Co-Employment Risk and Liability in PEO Arrangements

A PEO does not take employer liability off a company's books. It splits specific employer duties between the client and the PEO, but the client stays legally exposed in several areas, and no contract can sign that away. For a 50-person company comparing a PEO against a broker or an AI-native benefits platform, the real cost comparison isn't admin fees alone: it's which party holds the liability when something goes wrong, and what it costs to find out too late.

How co-employment distributes employer responsibility

Many companies sign a PEO services agreement and think they've handed off employer liability along with the paperwork. That belief is the single most expensive misreading of what co-employment actually does. Co-employment is a structure for dividing specific employer responsibilities between two parties, not a mechanism for moving legal risk from one party to the other.

The client company remains the common law employer. The PEO, meanwhile, becomes the employer of record for a defined set of functions: payroll processing, tax withholding and remittance, state unemployment insurance (SUI) registration, new-hire reporting, workers' compensation coverage under a master policy, and benefits administration. Both companies hold employer status at the same time, but each for a different purpose and under a different legal framework.

This relationship becomes official the moment the contract is signed, even though the PEO typically doesn't start processing payroll in its own system until onboarding is finished. Some obligations, like workplace safety compliance, benefits plan selection, and employee communication, are genuinely shared.

The gap that catches companies off guard is simple to state and easy to miss: liability follows the statute, not the service agreement. If the contract assigns a duty to the PEO, that assignment governs the relationship between the two companies. A tax agency, a labor department, or a plaintiff's attorney picks who to pursue without reading the service agreement first. They read the statute, and the statute usually names the employer, and the client is still that.

Where CPEO certification changes the liability calculus

One mechanism in the PEO world does meaningfully shift liability, rather than merely assigning it by contract: a specific federal certification process administered through the IRS. This certification's value is real but narrow, and treating it as broader than it is leaves other exposure areas unguarded.

Under IRC Section 3511, a CPEO is treated as the sole employer for federal employment taxes when it comes to work site employees, so if a certified PEO fails to remit payroll taxes it withheld, the client generally is not on the hook for that failure under a statutory protection written into the tax code, at least for employees covered under that work site arrangement (the client can still be concurrently liable for non-work site covered employees).

What certification does not cover is just as important. It provides no shelter from employment claims: discrimination suits, wrongful termination claims, and workplace safety violations remain the client's exposure no matter how clean the PEO's certification record is. It doesn't touch ERISA fiduciary duties, ACA compliance obligations, or state-level registration requirements. And the protection it offers only holds if the certification stays active. A PEO that loses CPEO certification mid-engagement reverts the client to full payroll tax exposure, and the law requires the CPEO to give each customer written notice within a short window after the IRS issues the revocation notice. With a non-certified PEO, the client carries full federal payroll tax exposure from the start, and the Trust Fund Recovery Penalty under IRC Section 6672 can reach corporate officers, owners, and even bookkeepers personally for unpaid trust fund taxes.

CPEO status is a necessary piece of payroll tax protection. It is not a complete liability management plan on its own. If a client confirms CPEO certification once and considers the matter settled, it has secured one area of exposure while several others sit unexamined.

The liability areas that co-employment never touches: employment claims, ERISA, and ACA

Employment law, ERISA, and the ACA all anchor liability to legal employer status, and the client holds that status regardless of what the PEO agreement says. None of these areas move with a service contract.

On employment claims, the client remains a legal employer for discrimination suits, wrongful termination claims, wage and hour violations, and workplace safety matters. When an employee sues over a termination the client decided, co-employment offers no cover, because the client made the call and owns what follows from it. These claims also tend to surface in class actions, where cumulative damages, legal fees, and reputational damage can outweigh the underlying wage or tax dispute by a wide margin.

ERISA adds a separate layer. Anyone who exercises discretionary control over a benefit plan or its assets is a fiduciary under the law, no matter what the co-employment agreement claims about who's responsible. The client usually keeps fiduciary duties around which plans to offer, how much to contribute, and monitoring 401(k) investment options, and none of that can be handed off by contract. Once a company's plan crosses 100 participants, ERISA requires an independent audit of the plan's financials attached to that year's Form 5500.

The ACA's employer mandate kicks in once a company reaches 50 full-time-equivalent employees, and a PEO arrangement doesn't change that threshold. It just administers the coverage offer on the client's behalf. The client still owns accurate FTE counting, timely offers of minimum essential coverage, and the penalty exposure if the PEO's administration leaves a gap. COBRA works the same way: general rights notices and election notices have to go out on schedule, and if a PEO handles that administration and misses a deadline, the statutory liability for that miss doesn't follow the outsourcing arrangement. It stays with the client. The client needs its own way of confirming notices actually went out.

Multi-state hiring and compounding co-employment liability

Multi-state hiring exposes one of the sharper timing problems in a PEO relationship: compliance obligations start the day a company hires in a new state, and the decisions that trigger them sit with the client, not the PEO.

There's no revenue threshold and no grace period. The moment a company brings on its first remote employee in a state where it hasn't operated before, withholding registration needs to be in place before the first payroll run, and unemployment insurance registration attaches to the first dollar paid to that employee. A single remote hire typically triggers four separate registrations: income tax withholding, unemployment insurance, workers' compensation coverage, and, depending on the state, a paid-leave program.

Once those accounts exist, the PEO can handle the mechanics of multi-state filings competently. But a payroll tax filing service doesn't decide whether to register in a given state, when to register, or what the nexus consequences are for the company's broader entity structure. Those are judgment calls that require someone with visibility into the hiring plan and the company's legal structure, and that someone is the client, not the PEO's processing system.

The regulatory surface keeps shifting underneath this. Each of these creates a new registration or compliance obligation that has to be identified before a PEO can do anything about it. Worker misclassification adds another layer of risk: states with strict classification rules impose severe per-violation penalties, and that classification decision belongs to the client. The PEO's payroll administration doesn't validate it or protect against getting it wrong.

The failure mode appears often enough in multi-state hiring to be predictable. A tech company adds a remote employee in a state it hasn't hired in before, assumes the PEO will take care of the registrations, and the PEO can't register anything until the client initiates the process. The gap between the hire date and the registration date is uninsured exposure, and it belongs entirely to the client.

Why contractual indemnification is only half a defense

The standard response to all of this is that the service agreement includes indemnification language, so the client is covered. That response misunderstands what indemnification actually does. A strong indemnification clause gives the client a private right to be made whole by the PEO. It does not stop a regulator or a plaintiff from pursuing the client directly, and its value is tied entirely to the PEO's solvency and continued existence.

Indemnification is an agreement between two contracting parties. It carries no weight with tax authorities, labor regulators, or plaintiffs in an employment lawsuit, all of whom can go after the client as co-employer no matter what the service agreement promises between the two companies. The indemnification claim also only becomes available after the damage has already occurred: the client has to absorb the initial penalty or judgment first, then pursue the PEO for reimbursement through a separate legal process, on its own timeline.

The PEO industry's current consolidation phase adds another variable. And as covered above, if the PEO loses CPEO certification mid-engagement, the client's payroll tax exposure reverts in full. No indemnification clause substitutes for that certification staying active.

The contract itself cannot eliminate the client's legal exposure. What matters is understanding which statutory obligations sit with which party, and monitoring performance across renewals and regulatory changes rather than treating the signed agreement as the end of the conversation. Compliance automation, built into modern benefits platforms and layered on top of a company's existing HRIS, can help track that responsibility split and flag when statutory or contract obligations shift. The underlying distribution, and the gap it creates, still requires active attention rather than an assumption that the paperwork handles it.

What independent verification of a PEO's compliance performance requires

Verifying a PEO's compliance performance is a defined set of checks the client has to own, because no contract substitutes for independently confirming that obligations were actually met.

The most dangerous assumption is that a PEO is remitting payroll taxes simply because the contract requires it. The IRS's Electronic Federal Tax Payment System, EFTPS, lets account holders verify deposits directly. Reviewing IRS notices and state agency correspondence should happen at least quarterly, and it matters because those notices go to the employer of record address and may get routed through the PEO first, creating a visibility gap for the client if nobody is watching for it independently.

Certification status needs its own check. Certification can be suspended or revoked mid-contract, and a lapse restores the client's full payroll tax exposure retroactively.

On the benefits side, a company that has crossed 100 plan participants should confirm that an independent audit has actually been completed and attached to the annual Form 5500 filing. Registration decisions should sit with a named internal owner who has visibility into the hiring plan, not be delegated entirely to the PEO's processing team.

This is the layer of the relationship where dedicated support often goes missing in traditional PEO arrangements, and it's where a different kind of platform does meaningful work. Platforms built for this gap can alert clients to certification status changes and the liability consequences that follow, before a lapse turns into a payroll tax problem. Ongoing compliance tracking across multi-state jurisdictions and shifting regulations functions less like a one-time audit and more like a continuous operating responsibility, and that's the function this layer of technology is built to serve.

Liability When a Company Outgrows Its PEO

The moment a company's size makes the PEO's cost-benefit math stop working is also the moment unresolved co-employment liability becomes most consequential operationally. Leaving a PEO without a structured liability review creates exposure on both sides of the transition, the one a company is leaving and the one it's moving into.

Exit costs are routinely underestimated because companies compare only the current admin fee to the admin fee they'd pay elsewhere. The real cost structure has three layers: one-time exit costs, temporary overlap costs while both arrangements run in parallel, and risk-driven cleanup costs tied to resolving open liability questions. Internal staff typically absorb real hours on reconciliations, carrier follow-up, and employee communication during the transition, hours that rarely make it into the initial cost comparison.

Liability doesn't end when the contract does. Wage and hour claims, workers' compensation tail obligations, and ERISA fiduciary duties tied to the co-employment period can survive well past exit. If the departing PEO gets acquired through a stock transaction mid-relationship, the buyer inherits all pre-closing liabilities, and the client's indemnification counterparty changes without the client ever agreeing to the swap. Benefits transitions bring their own fiduciary load: re-enrollment, new carrier contracts, and an independent ERISA compliance posture the client now has to stand up on its own, since the departing PEO's master plan coverage ends on exit.

For companies at this stage, an AI-native brokerage model offers a structurally different answer than either a bundled PEO or a traditional commission-based broker. Spine, for example, sits on top of a company's existing HRIS without entering a co-employment arrangement. It handles benefits design, compliance monitoring across jurisdictions, and carrier negotiation, which distributes liability clearly from the outset instead of managing around it, while still matching the service depth a mid-sized company needs from a broker or PEO relationship.

Employment law, ERISA, and ACA obligations anchor directly to a company's status as a legal employer, and none of that status transfers through a PEO contract. What a company can control is how well it tracks the responsibilities it retains at every stage, from the first multi-state hire through CPEO renewal to the eventual exit. Knowing precisely which employer duties stay with the client, at each point in the relationship, is what lets a company plan exit timing, verification cadence, and benefits strategy around real numbers instead of an assumption that the PEO already has it covered.