Type of Visa / Work Permit required for auditing & pen testing in Europe

[DelBoyJonesy]

Morning All

I have a query about the type of visa/work permit needed for Europe. I run a audit and pen testing company in the UK and almost all work is done remotely (even before the pandemic), but sometimes it needs an in-person visit to site to do a test, but since these are UK based there's no issue (save Covid).

Now if my company secured a contract with an EU based company to do a pen test and some or all of it needed to carried out within the EU, what type of visa / permit is required if I go myself or send a member of staff?

All of the current UK-EU visa / work permit guidance just talks about people taking up traditional paid/contract work with an employer in the EU, but none of the guidance appears to deal with "engineers" or "consultants" travelling to the EU to do a task/job for their UK based employer who has a contract to supply services to a EU based company and then returning to the UK.

Does anyone have any experience or guidance on this?

I suspect its a grey area ...

[Lance]

You can go to EU Visa free for meetings.
You need a visa to do actual work.

Is a pen-test actual work? That's the only grey area to my mind. You're not producing anything. It's an audit (of a fashion) and audit probably comes under meetings.
That being said, I wouldn't want to test it in a French court.
Worst case scenario is the individual gets sent home and not allowed to get back in. As an employer that leaves you in a difficult position with regards to duty of care.

But you should get proper legal advice....

What would I do??? If it were a proper business and EU is part of the strategy, I'd get EU citizens on the payroll.
There's lots of them and the Eastern Europeans are pretty sh*t-hot at security stuff. Irish passport holders also.
If this is not common work then you could find an EU partner company and use their staff on a day rate.

[hobnob]

Is a pen-test actual work? That's the only grey area to my mind. You're not producing anything. It's an audit (of a fashion) and audit probably comes under meetings.

You're producing a report, i.e. that's how you deliver value to the client rather than just saying "Haha, you got pwned, n00b!"

I'm guessing that this will be more than just a meeting (which could happen over Zoom). E.g. if the client wants you to try breaking into their wireless network, you'd need to be onsite (to be within range), but they'd just give you a desk and leave you to it. So, I think this counts as actual work.

[jamesbrown]

Pen testing would be productive work, for sure.

[northernladuk]

Is a pen-test actual work?

It's the whole purpose of his company and it's what he get's paid for. How can that be a grey area?

[DelBoyJonesy]

Thanks for the replies. It is actual work, but the question is for whom?

Myself or my employee are directly working for my UK based company, and the UK company is then engaged by the EU company to carry out the pen tests, so we would not legally be working for the EU company (in any direct sense).

The onsite work, i.e. the actual tests are whatever we (the UK company) deem appropriate in that context. There would be a "wash-up" meeting at the end of the test to discuss the findings before the formal report is issued to the client.

I suspect the local EU immigration dept would say a work permit, I just find it difficult to believe that an EU company would say "yes, we'll sponsor a permit (i.e. pay money) for you to come over for 3 days", or would a Business Schengen Visa be sufficient?

Everything just sounds like a massive hassle ...

[jamesbrown]

So, according to your argument, you can do productive work in any jurisdiction you want without an appropriate visa for productive work simply by interposing an intermediary between the person doing the productive work and the end client. Er, no. It doesn’t work like that.

[hobnob]

Which EU country are you going to? Looking at the gov.uk website, they each have their own rules:
Travelling to the EU, Switzerland, Norway, Iceland or Liechtenstein for work - GOV.UK (www.gov.uk)

For instance:

These don’t require a visa or permit in France if they’re for no more than 90 days:

• auditors and other experts in architecture, engineering, finance, insurance, IT and management working on assignment

On the other hand, you would need a visa and permit for the same work in Spain.

(This is separate to the "no visa required for meetings" rule that Lance mentioned earlier.)

[WTFH]

Everything just sounds like a massive hassle ...

Welcome to “the will of the people” and the “oven ready” deal done by the right wing politicians in the UK.

[DelBoyJonesy]

So, according to your argument, you can do productive work in any jurisdiction you want without an appropriate visa for productive work simply by interposing an intermediary between the person doing the productive work and the end client. Er, no. It doesn’t work like that.

I havent said that at all