{"id":8582,"date":"2025-05-29T19:06:05","date_gmt":"2025-05-29T23:06:05","guid":{"rendered":"https:\/\/employerdefensereport.com\/?p=8582"},"modified":"2026-03-20T12:05:29","modified_gmt":"2026-03-20T16:05:29","slug":"navigating-legal-risk-in-the-remote-work-era","status":"publish","type":"post","link":"https:\/\/www.connmaciel.com\/employer-defense-report\/navigating-legal-risk-in-the-remote-work-era\/","title":{"rendered":"Navigating Legal Risk in the Remote Work Era"},"content":{"rendered":"

The widespread adoption of remote work arrangements has <\/span>reframed<\/span> the employment landscape, <\/span>offering<\/span> organizations <\/span>access to a broader talent pool and increased operational flexibility.<\/span> However, this reorganization also presents complex legal challenges\u2014many of which remain underappreciated.<\/span><\/p>\n

As employees work from locations that may be hundreds or thousands of miles from their employers\u2019 offices, questions of applicable law, regulatory obligations, and legal exposure become increasingly difficult to resolve. In particular, employers must contend with a patchwork of state and federal employment laws, jurisdictional triggers based on employee location, and a rising set of cybersecurity and compliance risks; all of which may <\/span>be activated<\/span> by something as simple as an employee moving across state lines.<\/span><\/p>\n

The Problem of Legal Geography: Where Your Employees Are Matters<\/span><\/strong><\/p>\n

Too often, employers operate <\/span>on<\/span> the assumption that compliance <\/span>flows from where<\/span> the company <\/span>is headquartered<\/span>.<\/span> But<\/span> in practice, most employment laws <\/span>look to<\/span> the employee\u2019s physical location, not the employer\u2019s.<\/span> And in a remote-first world, that means companies are increasingly subject to laws in places they never intended to do business.<\/span><\/p>\n

Sometimes, those laws have clearly defined geographic limits. Other times, they don\u2019t. <\/span>In general<\/span>, courts apply a presumption against extraterritoriality, declining to <\/span>apply<\/span> a state law outside its borders unless the statute expressly <\/span>says<\/span> otherwise.<\/span> However, this is state-dependent: some states reject the presumption and instead rely on traditional statutory interpretation or <\/span>conflict-of-laws<\/span> principles. <\/span>This<\/span> creates real confusion\u2014particularly when an employee lives in one state, reports to a supervisor in another, and accesses systems hosted in a third. <\/span><\/p>\n

In Washington, D.C., for example, the law often looks to where the controlling authority or supervisor resides. That means a Virginia-based employee working remotely could potentially be protected by D.C.\u2019s Human Rights Act simply because their <\/span>boss sits<\/span> in a D.C. office. In contrast, California\u2019s CFRA typically applies to employers with five or more employees nationwide, even if just one works remotely in California. New York\u2019s paid sick leave law triggers based on total employee headcount, regardless of where employees <\/span>are located<\/span>.<\/span><\/p>\n

Not Just Leave Laws: Workers\u2019 Comp and Wage Claims
\n<\/span><\/strong>
\nThe same jurisdictional tangle applies to workers\u2019 compensation insurance, which is state-regulated and location-specific. If a remote employee moves to another state, even temporarily, and suffers a workplace injury there, an employer might find itself out of compliance and uninsured, despite having coverage in the home state.<\/span><\/p>\n

Similarly, wage-and-hour enforcement agencies may assert jurisdiction based on where the work is performed<\/span>. <\/span>A remote worker who <\/span>moves<\/span> to Massachusetts or California\u2014two states with <\/span>aggressive<\/span> wage enforcement regimes\u2014may trigger <\/span>recordkeeping<\/span>, overtime, or meal\/rest break obligations even if the employer never intended to operate in those jurisdictions.<\/span><\/p>\n

Disability Accommodations and Remote Work<\/span><\/strong><\/p>\n

Remote work raises <\/span>important<\/span> considerations under the Americans with Disabilities Act (ADA). In many cases, remote work may <\/span>be considered<\/span> a reasonable accommodation, particularly if the employee can perform essential job functions from home. Blanket refusals to allow remote work\u2014especially when <\/span>previously<\/span> permitted\u2014can lead to legal challenges.<\/span><\/p>\n

More broadly, remote work itself has roots in disability accommodation. Many of the structures now widely used for hybrid and distributed workforces began as accessibility strategies. As such, employers should treat remote work policies not only as productivity <\/span>tools,<\/span> but also as frameworks for compliance and inclusion. Denying remote work without individualized assessment can increase risk under the ADA and parallel state laws.<\/span><\/p>\n

Surveillance and Privacy Compliance<\/span><\/strong><\/p>\n

Employers using digital productivity tools or surveillance software must carefully navigate state privacy and consent law<\/span>s\u2014i<\/span>ncluding notice and affirmative agreement requirements in jurisdictions <\/span>like<\/span> California, Connecticut, and New York.<\/span> These rules vary widely and often require transparency about monitoring methods, data use, and access rights.<\/span><\/p>\n

I-9 Verification and Remote Onboarding<\/span><\/strong><\/p>\n

On the compliance front, employers must ensure they follow DHS guidance for Form I-9 verification when onboarding remote employees. <\/span>This<\/span> includes adhering to evolving rules for document inspection, which now permit alternatives to in-person review under designated circumstances. Failure to comply can lead to fines and delays in workforce activation.<\/span><\/p>\n

Insider Threats, Dual Jobs, and Cross-Border Data Exposure<\/span><\/strong><\/p>\n

Legal risk is only half the story. Employers must also contend with security vulnerabilities introduced by remote work\u2014particularly the growing threat of insider access abuse. Remote onboarding makes it harder to verify identity, monitor behavior, or detect when someone is using multiple logins, multiple devices, or even subcontracting their job to someone else.<\/span><\/p>\n

One of the most alarming examples involved a widespread infiltration scheme by North Korean IT operatives, who posed as remote contractors and embedded themselves into U.S. companies. These operatives used AI-generated resumes, spoofed identities, and third-party U.S. devices to obtain credentials and take advantage of proprietary access.<\/span><\/p>\n

Compounding this risk is the dual employment problem: remote workers taking on multiple roles, sometimes with competitors, while logged into proprietary systems. Without proper controls, this creates exposure to IP theft, trade secret misappropriation, and misuse of company infrastructure.<\/span><\/p>\n

Cross-border concerns add another layer. The U.S. Department of Justice\u2019s recent rule on sensitive personal data prohibits unauthorized access to personal data by individuals or entities affiliated with foreign adversaries. <\/span>The rule explicitly highlights employment and contracting relationships as vectors of risk, reinforcing the importance of knowing not just who your workers ar<\/span>e\u2014b<\/span>ut where they <\/span>are<\/span>,<\/span> and who else might be behind them.<\/span><\/p>\n

Each of these elements underscores a larger truth: employment agreements and company policies must evolve to address the operational and legal complexities of a distributed workforce. To manage risk across jurisdictions, employers should establish core protocols that apply regardless of employee location. Use the checklist below as a starting point for legal and operational safeguards.<\/span><\/p>\n

Checklist<\/span><\/strong><\/p>\n

To manage risk across jurisdictions, employers should establish core protocols that apply regardless of employee location. Use the checklist below as a starting point for legal and operational safeguards:<\/span><\/p>\n