Which Rules Apply Here

An organisation operating in more than one country is under more than one set of working time rules. That much is obvious. What is not obvious, and what is almost never written down anywhere, is which set applies to which person.

The workflow in “Which Rules Apply Here” becomes more dependable when scheduled work, actual time and later corrections can be distinguished. For teams exploring employee monitoring software, employee monitoring software can provide operational context, while policy ownership, employee explanation and consequential decisions remain with accountable people.

The question sounds like a legal one and the first three quarters of it are administrative. Before anybody can advise on what the rules are, somebody has to establish where people work, where they are employed, which entity employs them, and what they actually do. On most multi-country sites nobody holds all four facts in one place.

For an independent reference relevant to “Which Rules Apply Here”, consult the CISA insider-threat mitigation resources. Use it to challenge assumptions about working time, privacy, recordkeeping and exception handling against the organisation’s real operating model.

That absence is the real finding of this collection's first section. Organisations do not generally get the rules wrong where they know they apply; they get caught by a population they never mapped.

Start from the people, not from the countries

The reliable method is to list every group of people the organisation pays or directs, and ask what applies to each. Starting from a list of countries and asking who is there misses everybody who does not fit the model.

Twenty minutes with a headcount report produces the list: permanent staff by entity and location, people on local contracts, people on expatriate terms, cross-border commuters, remote workers who live somewhere other than the office they report to, frequent travellers, agency and contract staff, and anybody engaged through a third party that employs them on the organisation's behalf.

Several of those groups will not appear in the headcount report at all, which is itself informative. The ones who are hardest to find are usually the ones whose position is least clear.

The four facts per group

Where the work is physically performed. Which legal entity employs them. Which country's law the contract says governs it. And whether the work is of a kind that attracts a sector regime — driving, aviation, maritime, healthcare, offshore.

Those four, in four columns, for each group. The fourth is the one most often skipped and the one that most often changes the answer, because sector rules frequently displace the general ones rather than adding to them.

Where the four do not agree — work performed in one country under a contract governed by another, employed by an entity in a third — that is a flag rather than a conclusion. It is the point at which the question stops being administrative and goes to somebody qualified to answer it.

What the register looks like

One row per population, with those four facts, plus a column for which rule set has been established as applying and where that determination is recorded.

That last column is the one that makes the register a document rather than an opinion. "Local counsel, advice dated March 2024, file reference" is a source. "HR believes" is not, and three years later nobody will remember which of the two it was.

The register does not need to contain the rules themselves at this stage. It needs to establish the map: who is under what. The rules go in the next layer, and most organisations try to build the second layer without the first, which is why their rule tables have gaps nobody can account for.

The populations that are always missing

The new office nobody told HR about, opened by a regional director with four local hires. The person who moved countries during the pandemic and never changed anything on paper. Contractors engaged directly by a project manager. An acquired company still running its own arrangements.

Each of these is a population with its own rules and no entry in anybody's register. Finding them is not a legal exercise; it is a matter of comparing the payroll list, the entity list, the office list and the access control records, and looking at what does not reconcile.

What this is not

It is not a determination of what any country requires. Nothing in this collection tells you what the weekly maximum is in any jurisdiction, and anything that did would be out of date and unsafe to rely on.

What the register does is make it possible to ask the right question of the right person. An organisation arriving at its advisers with a mapped list of populations and the four facts for each gets a usable answer in a fraction of the time, and pays for a fraction of the work, compared with one that arrives with a question about compliance in general.

Who should own it

Whoever owns employment compliance centrally, with the local entity confirming its own row annually. Not the local HR lead alone, because the point of the register is that it is comparable across entities, and not the centre alone, because the centre does not know what the local entity has quietly started doing.

A single owner with local confirmations is the arrangement that stays accurate. Everything else drifts, and the drift is invisible until somebody asks a question the register was supposed to answer.

The first version

Do it with what you have, in an afternoon, with gaps marked as gaps. A register with four populations established and three marked "not determined" is immediately more useful than no register, because it names the three things somebody needs to find out.

The temptation is to wait until the picture is complete. It never becomes complete on its own, and the half-finished version is what generates the questions that finish it.