Who pays for recruitment: what the 2026 rules actually require of you

What zero fee actually covers

Most employers who say they use zero-fee recruitment mean one thing: no agency commission taken out of the worker. That is the easy half. The definition everyone else is working from is wider, and the gap is where the problems sit.

The ILO's 2018 definition is the reference point, and it is blunt: workers shall not be charged directly or indirectly, in whole or in part, any fees or related costs for their recruitment. Related costs are then listed, and the list is longer than most people expect: medical costs, insurance, equipment, training and orientation, travel and lodging, administrative costs, and skills or qualifications testing. Extra-contractual, undisclosed, inflated or illicit charges are never legitimate at all.

Read that list against a normal placement and you see where an otherwise honest arrangement leaks. The agency commission is waived, but the worker pays for the medical. Or the trade test. Or the flight, reimbursed later from wages, which is the same thing with extra steps. Or the safety boots on arrival. Each of those is a recruitment cost under the definition, and a worker who borrowed to cover them arrives in debt, which is the single condition every forced-labour indicator is built around.

The IOM's IRIS standard states the positive form of the rule in one sentence: the worker does not pay any fees or related costs for their recruitment and deployment, those costs are covered by the employer. That is the benchmark an auditor, a buyer or a consulate will hold your arrangement against, whichever direction the pressure comes from.

The due-diligence law got smaller, and it probably misses you

If you have been told that the EU Corporate Sustainability Due Diligence Directive obliges your company to audit labour recruitment, check the thresholds before you buy anything on that basis. They changed in 2026, and they changed a long way.

The Omnibus amendment was published in the Official Journal on 26 February 2026. The directive now reaches EU companies with more than 5,000 employees and more than 1.5 billion euros in net worldwide turnover, and non-EU companies with more than 1.5 billion euros of turnover inside the EU. Member States have until 26 July 2028 to transpose it, and it first applies on 26 July 2029. The mandatory EU-wide civil liability regime was removed from the final text; liability is left to national law, with a review clause set for July 2031.

Germany went the same direction with its own law. The cabinet draft of 3 September 2025 deletes the LkSG reporting duty outright and most of its administrative offences, and BAFA stopped reviewing company reports in October 2025, now sanctioning only particularly serious breaches tied to grave abuses. The core due-diligence duties technically remain in force, and the stated plan is to replace the LkSG with a light-touch CSDDD implementation at the same 5,000-employee, 1.5-billion threshold.

So for a 200-person engineering plant in Silesia, a hotel group on the Adriatic or a food processor in Moravia, the honest answer is that this law does not apply to you and is not going to. Anyone citing the CSDDD at you as a reason to buy a compliance product is either not current or not straight. One part of it is worth knowing anyway: the attempt to limit due diligence to direct, tier-one suppliers was rejected, so for the companies in scope the obligation still runs across the whole chain of activities. That matters for the fourth channel below.

The forced-labour ban has no size threshold

The regulation that does reach you is a different instrument, and it is the one that gets discussed least. Regulation (EU) 2024/3015 prohibits products made with forced labour on the EU market. It entered into force on 13 December 2024 and applies from 14 December 2027.

It has no employee count and no turnover floor. It binds economic operators, meaning any natural or legal person placing products on the EU market, exporting from it, or making them available on it. Size is irrelevant because the instrument does not regulate companies, it regulates products.

What authorities can do is the part worth reading slowly. A competent authority can prohibit placing the product on the market or making it available, order it withdrawn, order related content removed from online marketplaces, and order disposal of the goods. There is a narrow accommodation for strategically important products, where specific components may be replaced rather than the whole product destroyed. The Commission is also required to run an EU database identifying high-risk sectors and geographic areas, fed by ILO and other international reporting.

For a manufacturer, that is not a reporting obligation, it is an inventory risk. A line staffed through a recruitment chain you cannot describe is a line whose output you cannot prove the provenance of. Three years is not long to get the paperwork of your labour supply into a state where you could answer a question about it.

The rule already being enforced is consular

While the EU instruments sit in 2027 and 2029, one form of enforcement is already running, it is immediate, and it has nothing to do with due-diligence law. A consulate can simply refuse the visa.

Finland's 2026 wild-berry season is the clearest demonstration on record. In 2025 the Finnish Ministry for Foreign Affairs granted around 2,600 seasonal work visas to foreign pickers and refused about 60. In 2026 the embassy in Bangkok handled more than 2,100 applications and granted 123. The ministry's stated primary ground for refusal was that the mission was not satisfied the employer would be able to fulfil its obligations as an employer, alongside indications of exploitation risk and criminal proceedings in the sector.

Then the distribution: 107 of the 123 went to one company. Its chief executive attributed that to paying the entire travel cost of each worker, roughly 1,500 euros per person in airfare, insurance and visa fees, where the company had previously covered 30 percent. Same law as the year before, same sector, same source country. What separated the company that got its season from the ones that did not was who paid.

No directive was involved. No threshold, no transposition date, no audit. A visa officer read a file and formed a view about the employer. That mechanism exists in every destination country in Europe and it operates now.

Your customers are the fourth channel

The last route is contractual, and for suppliers it is usually the one that arrives first. The companies that are in CSDDD scope, the ones over 5,000 employees and 1.5 billion euros, still owe due diligence across their whole chain of activities, because the proposal to confine it to direct suppliers was rejected in the final text.

Those companies discharge that obligation the way large companies always have: by pushing it into supplier contracts, questionnaires and audit clauses. So a 150-person component maker that is nowhere near the legal threshold gets the substance of the obligation anyway, as a condition of staying on an OEM's approved list. The same pattern runs through grocery retail, hospitality groups and construction main contractors.

This is why the question is commercial rather than ethical in the end. The obligation reaches small suppliers through the commercial relationship, on the buyer's timetable rather than the legislator's, and with a faster penalty: not a fine, just a lost contract.

What it costs and what it buys

Put a real number on it. For a Finnish season the employer that succeeded in 2026 quoted roughly 1,500 euros a head for airfare, insurance and visa fees. Add the permit fee, add the medical, add the trade test where the role needs one, add equipment, add accommodation to the standard the authority expects. For a skilled placement into central Europe the order of magnitude is similar: a low four-figure sum per worker, once, before the first shift.

Against it, three things. The file passes, which in 2026 is not a given. The worker arrives without debt, which is what removes the indicator that makes a consulate refuse and an auditor escalate. And the worker stays, because a person who owes nothing for the privilege of the job has no reason to disappear into informal work to service a loan. Retention is the part that actually pays for this: the second season with the same crew costs a fraction of the first.

Our side of it is fixed and it is not a pricing decision. The worker pays nothing: no recruitment fee, no deposit, no charge for documents, medical, testing, transport or equipment, and no deduction from the first wages. Thai law regulates and caps what a licensed agency may charge a job-seeker, and the Department of Employment registers the employment contract and clears the departure against it, so the arrangement is on the record in Thailand before anyone boards a plane. The part you are buying is not a promise, it is a paper trail that two governments already hold.

One thing we do not claim: we are not IRIS certified. IRIS certification is a voluntary IOM scheme with capacity building, a third-party audit by an auditor the IRIS Scheme Manager approves, and periodic re-certification. We use the IRIS definition of the Employer Pays Principle as the standard to meet and we will tell you exactly what we do against it, which is a more useful thing for you to check than a logo.