EOR Insurance and Liability Coverage Explained: What You’re Actually Protected Against

A CFO forwarded us a Slack thread last quarter. His head of legal had asked what sounded like a simple question: “Our EOR says they handle compliance. If a worker sues us, they’ll cover it, right?”

The honest answer took three paragraphs, because it genuinely depends on who’s suing, what they’re suing about, and what the MSA says. What sales conversations describe as “the EOR handles everything” turns into a much narrower picture once you read the certificates of insurance and the limitation-of-liability clause side by side.

This is a walk-through of what an EOR’s insurance stack actually covers, what it doesn’t, and where the contract quietly shifts risk back to the client. Written for people about to sign something, or people who signed something a while ago and now want to understand what they’re holding.

What “the EOR handles compliance” actually means

Handling compliance is an operational commitment. Your EOR pays wages correctly, files taxes, maintains employment relationships in accordance with local labor laws, and files anything the regulator requests. When they do the job well, you don’t notice. That’s the point of the arrangement.

Insurance and indemnity are separate machinery from all that. Insurance is what pays if something goes wrong that a specific policy covers. Indemnity is a contractual promise that one party will make the other whole for specific categories of loss. They interact, but they aren’t the same thing, and neither one is automatically triggered by the phrase “handles compliance” in a sales deck.

Working with an EOR partner that will show you the actual certificates before you sign is the first sanity check. Vendors who describe their coverage in vague marketing language usually have thinner coverage than they let on.

The four insurance policies a real EOR should carry

There are four policies in the standard EOR insurance stack. If any of them aren’t in place at your vendor, that’s something to know before you sign anything.

Employer’s Liability Insurance (EL)

Covers employee claims for industrial injury or occupational disease where statutory social insurance does not fully cover the cost. Every jurisdiction has some sort of state-run injury system; EL sits on top of it.

The Social Protection Fund handles the majority of on-the-job injury claims in Belarus, thanks to mandated social accident insurance. EL becomes significant when a claim exceeds the statutory limits or when the injury falls into a gray area that the state plan does not fully address. Limits for EORs operating in Belarus are normally in the low seven figures per occurrence, while the range varies depending on insurer and EOR claims history.

The claim scenario that shows up most in practice: a remote developer with a repetitive strain injury who argues the ergonomic setup was inadequate. The state scheme covers medical costs. EL responds to the additional damages if any are awarded.

General Liability (GL) / Public Liability

Covers third-party bodily injury or property damage caused by the EOR’s own operations. For a services business this is largely boilerplate — an EOR isn’t running machinery on your property or receiving customers in an office where someone might slip on a wet floor.

It’s in the stack anyway because enterprise procurement teams often require a GL certificate on file before they’ll approve a vendor. Standard limits are usually in the $1-2M per occurrence range. Rarely relevant to what a software client is actually worried about, but the certificate needs to exist.

Professional Indemnity (PI) / Errors & Omissions (E&O)

PI is the policy most buyers care about once they’ve been through an actual claim. It covers claims arising from mistakes the EOR makes in performing its professional services. v

Limits vary widely. Some carriers write $1-2M, better carriers write $5-10M, and specialist EOR programs sometimes go higher. It’s worth asking your vendor what they carry and pushing back if it seems low relative to the number of employees they’re running for you.

Cyber Liability

Not universal in EOR stacks yet, but increasingly common. It’s worth pushing on if your vendor doesn’t have it.

EORs hold employee personal data — salary information, tax IDs, direct deposit details, sometimes health information. Any incident compromising this data creates notification obligations. Sometimes regulatory fines. Sometimes third-party claims from affected employees.

Belarus has a real personal data protection framework with actual enforcement behind it, so this isn’t a theoretical concern. Cyber policies usually cover incident response costs and notification expenses. Regulatory defense and third-party claims are sometimes covered, sometimes carved out separately — read the specifics. Limits are typically smaller than PI limits, but the coverage triggers a lot more often than most buyers expect.

The five things EOR insurance almost never covers

This is the section that will save you an argument with your legal team six months into an incident.

Your instructions to the EOR that turn out to be illegal

If you told your EOR to terminate someone for a reason that violates Belarus labor law and they carried out the instruction, the resulting claim is usually excluded from PI coverage. The contract also typically shifts the exposure back to the client through the indemnity clause. Which makes sense — if you were the source of the mistake, insurance isn’t going to rescue you from your own decision.

Discrimination or harassment claims tracing to your management

The EOR is the employer on paper, but you’re the one directing the work. You run the meetings. You decide on promotions and raises and who gets let go. Discrimination claims follow the decision-maker, and the EOR’s PI policy is not going to cover management conduct that isn’t theirs. A good HR consulting arrangement will help you avoid the underlying decisions that create this exposure, but the coverage question stays separate.

IP disputes between you and your workers

Your developer claims they own code they wrote for you. That’s a commercial dispute between your company and the developer. Your EOR wasn’t part of it, and their coverage doesn’t reach it.

Regulatory fines against your company

If your company gets fined for something — export control, sanctions exposure, tax positions taken by your own entity — the EOR’s insurance isn’t going to respond. Those are your regulatory exposures. They stay with your company.

Business interruption and lost revenue on your side

If an improper termination costs you an enterprise customer, you have lost real money. But that loss doesn’t come back through the EOR’s insurance. Coverage responds to direct damages. Consequential losses like this one sit outside the policy and usually outside the contractual cap as well.

Where the contract does most of the actual work

Insurance is only half the picture. The MSA is where risk allocation actually gets settled, and most of the fights that come up in an EOR relationship end up being about contract clauses more than about what any specific policy did or didn’t do.

Four contract mechanics matter more than the certificate of insurance:

• Indemnity flows in both directions. The EOR indemnifies you for certain things — usually errors in statutory filings, mispaid payroll, breach of confidentiality. You indemnify them for the reverse: your instructions that create liability, your management conduct, your data.
• Limitation of liability caps. Standard EOR contracts often cap total liability at 12 months of fees. For a five-person team on a $50k annual service contract, that’s a $50k ceiling on the vendor’s total exposure to you. This clause needs a careful read — what it caps, and what (if anything) it excludes from the cap.
• Exclusions of consequential and indirect damages. Lost profits, reputational harm, business interruption — usually outside the cap and outside the coverage. Standard commercial contract language, but the practical effect is that whole categories of loss are simply not recoverable through the vendor.
• Insurance maintenance obligations. What is the EOR required to keep in force, and what happens if they let a policy lapse? Some contracts say “commercially reasonable” insurance, which is not the same as specifying the four policies at specific limits.

If the limitation-of-liability cap is small and the indemnity carve-outs are narrow, you have less protection than a certificate of insurance alone might suggest. Our vendor due diligence checklist covers what to look for in each of these clauses and what a straight answer looks like.

What to actually ask before signing

The practical items to work through with any EOR vendor, roughly in the order of importance:

• Certificates of insurance for all four policies, dated within the last 60 days.
• The specific policy limits — not marketing “up to” numbers.
• The insurer’s rating. An A-rated carrier at $2M is worth more than an unrated carrier at $10M. Better to have less coverage from a solvent insurer than a big number from one that might not pay.
• Territorial scope. A policy that reads “worldwide” is different from one that specifies Belarus or Eastern Europe. If you’re employing across multiple markets, this determines whether you’re covered where you actually operate.
• Whether each policy is claims-made or occurrence basis. Claims-made responds to claims filed while the policy is active; occurrence responds to events that happened while the policy was active. Matters most when the vendor relationship ends and a claim shows up afterwards.
• Sub-limits inside each policy. PI often has retroactive dates and specific sub-limits for regulatory defense. Cyber usually has separate sub-limits for notification, forensics, and third-party claims.
• The limitation-of-liability cap — and whether it carves out indemnified claims, gross negligence, and willful misconduct (it should).
• Who the EOR’s insurance broker is. Vendors with a specialist broker who understands EOR risk usually run a tighter program than vendors whose insurance came from a general small-business quote.

Comparing responses across two or three vendors on these items will tell you more about the quality of the operation than most other diligence steps.

How Belarus specifics change the picture

Two Belarus-specific mechanics affect how EOR coverage plays out in practice.

First, the mandatory state social insurance system covers much of what EL would normally manage. The Ministry of Labour publishes current statutory contribution rates and coverage breadth, and clients are frequently startled by how much of their injury and illness risk the state program currently manages. EL is less important in Belarus than in other markets, yet it is still significant.

Second, Belarusian labor law has specific rules around termination, severance, and mandated benefits that draw PI coverage into play quickly. If your EOR miscalculates statutory severance, misses a required social contribution, or gets the notice period wrong, that’s usually a PI claim. The same Belarus mechanics that surprise foreign employers on sick leave also drive the specific claims that PI insurance actually responds to.

Working with a provider who understands the Belarusian rules from beginning to end is the first line of protection here. Even if your coverage responds properly, avoiding a claim is significantly less expensive than filing one.

FAQ

Does an EOR’s insurance cover me if my employee sues my company for discrimination?

Usually no, at least not through the EOR’s PI policy. Discrimination and harassment claims typically follow the decision-maker, which is usually the client company rather than the EOR. You should carry your own Employment Practices Liability (EPL) coverage for this exposure. The SHRM overview of EPL coverage has a good general explanation of what these policies do and where the coverage lines usually sit.

What’s the difference between the EOR indemnifying us and their insurance covering us?

Indemnity is a contract promise; insurance is what actually funds the promise if it gets called on. They can exist independently, and that’s the problem — an EOR can indemnify you for something and still be unable to pay because their insurance doesn’t respond or the loss exceeds their policy limits. What you want in the MSA is both: contractual indemnity backed by insurance that actually covers the same categories. Without both, the promise is only worth what the vendor’s balance sheet is worth on the day the claim comes in.

If the EOR makes a payroll mistake and we owe back taxes, who pays?

The taxes themselves are your company’s obligation because the earnings were paid to your employee. What the EOR’s PI covers is the additional damages that resulted from their error — penalties, interest, defense costs. Your payroll service scope defines what the EOR is responsible for. Read it carefully; scope language decides who is at fault before insurance ever enters the picture.

Does the EOR cover cybersecurity incidents involving our employee data?

If they have cyber liability coverage, yes — to the extent of that policy. Notification costs, incident response, and third-party claims are the typical response areas. You should still carry your own cyber policy though. The EOR’s coverage responds when the incident traces back to their systems and processes; anything on your side stays on your own policy.

What’s a typical limitation-of-liability cap in an EOR contract?

Twelve months of fees is standard. Sometimes 24. Some vendors will negotiate uncapped indemnification for specific categories like data breach and gross negligence — worth asking. The cap is often a bigger practical constraint on your recovery than any of the insurance limits.

Do we still need our own employment practices liability insurance?

For most companies employing through an EOR, yes. EPLI covers your management decisions, and the ILO framework on employer obligations makes clear that direction of work drives a lot of the legal exposure regardless of who’s on the payroll paperwork. If you’re managing the team, you’re carrying the management-side risk. The EOR’s coverage doesn’t reach it.

What happens to coverage if we terminate the EOR relationship?

Depends on whether the policies are claims-made or occurrence basis. Claims-made policies only respond to claims reported while the policy is active, so a claim filed six months after you end the relationship may not be covered unless there’s an extended reporting period or a “tail” purchased. Ask what the EOR’s practice is for post-termination claims. Some contracts include a tail provision by default. Most don’t.

Does the HTP special regime affect any of this?

Not directly. The HTP framework is a tax and residency regime, not an insurance regime. HTP-resident EORs carry the same coverage stack as any other Belarusian provider. Where HTP does matter is that it shapes the specific tax and payroll exposures that PI coverage might end up responding to.

Closing

Insurance is where the sales conversation ends with the contract. The contract is where the danger genuinely exists.

The four-policy stack matters, but the exclusions matter more, and often the limitation-of-liability cap is the number that determines what the entire arrangement is actually worth to you when something goes wrong. Get the certificates in hand before signing. Read the indemnity and cap language carefully. Ask specific questions about coverage triggers — the answers you get will tell you more about the vendor than any sales deck.

If you’re mid-way through an EOR contract review and want a 30-minute walk-through of the coverage stack and the specific clauses that matter (no pitch, just an honest read on what you’re actually holding), reach us through the contact page.