How do HR compliance and I-9 / E-Verify software keep you compliant across states (documents, retention, penalties)?

This software turns Form I-9 and E-Verify into a guided, dated workflow, so the paperwork rules that carry federal fines get enforced on every hire instead of depending on whoever happens to run onboarding that week. It presents Section 1 to the new employee electronically, validates the entries before they can submit, and routes Section 2 to the employer representative with a running count against the three business day deadline [1][9]. Since the errors that draw penalties are usually blank fields, wrong dates, or a missing signature rather than any intent to cut corners, catching them at the point of entry is where most of the practical value sits [10][11].

The pieces it manages

E-Verify sits directly on top of the completed I-9. Products create the E-Verify case, submit it, and hold the answer inside the same record, and when that answer comes back as a mismatch they walk the employer through the notice and referral steps the program requires [6][9]. Reverification of an expiring work authorization is tracked by date, so the record surfaces before the authorization lapses rather than after someone notices [1][10]. The retention clock runs on its own: the system keeps each I-9 for three years after the hire date or one year after employment ends, whichever is later, and can purge on schedule once that date has passed [1].

Why the audit trail matters

Every action carries a timestamp, the identity of the person who took it, and a stored copy of the documents that were examined, which is exactly what an Immigration and Customs Enforcement inspection asks to see [9][10]. Equifax describes its Guardian and I-9 HQ products as guided workflows that mitigate more than 300 possible Form I-9 errors and log every change [11]; Mitratech's Tracker I-9 exposes potential errors for remediation and submits eligible records to E-Verify as they are completed [10]; WorkBright runs field validation and more than 150 automated compliance checks before a form can go through [9]. The shared idea is that the software remembers what was done and when, so you can produce a clean, defensible file on three days' notice.

Four I-9 rules do most of the compliance work, and each maps to a field or a date the software watches. Section 1 must be completed by the employee no later than the first day of work for pay, which the regulation frames as the time of hire [1]. Section 2, where the employer examines the identity and work authorization documents the employee presents and records them, has to be done within three business days of that first day [1].

The retention clock

You keep each completed I-9 for three years after the date of hire or one year after the date employment ends, whichever of the two is later [1]. That formula means a long-tenured employee's form is retained for one year past their departure, while someone who leaves quickly is still covered for the full three years from hire. Software runs this calculation per person and flags forms that have aged out, which keeps you from destroying a record too early or holding personal data longer than the rule allows.

Reverification and document examination

Reverification of a time-limited work authorization must happen no later than the date that authorization expires, and the system tracks the expiration so the prompt arrives with time to spare [1]. For document examination, the employer or its authorized representative has to review the actual documents the employee chooses to present from the acceptable-document lists, and the software stores those copies alongside the form. None of this turns a weak process into a compliant one on its own. If an untrained reviewer accepts the wrong document or backdates a form, the software will faithfully record the mistake, which is why the tool reduces error without removing your responsibility for the judgment calls.

E-Verify compares the information from a completed Form I-9 against Department of Homeland Security and Social Security Administration records and returns either a confirmation or a mismatch. When you use it, a case has to be created within three business days of the employee's start date, and compliance software builds that deadline into the same workflow that produced the I-9 [6][8]. Most cases resolve to employment authorized within seconds, and the harder path is the mismatch [9].

The mismatch process

A mismatch, which E-Verify's current materials use in place of the older term tentative nonconfirmation, means the data did not line up and the case needs attention before it can close [8]. You give the employee a Further Action Notice, review it with them in private, and they decide whether to take action to resolve it [8]. If they choose to act, you refer the case, and the employee contacts the Social Security Administration or Department of Homeland Security within the allotted federal working days to sort out the record [6][8].

What you cannot do while it is pending

You cannot terminate, suspend, withhold pay, delay training, or take any other adverse step against a worker because of a mismatch while the case is still open [8]. Only after the case closes as a Final Nonconfirmation may you act on it [8]. This protection is the part manual processes get wrong most often, which is why the software locks the case status and timestamps each step rather than leaving the sequence to memory.

Remote document examination is allowed, but only through a specific DHS procedure and only for employers enrolled in E-Verify and in good standing. DHS finalized this optional alternative in a rule published July 25, 2023, effective August 1, 2023, after years of temporary pandemic flexibility [3]. It lets a qualifying employer examine identity and work authorization documents over a live video interaction instead of in the same room as the employee [4].

What the procedure requires

The employer has to be a participant in good standing in E-Verify at the hiring site using it, conduct the live video review, and keep a clear copy of the front and back of every document presented [4]. For a new hire, the employer also creates an E-Verify case as part of the same process [3][4]. An employer that is not enrolled in E-Verify does not get this option and still has to examine documents in person, which is a practical reason many multi-location employers enroll in the first place [4]. Compliance platforms support the procedure directly. WorkBright, for example, runs remote, in-person, and DHS alternative procedure examinations in one workflow, while Tracker I-9 and Equifax route in-person cases through networks of physical locations for employers that cannot or choose not to verify over video [9][10][11].

The software records and enforces; it does not assume your legal liability. An I-9 penalty is assessed against the employer, not the vendor, so a clean audit still depends on trained reviewers making correct calls at the document table [1][2]. A few limits are worth stating plainly.

It does not replace judgment on the documents

The tool can validate that a field is filled and a date is present, but it cannot tell you whether the document in front of a reviewer is genuine or whether it reasonably relates to the person presenting it. That judgment stays with the human, and the DHS alternative procedure still requires a live look at the documents rather than an automated scan [4].

It is not legal advice or immigration counsel

Product help text and compliance checklists describe federal requirements, but they do not resolve a specific worker's status question or a novel state rule. The state mandate list and the penalty amounts both move, and a vendor's summary can lag the current law [2][5].

It does not remove the free option or the underlying duty

E-Verify itself is a free government service, so the paid software is buying workflow, validation, records, and multi-state logic rather than access to E-Verify [6]. If you run low volume in a single voluntary state, a careful manual process on the current government form can be compliant, and the case for software strengthens as headcount, locations, and remote hiring grow [5][9]. Either way, the duty to complete, examine, retain, and reverify is yours, and the tool is the evidence that you met it.