I-9 Compliance for Small Business: Forms, E-Verify, and Audits in 2026

USCIS Form I-9.

---

By Alex Santos, M.B.A. • Founder, Nimble Advisors

Last updated: May 2026

Every U.S. employer must complete Form I-9 for every new employee to verify identity and authorization to work, regardless of company size or the employee's citizenship. Section 1 is completed by the employee on or before their first day of work; Section 2 is completed by the employer within three business days of the start date. The current Form I-9 edition is dated 01/20/25 with an expiration of 05/31/2027 — and after July 31, 2026, this is the only acceptable version for new hires. I-9s must be retained for the longer of three years after hire or one year after termination. ICE penalties for substantive violations in 2026 range from $288 to $2,861 per form; knowing-hire violations can reach $28,619.

I-9 compliance used to be one of the lower-risk areas of HR for an SMB. That changed materially in 2025 and 2026. ICE audit volume is up roughly tenfold from 2024 baselines, the One Big Beautiful Bill Act funded 10,000 new enforcement officers, and in April 2026 ICE quietly reclassified several common paperwork errors from "technical" (correctable within 10 days) to "substantive" (immediately fineable). The base rules haven't changed. The cost of getting them wrong has.

This guide walks through the I-9 process from start to finish, explains the 2026 form transition, covers E-Verify (including Florida's mandate), and gives you a practical framework for a self-audit before ICE shows up at your door. For the broader compliance picture, see our HR Compliance for Small and Mid-Sized Businesses guide. For the related question of which workers need an I-9 at all (employees yes, contractors no), see Employee vs. Independent Contractor: Classification Rules.

This is an educational resource, not legal advice. For specific situations, especially anything involving an active investigation, consult employment or immigration counsel immediately.

What Changed in 2025–2026

Three shifts make 2026 I-9 compliance materially different from prior years.

A new Form I-9 edition with a hard deadline. The current Form I-9 is dated 01/20/25 with an expiration of 05/31/2027. Earlier editions (dated 08/01/23 with various printed expirations) are still acceptable until their printed expiration dates — but as of August 1, 2026, only forms showing the 05/31/2027 expiration date may be used for new hires. Employers using electronic I-9 systems must confirm their vendor has updated the form by July 31, 2026.

ICE reclassified routine errors as substantive. In April 2026, ICE updated its I-9 Inspection guidance to treat several categories of error as substantive violations — meaning they no longer benefit from the traditional 10-business-day correction window. The reclassified items include certain electronic-system audit-trail and signature failures, and failures to properly indicate when documents were reviewed remotely under the alternative procedure. Substantive violations carry per-form penalties immediately.

Enforcement activity has intensified. ICE has publicly tied its increased audit volume to OBBBA funding for additional enforcement officers and to a stated focus on industries with historical compliance issues (construction, hospitality, manufacturing, staffing, retail, agriculture). Even employers outside those industries should expect more scrutiny than in prior years.

The combination is straightforward to summarize: more audits, harder to fix mistakes mid-audit, larger penalties when errors are found. Self-correction in advance is the single highest-leverage investment an SMB can make in this area right now.

Who Must Complete Form I-9

Every employer in the United States must complete Form I-9 for every employee hired, regardless of:

• The employer's size
• The employee's citizenship (U.S. citizens included)
• Whether the position is full-time, part-time, temporary, or seasonal

The narrow exceptions:

• Independent contractors do not require an I-9. (If you're not sure whether someone is genuinely a contractor or actually a misclassified employee, that's its own significant compliance question — see Employee vs. Independent Contractor: Classification Rules before assuming contractor status removes the I-9 obligation.)
• Casual domestic employees (someone doing sporadic, irregular, intermittent household work) are exempt.
• Employees hired before November 7, 1986 (the IRCA effective date) are exempt — vanishingly rare in practice today.

If the worker is on your payroll and receives a W-2, they need an I-9. There are no exceptions for "we know them," "they're family," or "they're only here for a few weeks."

The Three Sections of Form I-9 and Their Timing

Form I-9 has three sections, each with strict timing requirements that ICE pays close attention to.

Section 1: Employee Information and Attestation

Completed by the employee, on or before their first day of work. The employee attests under penalty of perjury to their identity and work authorization status (U.S. citizen, noncitizen national, lawful permanent resident, or alien authorized to work). The employee selects only one citizenship status.

Common SMB mistake: letting the employee complete Section 1 days after starting work. Section 1 should be done on day one at the latest.

Section 2: Employer Review and Verification

Completed by the employer or an authorized representative, within three business days of the employee's first day of work. The employer must:

1. Physically examine documents from the Lists of Acceptable Documents (or examine them remotely under the alternative procedure if eligible — see below).
2. Record the document title, issuing authority, document number, and expiration date.
3. Sign and date Section 2.

The employer must accept any document(s) the employee chooses to present from the Lists of Acceptable Documents, as long as the documents reasonably appear to be genuine and relate to the employee. Employers may not specify which documents an employee must present — doing so is an unfair documentary practice and itself a violation.

Supplement B: Reverification and Rehires

Replaces the old Section 3 (in the 01/20/25 edition). Used to reverify employees whose work authorization expires and to document rehires within three years of the original I-9. Reverification must be completed before the work authorization expires, not after.

Note: U.S. citizens and lawful permanent residents never require reverification. Only employees whose work authorization is tied to a temporary status need it.

The Current Form I-9 Edition (2026)

As of May 2026, three valid versions of Form I-9 are in circulation. The differences matter because using the wrong version after July 31, 2026 is itself a substantive violation.

Edition Date	Expiration Date	Status
01/20/25	05/31/2027	Current — acceptable indefinitely until USCIS releases a successor
08/01/23	05/31/2027	Still acceptable through 05/31/2027
08/01/23	07/31/2026	Acceptable only through July 31, 2026 — must be replaced by August 1

How to verify the version you're using: The edition date appears in the bottom-left corner of the form (e.g., "Form I-9 Edition 01/20/25"). The expiration date appears in the top-right corner. Don't rely on the file name — actually look at the form itself.

If you use an electronic I-9 system: Confirm with your vendor that the form generated in your system shows the 05/31/2027 expiration date. Vendor marketing language claiming "compliance" is not the same as the system actually serving the current version. Many SMB I-9 systems have not been updated as of mid-2026.

Forms already completed on an earlier edition remain valid. You do not need to redo I-9s completed on an earlier edition while that edition was current. The transition rule applies only to new hires.

Lists of Acceptable Documents

Employees present documents from one of three lists to establish identity and work authorization:

• List A — documents that establish both identity and work authorization (e.g., U.S. Passport, Permanent Resident Card, Employment Authorization Document)
• List B — documents that establish identity only (e.g., state-issued driver's license or ID card, school ID with photograph)
• List C — documents that establish work authorization only (e.g., unrestricted Social Security card, certified birth certificate, U.S. citizen ID card)

An employee may present one List A document, or one List B and one List C document in combination.

The employer's role is to accept whatever the employee presents, provided the documents reasonably appear genuine and relate to the person. The single most common SMB error here is overreach — asking for "your Social Security card and your driver's license" or "your passport, please" instead of letting the employee choose. That overreach is a documentary practice violation, separate from any underlying I-9 paperwork issue.

The current Lists of Acceptable Documents are published on the USCIS I-9 Central site and on the last page of the Form I-9 instructions.

Remote Verification: The DHS Alternative Procedure

Since August 1, 2023, certain employers may verify Section 2 documents remotely under DHS's alternative procedure — provided they are enrolled in E-Verify in good standing at the time of verification.

The remote procedure requires:

1. The employee transmits clear copies of the documents (front and back) to the employer
2. The employer examines the copies and conducts a live video interaction with the employee, during which the employee presents the actual documents
3. The employer creates an E-Verify case for the employee
4. The employer indicates on Form I-9 that the alternative procedure was used (checkbox on the form)
5. The employer retains the document copies for the duration of the I-9 retention period

Critical 2026 update: Failure to check the alternative-procedure indicator on the form, or using the remote procedure without being enrolled in E-Verify at the time, are now substantive violations under ICE's April 2026 guidance. These were previously treated as technical errors with a 10-day correction window. They are not anymore.

Employers not enrolled in E-Verify must verify documents in person. There is no exception for remote employees — if you hire someone remotely and are not in E-Verify, you must either enroll in E-Verify before completing Section 2, or use an authorized representative to physically examine the documents on your behalf. Authorized representatives can be anyone the employer designates (a notary, a current employee, a contracted vendor) — but the employer remains liable for any errors the representative makes.

E-Verify

E-Verify is the federal electronic system that compares Form I-9 information against Department of Homeland Security and Social Security Administration records to confirm employment eligibility. Enrollment is:

• Voluntary for most private employers federally
• Mandatory for federal contractors with the FAR E-Verify clause
• Mandatory under state law in a growing list of states, including Alabama, Arizona, Florida, Georgia, Mississippi, North Carolina, South Carolina, Tennessee, and Utah, with thresholds and scope varying by state

Florida's E-Verify mandate applies to private employers with 25 or more employees for all new hires made on or after July 1, 2023 (Fla. Stat. § 448.095). Penalties include suspension of business licenses for repeat violations, and a presumption that the employer knowingly hired an unauthorized worker if E-Verify is not used as required. Florida is one of the strictest state mandates in the country.

Enrollment in E-Verify is free at e-verify.gov. The system is generally straightforward to use, but creates its own compliance obligations — including time-bound responses to tentative nonconfirmations, anti-discrimination requirements during the resolution process, and recordkeeping. Employers should not enroll without understanding the operational commitments involved.

I-9 Retention Requirements

Employers must retain each employee's Form I-9 for the longer of:

• Three years after the date of hire, or
• One year after the date employment ends

Some practical examples: an employee who works for one year must have their I-9 retained for three years after hire (the longer period). An employee who works for ten years must have their I-9 retained for one year after termination (the longer period).

Best practices for I-9 storage:

• Maintain a separate I-9 binder or electronic file system distinct from personnel files. During an ICE audit, you may be required to produce only I-9s — not full personnel records. A separate system limits exposure and speeds production.
• Store current employees' I-9s separately from terminated employees' I-9s. This makes ICE production easier and makes scheduled disposal of expired records straightforward.
• Maintain a purge schedule. I-9s past the retention period should be destroyed, not kept indefinitely. Retaining expired I-9s creates unnecessary exposure if errors are present in those old forms.
• If you use an electronic I-9 system, confirm it meets DHS standards for indexing, audit trails, secure storage, and electronic signatures. As of April 2026, electronic system failures are substantive violations — including weak audit trails, improper signature protocols, and security control gaps.

Technical vs. Substantive Violations (Updated April 2026)

The distinction between "technical" and "substantive" I-9 violations drives the entire ICE penalty framework. The 2026 reclassification matters because it shifts items previously fixable into items immediately fineable.

Technical violations — fixable within a 10-business-day correction window after ICE issues a Notice of Technical or Procedural Failures. Examples (post-April 2026):

• Failure to date Section 1 (when the rest of Section 1 is properly completed)
• Failure to record a middle initial
• Minor omissions in document description fields that don't go to the substance of verification

Substantive violations — immediately fineable, no correction window. The April 2026 ICE guidance expanded this category to include:

• Failure to complete Section 2 within three business days of hire
• Failure to sign Section 2
• Failure to indicate on the form that the alternative (remote) procedure was used
• Use of the alternative procedure without active E-Verify enrollment at the time
• Electronic system failures: missing audit trails, improper signature protocols, security control gaps under DHS standards
• Use of an expired or non-current Form I-9 edition for new hires
• Failure to reverify expiring work authorization

If you have an electronic I-9 system, the ICE update on system-level requirements is the single most important development for your operation. A system that "worked fine" in 2024 may now produce substantive violations on every I-9 it processes if the audit trail or signature protocol doesn't meet current DHS standards.

2026 Penalty Ranges

Civil penalties for I-9 violations are inflation-adjusted annually. As of 2026:

Violation Type	Minimum Per Form	Maximum Per Form
Substantive paperwork violations	$288	$2,861
Knowing hire / continuing to employ — first offense	$716	$5,724
Knowing hire / continuing to employ — second offense	$5,724	$14,308
Knowing hire / continuing to employ — subsequent	$8,586	$28,619

ICE calculates the per-form penalty by dividing the number of substantive violations by the total number of I-9s reviewed (the "violation percentage"), then mapping that percentage to a base penalty within the range above. ICE then adjusts the base penalty up or down by as much as 25% based on five enhancement/mitigation factors:

1. Business size
2. Good faith of the employer
3. Seriousness of the violations
4. Whether the employer is currently employing unauthorized workers
5. Prior history of violations

A small business with 50 employees and a 10% substantive error rate (5 defective forms) could face paperwork penalties between roughly $1,440 and $14,300 even with no unauthorized workers involved — before the five-factor adjustment.

Common SMB I-9 Mistakes

In our compliance reviews, six patterns drive most I-9 findings:

1. Section 2 completed late. Three business days isn't a guideline — it's the regulation. A Section 2 signed on day five is a substantive violation, and the date written on the form makes the violation self-evident.
2. Missing signatures or dates. The single most common error category. The employee must sign and date Section 1; the employer must sign and date Section 2 (and Supplement B if applicable).
3. Overreaching on documents. Asking for specific documents ("can I see your Social Security card?") rather than letting the employee choose from the Lists of Acceptable Documents. This is a documentary practice violation under separate IRCA provisions.
4. I-9s stored with personnel files. Co-mingling I-9s with personnel records creates exposure during an ICE audit and makes production unnecessarily messy.
5. Failure to reverify expiring work authorization. Reverification must happen before expiration, using Supplement B. Reverification after expiration creates a continuing-to-employ exposure.
6. Out-of-date forms or electronic systems. Using an expired Form I-9 edition is itself a substantive violation, as is operating an electronic system that doesn't meet DHS audit-trail and signature standards.

How to Run an I-9 Self-Audit

A self-audit is the most effective single thing an SMB can do to limit ICE exposure. The DOJ has issued guidance on conducting internal I-9 audits that provides legal cover for the process if followed correctly. The basics:

1. Pull every I-9 on file. Include current employees and any terminated employees still within the retention period.
2. Compare each I-9 to the active payroll roster. Identify any current employees who don't have an I-9 on file (a substantive violation per missing form) and any I-9s on file for individuals who are no longer current employees.
3. Review each I-9 against the rules. Section 1 complete and timely? Section 2 complete, timely (within 3 business days), and signed? Documents recorded properly? Alternative procedure indicator checked where applicable?
4. Correct what's properly correctable. Technical errors can be corrected by drawing a single line through the error, entering the correction, and initialing and dating the change. Do not backdate anything — that converts a fixable error into a fraud exposure. For substantive errors that cannot be corrected, document the error and your good-faith efforts; consult immigration counsel about whether to redo the form.
5. Document the audit itself. A written record of when the audit was performed, what was reviewed, what was corrected, and who performed the audit is one of the strongest pieces of evidence of good-faith compliance — and can mitigate penalty ranges in the five-factor calculation above.
6. Establish a recurring schedule. Annual is the minimum; semi-annual is appropriate during periods of rapid hiring, expansion into new states, or after any significant change in HR personnel.

What to Do If You Receive a Notice of Inspection

If ICE serves you with a Notice of Inspection (NOI), you have three business days to produce the requested records — typically Forms I-9 and supporting payroll documentation, employee rosters, and E-Verify records. The first 24 hours are critical:

1. Call immigration counsel immediately. This is not a self-managed situation. The cost of counsel is trivial compared to the cost of mistakes during the response.
2. Preserve everything. Do not alter, correct, or destroy any I-9 between receipt of the NOI and counsel's review. Mid-audit corrections are universally treated as obstruction or evidence of fraud.
3. Designate a single point of contact for ICE communications. Limit the number of employees aware of the audit.
4. Begin assembling the records counsel will need to review before production.

The 10-business-day correction window applies only to specific technical violations identified by ICE in a Notice of Technical or Procedural Failures. It does not apply to any of the items reclassified as substantive in April 2026. Self-correction outside that formal window is unlikely to be credited as good faith.

When to Bring in Outside Help

For most SMBs, baseline I-9 compliance is manageable internally with a checklist, a binder, and an annual self-audit. The threshold for bringing in outside help is usually:

• You've never run a formal I-9 self-audit
• You've crossed (or are about to cross) the Florida 25-employee E-Verify threshold (or another state's mandate)
• You're operating an electronic I-9 system and don't know whether it meets the April 2026 DHS standards
• You're in an industry seeing elevated ICE enforcement (construction, hospitality, manufacturing, staffing, retail, agriculture)
• You're preparing for due diligence, an M&A transaction, or a financing event
• You've received a Notice of Inspection or any other ICE communication

→ For the broader compliance picture beyond I-9, see HR Compliance for Small and Mid-Sized Businesses. For the related question of whether a worker should even be on an I-9 (employee) or excluded (contractor), see Employee vs. Independent Contractor: Classification Rules.

Frequently Asked Questions

Which version of Form I-9 should I use in 2026?

As of May 2026, the current edition is dated 01/20/25 with an expiration of 05/31/2027. Two earlier 08/01/23 editions remain valid through their respective printed expirations (one expires 05/31/2027 and one expires 07/31/2026). After July 31, 2026, only forms showing the 05/31/2027 expiration date may be used for new hires. The edition date appears in the bottom-left corner of the form; the expiration date appears in the top-right corner.

Do I need to complete a Form I-9 for independent contractors?

No. Form I-9 is required only for W-2 employees. Independent contractors do not require an I-9. However, if a worker classified as a contractor is actually a misclassified employee under federal or state law, you may face I-9 violations on top of the misclassification exposure when the worker's status is corrected. Verify classification before assuming contractor status removes the I-9 obligation.

How long must I keep an employee's I-9 after they leave?

You must retain the I-9 for the longer of three years after the date of hire or one year after the date of termination. For an employee who worked one year, the three-year-from-hire rule controls (so two years after termination). For an employee who worked ten years, the one-year-from-termination rule controls.

Is E-Verify mandatory for my business?

E-Verify is voluntary federally for most private employers, but mandatory under state law in a growing number of states. In Florida, private employers with 25 or more employees must use E-Verify for all new hires under Fla. Stat. § 448.095. Several other states (Alabama, Arizona, Georgia, Mississippi, North Carolina, South Carolina, Tennessee, Utah) have their own mandates with varying thresholds.

Can I verify documents remotely?

Yes — but only if you are enrolled in E-Verify in good standing at the time of verification. Under DHS's alternative procedure, you may examine document copies during a live video interaction with the employee, create an E-Verify case, and indicate on the form that the alternative procedure was used. Failure to check the indicator on the form, or use of the alternative procedure without active E-Verify enrollment, are now substantive violations under ICE's April 2026 guidance. Employers not enrolled in E-Verify must verify in person, either themselves or through an authorized representative.

What are the penalties for I-9 violations in 2026?

Substantive paperwork violations range from $288 to $2,861 per form. Knowing-hire or continuing-to-employ violations range from $716 (first offense, low end) to $28,619 (subsequent offenses, high end) per worker. ICE calculates a violation percentage by dividing the number of substantive violations by the total I-9s reviewed, maps that percentage to a base penalty range, and adjusts up or down by as much as 25% based on five factors: business size, good faith, seriousness, presence of unauthorized workers, and prior history.

What's the difference between a technical and substantive I-9 violation?

Technical violations are correctable within a 10-business-day window after ICE issues a Notice of Technical or Procedural Failures. Substantive violations are immediately fineable with no correction window. In April 2026, ICE reclassified several previously technical errors as substantive — including failure to sign Section 2, failure to indicate alternative procedure use, electronic system audit-trail and signature failures, and use of an expired Form I-9 edition. The functional implication: many errors that could once be fixed mid-audit are now immediately fineable.

Should I run a self-audit of my I-9s?

Yes. An internal I-9 self-audit, conducted under the DOJ's published guidance, is the single highest-leverage compliance investment most SMBs can make. It surfaces fixable errors before ICE does, creates documented evidence of good-faith compliance that mitigates penalty calculations, and identifies systemic issues (electronic system gaps, training gaps) that would otherwise compound. Annual self-audits are the minimum; semi-annual during periods of rapid hiring or after personnel changes.

This article is provided for general educational purposes and does not constitute legal advice. I-9 and immigration compliance rules are technical and frequently updated. For situations involving an active investigation, Notice of Inspection, or any other ICE communication, consult immigration or employment counsel immediately.

Last reviewed: May 2026. Next scheduled review: November 2026.