Form I-9 Compliance in 2026: What General Counsel Should Know as Work Authorization Rules Change
- Todd Nurick
- 3 days ago
- 12 min read
For many employers, Form I-9 compliance used to feel largely administrative: complete the form when someone is hired, retain it for the required period, and reverify employment authorization when necessary. That model has become increasingly incomplete as federal rules governing Employment Authorization Documents, Temporary Protected Status, E-Verify, and reverification have changed.
The compliance challenge is particularly visible in 2026 because the expiration date printed on an employee's document may not tell the entire story. In some circumstances an apparently expired Employment Authorization Document can remain valid because federal law or an applicable government notice extends it, while in other circumstances an apparently unexpired document can cease to establish work authorization because the Department of Homeland Security has revoked the underlying authorization.
For a General Counsel, the issue isn't whether the company should favor a restrictive or permissive immigration policy. The objective is much more straightforward: make sure the company employs people who are legally authorized to work while avoiding unlawful reverification, document demands, or discrimination against people who are authorized.
Why Form I-9 Compliance Has Become More Complicated
Federal law requires employers to verify the identity and employment authorization of individuals hired for employment in the United States through Form I-9, Employment Eligibility Verification. U.S. Citizenship and Immigration Services, or USCIS, maintains the form, detailed employer instructions, and its I-9 Central guidance for employers.
The initial process is familiar to most Human Resources departments, but continuing compliance can be more difficult because different categories of employees have different rules. Some employment authorization expires and requires reverification, some workers shouldn't be reverified merely because a document expires, and certain employees may establish continuing work authorization through a document different from the one they originally presented.
That distinction becomes important when employers equate a document's expiration date with the employee's right to work. Form I-9 is an employment-eligibility verification system, not a general immigration-status investigation, and the employer shouldn't attempt to independently determine whether it approves of or understands the employee's immigration history.
Form I-9 Compliance Requires Tracking Authorization, Not Guessing Status
One of the most important distinctions is between immigration status and employment authorization. They can overlap, but they aren't necessarily the same thing.
Some individuals are authorized to work because of their immigration status itself, while others receive employment authorization under a separate category. USCIS guidance reflects those differences, including categories in which employment authorization is incident to status and situations in which an employee may present several different combinations of acceptable Form I-9 documents.
Employers also have to understand when not to reverify. Department of Justice guidance cautions employers against unnecessary reverification of Permanent Resident Cards and List B identity documents and emphasizes that, when reverification is required, employees generally may choose from the acceptable documentation authorized by the Form I-9 rules.
That legal balance is important. The employer has an obligation to avoid unauthorized employment, but it also has an obligation not to impose additional documentary requirements because of an employee's citizenship, immigration status, or national origin.
A Major Employment Authorization Rule Changed in October 2025
One of the most significant recent changes concerns automatic extensions of certain Employment Authorization Documents, commonly called EADs.
For years, eligible employees who timely filed certain EAD renewal applications could receive an automatic extension of their employment authorization and expiring documentation while USCIS processed the renewal. The Department of Homeland Security changed that policy through an interim final rule effective October 30, 2025.
Under the new rule, people filing qualifying renewal applications on or after October 30, 2025 generally no longer receive the automatic extension that had previously applied to certain categories. The rule doesn't invalidate automatic extensions that became effective before October 30, 2025, and it preserves extensions that arise under other legal authority or an applicable Federal Register notice, including certain Temporary Protected Status situations.
The Department of Homeland Security explained that the change was intended to require additional screening and adjudication before extending a new period of employment authorization. Business groups criticized the change because employees may experience gaps in employment authorization while renewal applications remain pending, but the employer's compliance obligation isn't determined by which policy position it prefers.
For employers, the practical lesson is that a timely filed EAD renewal application no longer supports a blanket assumption that employment authorization automatically continues. The filing date, employment-authorization category, applicable law, any Federal Register notice, and current USCIS guidance all may matter.
An Expired Document Can Sometimes Remain Valid
Temporary Protected Status illustrates why an employer can't always rely solely on the expiration date printed on an EAD.
Federal law and agency action sometimes extend the validity of specified documents for defined populations even though the physical card continues to display an earlier expiration date. USCIS and Federal Register notices identify the affected categories, card expiration dates, extension periods, and Form I-9 procedures employers should follow.
These extensions aren't universal. An employer can't assume that every expired EAD remains valid merely because it was issued to a worker with Temporary Protected Status, and it likewise shouldn't reject an otherwise qualifying document simply because the expiration date printed on the card has passed.
The correct answer depends on the applicable government authority. That means the Human Resources employee reviewing the document may need to consult current USCIS or Federal Register guidance rather than relying exclusively on the face of the card.
An Unexpired EAD Can Present the Opposite Problem
Recent federal action has created the reverse situation as well.
E-Verify developed a Status Change Report for participating employers that identifies E-Verify cases in which an EAD used for verification was subsequently revoked by the Department of Homeland Security. E-Verify guidance explains that affected employers may need to reverify the employee's current work authorization even when the physical EAD still displays a future expiration date.
The employee still has the right to present other acceptable documentation establishing employment authorization. The existence of a revoked EAD doesn't necessarily mean that the employee has no other lawful basis to work.
This creates an important governance distinction. Employers shouldn't independently investigate every employee's immigration status, but an employer participating in E-Verify should have a process for reviewing the government information that E-Verify specifically instructs it to monitor.
Don't Solve Under-Verification by Over-Verifying
Employers understandably tend to focus on the consequences of continuing to employ someone whose authorization has expired. Recent Department of Justice enforcement demonstrates that excessive reverification can create a different kind of exposure.
In 2026, the Department of Justice entered into a settlement with Whirlpool Corporation following allegations concerning employment-eligibility verification practices at an Iowa facility. The settlement required Whirlpool to pay $125,000 in civil penalties and establish a back-pay fund of up to $100,000 for potentially affected workers.
The agreement addressed alleged practices involving unnecessary or improper document requests and reverification affecting non-U.S. citizens. It also required Whirlpool to establish an escalation process for adverse employment-verification decisions, designate an individual responsible for employment-verification policies and practices, revise procedures, and provide training.
That enforcement action is particularly useful from a General Counsel perspective because it shows that I-9 compliance isn't simply about asking for more documentation whenever there is uncertainty. A well-intentioned effort to avoid unauthorized employment can itself create legal problems if the company demands documents the law doesn't require.
Reverification Is Not a Citizenship Investigation
The Form I-9 rules are structured around establishing identity and employment authorization, not repeatedly proving an employee's citizenship or immigration status.
Department of Justice materials emphasize that employers generally shouldn't reverify U.S. citizens, U.S. nationals, Permanent Resident Cards, or List B identity documents merely because a document has expired. When reverification is properly required, employees can generally choose an acceptable List A or List C document and aren't required to produce the same document they presented previously.
That employee choice matters because an employer can violate federal anti-discrimination law by demanding more, different, or specific documents based on citizenship status or national origin. A Human Resources department that reflexively tells every noncitizen employee to bring in a new immigration card can therefore create risk even when management's intent is simply to maintain accurate employment records.
The better approach is to identify whether reverification is legally required and, if so, apply the same neutral Form I-9 process the law requires.
An E-Verify Mismatch Isn't the Same as Unauthorized Employment
E-Verify adds another layer because it compares Form I-9 information against records available to the Department of Homeland Security and the Social Security Administration.
A mismatch, historically called a Tentative Nonconfirmation, doesn't necessarily establish that the employee lacks authorization to work. Differences can arise from data-entry errors, name changes, agency records, immigration-status changes, or other discrepancies, and E-Verify provides procedures through which the employee may respond.
Employers should therefore avoid treating an initial E-Verify mismatch as an automatic termination event. The federal process is designed to give the employee an opportunity to address the discrepancy before a final determination is reached.
This is another area where automation can create false confidence. A computer-generated result may initiate a legally prescribed process, but it doesn't eliminate the employer's obligation to follow that process correctly.
E-Verify Doesn't Replace Form I-9
Form I-9 and E-Verify are related, but they aren't interchangeable.
Form I-9 is the underlying federal employment-eligibility verification process, while E-Verify electronically compares information from the Form I-9 with government databases for participating employers. E-Verify+ is also being developed as a more integrated digital verification process for modern and hybrid work environments.
Federal law doesn't impose E-Verify participation on every private employer nationwide, although participation can be required for certain federal contractors and under particular state laws. Multi-state employers therefore need to determine whether their obligations change depending on where employees work or which governmental contracts the business performs.
That makes I-9 administration another example of a corporate process that can look uniform nationally while actually containing jurisdiction-specific requirements.
Technology Can Create I-9 Problems Too
Many companies now rely on electronic onboarding platforms, Human Resources information systems, payroll systems, and third-party employment-verification vendors to manage Form I-9 compliance.
Those tools can significantly improve consistency, but management shouldn't assume that a vendor's workflow is legally correct simply because the product automates Form I-9. If software automatically demands reverification whenever a Permanent Resident Card expires, instructs noncitizens to provide a specific immigration document, or mishandles an automatic extension, the employer may still bear responsibility for the resulting employment decision.
The same concern applies as artificial intelligence becomes integrated into Human Resources systems. Automation should help the organization apply the correct rules consistently, not convert a mistaken rule into a company-wide practice.
General Counsel doesn't need to program the system, but someone should periodically ask what the system actually does when an authorization date, document category, government notice, or E-Verify result changes.
Remote Verification Has Rules of Its Own
The move toward remote and hybrid work has also changed Form I-9 administration.
The Department of Homeland Security permits qualifying E-Verify employers to use an authorized alternative procedure for remote examination of Form I-9 documents when the employer satisfies the required conditions. That procedure isn't simply a company deciding that reviewing an emailed photograph is good enough.
Remote verification needs to be incorporated into a consistent policy that reflects the current federal requirements. Human Resources personnel should know which employees and locations qualify, what live interaction is required, how the Form I-9 is annotated, and what records must be retained.
The convenience of remote verification makes it attractive, but the company should treat it as a defined compliance process rather than an informal accommodation improvised by individual managers.
Changing Law Makes Static Expiration Calendars Dangerous
A spreadsheet tracking document expiration dates can still be useful, but it can't be the entire compliance system.
Employment authorization can be affected by new regulations, Federal Register notices, changes to Temporary Protected Status designations, EAD revocations, court orders, agency guidance, and changes to the employee's underlying basis for authorization. The physical document sitting in the employee's wallet may remain unchanged while the legal significance of that document changes.
That doesn't mean Human Resources should become an immigration law firm. It does mean the company needs to recognize the point at which an ordinary administrative question has become a legal one.
A static calendar works well when the rule itself is static. It becomes less reliable when the government's treatment of the underlying authorization changes before the date in the spreadsheet arrives.
Internal I-9 Audits Can Help, but They Need Structure
Periodic internal audits can identify missing forms, incomplete sections, missed reverifications, incorrect document information, inconsistent practices, retention problems, and defects in electronic systems.
An audit can also create problems if the company selects employees for review based on perceived nationality, accent, surname, citizenship status, or another non-neutral criterion. Department of Justice and immigration-enforcement guidance has long emphasized that internal audits should use neutral selection criteria and consistent correction procedures.
Corrections should also preserve the integrity of the original record. An internal audit isn't an invitation to backdate forms, recreate records as though an error never occurred, or destroy information showing when the company actually identified a problem.
For General Counsel, the objective should be to understand the quality of the system, correct deficiencies lawfully, and document a reasonable remediation process.
What General Counsel Should Build Around Form I-9 Compliance
A General Counsel shouldn't personally review every Form I-9. The more useful role is to create a process that distinguishes routine verification from the situations that require escalation.
At a minimum, management should know:
Who owns Form I-9 and E-Verify compliance inside the organization?
Who monitors material USCIS, Department of Homeland Security, E-Verify, Department of Justice, and relevant state-law changes?
Does the company distinguish expiration of an identity document from expiration of employment authorization?
Who determines whether an employee actually requires reverification?
Can the company's software recognize automatic extensions and government notices, or does a human need to override the system?
Who reviews an E-Verify Status Change Report or other government notice affecting an employee's previously accepted document?
Does Human Resources understand that employees generally choose which acceptable documents to present?
What is the escalation procedure for unfamiliar documentation or conflicting expiration information?
Are managers prohibited from improvising additional immigration-document demands?
Are third-party Form I-9 and E-Verify vendors periodically reviewed rather than simply assumed to be compliant?
These questions aren't designed to turn every employment-verification issue into a legal matter. They're intended to prevent a routine Human Resources process from producing a serious legal decision without anyone recognizing that the situation has changed.
General Counsel Should Establish a Source Hierarchy
One practical improvement is to decide in advance which sources Human Resources will rely on when employment-authorization information appears inconsistent.
An employee's explanation, an old training slide, an internet search result, a vendor alert, a legal blog, an applicable Federal Register notice, and current USCIS guidance don't all carry the same weight. When continued employment depends on the answer, the organization should work from the governing authority whenever possible.
That generally means starting with the applicable statute or regulation, USCIS guidance, Form I-9 instructions, E-Verify materials, a Federal Register notice, or a controlling court order, depending on the issue. Secondary legal commentary can be useful for identifying and explaining developments, but it shouldn't quietly replace the government authority that actually determines whether an employee is authorized to work.
Form I-9 Compliance Needs a Clear Escalation Rule
Human Resources personnel shouldn't be expected to resolve every unusual employment-authorization issue on their own.
A sensible policy can identify circumstances that trigger legal or specialist review, including an unfamiliar document, a claimed automatic extension, a government revocation notice, conflicting expiration dates, a Temporary Protected Status development, an unusual E-Verify result, or a proposed termination based on an employee's inability to satisfy a particular document request.
The purpose isn't to make the process more cumbersome. It's to distinguish the ordinary case, which trained Human Resources personnel should be able to handle efficiently, from the unusual case where applying a routine rule could produce the wrong result.
Neutral Compliance Is the Most Defensible Approach
Immigration policy is politically contentious, and federal policy can change significantly from one administration to another. Employers don't need to resolve those political debates to administer Form I-9 correctly.
If federal law narrows an employee's authorization to work, the employer has to follow the resulting employment-verification rules. If federal law, an agency notice, or a controlling court order extends that authorization, the employer has to recognize that as well.
If an employee can't establish continuing authorization when reverification is legally required, the company can't simply ignore the problem. If the employee can establish authorization using documentation the law permits, the company shouldn't demand additional documents because a manager is uncomfortable with the person's immigration category.
That is the neutral compliance position a General Counsel should be able to defend regardless of which political party controls the federal government.
Form I-9 Compliance Is Becoming a Monitoring Function
The older model of Form I-9 compliance was largely transactional: verify the employee, complete the form, retain the record, and reverify when a tracked date arrives.
For some workforces, the modern model also requires monitoring. Employers may need to account for regulatory changes, EAD renewal rules, Federal Register notices, E-Verify status information, litigation affecting federal programs, state requirements, and anti-discrimination restrictions that limit when additional documentation can be requested.
The company doesn't need to turn every Human Resources employee into an immigration specialist. It does need a reliable process for recognizing when the rules affecting a particular worker have changed and for obtaining the right answer before making an employment decision.
For a General Counsel, that is the broader lesson. Form I-9 compliance isn't simply about filling out the form correctly on the employee's first day. It is increasingly about building a system that remains accurate when the law changes around it.
About Todd B. Nurick
Todd B. Nurick is a Pennsylvania and New York business attorney, former U.S. Army officer, and Outside/Fractional General Counsel with nearly 30 years of civilian business law and litigation experience.
Through the Law Office of Todd B. Nurick, he advises businesses on contracts, transactions, employment matters, investigations, governance, compliance, technology, and the legal and operational risks involved in running a business.
The Law Office of Todd B. Nurick is a fictitious name of Nurick Law Group LLC, the law firm Todd founded and through which he has represented businesses for decades.
Sources
U.S. Citizenship and Immigration Services - DHS Ends Automatic Extension of Employment Authorization
Disclaimer: This article is for informational purposes only and isn't legal advice. Immigration and employment-authorization rules can change through statutes, regulations, agency actions, Federal Register notices, and court orders, and employers should confirm current requirements before taking employment action. Reading this article doesn't create an attorney-client relationship. Law Office of Todd B. Nurick is a fictitious name of Nurick Law Group LLC. Todd B. Nurick, Law Office of Todd B. Nurick, and Nurick Law Group LLC aren't your attorneys unless and until there is a fully executed written engagement agreement.
