If you think of Form I-9 as a routine piece of onboarding paperwork, it’s time to rethink that. In 2026, it’s become one of the highest-risk documents a small business handles, and the rules around what counts as a “minor mistake” have gotten a lot less forgiving.
Here’s what’s changed, the most common mistakes small businesses are still making, and how to protect your business before an audit ever lands on your desk.
Why I-9 Compliance Got a Lot More Serious This Year
For years, many I-9 mistakes fell into a “technical” category. If an error was flagged during an audit, employers typically had a 10-business-day window to fix it before facing a penalty.
That’s no longer guaranteed. In March 2026, immigration authorities reclassified several common paperwork errors from “technical” to “substantive,” which means many mistakes that used to be correctable are now immediately fineable the moment they’re discovered.
At the same time, enforcement has ramped up significantly. Audit volume is up roughly tenfold compared to 2024 levels. Penalties for paperwork violations now range from $288 to $2,861 per form, and for businesses that knowingly employ unauthorized workers, fines can reach $28,619 per person for repeat violations. Even a handful of small clerical errors, repeated across a growing team, can add up to a five- or six-figure liability.
In short: I-9 compliance isn’t just a legal formality anymore. It’s a real financial risk that deserves the same attention as payroll or tax compliance.
Common I-9 Mistakes Small Businesses Are Still Making
Most I-9 violations aren’t the result of employers knowingly hiring unauthorized workers. They’re honest, avoidable clerical errors, exactly the kind now being treated more seriously.
- Missing or late signatures Both Section 1 (completed by the employee) and Section 2 (completed by the employer) require signatures and specific dates. A missing signature, or a signature dated after the required deadline, is one of the most frequently cited errors in audits.
- Missing the three-day completion deadline Employees must complete Section 1 on or before their first day of work. Employers must complete Section 2 within three business days of the employee’s start date. Waiting until the end of the first week, even by a day or two, is a common and easily avoidable violation.
- Incomplete or incorrect document information Even when a copy of an employee’s ID or work authorization document is attached to the file, errors like an incorrect document number, wrong issuing authority, or missing expiration date can still trigger a violation. Attaching a copy no longer excuses incomplete or inaccurate fields under current guidance.
- Using an outdated version of the form Form I-9 gets updated periodically, and using an outdated version is itself a compliance issue. The current edition is dated 01/20/25, and after July 31, 2026, only forms carrying the 05/31/2027 expiration date will be accepted for new hires. If your onboarding packet hasn’t been checked recently, this is worth verifying immediately.
- Failing to reverify work authorization before it expires When an employee’s temporary work authorization is set to expire, employers are required to reverify before that expiration date. Missing this deadline, or completing the reverification (Supplement B) with missing signatures, incorrect dates, or incomplete information, is now treated with particular severity under current guidance.
- Using remote verification without being enrolled in E-Verify Since 2023, employers enrolled in E-Verify and in good standing have been permitted to verify I-9 documents remotely via live video rather than requiring in-person document review. This is a real convenience, but it comes with a catch many businesses miss: employers using remote verification without being properly enrolled in E-Verify are technically out of compliance, even if the intent was simply to accommodate a remote hire.
- Poor recordkeeping and retention practices I-9 forms must be retained for the longer of three years after the hire date or one year after termination, whichever is later. Businesses that don’t have a clear retention and disposal process often end up with either missing records (a violation) or unnecessarily retained records for former employees no longer required to be kept on file.
How to Reduce Your Risk
- Audit your existing I-9 files now, not after a notice arrives Set aside time to review current employee I-9s for missing signatures, outdated form versions, and incomplete sections. Catching and correcting errors proactively, before an audit, is treated far more favorably than being caught with the same errors during enforcement action.
- Build a simple, repeatable onboarding checklist Delegating I-9 completion to hiring managers is fine, but only when they’re trained and working from a clear, consistent checklist. Inconsistent processes across different managers or locations are a common source of recurring errors.
- Track reverification deadlines actively Don’t rely on memory or a manual calendar reminder for employees with temporary work authorization. A simple tracking system, even a shared spreadsheet, can prevent missed reverification deadlines that now carry immediate penalties.
- Confirm your E-Verify enrollment status before using remote verification If your business allows remote document review for any hires, confirm you’re properly enrolled in E-Verify and in good standing first. This is a quick check that closes a surprisingly common compliance gap.
- Document your good-faith compliance efforts Keep records of internal I-9 audits, staff training sessions, and process updates. If your business is ever audited, being able to demonstrate a genuine culture of compliance, not just a single clean form, can meaningfully reduce penalty exposure.
- Know that E-Verify helps, but doesn’t replace a correct I-9 E-Verify can add a layer of confidence around work eligibility, but it doesn’t substitute for a fully accurate, properly completed I-9. Both need attention, not just one or the other.
The Bottom Line
I-9 compliance used to be one of the lower-risk items on a small business owner’s to-do list. In 2026, that’s no longer true. Enforcement is more aggressive, penalties are steeper, and errors that used to come with a grace period often don’t anymore.
The good news is that most I-9 violations are entirely preventable. They come down to consistent processes, timely completion, and a willingness to audit your own paperwork before someone else does it for you. For small businesses without a dedicated HR team, this is exactly the kind of compliance risk worth getting outside support for, before a routine audit turns into an unexpected six-figure problem.
This article is for informational purposes only and does not constitute legal advice. Employers should consult with qualified legal counsel regarding their specific I-9 and E-Verify compliance obligations.