President Donald Trump has not minced words about his plan to crack down on illegal immigration, and employers are taking notice. The administration has begun workplace raids and stakeholders predict an increase in audits of Form I-9s, the documents used to verify whether an employee is eligible to work in the U.S.

In the days following Trump’s inauguration, however, voices in the immigration compliance community have been increasingly sounding an alarm about a vulnerability of which many employers may be unaware: their Form I-9 vendors.

Form I-9 goes online

Form I-9 compliance involves multiple variables, one of which is how the form is filled out. Both employers and employees must complete certain sections of the form. Traditionally, an employer representative sits down with a new hire in person to collect and review the employee’s documents that establish identity and employment authorization, which may include some combination of a government ID, a passport, a green card or similar items.

But some aspects of the process have become more electronically driven in recent years, thanks in part to the COVID-19 pandemic. In 2020, U.S. Immigration and Customs Enforcement temporarily permitted employers to review authorization documents remotely. ICE then made remote authorization a permanent option for E-Verify participants in good standing in 2023.

Electronic solutions that aid with Form I-9 completion and recordkeeping had also become increasingly common well before the pandemic, according to David Adams, account executive at background check provider SafestHires, which does not have its own Form I-9 product. These tools, offered by HR information systems vendors, law firms and other third parties, are sold on the premise of streamlining what can be a time- and resource-intensive process for employers.

Adams and others who spoke to HR Dive said they are concerned after having seen multiple platforms produce electronic I-9s that do not comply with federal regulations — opening the potential for infractions that the Trump administration is likely to uncover.

A two-part problem

There are two main areas of concern for HR teams, Adams said. The first is that Form I-9 vendor software may prepopulate certain sections of the Form I-9, such as an employee’s biographical information.

Per joint guidance by ICE and the U.S. Department of Justice, employers using Form I-9 software programs may not prepopulate I-9s with employee information that has been gathered via external sources such as the employee’s job application. Employers also may not complete an I-9 on an employee’s behalf unless they are helping the employee complete Section 1 of the form — where employees enter their information and attestation — as a preparer or translator.

The second area of concern is paper Form I-9s that have been affixed with an employee’s electronic signature using a software program. The problem is that the use of an electronic signature necessitates compliance with a host of U.S. Department of Homeland Security standards separate from those that apply to paper I-9s, and this could put employers effectively out of compliance.

While it’s unlikely I-9 vendors have purposefully released noncompliant products, Adams said, it is not enough to trust a vendor’s insistence that a product is compliant. HR teams, he said, must ask the right questions and cannot assume compliance; “you need to look at your system.”

In fact, the additional compliance measures required for digital forms are myriad. For one, DHS regulations require that employers keep “audit trails” of electronic I-9s, which are records showing what actions have been taken with respect to a specific form, said Chris Thomas, partner at Holland & Hart. And even when a vendor does keep an audit trail, the quality of those trails may not be sufficient to meet DHS standards, he added.

DHS regulations also state that employers must implement an electronic records security program that:

• Ensures only authorized personnel have access to electronic records.
• Provides for backup and recovery of records to protect against information loss, such as during power interruptions.
• Ensures that employees are trained to minimize the risk of unauthorized or accidental alteration or erasure of electronic records.
• Ensure that whenever the electronic record is created, completed, updated, modified, altered or corrected, a secure and permanent record is created that establishes the date of access, the identity of the individual who accessed the electronic record and the particular action taken.

The employee’s attestation can also create compliance concerns. DHS requires electronic systems used to capture an attestation to include a method that can show the employee has signed and read the attestation. The signature must be affixed at the time of the transaction and the system must create and preserve a record verifying the signer’s identity.

But Thomas said several electronic I-9 systems he has reviewed do not include such an attestation. That requirement could be fulfilled, in part, with a small box that an employee can check to affirm that they have read the attestation and entered their signature. “The laws are clear that if they don’t have that, then there’s no I-9 at all in the eyes of DHS,” Thomas added. “Many vendors do not have that attestation.”

Federal law enforcement agencies have previously taken action against employers using noncompliant electronic Form I-9 systems. Adams noted that in 2010, ICE fined retailer Abercrombie & Fitch more than $1 million over technology-related deficiencies in the company’s electronic Form I-9 verification system.

Adams said similar enforcement by the Trump administration could be costly for employers. On Jan. 2, DHS detailed civil monetary penalty adjustments for inflation in which the penalty for Form I-9 paperwork violations increased from a maximum of $2,789 per violation to $2,861 per violation.

“If it’s not compliant, you’re going to pay so much money,” Adams said.

‘Everybody’s in the crosshairs here’

Management-side attorneys who spoke to HR Dive largely agreed that electronic Form I-9 compliance is a concern for employers under Trump. Thomas said he has spoken with agents at ICE who have confirmed the agency’s intention to pursue enforcement actions against employers whose electronic Form I-9 vendors are out of compliance.

ICE did not respond to multiple requests for comment on its plans for electronic Form I-9 compliance enforcement.

The first day of Trump’s second term alone saw a number of executive orders aimed at reducing illegal immigration, including an order declaring an emergency at the U.S.-Mexico border and another aimed at preventing mass migration and resettlement. A separate order, “Protecting the American People Against Invasion,” directs DHS to “take all appropriate action to significantly increase the number of agents and officers available to perform the duties of immigration officers.”

The latter of these items may be particularly important given the limited number of agents on hand to conduct I-9 audits among ICE’s 30 regional Homeland Security Investigations Special Agent in Charge offices, said Thomas. He noted that the agency has worked with on-site contractors to speed up the pace of large-scale audits and could institute quotas to that effect.

“They will do everything to break the employment magnet in the U.S.,” Thomas said. “Everybody’s in the crosshairs here.”

The risk of an I-9 audit finding errors exists even if an employee is authorized to work in the U.S., said Doug Kauffman, partner at Balch & Bingham, because a system can still be deemed noncompliant.

What to do now

HR teams must take the initiative and ensure their vendors are aware of DHS regulations, Kauffman said; “ICE is not going to let you off the hook.”

It also may be worth going a step further: “Employers should not assume that their software solution is compliant,” said Eileen Lohmann, senior associate at law firm BAL. “It really is important to independently vet every electronic solution they’re using to make sure it complies with the regulations. It’s always going to be the employer who is liable for any errors on their Form I-9.”

In helping employers choose between different I-9 vendor proposals, Kauffman said he is “always looking at the regs every time,” as this is what ICE will focus on when evaluating employers. He said he also focuses on what vendors will do when their clients are audited by ICE, and what their processes and procedures are for ensuring clients have access to the materials ICE will ask for — including audit trails — within three business days.

“If we’re not able to provide it to ICE, it doesn’t do us much good,” Kauffman said.

Lohmann similarly said employers should consider a vendor’s process in the event of an audit. She said she also recommends that employers proactively do an internal I-9 audit to get a sense of what ICE might find. This could involve looking through a subset of I-9s with or without the assistance of outside counsel. “Even a smaller review can allow an employer to course correct and reduce their risk of exposure going forward,” Lohmann said.