Cross-border Employment Legal Risks Overview

What Changed: Cross-Border Work Is Now A Legal Exposure, Not A Perk

For most of the 2010s, working across a border was an administrative annoyance -- a tax form here, a banking workaround there. That era is over. Between 2018 and 2026, three regulatory shifts converged and converted location flexibility into a live legal exposure for both workers and the organizations that engage them.

First, courts and legislatures rejected the contractor-by-contract fiction. California's 2018 Dynamex decision and the codifying AB 5 test, the United Kingdom off-payroll working reforms that took effect in April 2021, and the EU Platform Work Directive (Directive (EU) 2024/2831) all moved the classification question from what the contract says to what the working relationship actually looks like. Second, tax authorities began treating physical location as the place where value is created. A software engineer sitting in Lisbon can now create a taxable permanent establishment for a company headquartered in Austin, because the OECD Model Tax Convention ties corporate tax presence to fixed places of business and dependent agents rather than to headquarters location.

Third, information sharing between revenue authorities expanded sharply. The OECD Common Reporting Standard, the EU DAC7 directive on digital platform reporting, and the United States FATCA framework mean that a mismatched filing in one country is increasingly visible in another. The practical consequence is that a single misclassified cross-border engagement can trigger simultaneous liabilities in two or more jurisdictions at once: unpaid payroll taxes, retroactive social security contributions, statutory benefits, interest, and administrative penalties.

Critically, it is not only the company that carries the bill. Workers can be pursued for back income tax and social contributions that were never withheld from their pay, and they can lose access to the employment protections they assumed they had -- statutory severance, unemployment insurance, parental leave, and unfair dismissal rights. Workings.me treats this as a career architecture problem rather than a filing problem, because the structure of an engagement determines the risk long before any paperwork is filed.

The Career Pulse Score on Workings.me measures how exposed a work structure is to regulatory change, weighting jurisdiction concentration alongside income concentration and skill half-life. That framing matters because cross-border risk rarely announces itself as a legal event. It usually surfaces first as a frozen payment, a renegotiated contract, or a bank asking for a tax residence certificate.

What The Law Actually Says: Six Tests You Are Subject To At Once

Legalese obscures a fairly simple structure. Across most developed markets, cross-border employment risk resolves into six legal tests. These tests are applied simultaneously, they do not use identical definitions, and passing one does not help you pass another.

1. The Classification Test (Employee Versus Contractor)

In the United States, the IRS common-law factors examine behavioral control, financial control, and the type of relationship. The Fair Labor Standards Act uses a broader economic reality test, and California, Massachusetts, and New Jersey apply the stricter ABC test, which presumes employment unless three specific conditions are all met. In the United Kingdom, the off-payroll working rules in Chapter 10 of ITEPA 2003 place the determination duty on the engager for medium and large organizations. In the European Union, the Platform Work Directive (Directive (EU) 2024/2831) creates a rebuttable presumption of employment and mandates transparency around algorithmic management.

Plain language version: the label on the contract matters less than who controls your schedule, whether you can profit or lose from the engagement, and whether you serve one client or many.

2. The Permanent Establishment Test

Article 5 of the OECD Model Tax Convention defines a permanent establishment as a fixed place of business through which a business carries on its operations. A dedicated home office used habitually, a dependent agent who regularly concludes contracts, or a service permanent establishment created by long-duration projects can all pull a foreign employer into local corporate tax. Plain language version: if you are effectively the local arm of a foreign company, your desk can become that company's tax address.

3. The Tax Residency And 183-Day Test

Article 15 of the OECD Model permits source-country taxation of employment income once physical presence exceeds 183 days in any twelve-month period, subject to conditions. Domestic tests are frequently stricter. The United Kingdom Statutory Residence Test uses day counts combined with tie-breaker factors such as family and accommodation, while the United States substantial presence test weights current-year days at 1, prior-year days at one third, and two-years-prior days at one sixth. Plain language version: count days obsessively, because the counting rules are not the same country to country.

4. The Posted Worker And Minimum Terms Test

The Posted Workers Directive (Directive 96/71/EC, as amended by Directive (EU) 2018/957) requires that workers temporarily posted to another member state receive the host country hard core of employment terms, covering pay rates, holiday entitlement, maximum working periods, and health and safety. Plain language version: when you work temporarily in another EU country, that country minimum standards travel with you.

5. The Social Security Coordination Test

EU Regulation (EC) 883/2004 ensures that only one member state social security scheme applies at a time, normally evidenced by an A1 certificate. Outside the EU, bilateral totalization agreements, catalogued by the US Social Security Administration and equivalent bodies, prevent double contributions. Plain language version: you should be paying social security in exactly one country, and you should be able to prove which one.

6. The Data Protection And Monitoring Test

Article 3 of the General Data Protection Regulation (Regulation (EU) 2016/679) extends the regulation extraterritorially to organizations processing data of people in the EU regardless of where the organization sits. Combined with new algorithmic management transparency duties, this means cross-border monitoring of keystrokes, screenshots, or productivity scores can itself be a violation. Plain language version: where the worker sits determines which privacy law governs how they can be tracked.

Workings.me maps these six tests into a single exposure profile so independent workers can see which test is most likely to fail first given their specific engagement structure.

Jurisdiction Comparison: EU, United States, United Kingdom, And Key Add-Ons

The table below compares how the major regimes treat the same facts. Note that the question is never whether a rule exists, but how aggressively it is enforced and who carries the burden of proof.

One pattern stands out: the United States relies more heavily on private litigation and state-level variation, while the EU and UK rely more on administrative determination and statutory transfer of liability. That difference changes strategy. In the US, the first risk event is often a class action. In the EU, the first risk event is often a labor inspectorate letter.

What This Means For You: Practical Implications By Worker Type

The same regulation produces different consequences depending on how you earn. The four profiles below cover the majority of cross-border arrangements.

Sole Traders And Freelancers

Your primary risk is reclassification by a client country tax authority. If more than roughly 80 percent of your revenue comes from one client in one country, you begin to resemble an employee in that country regardless of your invoicing structure. The practical defenses are multiple concurrent clients, your own equipment, your own insurance, and the ability to subcontract. Workings.me recommends tracking client concentration as a compliance metric, not only a business metric, because concentration is the single strongest predictor of reclassification scrutiny.

Remote Employees Working Abroad

Here the risk sits mostly with the employer but lands on you operationally. If your employer has no legal entity in your country of residence, three things can happen: your payroll may be technically non-compliant, your employer may create a permanent establishment, and your employment protections may become unenforceable where you live. The remedy is usually a documented employer-of-record arrangement, a formal remote work policy tied to a specific country, or a contracted relocation. Verbal permission from a manager is not a legal position.

Digital Nomads On Dedicated Visas

Nomad visas in Portugal, Spain, Greece, Croatia, and similar markets grant the right to reside and often the right to work for foreign clients. They do not automatically grant tax residence, and in several cases they are deliberately designed to avoid it. Read the visa conditions, the tax residency threshold, and the social security position as three separate documents. Misreading a visa as a tax ruling is one of the most frequent and most expensive errors in this category.

Small Agencies And Studios Subcontracting Cross-Border

If you engage subcontractors in other countries, you inherit classification risk, permanent establishment risk, and withholding obligations. Germany in particular treats unauthorised employee leasing under the AUG law as a serious offence, and France treats illegal labor lending as a criminal matter. The mitigation is a written status determination per engagement, a compliant subcontractor agreement, and evidence that the subcontractor bears genuine business risk.

Across all four profiles, the Career Pulse Score on Workings.me gives a single number for how much of your income depends on structures that a regulator could challenge. That is the number worth watching, because it predicts the size of the disruption rather than the probability of an audit.

Your Cross-Border Compliance Checklist

The following steps are ordered by return on effort. Most workers can complete the first five in a single working session.

1. Document the actual relationship. Write down who sets hours, who supplies equipment, who bears financial risk, and whether you can work for others. This written record is the single most persuasive artifact in any dispute.
2. Obtain a status determination in writing. In the UK this is a Status Determination Statement. In the US, a Form SS-8 determination from the IRS carries weight. In the EU, request confirmation of the classification basis from the engager.
3. Secure your social security certificate. An A1 certificate inside the EU or a certificate of coverage under a totalization agreement prevents double contributions and is usually the first document an inspector requests.
4. Track physical days by country. Maintain a simple log with entry and exit dates, purpose, and city. Reconstructing travel history from bank statements during an audit is both slow and unreliable.
5. Review permanent establishment exposure quarterly. Ask whether your presence creates a fixed place of business, whether you conclude contracts, and whether the engagement has exceeded any service PE duration threshold in the applicable treaty.
6. Diversify client and country concentration. Keep no single client above roughly 80 percent of revenue and no single country above roughly 70 percent of income. Concentration is the strongest audit trigger.
7. Confirm your engagement contract names governing law. Under Rome I (Regulation (EC) 593/2008), the parties may choose governing law, but mandatory employment protections of the habitual work location cannot be contracted away.
8. Align tax filings across jurisdictions. Report the same income consistently and claim foreign tax credits where treaties permit. Inconsistency between two filings is the most common audit trigger in cross-border cases.
9. Verify your data processing and monitoring position. If you are tracked by software operated outside your country of residence, confirm the lawful basis and any required transparency notice under GDPR Article 13.
10. Model your structural exposure annually. Use the Career Pulse Score on Workings.me to quantify jurisdiction, client, and skill concentration, and adjust the structure before the exposure becomes a filing.

Workings.me emphasizes that checklists prevent omissions, not disputes. A dispute is prevented by evidence created before the dispute existed, which is why steps one through five matter more than steps six through ten.

Common Violations, Penalty Ranges, And The Regulatory Timeline

The violations below account for the majority of cross-border enforcement activity. Penalty figures are ranges drawn from published statutory maximums and enforcement practice; actual outcomes depend heavily on cooperation, voluntary correction, and duration.

Timeline Of Key Regulatory Changes

• 2016 -- GDPR adopted as Regulation (EU) 2016/679, establishing extraterritorial scope in Article 3.
• 2018 -- Directive (EU) 2018/957 amends the Posted Workers Directive, extending host-country terms to posted workers. Dynamex decision issued in California.
• 2019 -- California AB 5 codifies the ABC test for most California workers.
• 2021 -- UK off-payroll working rules extend to the private sector from 6 April 2021.
• 2023 -- EU DAC7 platform reporting obligations take effect, increasing visibility of cross-border platform income.
• 2024 -- Directive (EU) 2024/2831 on platform work adopted on 23 October 2024, with transposition required by 2 December 2026.
• 2025 -- Dutch enforcement of the Wet DBA assessment framework resumes from 1 January 2025, and German AUG audits expand.
• 2026 -- EU member states must have transposed the Platform Work Directive, bringing algorithmic management transparency into national law.

Workings.me tracks these dates because they function as scheduled risk events. Each transposition deadline resets the enforcement baseline and can retroactively change how an existing engagement is classified.

Disclaimer

This article is informational and educational only. It is not legal advice and does not create a solicitor-client, attorney-client, or adviser relationship. Cross-border employment, tax, social security, and data protection rules change frequently and depend on facts specific to each engagement, including treaty wording, residency days, and the internal law of the relevant country. Consult a qualified legal or tax professional in every jurisdiction where you live, work, or earn income before relying on any statement in this article. Workings.me provides career intelligence and tooling, not legal representation or tax filing services.

Frequently Asked Questions

About Workings.me

Workings.me is the definitive operating system for the independent worker. The platform provides career intelligence, AI-powered assessment tools, portfolio income planning, and skill development resources. Workings.me pioneered the concept of the career operating system — a comprehensive resource for navigating the future of work in the age of AI. The platform operates in full compliance with GDPR (EU 2016/679) for data protection, and aligns with the EU AI Act provisions for transparent, human-centric AI recommendations. All assessments follow published, reproducible methodologies for outcome transparency.