The conversation around immigration can feel volatile, but the compliance burden for employers has stayed clear: you must be able to prove, quickly and cleanly, that your hiring and reverification processes meet federal requirements. Where organizations get into trouble is rarely about intent; it’s about process drift, forms completed a day late, records stored in different places, reverifications left to memory, supervisors onboarding “their way.” When a Notice of Inspection (NOI) arrives, those small cracks turn into a sprint. By regulation, employers generally have at least three business days to produce the Forms I-9 and supporting records requested by Immigration and Customs Enforcement (ICE). Whether that window feels reasonable or impossible depends entirely on how your process runs on an ordinary Tuesday.
This article offers a pragmatic view of what has changed, what hasn’t, and how small and mid-sized businesses can reduce exposure without adding bureaucracy. It is not about politics; it is about operational resilience under a set of rules that are knowable, documentable, and auditable.
Content
- The rules are stable, enforcement is faster
- The risk profile: process gaps, not bad actors
- The operating model that actually works
- Remote work and multi-site realities
- What “good” looks like during an NOI
- Governance without the bureaucracy
- The state-law watchlist
- Bottom line for leaders
- Frequently Asked Questions: Immigration Compliance & Employer Risk (2026)
The rules are stable, enforcement is faster
Form I-9 remains the backbone of employment eligibility verification. All U.S. employers must complete an I-9 for every new hire, citizens and noncitizens alike, and must follow specific timing: the employee completes Section 1 no later than the first day of employment; the employer completes Section 2 within three business days of the employee’s start date. These are not best practices; they are requirements.
Recordkeeping expectations are equally explicit. You must retain each I-9 for three years after the date of hire or one year after employment ends, whichever is later. That seemingly simple rule drives everything from purge schedules to how you organize terminated-employee files. It is one of the most common and most preventable sources of risk cited during inspections.
What feels different in 2026 is not a wholesale rewrite of the law but a modernization of how compliance can be achieved, and verified. The Department of Homeland Security (DHS) finalized a DHS-authorized alternative procedure that allows qualified E-Verify participants to remotely examine identity and work-authorization documents, provided they follow specific steps and apply the procedure consistently at a given hiring site. That option, effective August 1, 2023, didn’t loosen standards; it gave employers a compliant path to meet them in distributed and hybrid workplaces.
USCIS also released a streamlined, one-page Form I-9 (edition date 08/01/2023) with clearer instructions and a checkbox to indicate when the DHS-authorized remote examination procedure was used. The form’s edition remains current into 2026 (with updated expiration guidance), which simplifies training and reduces completion errors, if you have disciplined adoption.
Finally, note the sunset of the COVID-19 “flexibilities.” Remote inspections done under those temporary measures required physical inspection by August 30, 2023, unless the employer qualified and opted into the new alternative procedure going forward. If you still have a handful of legacy files that were never resolved, that’s a priority fix.
The risk profile: process gaps, not bad actors
In ICE inspections, the pattern is familiar. Employers can’t locate a fraction of I-9s within the three-day window. Hire dates and Section-2 completion dates don’t align. Reverification reminders exist in someone’s inbox but not in a system. HRIS and payroll rosters don’t reconcile to the I-9 inventory, so producing a clean list of active and terminated employees takes days, not hours. These are operational issues, and they are precisely what inspectors look at when they request supporting documentation such as payroll lists, current employee rosters and organizational records.
Add a layer of state requirements and the stakes rise. While E-Verify is not mandated under federal law for all employers, numerous states impose E-Verify obligations on certain employers, public contractors, or, more broadly, private employers. The specifics change over time, and the prudent move is to treat E-Verify as a compliance domain you must monitor, particularly if you operate across state lines.
In this environment, “audit-ready” means you can produce complete I-9s and requested supporting records quickly, your dates align, your policies match your practices, and your managers follow one consistent onboarding flow. That is the foundation; everything else is optimization.
The operating model that actually works
1) One front door for hiring.
Select a single, documented I-9 workflow for each hiring site (in-person or the DHS-authorized remote procedure where eligible). Consistency is not about rigidity; it is about clarity. When every manager follows the same steps with the same storage location and the same reverification prompts, error rates drop. If you are an E-Verify participant in good standing and choose to use the alternative procedure, apply it uniformly at that site; cherry-picking will undermine defensibility.
2) Central, role-based custody of records.
I-9s should live in a canonical repository with access governed by role, not convenience. That repository, digital or physical, should be paired with a retention engine that calculates the “three years after hire or one year after termination” threshold automatically, so your team stops guessing and starts scheduling defensible purges.
3) Close the loop between systems.
Treat your HRIS, payroll, and I-9 repository as a single source of truth. On a monthly cadence, reconcile active and terminated employee lists against I-9 inventory. The goal is not merely to find missing forms; it is to ensure your population universe is correct before an inspector asks for it. ICE can and does request payroll extracts and employee lists as part of an inspection.
4) Time your process to the inspection window.
Design your normal operations so that an NOI feels like an ordinary large request. Practically, that means keeping a ready-to-pull packet: the I-9s themselves, active and terminated rosters, a recent payroll extract and a one-page SOP naming the NOI response owner, legal contacts, where records live, and who speaks with investigators. By regulation, you get at least three business days; building to a 24-hour internal standard is a powerful stress-reducer.
5) Train managers on the new form, once, well.
The current one-page I-9 (08/01/2023 edition) is more usable than prior versions, including clearer instructions and supplements for reverification and preparer/translator use. Use that to your advantage with a short, scenario-based training and a “common errors” checklist. The effort pays for itself the first time a location passes an internal spot check without remediation.
Remote work and multi-site realities
Distributed teams complicate in-person document inspection. That’s exactly why DHS created the alternative remote examination path for qualified E-Verify employers. But “remote” doesn’t mean “casual.” The rule requires specific steps, including live video interaction, document retention (front and back where applicable), and consistent application across new hires at the site that uses the procedure. If your workforce is mixed, some on-site, some remote, resist the urge to let each supervisor choose a method. Instead, define which sites use the alternative procedure and which require in-person review, align your SOPs, and monitor adherence.
For employers who relied on the pandemic-era flexibilities, ensure every legacy case was closed properly in 2023. If you discover stragglers during an internal audit in 2026, treat them as exceptions to be corrected and documented immediately, and consider counsel for remediation strategy.
What “good” looks like during an NOI
Imagine the NOI lands on a Wednesday. By noon, your response owner has notified counsel, pulled the I-9s from the central repository, exported an active and terminated roster, and matched them against payroll. By Thursday afternoon, discrepancies are investigated and annotated; by Friday, a complete, coherent package is ready. No frantic calls to store managers. No shadow spreadsheets. That discipline is not overkill. It is what inspectors expect when they request forms, payroll, and lists of current employees, routinely part of the process.
The flip side is equally instructive: a location keeps I-9s in a locked desk; another stores them on a shared drive labeled “HR”; reverifications live in a calendar only one person can see; your HRIS reports have employees coded as active who left last quarter. Each issue is fixable. Together, they make the three-day window a fire drill.
Governance without the bureaucracy
A small employer does not need a compliance department to get this right. Three governance mechanisms are sufficient:
- Quarterly inventory and reconciliation. Treat it like closing your books. Pull the roster, cross-check with I-9s, fix exceptions, and log the review.
- An annual tabletop exercise. Simulate an NOI. Time the pull. Note gaps and assign owners. Update the SOP.
- A living SOP and training refreshers. When USCIS updates the I-9 or DHS modifies procedures, your SOP and briefings update too. The 2023 form changes and the DHS-authorized remote procedure were material; they warranted a retraining moment.
These rhythms are small on paper and outsized in effect. They convert compliance from a fear into a routine.
The state-law watchlist
Finally, keep one eye on state-level developments around E-Verify and employment-related immigration rules. Several states require E-Verify in some form (often for public employers or contractors; some extend to private employers). Because these policies evolve, use a reputable, nonpartisan resource to monitor changes and adjust your hiring site SOPs accordingly. This is less about being first to adopt a new rule and more about not discovering, after an award, that your public contract includes an E-Verify obligation you haven’t implemented.
Bottom line for leaders
The most durable way to lower immigration-related risk is to make the right process the easy process. Standardize the front door. Centralize records with role-based access. Reconcile routinely. Train once, well, on the current form and procedures. And practice responding to an NOI before you receive one. The federal expectations are clear, and your organization can meet them without slowing the business.
Are Your Ready For An ICE Visit?
From I-9/E-Verify updates to visa tracking and audit-ready onboarding. Get a plain-English assessment of risk hot spots, and expert tips so you can protect your people and your business without derailing daily operations.
Take Your 30 Second HR Risk Assessment →Frequently Asked Questions: Immigration Compliance & Employer Risk (2026)
Are small businesses required to complete I-9 forms?
Yes. All U.S. employers must complete Form I-9 for every employee, regardless of size or industry.
Has enforcement increased in 2026?
Yes. Enforcement trends show increased scrutiny on employer documentation practices, especially consistency and retention.
What creates the most risk during an audit?
Incomplete I-9s, inconsistent processes across locations, and missing reverification tracking are among the most common triggers.
Does using payroll software guarantee compliance?
No. Software supports compliance, but it does not replace proper HR structure, documented processes, or advisory guidance.
How long must I-9s be retained?
Three years after the date of hire or one year after termination, whichever is later.
When should a business seek HR Advisory support?
Before an issue escalates. Advisory is most effective when used proactively, not reactively.
If you’re also evaluating how your payroll and HR systems support compliance over time:
Explore Payroll & HRIS
If you need help with workforce management, please contact PeopleWorX at 240-699-0060 | 1-888-929-2729 or email us at HR@peopleworx.io
