You live in London, Dubai or New York and you run your French company from abroad. Business is growing, so instead of hiring your first employee under a French employment contract, you call a subcontractor: a renovation firm to fit out your Paris office, an IT provider to build your platform, a cleaning company for your premises, or a foreign crew sent by your usual supplier to work on a French site. A few months later, a letter from URSSAF (Union de recouvrement des cotisations de Sécurité sociale et d’allocations familiales, the agency that collects French social contributions) lands on your registered office desk. Your subcontractor never declared its workers, and the agency now asks you, the client, to pay its social charges, its taxes, and even its employees’ wages. This is not a mistake. Under French law, the client who orders work, known as the donneur d’ordre, carries a duty of vigilance over its contractors, and a breach of that duty triggers joint and several liability for the subcontractor’s hidden debts. The mechanism is strict, the amounts can reach hundreds of thousands of euros, and distance does not protect you: the registered office of your SAS (société par actions simplifiée, the flexible French company most foreign founders choose) is in France, so French inspectors and collectors come to you. This article explains, step by step, which papers you must demand before work starts, what happens when your subcontractor cheats, and exactly how to challenge an URSSAF assessment from abroad.
I. What Papers Must You Demand From Your Subcontractor Before Work Starts?
French law does not ask you to trust your contractor. It asks you to check it, in writing, at fixed dates, and to keep the proof. The checks differ depending on whether your subcontractor is French or established abroad, but the logic is the same: a client who can show a complete vigilance file almost always escapes liability, while a client with no papers pays.
A. The URSSAF Attestation de Vigilance and the Kbis: What to Collect and Recheck Every Six Months
The cornerstone of your protection is a document called the attestation de vigilance. It is a certificate issued by URSSAF confirming that your contractor is up to date with its social declarations and payments. The Labour Code states the principle in plain terms: « Toute personne vérifie lors de la conclusion d’un contrat dont l’objet porte sur une obligation d’un montant minimum en vue de l’exécution d’un travail, de la fourniture d’une prestation de services ou de l’accomplissement d’un acte de commerce, et périodiquement jusqu’à la fin de l’exécution du contrat, que son cocontractant s’acquitte » of its registration and declaration duties (Article L8222-1 of the Labour Code). Two features of this text matter enormously for a foreign director. First, the check happens twice: when the contract is signed and then periodically until the work ends. A certificate collected on day one and never renewed is worthless two years later. Second, the duty applies to any person ordering work, including a company directed from abroad, with only one exception: a private individual ordering work for strictly personal or family use (Article L8222-5 of the Labour Code). Your SAS is not a private individual, so the exception never helps you.
The monetary trigger is low. The verification duties apply to « toute opération d’un montant au moins égal à 5 000 euros hors taxes » (Article R8222-1 of the Labour Code). Any renovation, IT development, cleaning contract or maintenance agreement worth 5,000 euros before tax or more falls inside the system. Below that threshold the statute does not impose the formal checks, but prudent foreign directors apply the same routine anyway, because a small contract that grows through amendments can cross the line unnoticed.
Concretely, the regulations deem you to have performed your checks if, at signing and then every six months until the end of the contract, you obtain from your contractor « Une attestation de fourniture des déclarations sociales et de paiement des cotisations et contributions de sécurité sociale prévue à l’article L. 243-15 émanant de l’organisme de protection sociale chargé du recouvrement des cotisations et des contributions datant de moins de six mois » (Article D8222-5 of the Labour Code). In practice, your contractor downloads this attestation from its URSSAF online account and sends it to you. You must then verify its authenticity yourself: URSSAF states on its official site that the client must request the attestation when the contract is signed and then every six months until the contract ends, and must check that it is valid, by entering the security code printed on the certificate into the URSSAF attestation verification tool. A PDF received by email and never verified proves very little if the document was forged or expired.
Alongside the attestation, you must collect proof that your contractor legally exists: a Kbis extract (the official identity card of a French company, issued by the greffe, the registry of the commercial court) for a commercial company, or an extract from the Registre national des entreprises, the RNE, the single national business register, for a craft business, or equivalent proof of registration with a professional order for regulated professions (Article D8222-5 of the Labour Code). For a foreign founder, the reflex should be automatic: no Kbis or RNE extract, no signature. If your contractor claims it just incorporated and has no Kbis yet, wait until it does. The official service-public guide to the vigilance certificate confirms that the certificate is required for every contract of 5,000 euros before tax or more and remains valid for six months, which is exactly the rhythm of your rechecks.
Three practical habits separate protected clients from exposed ones. First, write the vigilance routine into the contract itself: a clause requiring the contractor to deliver a fresh attestation every six months, to notify you of any payment plan negotiated with URSSAF, and to accept termination if it stops complying. Second, centralise the file: attestations, verification screenshots, Kbis extracts, invoices and proof of payment, stored where your French accountant and your lawyer can find them even if you are on another continent. Third, diary the six-month deadlines with a margin of several weeks, because an attestation that is seven months old on the day of an inspection is treated as missing. If you are still hesitating between operating vehicles for your French presence, read our guide on choosing between a French SAS, SARL, branch or subsidiary from abroad: the vigilance duty weighs on all of them, but the way liability hits your personal assets differs.
B. Foreign Subcontractors and Posted Workers: the Extra Declaration You Must File Within 48 Hours
Matters become more technical, and more dangerous, when the workers on your French site are sent by a company established outside France. European Union law allows a foreign employer to post its own employees temporarily to France while keeping them under the social system of the home country, proven by an A1 certificate, but France surrounds this posted work, called détachement, with strict declarations and minimum pay rules. As the client for whom the posted workers labour, you carry a specific vigilance duty of your own, on top of the general one described above.
Before the posting starts, you must check with your foreign contractor that it has filed the prior posting declaration on SIPSI, the Interior Ministry online portal for posted-worker declarations, and complied with the core duties of the posting employer. If your contractor cannot show you a copy of that declaration, the statute orders you to act yourself: « le maître d’ouvrage ou le donneur d’ordre adresse, dans les quarante-huit heures suivant le début du détachement, une déclaration à l’inspection du travail du lieu où débute la prestation » (Article L1262-4-1 of the Labour Code). The inspection du travail is the French labour inspectorate, the field authority that audits workplaces. Forty-eight hours is brutally short for a director living abroad, which is why you should designate in advance who in France, an employee, your accountant or your counsel, is empowered to file that declaration the day the foreign crew arrives. When the chain involves several layers, a main contractor plus sub-subcontractors, the project owner must also verify each direct and indirect subcontractor it has accepted, a point the same article states expressly and which foreshadows the coming reform of cascading subcontracting.
The price of neglect is an administrative fine that bites per worker. Failure by the posting employer to meet its posting duties « est passible d’une amende administrative » (Article L1264-1 of the Labour Code), and the scale is fixed by the next article: the fine is « d’au plus 4 000 € par salarié détaché et d’au plus 8 000 € en cas de réitération dans un délai de deux ans », with a total cap, because « Le montant total de l’amende ne peut être supérieur à 500 000 € » (Article L1264-3 of the Labour Code). The authority must weigh the circumstances, the seriousness, your good faith and your resources, and you « peut contester la décision de l’administration devant le tribunal administratif », the administrative court, with no hierarchical appeal. Ten undeclared posted workers on a Paris building site can therefore mean 40,000 euros on first finding and 80,000 on a repeat within two years, before any criminal or URSSAF consequences are even discussed. Our companion article on sending your own staff to work in France, SIPSI declarations, A1 certificates and inspection fines walks through the mirror situation where you are the posting employer rather than the client.
A final warning for foreign founders: never confuse a posted worker with a local hire, and never let a contractor re-label French-resident workers as posted. If the crew lives in France, is recruited in France and works only for your French project, it is almost certainly not posted workers but undeclared French employment, which triggers the full joint-liability regime of Part II below plus criminal exposure for concealed work. When in doubt, ask for the A1 certificates nominatively, check the SIPSI receipt number, and call the inspection du travail for the place of performance before the crew starts rather than after the inspectors arrive.
II. What Happens When Your Subcontractor Cheats on Taxes and Social Charges?
Even careful clients sometimes discover, usually through an URSSAF letter, that their contractor was in trouble. Understanding the exact mechanics of your liability, and the exact procedure to fight an excessive bill, is what turns a potentially fatal assessment into a manageable dispute.
A. Joint Liability: Paying the Taxes, Contributions, Penalties and Wages Your Subcontractor Hid
The central rule is financial solidarity, called solidarité financière. A client who ignored the vigilance checks, and any person convicted of using the services of a concealed-work operator, « est tenue solidairement avec celui qui a fait l’objet d’un procès-verbal pour délit de travail dissimulé » for three categories: the taxes, duties, compulsory contributions, penalties and surcharges owed to the Treasury or the social protection bodies, the repayment of public aid unduly received, and the wages, indemnities and charges owed to undeclared employees (Article L8222-2 of the Labour Code). Note the trigger: a procès-verbal, an official report recording the offence of concealed work, drawn up against your contractor. Without that report, there is no solidarity, a point the courts enforce strictly, as Part II.B shows.
There is, however, a second route into the same trap that requires no prior failure on your part at signing. If a control agent, a union, a professional organisation or staff representatives inform you in writing that your contractor, a subcontractor or a sub-delegatee is operating irregularly, you must « enjoint aussitôt à son cocontractant de faire cesser sans délai cette situation », and if you fail to do so you become jointly liable under the same conditions (Article L8222-5 of the Labour Code). For a director abroad, the lesson is organisational: written warnings from inspectors or unions must reach you the same day, be translated, and trigger an immediate formal demand to the contractor sent by traceable means. Silence after a written warning is treated as complicity.
The good news is that your liability is measured, not unlimited. « Les sommes dont le paiement est exigible en application de l’article L. 8222-2 sont déterminées à due proportion de la valeur des travaux réalisés, des services fournis, du bien vendu et de la rémunération en vigueur dans la profession » (Article L8222-3 of the Labour Code). If your contractor performed 200,000 euros of work for you but hid 2 million euros of activity elsewhere, you answer only for the proportion linked to your contract. Always check URSSAF’s arithmetic on this point: assessments that quietly forget proportionality are among the most frequently reduced on appeal.
A parallel sanction can hurt even more than the solidarity bill itself. When a client breached its vigilance duty and its contractor concealed work during the same period, « l’organisme de recouvrement procède à l’annulation des réductions ou exonérations des cotisations ou contributions dont le donneur d’ordre a bénéficié au titre des rémunérations versées à ses salariés » (Article L133-4-5 of the Social Security Code). In other words, URSSAF cancels your own payroll tax breaks, month by month, for every month both conditions were met. The Cour de cassation, the supreme court for civil and social matters, confirmed that these sanctions apply as soon as a control performed after 6 December 2013 finds both your vigilance failure and your subcontractor’s concealed work committed after 1 January 2013: « les sanctions prévues par le premier sont applicables lorsque, à l’occasion d’un contrôle effectué après le 6 décembre 2013, ont été constatés le manquement du donneur d’ordre à son obligation de vigilance et des faits matériels de travail dissimulé par son sous-traitant, commis postérieurement au 1er janvier 2013 » (Cass. 2e civ., 16 February 2023, No. 21-14.403, published in the Bulletin, ECLI:FR:CCASS:2023:C200184). The statute caps the pain: the cancellation is limited by reference to the solidarity sums, and « réduit à 15 000 € pour une personne physique et à 75 000 € pour une personne morale » when no cancellation hit you in the previous five years (Article L133-4-5 of the Social Security Code). Seventy-five thousand euros remains a heavy price for missing paperwork, which is why the six-month attestation routine of Part I is the cheapest insurance your company will ever buy.
One reform makes acting now urgent. The official service-public site warns that the client’s duty will soon extend beyond the first direct contractor to every subcontractor in cascading chains, with the new duties applying once the implementing decree issues and no later than 27 December 2026 (service-public, vigilance certificate page). If your Paris fit-out involves a general contractor who itself subcontracts electrical work, plumbing and painting, you will soon have to verify the whole chain, not just your direct cocontractant. Foreign directors should renegotiate their framework contracts now to include a cascading information clause, requiring each contractor to disclose its own subcontractors and forward their attestations to you.
B. Challenging the Bill From Abroad: Mise en Demeure, the Two-Month Appeal and the Case Law That Protects You
Receiving an URSSAF assessment as donneur d’ordre is the start of a procedure, not the end of the story. French recovery law gives you three shields, and each has a strict deadline you must calendar from abroad.
The first shield is the formal demand itself. Any recovery action must be preceded by a mise en demeure, a formal registered demand, and « Le contenu de l’avertissement ou de la mise en demeure mentionnés au premier alinéa doit être précis et motivé » (Article L244-2 of the Social Security Code). Read that letter with a lawyer’s eye: does it identify the contractor, the official report, the periods, the legal basis of your solidarity and the exact computation? A vague demand that merely states a global sum without explaining which months, which workers and which proportion of the work it covers is vulnerable. The same discipline applies to the document opening the L133-4-5 cancellation procedure, which must reference the concealed-work report drawn up against your contractor.
The second shield is the most powerful weapon the courts have given clients, and it was forged by the Cour de cassation itself. The court holds that a client who ignored its vigilance checks « est tenu solidairement au paiement des cotisations obligatoires, pénalités et majorations dues par son sous-traitant qui a fait l’objet d’un procès-verbal pour délit de travail dissimulé » (Cass. 2e civ., 8 April 2021, No. 19-23.728, ECLI:FR:CCASS:2021:C200302), but it adds a decisive protection: « l’organisme de recouvrement est tenu de produire ce procès-verbal devant la juridiction de sécurité sociale en cas de contestation par le donneur d’ordre de l’existence ou du contenu de ce document ». In plain English: URSSAF does not have to send you the concealed-work report spontaneously, but the moment you contest its existence or content before the social court, the agency must produce it, and if it cannot, the whole solidarity assessment collapses. The decision rests on a constitutional guarantee: by its ruling No. 2015-479 QPC of 31 July 2015, the Constitutional Council upheld the solidarity regime only on condition that the client may dispute the regularity of the procedure and the merits of the taxes and contributions it is asked to pay jointly. Your appeal strategy therefore starts with two systematic demands: produce the official report against the contractor, and justify every euro of the computation, including proportionality to your contract.
The third shield is procedural and carries the shortest fuse. Disputes against URSSAF decisions go first to the commission de recours amiable, the CRA, the friendly-appeal board inside the agency, and « Cette commission doit être saisie dans le délai de deux mois à compter de la notification de la décision » (Article R142-1 of the Social Security Code). Two months from receipt, not from the date you actually read the letter at your foreign address, which is why every foreign-run French company needs a person in France who opens, scans and forwards official mail daily. If the two-month clock is already running against you, call +33 6 46 60 58 22 without waiting: once the deadline expires, the assessment becomes final and only a court action on narrow grounds remains. After the CRA stage, the dispute moves to the judicial court, tribunal judiciaire, social division, where the 2021 case law on production of the official report will do its work. Our walkthrough of a URSSAF audit of your French company, control, assessment and how to challenge from abroad details each stage, and founders setting up their first routines should also read setting up a company in France as a foreign founder, bank account, Kbis, VAT and first hire. For Paris-based operations, challenges concentrate before the Paris CRA and the Paris judicial court, and the DREETS for the Paris region, the regional directorate for employment and labour, is the authority that will rule on any administrative fine for posting failures, so keep its address in your file alongside your accountant’s.
Conclusion
Hiring a subcontractor for your French company while you live abroad is perfectly lawful, but it makes you the guarantor of your contractor’s honesty unless you build the paper shield the statutes describe. Collect the URSSAF attestation de vigilance and the Kbis or RNE extract before signing, recheck them every six months, verify each attestation code online, file the 48-hour declaration yourself whenever a foreign contractor cannot show its SIPSI receipt, and write all of it into your contracts. If an assessment arrives despite your care, attack it methodically: demand the concealed-work report, verify the proportionality of the sums, meet the two-month CRA deadline, and carry the dispute to the social court armed with the 2021 and 2023 rulings of the Cour de cassation. With the extension of vigilance to cascading subcontracting arriving by December 2026, the directors who put these routines in place today will be the only ones sleeping well tomorrow.