September 22, 202618 min readImmigration compliance

What Changed in I-9 Enforcement, and Why Every Employer Should Reassess Its I-9 File

An audit letter arrives. The employer pulls the I-9 file, confident that a handful of missing dates and a couple of blank fields were always minor paperwork issues, correctable if anyone ever asked. That confidence used to be more reliable. As of March 2026, ICE's inspection guidance classifies many errors employers historically treated as technical as substantive violations. For those errors, employers should not assume they will receive the 10-business-day correction opportunity previously associated with technical or procedural violations. The guidance can also matter when ICE inspects forms completed years earlier.

Two other things round out the picture. Form I-9 use requirements also changed in August 2026, when USCIS began directing employers to use a version bearing a 05/31/2027 expiration date. And Florida's existing state-level E-Verify requirement, in place since 2023, adds obligations on top of the federal form that are easy to overlook amid the federal changes. This issue covers all three, since all three show up in the same file when ICE, or a Florida auditor, comes asking.

What changed in federal I-9 enforcement

Since 1986, the Immigration Reform and Control Act has required every employer to verify the identity and work authorization of every employee hired after November 6, 1986, using Form I-9. Section 1 is completed by the employee no later than the first day of employment. Section 2 must be completed by the employer within three business days after the employee's first day of employment, based on physical examination of original identity and work-authorization documents, or a DHS-authorized remote or alternative procedure for eligible E-Verify participants who follow every step of that procedure. One exception shortens that window: if the job itself will last fewer than three business days, Section 2 must be completed no later than the employee's first day of employment, not within the usual three-day period. "Original documents" has its own exceptions worth knowing: certain certified birth-certificate copies and qualifying receipts in place of a listed document are acceptable under the Form I-9 rules, not only originals in the strictest sense. An employee needs one acceptable List A selection, including any required document combination (a foreign passport with a Form I-94 endorsement, for example, counts as a single List A selection), or an acceptable List B and List C combination; unused list columns on the form are not missing information.

Technical errors still receive a statutory correction opportunity

Federal law continues to protect qualifying good-faith technical or procedural failures, subject to its notice-and-correction requirements and exceptions. ICE's revised guidance changes which failures the agency treats as substantive and therefore outside that protection, not whether the underlying legal protection exists.

For nearly three decades, INS and later ICE followed a 1997 policy memo known as the Virtue Memorandum, which split I-9 errors into two categories. Technical or procedural violations were minor and correctable: the employer received at least 10 business days after notice to fix them, and no fine attached if the fix happened in time, provided the employer made a good-faith attempt to comply. Two things can defeat that protection: failing to correct a flagged failure within the notice period, or a pattern or practice of knowingly hiring or continuing to employ unauthorized workers. Substantive violations were treated as more serious; without a cure period, they may support a civil penalty subject to the applicable notice and hearing procedures, not an automatic or immediately payable fine.

On March 16, 2026, ICE updated its Form I-9 inspection fact sheet, reclassifying numerous errors from technical or procedural to substantive. Although the change appeared in an updated inspection fact sheet rather than a new regulation, it reflects ICE's current enforcement position: for the errors it identifies as substantive, employers should not assume the 10-business-day technical-error cure period will be available.

The copy-on-file rule that disappeared

The change that matters most for existing files: under earlier ICE guidance, some missing Section 2 document information could be treated as technical or procedural when the employer retained a legible copy of the document and could use it to complete the omitted information during the cure period. Under the March 2026 fact sheet, incomplete or incorrect List A, B, or C data in Section 2 is a substantive violation regardless of whether a copy was retained. A retained document copy can still help an employer identify the correct information when evaluating or correcting a form; it no longer changes an incomplete Section 2 entry from a substantive violation into a technical one.

What still qualifies as technical

ICE's fact sheet identifies errors that remain technical or procedural and may be eligible for the statutory 10-business-day cure opportunity after notice. The list runs longer than a short summary can fully capture. Examples include:

Failing to record the employee's Social Security number in Section 1, for employers enrolled in E-Verify
A missing employee name at the top of Supplement A or Supplement B
Failing to record other last names used by the employee, if applicable
Failing to record a new name in Supplement B during reverification
Failing to use an authorized version of Form I-9 at the time of initial completion
A missing employee address in Section 1
A missing employer business address in Section 2

Treat this as a set of examples rather than a complete index; consult ICE's fact sheet for the complete list.

What is now substantive

ICE's current substantive-violation list includes both newly reclassified errors and longstanding violations; employers should review their files against the following examples, which are illustrative rather than exhaustive:

Section 1: a missing date of birth, a missing date next to the employee signature, or a missing expiration date in Box 4 for an alien authorized to work
Section 2: a missing date of hire, a missing name or title for the employer representative, or a certification that was never dated
Section 2: incomplete or incorrect List A, B, or C document data, even where a copy of the document was retained
Section 2: failure to examine and verify documents within three business days of hire
Failure to properly indicate use of the DHS-authorized alternative procedure, or use of that procedure by an employer that is not eligible for it or does not follow all applicable requirements
Officially completing and retaining the Spanish-language version of Form I-9 outside Puerto Rico, rather than using it only as a translation aid alongside the English form
Supplement A: a missing preparer or translator name, address, signature, or date
Supplement B: a missing or incomplete rehire date
Electronic I-9 systems: audit trail, e-signature, or security documentation that does not meet DHS's electronic recordkeeping standards

Uncorrected technical violations also convert into substantive violations once the correction window closes, so a minor error that goes unaddressed does not stay minor. One caution when auditing for these: not every blank field is an error. An expiration date in Section 1 can correctly read "N/A" when the employee's work authorization does not expire. Supplement A only applies when a preparer or translator actually assisted. A rehire date only applies when documenting an actual rehire, not every reverification. And an employee still waiting on an assigned Social Security number can complete the I-9 and begin work while it is pending. Audit for fields that should have an entry and don't, not for blanks that were always going to be blank. A related caution cuts the other way: an audit should not trigger blanket demands for new documents. U.S. citizens and noncitizen nationals, List B identity documents, and permanent residents are not reverified merely because a previously accepted Permanent Resident Card has expired. Where reverification actually is required, check applicable extensions and category-specific guidance before concluding that work authorization has ended.

What this costs

For I-9 paperwork violations, the currently published civil penalty range is $288 to $2,861 per affected individual, under 8 C.F.R. Section 274a.10(b)(2). Penalty amounts are subject to future inflation adjustments, and what actually gets assessed in a specific case depends on the applicable law, ICE's enforcement guidance, and the facts of the inspection. A penalty is not automatic or immediately payable the moment a substantive violation is found: ICE describes a Notice of Intent to Fine, and current guidance requires the employer to submit a written request for a hearing before an administrative law judge within 30 days of being served that notice, in order to contest it before any fine is finalized. For illustration only: 200 affected forms at the currently published range represent potential exposure of roughly $57,600 to $572,200, before considering how ICE calculates violations and assesses penalties in a particular matter.

Civil-penalty proceedings generally implicate the five-year limitations period in 28 U.S.C. Section 2462. When a claim accrues depends on the violation; an old hire date alone does not establish that a paperwork violation is time-barred. Employers should get immigration counsel's advice on legacy-file issues while promptly documenting and addressing identified deficiencies, rather than assuming an old date puts a file beyond reach. Corrections should also be transparent, dated when actually made, and supported by an audit record. Never backdate an I-9 correction.

Use a Form I-9 with a 05/31/2027 expiration date

USCIS currently lists Form I-9, edition 01/20/25, as the current form. USCIS also permits continued use of the 08/01/23 edition, provided that copy bears a 05/31/2027 expiration date.

The earlier 08/01/23 version bearing a 07/31/2026 expiration date could be used through July 31, 2026. Beginning August 1, 2026, USCIS instructs employers to use a Form I-9 with a 05/31/2027 expiration date. Employers using electronic I-9 systems were required to update their systems to that version by July 31, 2026.

Practically, for a new Form I-9 first initiated on or after August 1, 2026, confirm that the form's expiration date, in the upper-right corner, reads 05/31/2027. That may be the 01/20/25 edition or the permitted reprinted 08/01/23 edition. Confirm both the edition date and the expiration date against USCIS guidance, since ICE describes edition validity by when any part of the form was initially completed, and a form properly started before the transition can raise a different question from one first started after it.

Employers do not need to redo properly completed I-9s merely because a later edition became available. The relevant question for an existing form is whether the employer used a version permitted at the time of completion and otherwise completed and retained it properly, not whether today's rule happens to match what was used back then.

Retention has not changed in its formula, but it is worth stating precisely. Keep the completed Form I-9, any applicable supplements, and any retained supporting documentation throughout the employee's employment; the three-year clock does not mean a current employee's form can be discarded early. After employment ends, retain those records until the later of three years after the first day of employment or one year after employment ends, and apply any longer retention period that separately applies.

Florida's E-Verify layer

Form I-9 is a federal floor. Florida adds a state-level requirement on top of it for a specific band of employers, under Florida Statutes Section 448.095, the Florida E-Verify law.

Who it covers

Beginning July 1, 2023, a private employer with 25 or more employees must use the federal E-Verify system, not just Form I-9, to confirm the employment eligibility of every new hire within three business days after the employee begins working for pay. The statute applies to private employers with 25 or more employees; it does not spell out in so many words how that count works for a multistate workforce, so employers with operations outside Florida should get counsel's advice on how the threshold applies to their specific organizational structure and employee population, rather than assume a single rule of thumb settles it. In practice, this means two things by the third business day: Form I-9 completed within its own federal deadlines, and an E-Verify case created, subject to applicable program exceptions. A final E-Verify result can take longer than that; follow the required case-resolution process rather than treating case creation as the finish line. An employer must not take a prohibited adverse action, such as firing, suspending, or withholding pay or training, against an employee who is timely resolving a tentative nonconfirmation, sometimes called a mismatch. Florida's Department of Revenue has published FAQ guidance that offers a partial answer: the count is based on employees performing services in Florida, and related companies generally count separately unless the employer is an authorized common paymaster for those companies, in which case an authorized common paymaster counts its own employees plus employees for whom it performs common-paymaster duties. That guidance covers typical situations, but unusual corporate structures, multistate remote workforces, and leased-employee arrangements are exactly where counsel's review still matters.

Florida public agencies must use E-Verify for their own new employees. Separately, public agencies must require, by contract, that contractors and subcontractors performing public contracts register with and use E-Verify; a public agency generally cannot enter into that contract unless each party to it is registered. A subcontractor must provide the contractor with the statutorily prescribed affidavit, which the contractor retains for the duration of the contract; violations can lead to contract termination on top of the daily-fine exposure described below. The registration-and-use requirement covers all of the covered contractor's or subcontractor's new employees, not only the ones assigned to that particular public contract.

Private employers below the 25-employee threshold are not required to use E-Verify under state law solely on that basis. They still must complete Form I-9 for every new hire, and may enroll in E-Verify voluntarily. One exception applies regardless of size: a contractor or subcontractor on a public contract must register with and use E-Verify under the public-agency contracting rules described above, even if the business has fewer than 25 employees.

The fallback and the paper trail it requires

E-Verify supplements Form I-9; an outage does not suspend Form I-9 deadlines, which still apply on their normal schedule. If E-Verify is unavailable for three business days after a new hire begins working for pay and the employer cannot access the system, Florida law requires the employer to use Form I-9 to verify employment eligibility. The employer must document the system's unavailability through a screenshot from each day the system was inaccessible, a public outage announcement, or another recorded communication or notice of the outage. The employer must retain that documentation, along with any official verification generated if applicable, for at least three years. When service resumes, follow the federal instructions applicable to that outage for creating any delayed E-Verify cases and recording the reason for the delay; an outage does not necessarily eliminate the later E-Verify obligation. Separately, FloridaCommerce's VerifyFlorida guidance states that employers with fewer than 25 employees using Form I-9 must retain copies of the supporting documentation and any official verification generated for at least three years. Employers must also follow the separate federal retention period for the completed Form I-9 itself.

Penalties and certification

Required employers must certify on their first Florida reemployment tax return filed each calendar year that they used E-Verify to confirm employment eligibility. For a typical quarterly filer, that first return of the year is the fourth-quarter report, filed in January; check your own filing frequency, since an accelerated or different schedule can change which specific filing counts as "first." An authorized employer representative, such as the owner, a specified corporate officer, or a partner or managing member, must complete the certification; an agent or management company filing the return on the employer's behalf does not have the statutory authority to certify for the employer, even if it prepares and submits the return itself. Employee-leasing companies and PEOs are handled differently: a PEO is generally responsible for certifying on behalf of a covered client company unless that responsibility is transferred to the client by written agreement. If the Florida Department of Commerce determines a covered employer is noncompliant, it must first notify the employer and allow 30 days to cure the noncompliance. Only if the employer fails to use E-Verify as required three times within a 24-month period must the Department impose a fine of $1,000 per day until the employer provides sufficient proof the noncompliance is cured. Continued noncompliance can also support suspension of every license the employer holds under Chapter 120, Florida Statutes.

Putting it together

For most employers, the practical I-9 compliance checklist looks like this:

For new Forms I-9 first initiated on or after August 1, 2026, is the employer using a USCIS-authorized edition bearing the 05/31/2027 expiration date? Confirm both the edition date and the expiration date against USCIS guidance. For historical forms, was the edition in use authorized on the date it was actually completed, rather than assuming today's rule applies retroactively?
Has the existing I-9 file been self-audited against the errors ICE now treats as substantive: incomplete Section 1 information, missing Section 2 certification details, incomplete List A/B/C data, improper Spanish-form use, and incomplete preparer/translator information among them?
Are Section 1 and Section 2 being completed and dated on time: Section 1 by the employee's first day, Section 2 within three business days after that first day (or by the first day itself if the job will last fewer than three business days), with all required dates entered and inapplicable fields handled according to the form instructions?
If relying on the DHS-authorized E-Verify alternative procedure: is every hiring site using it enrolled in E-Verify in good standing? Does the process follow USCIS's actual sequence, examining transmitted document copies (both sides, where applicable) first, then conducting a live video interaction in which the employee presents those same documents? Are clear legible copies retained, is the correct box checked in Section 2 or Supplement B as applicable, and is the procedure applied consistently and without discrimination across employees?
Does the employer meet Florida's 25-employee threshold for mandatory E-Verify? If the organization's multistate headcount or corporate structure makes that threshold unclear, get counsel's advice rather than assume.
For covered Florida employers, has the annual certification been made on the first Florida reemployment tax return filed this calendar year, by an authorized representative rather than an outside payroll provider by default, and is E-Verify documentation being retained for at least three years?
If E-Verify is unavailable, is there a process to document the outage day by day and to preserve the Form I-9 and outage records required by Florida law?
Is the retention schedule being followed: three years from hire, or one year after termination, whichever is later?

Employers should review their I-9 procedures, existing records, remote-examination practices, and applicable Florida E-Verify obligations. A documented review can identify deficiencies and support corrective action, but it does not eliminate liability for earlier violations. A couple of practical notes on running that self-audit: employees correct their own Section 1 entries; employers correct Section 2 and Supplement B. When deciding which files to review, use neutral, consistent criteria, such as a date range applied to every file, rather than singling out employees by any protected characteristic. Respect the employee's choice among acceptable documents throughout: assess whether the original documentation met the rules in effect when the form was completed, and if correction requires additional documentation, let the employee choose which acceptable documents to present. A usable correction protocol: preserve the original entry, enter the correction next to it, and initial and date the correction when it is actually made. Keep any explanation and replacement pages attached to the original form. If a former employee cannot be reached to correct their own Section 1 entry, document the deficiency and why a correction could not be obtained. None of this erases liability for an earlier violation, but it demonstrates a documented, good-faith effort going forward. Never backdate an I-9 correction.

This post is general HR and compliance information, not legal advice. Requirements vary based on employer size, industry, and immigration status of the workforce. Consult qualified legal counsel or an immigration compliance specialist before relying on this issue for a specific audit or hiring decision.

References

I-9 enforcement and federal requirements

Florida E-Verify requirements

Join the list

Get the next update in your inbox.

Monthly federal and state HR & compliance notes, plus early access to Groundwork.