Understanding Form I-9 Compliance: Navigating Employment Authorization Rules
Updated: Sep 11
Disclaimer: This article is for informational purposes only and is not legal advice. Reading it does not create an attorney–client relationship. Todd Nurick and Nurick Law Group are not your attorneys unless and until there is a fully executed written fee agreement with Todd Nurick or Nurick Law Group.
For many employers, Form I-9 compliance used to feel largely administrative. Employers would complete the form when someone was hired, retain it for the required period, and reverify employment authorization when necessary. However, this model has become increasingly incomplete. Federal rules governing Employment Authorization Documents, Temporary Protected Status, E-Verify, and reverification have changed significantly.
The compliance challenge is particularly visible in 2026. The expiration date printed on an employee's document may not tell the entire story. In some cases, an apparently expired Employment Authorization Document can remain valid. This is due to federal law or an applicable government notice that extends it. Conversely, an apparently unexpired document can cease to establish work authorization if the Department of Homeland Security has revoked the underlying authorization.
For a General Counsel, the issue is not whether the company should favor a restrictive or permissive immigration policy. The objective is much more straightforward: ensure the company employs people who are legally authorized to work while avoiding unlawful reverification, document demands, or discrimination against individuals who are authorized.
Why Form I-9 Compliance Has Become More Complicated
Federal law requires employers to verify the identity and employment authorization of individuals hired for employment in the United States through Form I-9, Employment Eligibility Verification. U.S. Citizenship and Immigration Services (USCIS) maintains the form, detailed employer instructions, and its I-9 Central guidance for employers.
The initial process is familiar to most Human Resources departments. However, continuing compliance can be more difficult. Different categories of employees have different rules. Some employment authorizations expire and require reverification, while others do not. Certain employees may establish continuing work authorization through a document different from the one they originally presented.
This distinction becomes important when employers equate a document's expiration date with the employee's right to work. Form I-9 is an employment-eligibility verification system, not a general immigration-status investigation. Employers should not attempt to independently determine whether they approve of or understand the employee's immigration history.
Form I-9 Compliance Requires Tracking Authorization, Not Guessing Status
One of the most important distinctions is between immigration status and employment authorization. They can overlap, but they are not necessarily the same thing. Some individuals are authorized to work because of their immigration status itself. Others receive employment authorization under a separate category. USCIS guidance reflects these differences, including categories in which employment authorization is incident to status and situations in which an employee may present several different combinations of acceptable Form I-9 documents.
Employers must also understand when not to reverify. Department of Justice guidance cautions employers against unnecessary reverification of Permanent Resident Cards and List B identity documents. It emphasizes that, when reverification is required, employees generally may choose from the acceptable documentation authorized by the Form I-9 rules.
This legal balance is important. Employers have an obligation to avoid unauthorized employment. However, they also have an obligation not to impose additional documentary requirements because of an employee's citizenship, immigration status, or national origin.
A Major Employment Authorization Rule Changed in October 2025
One of the most significant recent changes concerns automatic extensions of certain Employment Authorization Documents (EADs). For years, eligible employees who timely filed certain EAD renewal applications could receive an automatic extension of their employment authorization and expiring documentation while USCIS processed the renewal. The Department of Homeland Security changed that policy through an interim final rule effective October 30, 2025.
Under the new rule, individuals filing qualifying renewal applications on or after October 30, 2025, generally no longer receive the automatic extension that had previously applied to certain categories. The rule does not invalidate automatic extensions that became effective before October 30, 2025. It also preserves extensions that arise under other legal authority or an applicable Federal Register notice, including certain Temporary Protected Status situations.
The Department of Homeland Security explained that the change was intended to require additional screening and adjudication before extending a new period of employment authorization. Business groups criticized the change because employees may experience gaps in employment authorization while renewal applications remain pending. However, the employer's compliance obligation is not determined by which policy position it prefers.
For employers, the practical lesson is that a timely filed EAD renewal application no longer supports a blanket assumption that employment authorization automatically continues. The filing date, employment-authorization category, applicable law, any Federal Register notice, and current USCIS guidance all may matter.
An Expired Document Can Sometimes Remain Valid
Temporary Protected Status illustrates why an employer cannot always rely solely on the expiration date printed on an EAD. Federal law and agency action sometimes extend the validity of specified documents for defined populations, even though the physical card continues to display an earlier expiration date. USCIS and Federal Register notices identify the affected categories, card expiration dates, extension periods, and Form I-9 procedures employers should follow.
These extensions are not universal. An employer cannot assume that every expired EAD remains valid merely because it was issued to a worker with Temporary Protected Status. Likewise, it should not reject an otherwise qualifying document simply because the expiration date printed on the card has passed.
The correct answer depends on the applicable government authority. This means that the Human Resources employee reviewing the document may need to consult current USCIS or Federal Register guidance rather than relying exclusively on the face of the card.
An Unexpired EAD Can Present the Opposite Problem
Recent federal action has created the reverse situation as well. E-Verify developed a Status Change Report for participating employers that identifies E-Verify cases in which an EAD used for verification was subsequently revoked by the Department of Homeland Security. E-Verify guidance explains that affected employers may need to reverify the employee's current work authorization even when the physical EAD still displays a future expiration date.
The employee still has the right to present other acceptable documentation establishing employment authorization. The existence of a revoked EAD does not necessarily mean that the employee has no other lawful basis to work.
This creates an important governance distinction. Employers should not independently investigate every employee's immigration status. However, an employer participating in E-Verify should have a process for reviewing the government information that E-Verify specifically instructs it to monitor.
Do Not Solve Under-Verification by Over-Verifying
Employers understandably tend to focus on the consequences of continuing to employ someone whose authorization has expired. Recent Department of Justice enforcement demonstrates that excessive reverification can create a different kind of exposure.
In 2026, the Department of Justice entered into a settlement with Whirlpool Corporation following allegations concerning employment-eligibility verification practices at an Iowa facility. The settlement required Whirlpool to pay $125,000 in civil penalties and establish a back-pay fund of up to $100,000 for potentially affected workers.
The agreement addressed alleged practices involving unnecessary or improper document requests and reverification affecting non-U.S. citizens. It also required Whirlpool to establish an escalation process for adverse employment-verification decisions, designate an individual responsible for employment-verification policies and practices, revise procedures, and provide training.
This enforcement action is particularly useful from a General Counsel perspective. It shows that I-9 compliance is not simply about asking for more documentation whenever there is uncertainty. A well-intentioned effort to avoid unauthorized employment can create legal problems if the company demands documents the law does not require.
Reverification Is Not a Citizenship Investigation
The Form I-9 rules are structured around establishing identity and employment authorization, not repeatedly proving an employee's citizenship or immigration status. Department of Justice materials emphasize that employers generally should not reverify U.S. citizens, U.S. nationals, Permanent Resident Cards, or List B identity documents merely because a document has expired. When reverification is properly required, employees can generally choose an acceptable List A or List C document and are not required to produce the same document they presented previously.
That employee choice matters. An employer can violate federal anti-discrimination law by demanding more, different, or specific documents based on citizenship status or national origin. A Human Resources department that reflexively tells every noncitizen employee to bring in a new immigration card can therefore create risk, even when management's intent is simply to maintain accurate employment records.
The better approach is to identify whether reverification is legally required and, if so, apply the same neutral Form I-9 process the law requires.
An E-Verify Mismatch Is Not the Same as Unauthorized Employment
E-Verify adds another layer because it compares Form I-9 information against records available to the Department of Homeland Security and the Social Security Administration. A mismatch, historically called a Tentative Nonconfirmation, does not necessarily establish that the employee lacks authorization to work. Differences can arise from data-entry errors, name changes, agency records, immigration-status changes, or other discrepancies. E-Verify provides procedures through which the employee may respond.
Employers should therefore avoid treating an initial E-Verify mismatch as an automatic termination event. The federal process is designed to give the employee an opportunity to address the discrepancy before a final determination is reached.
This is another area where automation can create false confidence. A computer-generated result may initiate a legally prescribed process, but it does not eliminate the employer's obligation to follow that process correctly.
E-Verify Does Not Replace Form I-9
Form I-9 and E-Verify are related, but they are not interchangeable. Form I-9 is the underlying federal employment-eligibility verification process. E-Verify electronically compares information from the Form I-9 with government databases for participating employers. E-Verify+ is also being developed as a more integrated digital verification process for modern and hybrid work environments.
Federal law does not impose E-Verify participation on every private employer nationwide. However, participation can be required for certain federal contractors and under particular state laws. Multi-state employers therefore need to determine whether their obligations change depending on where employees work or which governmental contracts the business performs.
This makes I-9 administration another example of a corporate process that can look uniform nationally while actually containing jurisdiction-specific requirements.
Technology Can Create I-9 Problems Too
Many companies now rely on electronic onboarding platforms, Human Resources information systems, payroll systems, and third-party employment-verification vendors to manage Form I-9 compliance. These tools can significantly improve consistency. However, management should not assume that a vendor's workflow is legally correct simply because the product automates Form I-9.
If software automatically demands reverification whenever a Permanent Resident Card expires, instructs noncitizens to provide a specific immigration document, or mishandles an automatic extension, the employer may still bear responsibility for the resulting employment decision. The same concern applies as artificial intelligence becomes integrated into Human Resources systems. Automation should help the organization apply the correct rules consistently, not convert a mistaken rule into a company-wide practice.
General Counsel does not need to program the system. However, someone should periodically ask what the system actually does when an authorization date, document category, government notice, or E-Verify result changes.
Remote Verification Has Rules of Its Own
The move toward remote and hybrid work has also changed Form I-9 administration. The Department of Homeland Security permits qualifying E-Verify employers to use an authorized alternative procedure for remote examination of Form I-9 documents when the employer satisfies the required conditions. This procedure is not simply a company deciding that reviewing an emailed photograph is sufficient.
Remote verification needs to be incorporated into a consistent policy that reflects current federal requirements. Human Resources personnel should know which employees and locations qualify, what live interaction is required, how the Form I-9 is annotated, and what records must be retained.
The convenience of remote verification makes it attractive. However, the company should treat it as a defined compliance process rather than an informal accommodation improvised by individual managers.
Changing Law Makes Static Expiration Calendars Dangerous
A spreadsheet tracking document expiration dates can still be useful, but it cannot be the entire compliance system. Employment authorization can be affected by new regulations, Federal Register notices, changes to Temporary Protected Status designations, EAD revocations, court orders, agency guidance, and changes to the employee's underlying basis for authorization. The physical document sitting in the employee's wallet may remain unchanged while the legal significance of that document changes.
This does not mean Human Resources should become an immigration law firm. It does mean the company needs to recognize the point at which an ordinary administrative question has become a legal one. A static calendar works well when the rule itself is static. It becomes less reliable when the government's treatment of the underlying authorization changes before the date in the spreadsheet arrives.
Internal I-9 Audits Can Help, but They Need Structure
Periodic internal audits can identify missing forms, incomplete sections, missed reverifications, incorrect document information, inconsistent practices, retention problems, and defects in electronic systems. An audit can also create problems if the company selects employees for review based on perceived nationality, accent, surname, citizenship status, or another non-neutral criterion. Department of Justice and immigration-enforcement guidance has long emphasized that internal audits should use neutral selection criteria and consistent correction procedures.
Corrections should also preserve the integrity of the original record. An internal audit is not an invitation to backdate forms, recreate records as though an error never occurred, or destroy information showing when the company actually identified a problem. For General Counsel, the objective should be to understand the quality of the system, correct deficiencies lawfully, and document a reasonable remediation process.
What General Counsel Should Build Around Form I-9 Compliance
A General Counsel should not personally review every Form I-9. The more useful role is to create a process that distinguishes routine verification from situations that require escalation. Related employment and workplace counsel is available through the Law Office of Todd B. Nurick.
At a minimum, management should know:
Who owns Form I-9 and E-Verify compliance inside the organization?
Who monitors material USCIS, Department of Homeland Security, E-Verify, Department of Justice, and relevant state-law changes?
Does the company distinguish expiration of an identity document from expiration of employment authorization?
Who determines whether an employee actually requires reverification?
Can the company's software recognize automatic extensions and government notices, or does a human need to override the system?
Who reviews an E-Verify Status Change Report or other government notice affecting an employee's previously accepted document?
Does Human Resources understand that employees generally choose which acceptable documents to present?
What is the escalation procedure for unfamiliar documentation or conflicting expiration information?
Are managers prohibited from improvising additional immigration-document demands?
Are third-party Form I-9 and E-Verify vendors periodically reviewed rather than simply assumed to be compliant?
These questions are not designed to turn every employment-verification issue into a legal matter. They are intended to prevent a routine Human Resources process from producing a serious legal decision without anyone recognizing that the situation has changed.
General Counsel Should Establish a Source Hierarchy
One practical improvement is to decide in advance which sources Human Resources will rely on when employment-authorization information appears inconsistent. An employee's explanation, an old training slide, an internet search result, a vendor alert, a legal blog, an applicable Federal Register notice, and current USCIS guidance do not all carry the same weight. When continued employment depends on the answer, the organization should work from the governing authority whenever possible.
That generally means starting with the applicable statute or regulation, USCIS guidance, Form I-9 instructions, E-Verify materials, a Federal Register notice, or a controlling court order, depending on the issue. Secondary legal commentary can be useful for identifying and explaining developments, but it should not quietly replace the government authority that actually determines whether an employee is authorized to work.
Form I-9 Compliance Needs a Clear Escalation Rule
Human Resources personnel should not be expected to resolve every unusual employment-authorization issue on their own. A sensible policy can identify circumstances that trigger legal or specialist review. This includes an unfamiliar document, a claimed automatic extension, a government revocation notice, conflicting expiration dates, a Temporary Protected Status development, an unusual E-Verify result, or a proposed termination based on an employee's inability to satisfy a particular document request.
The purpose is not to make the process more cumbersome. It is to distinguish the ordinary case, which trained Human Resources personnel should be able to handle efficiently, from the unusual case where applying a routine rule could produce the wrong result.
Neutral Compliance Is the Most Defensible Approach
Immigration policy is politically contentious, and federal policy can change significantly from one administration to another. Employers do not need to resolve those political debates to administer Form I-9 correctly. If federal law narrows an employee's authorization to work, the employer must follow the resulting employment-verification rules. If federal law, an agency notice, or a controlling court order extends that authorization, the employer must recognize that as well.
If an employee cannot establish continuing authorization when reverification is legally required, the company cannot simply ignore the problem. If the employee can establish authorization using documentation the law permits, the company should not demand additional documents because a manager is uncomfortable with the person's immigration category.
This is the neutral compliance position a General Counsel should be able to defend, regardless of which political party controls the federal government.
Form I-9 Compliance Is Becoming a Monitoring Function
The older model of Form I-9 compliance was largely transactional. Employers would verify the employee, complete the form, retain the record, and reverify when a tracked date arrived. For some workforces, the modern model also requires monitoring. Employers may need to account for regulatory changes, EAD renewal rules, Federal Register notices, E-Verify status information, litigation affecting federal programs, state requirements, and anti-discrimination restrictions that limit when additional documentation can be requested.
The company does not need to turn every Human Resources employee into an immigration specialist. However, it does need a reliable process for recognizing when the rules affecting a particular worker have changed and for obtaining the right answer before making an employment decision.
For a General Counsel, that is the broader lesson. Form I-9 compliance is not simply about filling out the form correctly on the employee's first day. It is increasingly about building a system that remains accurate when the law changes around it.
About Todd B. Nurick
Todd B. Nurick is a Pennsylvania and New York business attorney, former U.S. Army officer, and Outside/Fractional General Counsel with nearly 30 years of civilian business law and litigation experience.
Through the Law Office of Todd B. Nurick, he advises businesses on contracts, transactions, employment matters, investigations, governance, compliance, technology, and the legal and operational risks involved in running a business. The Law Office of Todd B. Nurick is a fictitious name of Nurick Law Group LLC, the law firm Todd founded and through which he has represented businesses for decades.
