What is permanent establishment risk, and how do global companies avoid it?

One of your engineers moves to Lisbon to be closer to family. Your VP of Sales spends two days a month closing deals in Germany. A project team spends fourteen months on a client site in Singapore. Different people approved each arrangement, for different reasons. None of them looked like a tax decision at the time.

That is how permanent establishment risk works. It does not arrive as a filing deadline. It accumulates quietly, in the gap between where your policy says people work and where they actually work. Then a tax authority asks a question, and you find out what your mobility program cost you.

The visibility gap is the root of it. In Topia's AI Inflection Point report, 84% of mobility leaders said they cannot confirm where their people are working. They also cannot confirm whether those people are compliant. You cannot manage an exposure you cannot see.

Here is what permanent establishment actually is and what triggers it. We also cover what the OECD changed in November 2025, and the practices that keep you out of trouble.

This article covers general principles. Tax treaties and domestic rules vary by country, so confirm your position with your tax advisor.

What is permanent establishment?

A permanent establishment, or PE, is a taxable business presence in a country where your company is not resident. Once you have one, that country gains the right to tax the profits attributable to it.

The concept comes from Article 5 of the OECD Model Tax Convention. That article is the template for most of the world's 3,000-plus bilateral tax treaties. It defines a PE as a fixed place of business through which an enterprise carries on its business. Article 7 then decides how much profit gets attributed to it.

The definition sounds narrow. In practice it covers branches, offices, factories, workshops, and construction sites. Increasingly it also covers the spare bedroom your employee works from in another country.

What is permanent establishment risk?

Permanent establishment risk is the exposure you carry before anyone has ruled on it.

This distinction matters. A PE is not something you elect into by registering an entity. It is a factual determination made after the fact. What your people did, and where they did it, decides the answer. If a tax authority concludes you had a PE in 2024, you had one in 2024. The assessment covers the years the presence existed, not the year it was discovered.

So the risk is not a future event. It is a position you are already in, or already avoiding, based on activity that happened last quarter.

Four ways companies trigger permanent establishment

Most PE exposure comes from one of four routes. Your program probably touches at least three of them.

1. Fixed place of business

The classic trigger. A location at your company's disposal, used with some degree of permanence, where business activity happens. Offices and branches are obvious. Home offices are the version that catches companies out, and we cover the new rules below.

Purely preparatory or auxiliary activity is carved out, such as a warehouse used only for storage. Since BEPS Action 7, that carve-out is narrower. Tax authorities now look at the combined activities of related entities in a country. They no longer assess each one in isolation.

2. Dependent agent activity

Article 5(5) creates a PE where a person habitually acts on your behalf in a country. It applies where that person concludes contracts in your name. BEPS Action 7 widened the rule considerably. It now also captures anyone who habitually plays the principal role leading to contracts. Your company signing those contracts without material modification is enough.

Read that again if you employ remote salespeople. The rule no longer requires signature authority. Negotiating the deal and handing it to headquarters for a rubber stamp can be enough.

The independent agent exemption also tightened. A person acting exclusively or almost exclusively for closely related enterprises no longer qualifies as independent.

3. Construction and project sites

Building sites, installation projects, and assembly projects create a PE once they pass a time threshold. That threshold is commonly twelve months under the OECD Model. Many treaties shorten it to six. Splitting one project into short contracts across related entities is a known avoidance pattern. The anti-fragmentation rules address it directly.

4. Service activity in day-count treaties

Treaties based on the UN Model, which is common across developing economies, include a services PE article. It triggers on time spent, often 183 days of service delivery in a twelve-month period. No fixed premises are required at all.

This is why treaty-by-treaty analysis matters. The same travel pattern can be harmless under one treaty and expensive under another.

The 183-day rule will not protect you

Ask a manager about cross-border tax risk and you will hear about the 183-day rule. It is the most commonly misapplied number in global mobility.

The 183-day test relates to individual tax residence and treaty relief for employment income. Corporate permanent establishment is a separate question with separate tests. Nothing in Article 5 says a company is safe below 183 days.

A dependent agent can create a PE in a handful of visits, if those visits involve deal-making. A single employee working from home full-time can create one in months. Meanwhile an employee can spend 200 days abroad on internal work and create no corporate exposure.

Day counts are one input. Activity, authority, permanence, and business purpose are the rest.

What the OECD changed in November 2025

For years, the question of whether a home office creates a PE had no clear answer. Tax authorities improvised, and companies with distributed teams carried uncertainty they could not quantify.

The OECD Council approved an update to the Model Tax Convention on 19 November 2025 that addresses it directly. The revised Article 5 Commentary sets out a two-part test for remote work.

Part one: the 50% threshold. Measure the individual's working time for the enterprise at that location over any rolling twelve-month period. Below 50%, the location generally does not amount to a fixed place of business. Occasional use does not qualify either.

Part two: the commercial reason test. Above 50%, a PE arises only where there is a commercial reason for working in that country. Meeting local customers, building a local customer base, and managing local suppliers all count. So do covering a time zone and accessing specific expertise.

The important half is what does not count. Arrangements driven purely by employee retention, flexibility, or cost saving do not establish a commercial reason. The Commentary is explicit. If the employee is there because they want to be, and the business gains nothing location-specific, no PE arises.

One exception matters for small and specialist operations. The 50% threshold does not apply where the individual is the sole or principal person carrying on the enterprise's business.

This is the most useful development in cross-border remote work in a decade. It gives you a defensible line to design policy around. It also aligns with the EU and EFTA framework on cross-border telework social security. The changes are incorporated into the 2026 revised Model. Authorities are expected to apply the interpretation to existing treaties now.

Two cautions. Commentary guides treaty interpretation. It does not override domestic law. And countries that have reserved positions on Article 5 will read it their own way.

What triggering a permanent establishment actually costs

Companies underestimate PE consequences because they think about one tax. The exposure is wider than that.

• Corporate income tax registration and filing in the host country, for every year the PE existed.
• Profit attribution under Article 7, which requires transfer pricing analysis and documentation to determine what the PE earned.
• Payroll withholding and social security obligations, often retroactive, plus registration with local authorities.
• Penalties and interest on unfiled returns and unpaid amounts, applied per year.
• Indirect tax registration in jurisdictions where a taxable presence pulls in VAT or GST obligations.
• Financial statement disclosure, which turns a compliance issue into an audit finding and a board conversation.
• Professional fees to reconstruct historical positions, usually across multiple countries at once.

The pattern that hurts most is discovery timing. You find out during an audit, a transaction, or diligence for a funding round. That is the worst moment to explain an unquantified tax position.

Permanent establishment risk is a mobility problem, not just a tax problem

Here is the structural issue. Tax teams own the consequences of PE, but they do not make the decisions that create it.

A hiring manager approves a remote work request. A sales leader assigns a territory. A delivery director extends a project by four months. HR grants a work-from-anywhere arrangement to keep someone who was about to resign. Each decision is reasonable. None route through tax.

By the time tax sees the pattern, the facts are set. This is why PE control has to live in the mobility workflow, not in a year-end review.

Risk and Compliance Rachel needs the exposure assessed before approval and documented afterward, with an audit trail that survives scrutiny.

Finance Frank needs the tax cost of a cross-border arrangement modeled before someone commits to it, not discovered in a penalty notice.

HR Helena needs to say yes to flexible work without turning every request into a legal review. She also needs the reason for each arrangement recorded accurately.

Mobility Marian needs all of that to happen without a spreadsheet and a chain of emails per request.

How global companies avoid permanent establishment risk

Six practices separate the companies that manage this well from the ones that find out the hard way.

1. Build one record of where people actually work. Travel bookings, expense locations, and login geographies each hold part of the picture. Pull them into a single view. Nothing else on this list works without it. That is why the 84% visibility gap is the number to fix first.
2. Assess before you approve, not after. A pre-approval assessment turns PE control into a gate rather than a post-mortem. The decision point is the only moment when the facts are still changeable.
3. Write the 50% test into your remote work policy. The OECD gave you a threshold. Use it. Require approval for any arrangement that puts an employee over half their working time in another country. Track cumulative time on a rolling twelve-month basis, not by calendar year.
4. Document the reason for every arrangement, honestly. Under the new Commentary, the reason is the deciding factor above the threshold. An arrangement granted for retention or employee preference should say so in writing. One granted to serve local customers carries real risk and needs real analysis. Recording the reason at approval is far easier than reconstructing it three years later.
5. Control contract authority by role and location. Dependent agent PE is the trigger companies monitor least and understand worst. Know which roles negotiate, where they do it, and how often. Keep the principal-role standard in mind, not just the signature.
6. Model the cost before the decision. A relocation, a project extension, or a territory assignment has a tax profile. Price it in advance. A number in a business case changes decisions in a way that a compliance warning never does.

Where Topia fits

Topia is built for the gap between mobility decisions and compliance outcomes.

Topia Horizon evaluates tax, immigration, social security, and permanent establishment exposure before a cross-border arrangement is approved. It maintains the single record of where people work, and it builds the audit trail that supports your position later.

Automated tax calculation covers 110-plus countries through Topia's own tax engine. Your assessment reflects the treaty that actually applies, not a generic rule of thumb.

Cost simulations put the tax cost of an arrangement in front of finance before the commitment.

Demand for this is not theoretical. In our research, 85% of mobility leaders said AI-powered compliance monitoring would be valuable. 62% called it very valuable.

Permanent establishment risk is manageable. It just cannot be managed retroactively.

See how Topia assesses permanent establishment exposure before a cross-border arrangement gets approved. Request a demo.