An employer of record does not automatically shield you from permanent establishment risk. It reduces the odds, but the actual exposure depends on what your international hire does day to day, not who signs their contract. If a remote employee is closing deals, managing a P&L, or has been in a country for over six months doing core revenue work, you can have PE exposure with an EOR fully in place.
Most founders sign an EOR contract, get a certificate of employment, and mentally file the compliance question as closed. That's the gap this article covers: the specific, observable signs that your arrangement is quietly building tax exposure your EOR contract does not cover.
What permanent establishment risk actually means for a startup with an EOR
Permanent establishment (PE) is a tax concept, not an employment concept. A country's tax authority can decide your company has a taxable presence there because of what an employee does, regardless of whether that employee is on your payroll or an EOR's payroll.
An EOR solves the employment law problem: local contracts, statutory benefits, correct payroll withholding, termination rules. It does not automatically solve the tax problem. Tax authorities look at substance: is this person generating revenue, negotiating contracts, or representing the company locally in a way that looks like a fixed place of business.
EOR marketing pages lead with "PE protection" as a headline benefit, and it's real, because a clean employment structure removes some PE triggers. But it doesn't remove the ones tied to the employee's actual role and authority. A backend engineer in Lisbon carries very different PE exposure than a country manager in Lisbon closing enterprise deals, even under the same EOR.
The mistake founders make: treating the EOR as a legal force field
Founders ask their EOR vendor "are we compliant" and get reassured, but the vendor's compliance scope is employment law in that country. It rarely extends to a tax opinion on your specific business activity there.
PE exposure builds quietly. There's no single moment where you cross a line and get an alert. A tax authority typically only surfaces it during an audit, due diligence before a fundraise or acquisition, or a complaint from a competitor or ex-employee. By then the exposure may cover multiple tax years, with back taxes, penalties, and interest running into six figures for what started as one engineering hire.
5 warning signs your EOR isn't protecting you from permanent establishment risk
These are not legal conclusions. They are the practical leading indicators worth checking against your actual team, because the real failure only becomes visible in an audit, long after it would have been cheap to fix.
- Your EOR employee can sign contracts or bind the company. If a country manager, sales lead, or business development hire employed through an EOR has authority to negotiate terms or sign on the company's behalf, tax authorities can treat them as a "dependent agent," a classic PE trigger regardless of who processes their payroll.
- The role is revenue-generating, not support. Engineering, support, and back-office roles carry lower PE risk than sales, business development, or country-lead roles. If your EOR hire's core function is closing deals or managing local client relationships, the EOR's protection is weaker than the contract implies.
- The employee has been in the country for over six months doing consistent, substantive work. Many tax treaties use duration as a factor. A short-term contractor engagement reads differently to a tax authority than a permanent, ongoing role performing the same function your headquarters performs.
- Nobody has looked at your specific fact pattern with a local tax advisor. If your only compliance conversation has been with your EOR's sales or support team, you have employment law coverage and no tax opinion. A 30-minute call with a local tax advisor once you have 2 or more hires in a country is cheap insurance against a six-figure retroactive assessment.
- You are treating the EOR relationship the same for every country and every role. PE rules vary meaningfully by jurisdiction and by tax treaty. An arrangement that is low-risk in Ireland can be higher-risk in a country without a favorable treaty with the US. Applying one mental model to every hire is how exposure gets missed.
What this looks like in practice
A 12-person seed-stage SaaS company hired its first EU engineer through an EOR: backend role, no client contact, correctly low risk. Eighteen months later, a second hire in the same country became country lead, closing local deals and representing the company externally. The EOR paperwork didn't change. The risk profile did.
They found this during Series A due diligence, when the investor's counsel flagged the country-lead role as a PE trigger and asked for a tax opinion before closing. It delayed the round three weeks and cost a five-figure legal bill, a cost that would have been near zero if flagged before the hire instead of during diligence.
The lesson: role authority and revenue function, not payroll structure, are what should trigger a compliance review, and that review needs to happen before the hire.
What to do in the next 30 days
List every international hire made through an EOR and flag the ones with contract-signing authority or revenue-generating responsibility and more than six months of tenure. For those, get a 30-minute call with a local tax advisor in that country. This isn't a full audit, it's a targeted check on your highest-exposure roles, and it's the cheapest way to convert an unknown liability into a known one.
If you're planning a country-lead or sales hire in a new market, have that tax conversation before the offer goes out, not after.
Frequently asked questions
Does an employer of record eliminate permanent establishment risk?
No. An EOR reduces some PE triggers by handling local employment and payroll, but it doesn't eliminate exposure tied to what the employee actually does, especially contract-signing authority or revenue-generating work.
What is the biggest permanent establishment trigger for early-stage startups?
Employees with authority to negotiate or sign contracts on the company's behalf, sometimes called dependent agents, whether they're on your direct payroll or an EOR's.
How long can someone work in a country before permanent establishment risk increases?
Many tax treaties use six months as a rough threshold, though it varies by country. Duration alone doesn't create PE, but sustained, substantive work over that period raises the odds a tax authority looks closely.
Should every international hire get a tax review?
No. Support and engineering roles with no client-facing authority carry low PE risk in most cases. Reserve a formal review for revenue-generating or client-facing roles and hires approaching six months in a country.
Can my EOR provider give me a tax opinion?
Generally no. Most EOR vendors are scoped to employment law compliance, not a tax opinion on your specific business activity in that country. That requires a local tax advisor familiar with the relevant treaty.
Permanent establishment risk is not a reason to avoid international hiring. It's a reason to know exactly which roles carry it, before it shows up in a data room.