlolawfirm.com.

What is the biggest practical risk when employing someone across European borders without a local entity?

The biggest practical risk is the combination of unregistered social security obligations and unrecognised permanent establishment exposure. Social security authorities in France, Belgium and Germany actively audit cross-border arrangements and can assess contributions retroactively over two to three years. At the same time, an employee with authority to conclude contracts on behalf of a foreign company can trigger corporate income tax obligations in the host state. Both risks operate independently, meaning a company can face simultaneous assessments from two different authorities in the same host state. Early legal structuring is the only reliable way to prevent this combination.

How long does it take to establish compliant cross-border employment in a new European jurisdiction, and what does it cost?

The timeline depends on the chosen structure. Establishing a local subsidiary - a GmbH in Germany, a BV in the Netherlands, a SAS in France - typically takes four to eight weeks from instruction to registration, with notarial and registration costs in the low thousands of EUR plus ongoing accounting and compliance costs. An EOR arrangement can be operational in one to three weeks, with service fees adding 10-20% to total employment costs. Obtaining an A1 certificate for a posting takes two to six weeks depending on the issuing authority. The cost of delay is often higher than the cost of the structure itself: an unregistered employee generating PE risk from day one creates liability that accrues daily.

When should a business replace a posting arrangement with a local employment structure?

A posting arrangement under Directive 2018/957/EC is appropriate for temporary assignments with a defined end date, typically up to 12 months. Beyond 12 months, the long-term posting rules apply and the worker acquires near-local employment rights. Beyond 24 months, the A1 certificate for social security purposes expires and the host state';s social security legislation applies. If the business activity in the host state is ongoing rather than project-specific, a local employment structure - whether through a subsidiary, branch or EOR - is more appropriate from both a legal and operational perspective. The transition from posting to local employment should be planned in advance to avoid a gap in social security coverage or a period of non-compliant employment.

Cross-border employment in Europe sits at the intersection of labour law, social security coordination and tax, and none of these dimensions can be managed in isolation. The applicable law framework under Rome I, the coordination rules of Regulation 883/2004, the posted worker obligations of Directive 2018/957/EC and the PE rules of bilateral tax treaties all apply simultaneously. Businesses that address only one dimension while ignoring the others consistently generate the largest exposures. A structured, jurisdiction-specific approach - starting with a mapping exercise and selecting the right employment vehicle - is the only reliable way to manage the risk.

Our law firm VLO Law Firms has experience supporting clients across European jurisdictions on cross-border employment matters. We can assist with jurisdiction mapping, employment structure selection, A1 certificate procedures, posted worker compliance, EOR evaluation and tax residency analysis. To receive a consultation, contact: info@vlolawfirm.com.