You declared the hire, signed the employment contract and paid the first salary. Most foreign founders stop there and believe the hard part is over. It is not. Under French law, the day your first employee starts work, three automatic duties fall on your company even though nobody asked you to sign anything for them: you must buy a compulsory top-up health policy for that employee and pay at least half of it, you must set up death and disability cover known as prévoyance and prove in writing that the employee was informed, and you must open a written occupational-risk file called the DUERP and keep it updated for the whole employment relationship. Each duty carries its own fine, and each fine can reach you abroad through the labour inspector or URSSAF, the French body that collects social-security contributions from every employer. This guide explains what to buy, what to write, what it costs when you forget, and how to fix a fine or a back-payment order without flying to France. It picks up where our step-by-step formation guide left off, so read it together with Setting Up a Company in France as a Foreign Founder: Bank Account, Kbis, VAT and Your First Hire, which covers the declaration of the hire itself, the Kbis company registration certificate and the VAT number.

Hiring your first employee in France means entering a system where protection is collective and largely automatic. The French acronyms below look intimidating, but each one maps to a single concrete task. URSSAF (Unions de Recouvrement des cotisations de Sécurité Sociale et d’Allocations Familiales) is the network of bodies that collects employer social contributions and audits payrolls. The DUERP (Document Unique d’Évaluation des Risques Professionnels) is the single written file in which you list every health and safety risk in your company. The CSE (Comité Social et Économique) is the elected staff council that must exist once your headcount reaches eleven employees. The combinations mutuelle and complémentaire santé both mean the top-up health insurance that sits on top of the state scheme, while prévoyance means the separate cover for incapacity, invalidity and death. Keep these five definitions in mind and the rest of this article becomes a practical checklist.

I. Your First Hire Forces You to Fund Top-Up Health Cover and Death-Disability Protection

French state health insurance reimburses only part of medical bills. Since 1 January 2016 every private-sector employer, including a one-person SAS (Société par Actions Simplifiée, the flexible limited company most foreign founders choose) or SARL (Société à Responsabilité Limitée, the traditional private limited company) with a single employee, must provide a collective top-up policy with compulsory membership and pay a substantial share of it. A separate death and disability policy must normally be added on top, and every beneficiary must receive a written information notice. The labour courts treat missing paperwork as a standalone fault, and they price it in euros even when the employee never fell ill.

A. Buy the Compulsory Complementary Health Cover and Pay at Least Half

The rule sits in the Social Security Code, and its wording leaves no room for negotiation. Companies whose employees do not already enjoy equivalent collective cover “sont tenues de faire bénéficier leurs salariés de cette couverture minimale par décision unilatérale de l’employeur”, which means they must grant their employees this minimum cover by unilateral decision of the employer, with the employees informed of that decision. Read the provision here: Social Security Code, Article L911-7 on Legifrance. In practice, if no industry-wide agreement already covers your staff, you sign a group policy yourself and you notify the employee in writing. Doing nothing is not a neutral option: doing nothing is the breach.

The minimum basket is defined by the same article. It must cover all or part of three items: the patient’s statutory share of the tariffs used to compute state benefits, the daily hospital flat fee known as the forfait journalier, and the extra cost of prosthetic dental care, orthodontics and certain individually prescribed medical devices, with a decree setting the exact reimbursement levels. Your insurer will package this as a contrat responsable, the standard responsible-policy format, but you should check the schedule of benefits line by line, because a policy that misses one of the three baskets does not satisfy the statute even if the monthly premium looks correct. The financing rule is equally blunt: under Article L911-7, III, the employer must fund at least half of that compulsory collective top-up policy for sickness, maternity and accident. In plain English, the employer pays at least half of a compulsory collective policy covering top-up reimbursement for sickness, maternity or accident. You may pay more, and many founders pay sixty or one hundred percent to attract candidates, but you may never pay less than half.

Three practical consequences follow for a founder managing from abroad. First, the employer’s share is exempt from social-security contributions, which makes it cheaper than the same euros paid as salary, but there is no exemption from the CSG-CRDS levies on activity income, and in companies with at least eleven employees the forfait social package contribution applies. Your payroll provider must therefore show the employer’s health-cover share on its own payslip lines instead of burying it in gross salary. Second, short fixed-term contracts and part-time arrangements allow narrow statutory opt-outs, but only at the employee’s initiative and only with written proof kept in the file; an oral statement that the employee already has cover elsewhere is worthless in an audit. Third, affiliation must be effective from the start of employment, not from the end of probation and not from the date your broker finally returns your calls. A founder who waits nine months to finalise the paperwork commits a characterised breach of statutory duties, as the Versailles Court of Appeal put it in plain terms: “Le manquement de l’employeur à ses obligations légales est donc caractérisé.” Read the full decision here: Court of Appeal of Versailles, 15th chamber, 26 January 2023, case 20/02721. In that case the employer finalised the health-cover formalities in July 2018, more than nine months after the hiring, and the court held the breach established even though cover was eventually put in place.

The Versailles ruling also teaches the second half of the lesson, the one that decides how much you actually pay. The employee in that case argued that the delay forced him to postpone surgery for a polyp diagnosed in spring 2018, but his only evidence was a quotation dated 13 November 2018 for an operation scheduled on 5 December 2018. The court answered that, because the employee had not proved any loss caused by the employer’s faulty behaviour, the dismissal of his damages claim on that head had to be confirmed. Because the employee did not prove the loss caused by the employer’s faulty behaviour, the court confirmed the dismissal of his damages claim on that head. The message for founders cuts both ways. A late or missing policy is a proven breach from day one, and an employee who kept medical bills, a personal top-up policy or a postponed operation will convert that breach into damages. An employee who proves nothing gets nothing, but you cannot build your compliance strategy on the hope that your employee keeps no receipts.

B. Add Provident Cover and Hand Every Employee the Written Notice

Health top-ups pay doctors and hospitals. Prévoyance pays when the employee cannot work at all: daily allowances on top of state benefits during long sick leave, a pension supplement after a disabling accident, and a capital sum or annuity for the family if the employee dies. For manual workers the monthly minimum contributions are set by national agreement, and for managers and executives most applicable collective agreements impose a specific death-benefit rate, classically around one and a half times the social-security ceiling bracket. Your first task is therefore to read the collective agreement attached to your activity code before assuming the health policy is enough. If the agreement says nothing, you still set up cover voluntarily, because the labour courts punish the employer who leaves an employee with no income protection and no paperwork.

The Code offers exactly three lawful routes, and unilateral action is one of them. Collective guarantees supplementing state social security “sont déterminées soit par voie de conventions ou d’accords collectifs, soit à la suite de la ratification à la majorité des intéressés d’un projet d’accord proposé par le chef d’entreprise, soit par une décision unilatérale du chef d’entreprise constatée dans un écrit remis par celui-ci à chaque intéressé.” In other words, cover is set either by collective bargaining, by a majority vote of the staff on the employer’s proposal, or by a unilateral decision of the employer recorded in a written document handed by the employer to each person concerned. Read it here: Social Security Code, Article L911-1 on Legifrance. A small foreign-owned company will almost always use the third route: a one-page unilateral decision, called a décision unilatérale de l’employeur, handed to the employee with the contract, plus the insurer’s membership form. Keep a signed copy. The Paris Court of Appeal showed in 2025 what happens when that copy is missing.

In that case an employee had social-security deductions taken from her payslips for a top-up policy she said she could never use, because nobody ever told her which insurer covered her or how to claim. The employer produced an affiliation form with the insurer Henner dated 18 October 2016, but it was not signed by the employee, and it proved a second policy taken out with Cogevie in 2018 without showing that the employee had ever been told about it in the legally required form. The court stated the governing principle without hesitation: “L’employeur a l’obligation de remettre la notice d’information écrite à tous les bénéficiaires d’une complémentaire de santé et/ou de prévoyance collective que l’entreprise a mise en oeuvre.” The employer must hand the written information notice to every beneficiary of a collective health or provident scheme set up by the company. Because no notice had been delivered, the employee had paid contributions for nothing and had been forced to buy her own personal policy. The court concluded: “Le manquement de l’employeur a causé à Mme [S] un préjudice financier du fait des prélèvements des cotisations et un préjudice moral.” The breach caused financial loss through the deducted contributions and moral harm. It ordered reimbursement of 1,830.09 euros of wrongly deducted employee share and added 1,500 euros in damages, confirming the labour court on both heads. Read the full decision here: Court of Appeal of Paris, division 6 chamber 5, 8 April 2025, case 22/06399.

Translate this into a founder-proof routine you can run from abroad. Before the start date, ask your broker for two documents per scheme: the insurer’s information notice and a one-page membership certificate naming your employee. On the start date, hand over the unilateral decision, both notices and the affiliation forms, and collect signatures on a same-day receipt slip. Every month, check that the payslip shows the employer’s and the employee’s shares on separate lines, because unexplained deductions are exactly what cost the Paris employer 1,830.09 euros plus damages. Every year, ask the broker for the updated notice and re-issue it; tariffs and guarantee tables change, and an outdated notice is barely better than none. If the employee refuses membership under a statutory exemption, file the signed refusal with the employment contract. If URSSAF later audits your payroll, and URSSAF audits foreign-owned companies with particular attention, this little file is what turns a discussion about back contributions into a five-minute check instead of a formal reassessment with penalties.

II. Your First Hire Forces a Written Risk File and Exposes You to Fines You Can Challenge From Abroad

Insurance pays for damage after it happens. The second half of French employer law tries to stop the damage from happening at all, and it does so with paperwork. From the very first employee, including an office worker with a laptop and a chair, you must assess every occupational risk in writing, transcribe the results into a single document, update it on a fixed schedule, and show it to the people the Code lists. Forget this file and you face three separate sanction tracks at once: a criminal fine, an administrative fine per affected worker, and damages in the labour courts, with work-accident liability on top if someone is hurt. The good news is that each track has written procedures and deadlines, which means a founder abroad can answer them through a lawyer without boarding a plane, provided the underlying file exists.

A. Write and Update the Single Risk Assessment Document From Day One

The foundation is a short, famous sentence of the Labour Code: “L’employeur prend les mesures nécessaires pour assurer la sécurité et protéger la santé physique et mentale des travailleurs.” The employer takes the measures necessary to ensure safety and protect the physical and mental health of workers. Read it here: Labour Code, Article L4121-1 on Legifrance. Those measures expressly include prevention actions, information and training, and an adapted organisation with adequate means, and the employer must adjust them as circumstances change. The next article gives the method: “L’employeur met en oeuvre les mesures prévues à l’article L. 4121-1 sur le fondement des principes généraux de prévention suivants”, meaning the employer implements the L4121-1 measures on the basis of nine general prevention principles, starting with avoiding risks, evaluating unavoidable risks and fighting risks at their source. Read them here: Labour Code, Article L4121-2 on Legifrance. The assessment itself is described in the third text: “L’employeur, compte tenu de la nature des activités de l’établissement, évalue les risques pour la santé et la sécurité des travailleurs”, so the employer evaluates health and safety risks taking into account the nature of the establishment’s activities, including the choice of processes, equipment, chemicals, workplace layout, work organisation and job design. Read it here: Labour Code, Article L4121-3 on Legifrance.

All of this becomes one physical file through a single regulatory rule: the employer transcribes into a single document, and keeps updated there, the results of the risk assessment carried out under Article L4121-3, with an inventory of the identified risks in each work unit of the company or establishment, including heat-related atmospheres. The employer transcribes and updates in a single document the results of the risk assessment carried out under Article L4121-3, with an inventory of the identified risks in each work unit of the company or establishment, including heat-related atmospheres. Read it here: Labour Code, Article R4121-1 on Legifrance. A common foreign-founder mistake is believing that an office with one employee has no risks to list. It always has: screens and posture, electrical installations, slips and falls, road risk on business travel, psychosocial risks from workload and isolation, and since the recent reforms, heat waves and gender-differentiated exposure. An honest ten-page file listing real risks with real prevention actions beats a fifty-page template that describes another company’s factory.

The update calendar depends on headcount, and this is where founders get caught. The current wording states: “La mise à jour du document unique d’évaluation des risques professionnels est réalisée : 1° Au moins chaque année dans les entreprises d’au moins onze salariés”, which means the single risk-assessment document is updated at least every year in companies with at least eleven employees. Read the full schedule here: Labour Code, Article R4121-2 on Legifrance. Below eleven employees there is no yearly obligation, but the file must still be updated whenever a major layout decision changes health, safety or working conditions, and whenever new information about a risk reaches the employer, for example after an accident, a near miss, a doctor’s warning or the arrival of new equipment. Each update must also refresh the annual prevention programme or action list attached to the file. Keep every version for forty years from its drafting and hold them available for the staff, the staff council once it exists, the occupational doctor and the labour inspector; the Ministry of Labour’s own guidance confirms this forty-year retention. Companies above the thresholds must also deposit the document on the national digital portal, a formality your payroll or prevention adviser should diary for you.

Three sanction layers sit on top of this file, and each one has been applied to ordinary small employers. First, the criminal layer: failing to transcribe or update the assessment results as Articles R4121-1 and R4121-2 require is punished with the fifth-class petty-offence fine. Read it here: Labour Code, Article R4741-1 on Legifrance. The official business guidance quantifies it: up to 1,500 euros for a natural person and 7,500 euros for a legal entity such as your SAS, doubled on repeat offending. Second, the administrative layer: where no criminal prosecution follows, the labour administration can issue a warning or an administrative fine of up to 4,000 euros, applied as many times as there are affected workers, rising to 8,000 euros for a repeat offence of the same nature within two years of a previous fine or within one year of a previous warning. Third, the staff-council layer: a council must be set up “dans les entreprises d’au moins onze salariés”, in companies with at least eleven employees, and only once that headcount is reached for twelve consecutive months. Read the threshold here: Labour Code, Article L2311-2 on Legifrance. Withholding the risk file from an existing council is treated as obstructing its regular functioning, and the statute punishes obstruction directly: Obstructing their regular functioning is punished with a 7,500-euro fine, with up to one year of imprisonment for obstructing the creation of a council or the unhindered appointment of its members.

The labour courts add damages when the missing file meets a real injury. In the 2025 Paris case already cited, the same employer that forgot the health-cover notices also failed to organise any medical supervision while the employee repeatedly warned in writing about exhausting cleaning workloads, knee and arm pain and two work accidents. The court recalled the test in these terms: “Aux termes des articles L.4121-1 et L.4121-2 du code du travail, l’employeur doit prendre les mesures nécessaires pour assurer la sécurité et protéger la santé physique et mentale des travailleurs.” Then it applied it: “Ne méconnaît pas son obligation légale de sécurité, l’employeur qui justifie avoir pris toutes les mesures prévues par les articles L.4121-1 et L.4121-2 du code du travail.” An employer who proves it took all the measures in Articles L4121-1 and L4121-2 does not breach its statutory safety duty. This employer proved nothing, produced no medical follow-up and ignored written alerts, so the court found: “Ce manquement a causé un préjudice à la salariée laquelle n’a pas été en mesure de faire vérifier la compatibilité de son état de santé au poste de travail et, le cas échéant, d’obtenir les adaptations de son poste de travail.” The breach harmed the employee, who could not have her fitness for the post checked or her workstation adapted. It confirmed 4,000 euros in damages for breach of the health and risk-prevention duty. Read the full decision here: Court of Appeal of Paris, division 6 chamber 5, 8 April 2025, case 22/06399.

A 2026 ruling from Rouen completes the picture for work accidents, the scenario every founder fears. After a worker crushed his hand remounting a hydraulic engine with a forklift, the employer argued that the missing risk file was irrelevant because the manoeuvre was simple and the worker had disobeyed instructions. The court restated the employer’s written duties first: under Articles L4121-3 and R4121-1, the employer must assess company risks, implement prevention actions, and transcribe and update the assessment results in a single document. Then it set the exact evidential value of a missing file: “Le tribunal a rappelé à juste titre qu’aucune présomption de faute inexcusable ne pouvait résulter de l’absence éventuelle de document unique d’évaluation des risques, ce fait devant être simplement pris en considération pour l’appréciation de la conscience du danger et/ou des mesures de protection prises par l’employeur.” No presumption of inexcusable fault flows automatically from a missing risk file, but the absence must be weighed when judging whether the employer knew of the danger and what protection it provided. The governing test for inexcusable fault, which opens uncapped supplementary compensation paid in front of the social courts, runs as follows: “Le manquement à l’obligation légale de sécurité et de protection de la santé à laquelle l’employeur est tenu envers le travailleur, sur le fondement des articles L. 4121-1 et L. 4121-2 du code du travail, a le caractère d’une faute inexcusable lorsque l’employeur avait ou aurait dû avoir conscience du danger auquel était soumis le travailleur et qu’il n’a pas pris les mesures nécessaires pour l’en préserver.” A breach of the statutory safety duty counts as inexcusable fault when the employer was or should have been aware of the danger and failed to take the necessary protective measures. The Rouen court confirmed the trial judgment against the company. Read it here: Court of Appeal of Rouen, social chamber, 12 June 2026, case 25/02168. For a founder, the arithmetic is simple: a missing file never helps and is always held against you, while a serious file is your best evidence that you did your job.

B. Answer the Labour Inspector and URSSAF Without Flying to France

Enforcement reaches foreign directors through paper, not through border controls, and every paper has a reply box with a deadline. The labour inspector visits, sometimes after an employee complaint or an accident report, checks the risk file, the notices, the payslips and the working-time records, and can issue a formal demand to comply, draw up a criminal report for the file offences described above, or start the administrative-fine procedure that ends with up to 4,000 euros per affected worker. URSSAF runs the parallel payroll track: contribution shortfalls on the health and provident shares, missing affiliation paperwork and undeclared benefits all surface in a URSSAF audit, and the resulting reassessment goes to the company wherever its directors live. Neither procedure requires your physical presence at any stage, but both punish silence, so organise your representation before the first letter arrives.

Against URSSAF, the procedure is fenced with guarantees you should use systematically. The Code entrusts control over employers to the collection bodies, and every control opened under that mandate follows the same choreography. The current regulation provides: “Tout contrôle effectué en application de l’article L. 243-7 est précédé, au moins trente jours avant la date de la première visite de l’agent chargé du contrôle, de l’envoi par l’organisme effectuant le contrôle des cotisations et contributions de sécurité sociale d’un avis de contrôle.” Every control carried out under Article L243-7 is preceded, at least thirty days before the inspector’s first visit, by sending a control notice. Read the procedure here: Social Security Code, Article L243-7 on Legifrance and Social Security Code, Article R243-59 on Legifrance. That notice states the existence of the Charte du cotisant contrôlé, the audited-contributor charter describing the control procedure and your rights at each stage, and its provisions bind the auditing body itself. Use the thirty days to mandate a French payroll specialist or lawyer, gather the affiliation certificates, unilateral decisions, signed notices, payslips and exemption refusals described in Part I, and reconcile every health and provident line with the contribution returns. After the visit, the inspector sends an observations letter; you reply in writing within the stated period with documents and legal arguments, because points dropped at this contradictory stage are far harder to revive later. If a reassessment follows through a formal demand and then an enforceable order, each step has its own court deadline, and a lawyer with a power of attorney can file every challenge while you remain abroad.

Against the labour inspector, the logic is the same: answer fast, in writing, with documents. If the inspector notes a missing or outdated risk file, regularise immediately and send the new file with its dating and distribution proofs, because judges consistently treat a file created the week after the visit as evidence of good faith that caps penalties, while a file still missing at the hearing reads as contempt. If an administrative fine is notified, contest the facts you can disprove, such as headcount, dates and workers actually affected, since the fine multiplies per worker and the headcount math is where foreign founders most often overpay. If a criminal report goes to the prosecutor, the company as a legal entity is the fined party, and representation by counsel covers the hearings. In all three tracks, keep one reflex: never let a deadline expire because the letter arrived at the French registered office while you were abroad. Redirect the company’s mail to someone who opens it daily, calendar every reply period the day the letter arrives, and instruct your French contact to forward inspector and URSSAF mail within twenty-four hours. Most of the catastrophic French payroll cases in foreign-owned companies are not lost on the law; they are lost on unopened envelopes.

Conclusion

Your first French employee buys you talent, but the price includes three files you must open yourself: a health top-up policy funded at least half by the company with compulsory membership from day one, a death and disability scheme set up by agreement or unilateral decision with a written notice handed to every beneficiary, and a single risk-assessment document that lists real risks, names real prevention actions and is updated whenever the work changes, every year once you reach eleven employees. The statutes price each omission precisely, from fifth-class criminal fines to 4,000 euros per worker in administrative penalties and thousands of euros in labour-court damages, and the appeal courts apply them to ordinary small employers with written reasons you have just read. Build the three files before the start date, keep signed copies of every notice and every version, reconcile the payslips monthly, and calendar the inspector’s and URSSAF’s reply periods like board meetings. Do this, and hiring in France from abroad becomes what it should be: an administrative routine behind a commercial adventure, not a pile of unopened envelopes that turns into a court file.

Need a quick opinion on your case

Hiring your first employee in France while you live abroad and want the health cover, provident scheme and risk file set correctly from day one. The firm offers a phone consultation: 80 EUR including VAT, within 48 hours with a lawyer of the firm. Call +33 6 46 60 58 22 — Maître Reda Kohen. Send your draft contract, payslip and start date through our contact page before the call so the advice is concrete.