ICE Just Changed the I-9 Rules. Here's What Every Small Business Owner Needs to Know.
If you have employees, this one's for you. Not because I want to scare you. But because I'd much rather you hear this from me than find out the hard way during an audit.
What's an I-9 and Why Does It Exist?
The Form I-9 is how employers verify that every person they hire is legally authorized to work in the United States. Federal law requires you to complete one for every employee, not some employees. Every employee.
Here's what that means in practice: the employee fills out their section, and you, as the employer, physically verify their identification documents and complete your section. It has to happen within the first three days of employment. Day one is the start date. That clock is already ticking.
I know it sounds like just another piece of paperwork. I get it. But this is one of those things where the consequences for getting it wrong have historically been steep, and they just got steeper.
What Just Changed
ICE, the U.S. Immigration and Customs Enforcement agency, quietly updated their I-9 inspection fact sheet. No big announcement. No press release. It just showed up, and if you weren't subscribed to SHRM updates or working with an HR professional, you probably missed it.
Here's the shift: for years, I-9 violations were split into two categories.
Substantive violations were serious, came with immediate financial penalties, and had no grace period.
Technical or procedural violations were administrative errors that could be corrected within a 10-business-day window after an audit notification.
That second category, the correctable one, just got a lot smaller. ICE reclassified several common administrative errors as substantive violations, which means no correction window, no 10-day grace period. Just a fine.
What Is Now Considered a Substantive Violation
This is the part you need to pay attention to. These aren't obscure technicalities. These are the kinds of mistakes I see regularly in businesses of all sizes.
Missing date of birth or date of hire
Failing to date Section 1 (employee section) or Section 2 (employer section)
Incomplete preparer or translator information
Missing employer or authorized representative title
Failure to enter a rehire date for returning employees
Remote verification errors, including failing to check the alternative procedure box or not being an active E-Verify participant when using remote onboarding
Electronic I-9 software that doesn't meet ICE's documentation standards
That last one is worth emphasizing. A lot of businesses assume that because they use software, they're covered. That's not necessarily true. If your platform's audit trails, signature protocols, or security documentation don't meet ICE's standards, you can still be penalized.
Why This Matters More for Small Businesses Than You Think
I want to be honest with you here. These aren't mistakes only big companies make. They're exactly the kind of admin gaps that happen on small teams, especially when you're scaling fast, dealing with high turnover, or running a brick-and-mortar location where onboarding is happening quickly and informally.
If you run a cafe, a retail boutique, a wellness studio, or a creative business with a growing team, and your onboarding process is mostly just handing someone paperwork and hoping for the best, that's where the risk lives.
And here's the context that makes this more urgent: I-9 audits used to feel like a distant HR lore. Something people talked about but rarely experienced. That's changed. With increased federal focus on worksite enforcement, these audits are becoming more regular, and the I-9 is one of the first things they look at.
What You Should Do Right Now
Here's my practical advice for where to start.
Audit your existing I-9 files.
Pull them out, go through each one, and look for the errors listed above. If you find mistakes, you can correct them, but you have to document the correction. Write in the correction, initial it, and add the date of the correction. Do not use white-out. Do not start over on a new form unless absolutely necessary.
Designate a clear I-9 owner.
There should be one person in your business whose job it is to complete and verify I-9s. If that person is out, someone else needs to be trained to cover. This isn't a task that should fall through the cracks because the usual person was on vacation.
Know your document lists.
Employees can provide documents from List A alone, like a passport or green card. If they provide List B and C documents together, like a driver's license and a birth certificate, you need one from each column. A driver's license alone is not sufficient. This is one of the most common mistakes I see.
Get serious about storage.
I-9s should be stored separately from the rest of your employee files, either in a dedicated binder or within your HRIS platform. If you're using a platform like Gusto, Rippling, or ADP, they generally handle compliant storage. If you're doing paper files, keep a separate binder just for I-9s that's easy to locate if an audit happens.
Consider E-Verify.
E-Verify is a free, voluntary program that cross-references employee information against public records for an additional layer of identity verification. It's especially useful if you're hiring remote employees or want an extra check in your process.
The Bottom Line
I'm not sharing this to put you in a panic. I'm sharing it because this is exactly the kind of thing a business finds out about too late, usually during an audit, when the fine is already on the table.
The good news? This is entirely preventable. A solid onboarding process, a designated person who knows the rules, and a clean I-9 file are all it takes.
If you're not sure where your I-9s stand, or if your whole HR foundation feels like it could use a once-over, that's what I'm here for. An HR audit is usually where I start with every new client, and the I-9 file is always on the list.
You built something real. Make sure you're protecting it.
Reach out at kdzhrconsulting.com to learn more about working together!
