I-9 Compliance for Small Business: A 2026 Guide

Every time you hire someone, you have three business days to complete a two-page federal form. If you get it wrong, the fine starts at $288 per mistake. If you hire someone who is not authorized to work in the U.S., the fine can reach $28,619 per person.

That form is the I-9.

ICE audits of small businesses have increased dramatically in 2025 and 2026. If you have employees and have never thought much about your I-9 process, now is the time.

What the I-9 Is and Why It Exists

The I-9 is a federal form created by the Immigration Reform and Control Act of 1986. Every employer in the United States must complete one for every employee they hire, regardless of the employee's citizenship status. It verifies that your employee is who they say they are and is authorized to work in the United States.

It does not matter if they are part-time or full-time. It does not matter if you have known them for years. If you hire one person to wash dishes three nights a week, you complete an I-9.

The form itself is straightforward. What trips people up is the timeline, the document rules, and a set of common errors that used to be easy to fix and now carry immediate fines.

The Current Form

There are two valid versions of the I-9 in 2026. The recommended version has an edition date of 01/20/2025 and is valid through 05/31/2027. An older edition (08/01/2023) is also still accepted. Both are valid right now, but all electronic systems must update to the 2025 version by July 31, 2026.

You can download the current form directly from USCIS. Do not use a form you printed two years ago without checking the edition date in the lower left corner. An expired form version is its own violation.

The Timeline You Cannot Miss

This is where most small businesses get into trouble.

The I-9 has two sections. Section 1 is completed by the employee. Section 2 is completed by you, the employer.

Section 1: The employee must fill this out no later than the end of their first day of work. Not before you make a hiring decision. After. On or before the end of the first day.

Section 2: You must complete this within three business days of the employee's first day of work. If someone starts on a Monday, you have until Thursday. If they start on a Wednesday, you have until the following Monday. Three business days, not three calendar days. Weekends do not count.

A restaurant owner in Costa Mesa told me she had been completing the I-9 during orientation but leaving Section 2 blank until the employee's second week, thinking she could finish it when she had more time. That is a violation on every single form. Do not do that.

What Documents to Accept

The I-9 uses a three-list system.

List A documents prove both identity and work authorization. The most common is a U.S. passport. A Permanent Resident Card (Green Card) and an Employment Authorization Document also fall here. An employee who presents a List A document is done. You need nothing else from them.

List B documents prove identity only. A state driver's license, a state ID card, or a school ID with a photo all qualify.

List C documents prove work authorization only. An unrestricted Social Security card, a birth certificate, or a U.S. Citizen ID card all work.

If the employee does not provide a List A document, they must provide one document from List B AND one from List C.

Some common mistakes:

Accepting an expired document. Expired passports and expired licenses do not count unless there is an official automatic extension in effect, which is rare.

Accepting two documents from the same list. A Social Security card plus a birth certificate is List C plus List C. That is not a valid combination.

Accepting a restricted Social Security card. Cards stamped "NOT VALID FOR EMPLOYMENT" or "VALID FOR WORK ONLY WITH DHS AUTHORIZATION" are not valid for List C.

You are not supposed to tell the employee which documents to bring. They choose. You review what they present and determine if it meets the requirements.

How ICE Enforcement Changed in 2026

For most of I-9 history, if an auditor found a paperwork error, you had 10 days to correct it. That cure period still exists for some errors. But in March 2026, ICE reclassified more than 10 error categories that previously qualified for the cure period as substantive violations subject to immediate fines.

Those errors now carry fines of $288 to $2,861 per form with no correction window.

The enforcement environment has also intensified. In the first half of 2025, ICE issued Notices of Inspection at roughly ten times the rate of 2024, and that pace has continued into 2026 according to SHRM's tracking of the new ICE enforcement policy. The restaurant industry was among the first sectors targeted, with Homeland Security Investigations agents visiting over 100 restaurants for I-9 inspections in a single month in 2025.

If you run a restaurant, café, salon, or retail shop in Southern California, this is not abstract policy news. Audits are happening in this region.

Record Retention Rules

Once you complete the I-9, you have to keep it. Here are the rules:

Retain the I-9 for three years from the date of hire, or one year after the employee's last day of work, whichever is later.

If someone works for you for one month, you keep their I-9 for three years from their hire date. If someone works for you for five years, you keep their I-9 for one year after they leave, which is six years total from hire.

You do not file I-9s with any government agency. You keep them yourself. If you are audited, you must produce the requested forms within three business days of receiving a Notice of Inspection.

Store them separately from the rest of the employee's personnel file. If ICE issues an inspection notice and you hand over a packet that includes medical information or background check results alongside the I-9, you have created additional legal exposure. Keep the I-9s in their own binder, organized by employment status: current employees in one section, former employees in another. The employee handbook guide covers other required employer documents and where they fit in your broader recordkeeping system.

Errors That Now Carry Immediate Fines

The March 2026 policy change matters because of which specific errors moved into the substantive category. These are the ones that show up most often in small businesses:

Missing signature on Section 1 or Section 2. Every section must be signed. If the employee forgot to sign Section 1, or you forgot to sign Section 2, that is now a substantive violation.

Incorrect date in Section 2. The date you enter in Section 2 must reflect when you actually reviewed the documents, not the employee's hire date. These are often different days, and that difference matters.

Wrong form version. Using an expired form version that was not the 08/01/2023 edition is a technical violation. Check the edition date in the lower left corner before every use.

Section 1 completed after the first day. If an employee does not fill out Section 1 until the morning of day two, that is a timing violation, even if it is only by a few hours.

Accepting the wrong document combination. Two documents from the same list, or an expired document that is not covered by an extension, puts you out of compliance even if you acted in good faith.

This is not a complete list, but these are the errors that appear most consistently across audited businesses.

A Simple Process That Prevents Most Problems

Most of the errors above come from not having a consistent process. Here is one that works for a small business with hourly staff.

First, before the new hire's start date, send them a short note explaining that on their first day they will need to bring documents to verify their identity and work authorization. Do not list specific documents. Federal law prohibits you from specifying which documents they must bring. Just let them know they will need to be prepared.

Second, on the first day, have the employee complete Section 1 before they start their first shift. Sit down with them, hand them the form, and answer questions. This takes five minutes.

Third, review the documents they present. Check that they are not expired. Confirm the combination is valid under the three-list system. Do not accept anything that does not meet the requirements.

Fourth, complete Section 2 yourself within three business days. Write the document title, issuing authority, document number, and expiration date exactly as they appear on the document. Sign and date with the actual date you are completing the form.

Fifth, file the completed I-9 in your dedicated I-9 binder, separate from other personnel records.

A salon owner in Irvine I work with keeps a color-coded folder: current employees in green, terminated employees in red. She audits it every January to identify forms that have passed their retention date and can be destroyed. Simple and effective.

This kind of consistent process prevents the errors that surface during audits. For the broader new hire experience, the onboarding guide for small businesses covers the first 90 days in detail.

The Remote Hire Question

If you hire someone who is not physically at your location on their first day, you can still complete the I-9 without meeting in person, but only if you are enrolled in E-Verify.

Since August 2023, employers enrolled in E-Verify can use an authorized alternative procedure to examine I-9 documents remotely. The employee transmits scans of their documents, and you review them on a live video call. You note on the form that you used the alternative procedure.

If you are not enrolled in E-Verify, you must examine the physical documents in person. You can designate an authorized representative to do the in-person review on your behalf, such as a notary or another employer, but you are still legally responsible for any errors they make.

E-Verify Is Optional but Worth Considering

E-Verify is a free federal system that lets you electronically confirm that a new hire's documents match government records. It is voluntary for most California employers, though federal contractors and some other categories must use it.

Using E-Verify does not replace the I-9. You still complete the I-9 first, then run the verification. What E-Verify adds is a layer of electronic confirmation and, if you use the authorized alternative procedure, the ability to do remote document inspection.

Given the current enforcement climate, some small business owners in food service and retail are enrolling voluntarily. It is a reasonable defensive step if you are doing a lot of hiring or if you have had any past compliance issues.

What Happens During an Audit

If ICE issues a Notice of Inspection, you have three business days to produce the I-9 forms requested. They will specify which employees or what date range they want to review.

An auditor goes through the forms for completeness, correct timing, and document validity. If they find violations, they issue a Notice of Intent to Fine. You have a chance to respond and contest findings, but the burden is on you to demonstrate that a violation did not occur.

The fines add up faster than most people expect. A restaurant with 15 employees and an inconsistent I-9 process could realistically have errors on 8 to 10 forms. At $288 minimum per form, that is $2,300 to $2,900 before any aggravated categories. Systemic violations or a pattern of non-compliance attract the higher end of the range, which is $2,861 per form.

That is a significant hit for a business running on 10 to 15 percent margins. The fix costs nothing but time.

Other Hiring Compliance to Have in Order

The I-9 does not exist in isolation. If ICE is reviewing your workforce, so may other agencies depending on what they find. Common issues that come up alongside I-9 audits include misclassified workers, wage and hour violations, and improper background check procedures.

The California background checks guide covers the specific rules California employers must follow when running checks on applicants, including timing restrictions and what you can and cannot use in a hiring decision. The hiring mistakes guide covers the broader set of documentation and process errors that small business owners most commonly make.

If you are using My Friendly Staff to find and screen applicants, build the I-9 step into your standard new hire workflow the same way you would any other first-day task. It takes five minutes and the penalty for skipping it is not worth finding out.

The One Thing to Do This Week

If you have employees and you have never audited your I-9 records, pull them out and check three things:

Do you have a form for every current employee?

Is Section 2 dated within three business days of each employee's start date?

Is every section signed by both the employee and you?

If you find missing forms or unsigned sections, talk to an employment attorney before trying to backfill or reconstruct anything. Backdated forms are fraud. An attorney can walk you through how to properly document and disclose errors in a way that does not create additional legal exposure.

Getting this right does not require a compliance department. It just requires a consistent process and a binder you actually maintain.