- HR compliance means following every law, regulation, contract and union rule that governs how you employ people. Four types apply to most employers: statutory, regulatory, contractual and union law.
- The federal overtime salary threshold was formally restored to $684 a week in May 2026 after the 2024 rule was vacated. State thresholds are higher and they control, so California now sits at $1,352 a week.
- AI in hiring is now regulated in four US jurisdictions. California holds you liable for a vendor's tool and wants four years of data, and Illinois added notice duties on 1 January 2026.
- Most failures are process failures: misclassification, wage and hour errors, missed I-9 deadlines and record retention gaps. An annual audit and a fixed retention schedule catch nearly all of them.
What does HR compliance in 2026 actually demand of your business? Connect with us today.
HR compliance got harder in 2026, not easier. The federal overtime rule employers spent two years planning around was formally rescinded in May. Illinois started regulating artificial intelligence in hiring on 1 January. California's algorithmic discrimination rules are now in force and they reach your vendors as well as you. Three states switched on paid family leave benefits. And every state you employ in adds a layer, while every country adds several.
We handle the employment paperwork behind hundreds of cross-border hires, so we have written this the way we brief a client rather than the way a statute reads. You get the laws you must follow, what genuinely changed in 2026, the twelve places compliance breaks down in practice, how long you are required to keep each record, the audit that keeps you ahead of trouble, and what changes once part of your team sits outside your home country.
What is HR compliance?
HR compliance is the practice of making sure your company follows every law, regulation, contract and policy that governs how you employ people. It has two halves. You build policies that match what the law currently requires, and you actively enforce those policies and intervene when something goes wrong. The goal is twofold: avoid fines and lawsuits, and run a workplace that is fair, safe and legally defensible.
Four distinct types of compliance apply to most employers, and they are worth separating because each has a different enforcer and a different consequence when it fails:
| Type | What it covers | Who enforces it | What a failure looks like |
|---|---|---|---|
| Statutory | Federal, state and local laws on wages, hours, leave, safety and discrimination | Legislatures, through agencies and private lawsuits | Back wages, liquidated damages and attorneys' fees |
| Regulatory | Rules issued by a specific agency, and the guidance that interprets them | EEOC, OSHA, IRS, USCIS, state civil rights bodies | Charges, citations, audits and consent decrees |
| Contractual | Offer letters, employment agreements, separation agreements, NDAs, benefit plan documents | The counterparty, through breach of contract claims | Damages, specific performance, unenforceable clauses |
| Union law | Collective bargaining agreements and protected concerted activity | NLRB and arbitration under the agreement | Unfair labor practice charges and grievance awards |
Most organisations put HR at the centre of all four, which is the right call, but the work only holds when leadership, managers and employees each carry a share of it. The broader discipline that wraps around these four types is usually called compliance and legal management.
→ Read: HR Rules and Regulations 2026: Guide for US Employers
Why does HR compliance matter more in 2026?
Because three separate things all moved at once. Enforcement stayed heavy while the federal rulebook was rewritten, artificial intelligence became its own compliance category with its own state statutes, and the number of overlapping jurisdictions a normal employer touches kept climbing. Any one of those is manageable. Together they mean last year's checklist is now wrong in several places.
Start with the volume, because it is easy to misread. In fiscal year 2025 the EEOC processed 88,201 new discrimination charges, responded to nearly 270,000 inquiries and resolved 90,743 charges. Its Office of General Counsel filed 94 merits lawsuits and resolved 120, recovering $26,636,882.66 for roughly 2,505 people, with a successful outcome in 96.5% of resolutions, according to the EEOC Office of General Counsel FY 2025 annual report. Note what that does and does not say: filings went down against the prior year, while the win rate stayed near total. Fewer suits, not softer ones.
Second, AI is now a compliance category in its own right rather than a subheading under discrimination. Four US jurisdictions regulate automated employment decisions directly, and the common thread across all of them is that buying the tool from a vendor does not move the liability. If a screening model produces a disparate impact, you are the employer that produced it.
Third, multi-state and remote employers carry cumulative rather than additive risk. A Florida company with remote staff in California, Colorado and New York is subject to four overlapping rulebooks at once, and the interaction between them is where the errors live. Add a single international hire and the complexity steps up again.
Practitioners describe the trigger point the same way we hear it from clients, which is that the obligations arrive before anyone notices they have arrived:
"Most businesses don't realize they've triggered a whole new set of obligations the moment a single employee works from a different state." -Zachary Craig, writing on LinkedIn about multi-state HR compliance.
He goes on to list what actually gets triggered: payroll tax withholding, state unemployment insurance, workers' compensation, paid leave laws and final paycheck rules, each of them different in every state.
When non-compliance does surface, the cost arrives in five forms, and the ones that hurt most are rarely the ones that get budgeted for:
- Agency penalties: assessed per violation, per form or per employee, which is why small process failures scale badly across a large headcount.
- Private lawsuits: wage and hour claims typically carry liquidated damages and a fee-shifting provision, so the plaintiff's legal costs land on you.
- Back pay and remediation: correcting a misclassification retroactively means unpaid overtime, employer tax shares, interest and often benefits the worker never received.
- Public record: agency settlements and court filings are searchable, and they surface during due diligence long after the matter closes.
- Hiring drag: candidates now check pay ranges, leave policies and AI-use disclosures before they apply, so a compliance gap reads as a culture signal.
Read in reverse, that list is also the business case. Compliance done properly is a recruiting asset, and it is the cheapest form of insurance available to an employer. What follows is the legal floor every US employer stands on.
→ Read: Employer of record compliance: responsibilities and risks
What are the key US HR compliance laws every employer must know?
Federal employment law rests on about a dozen foundational statutes plus a handful that most guides leave out. The thing to hold onto is that each one has its own employee-count threshold, so the law that applies to you at 14 employees is not the law that applies at 15, 20 or 50. Coverage, not company size in the abstract, is what triggers the duty.
The table below is the reference version, ordered so the count thresholds are readable down the column:
| Statute | Applies at | What it requires of the employer |
|---|---|---|
| Fair Labor Standards Act (FLSA) | Nearly all employers | Federal minimum wage of $7.25 an hour, overtime at 1.5 times the regular rate past 40 hours for non-exempt staff, correct exempt classification, child labor limits |
| Immigration and Nationality Act, Form I-9 | 1 employee | Verify identity and work authorisation for every new hire and complete Form I-9 within three business days of the first day of work |
| Equal Pay Act (EPA) | 1 employee | Equal pay for substantially equal work between employees of opposite sexes in the same establishment |
| Occupational Safety and Health Act (OSHA) | 1 employee | Maintain a safe workplace, train on hazards, communicate them, record and report serious injuries within set timeframes |
| National Labor Relations Act (NLRA) | Most private employers | Protect the right to organise, bargain collectively and discuss wages and conditions, whether or not the workforce is unionised |
| PUMP Act (FLSA amendment) | 1 employee, with a limited exemption under 50 | Reasonable break time and a private non-bathroom space for nursing employees |
| Title VII of the Civil Rights Act | 15 employees | No discrimination on race, colour, religion, sex including gender identity, sexual orientation and pregnancy, or national origin |
| Americans with Disabilities Act (ADA) | 15 employees | Reasonable accommodation for qualified individuals with disabilities, and no disability-based discrimination |
| Genetic Information Nondiscrimination Act (GINA) | 15 employees | Do not request, require or use genetic information, including family medical history, in employment decisions |
| Pregnant Workers Fairness Act (PWFA) | 15 employees | Reasonable accommodation for known limitations related to pregnancy, childbirth or related conditions, even where the ADA disability standard is not met |
| Age Discrimination in Employment Act (ADEA) | 20 employees | Protect workers aged 40 and over in hiring, firing, promotion, pay and benefits |
| COBRA | 20 employees | Offer continuation of group health coverage after a qualifying event, with the election notice served on time |
| Family and Medical Leave Act (FMLA) | 50 employees | Up to 12 weeks of unpaid job-protected leave a year for serious health conditions, childbirth, adoption or care of a family member |
| Affordable Care Act employer mandate | 50 full-time equivalents | Offer affordable coverage meeting minimum value to full-time employees and dependents, and file the annual returns |
Two of those deserve a closer look, because in our experience they are the two employers most often assume do not apply to them. The FLSA sits at the top for a reason: the Wage and Hour Division's own FLSA guidance governs almost every employer in the country, and misclassification under it is the single most litigated question in US labour law.
The second is the Pregnant Workers Fairness Act, which is the gap we see most often in 2026 audits. The EEOC issued its final regulation on 15 April 2024 and it took effect on 18 June 2024. A request can be verbal, in plain language, and can come from someone acting for the employee. That is all it takes to trigger your duty to engage in the interactive process, and the most common failure is a frontline manager who treats the request as a purely HR matter and never documents the conversation.
The regulation also names four accommodations it calls predictable assessments, meaning they will virtually always be reasonable and denying one is very hard to defend:
- Allowing an employee to carry or keep water near them and drink, as needed.
- Allowing additional restroom breaks, as needed.
- Allowing an employee whose work requires standing to sit, and whose work requires sitting to stand, as needed.
- Allowing breaks to eat and drink, as needed.
If your manager training has not been updated since those regulations became final, that is the highest-priority gap on this page. It is also the cheapest one to close.
State and local law frequently goes further than any of the statutes above, and where it does you follow the stricter rule rather than the federal one. That principle is doing more work in 2026 than it has in years, because the federal layer moved down while the state layer moved up.
→ Read: How to Calculate Overtime Pay: A US Employer Guide
What actually changed in HR compliance in 2026?
Five things, and one of them is a reversal rather than an addition. The federal overtime threshold was reset downward, pay transparency kept spreading state by state, four jurisdictions now regulate AI in employment decisions, three states began paying family leave benefits, and non-competes went back to being purely a state question. Each is dated below, because in this area the date is the whole answer.
The federal overtime threshold was reset, not raised
This is the change most often reported backwards, so read it slowly. The 2024 rule that would have lifted the white-collar exemption threshold to $1,128 a week, or $58,656 a year, was struck down nationwide in November 2024.
The Fifth Circuit dismissed the remaining appeals on 5 May 2026 after the administration stopped defending the rule, and on 14 May 2026 the Department of Labor issued a technical amendment restoring the earlier salary levels, effective 15 May 2026. What was restored is the lower figure: $684 a week, or $35,568 a year, with the highly compensated employee threshold back at $107,432 in total annual compensation. The higher number is gone, not delayed.
The practical consequence is that the exemption question has moved to the states, several of which set their own floor and whose higher figure always controls.
California, New York, Colorado, Washington and Alaska all do. California's minimum wage rose to $16.90 on 1 January 2026, which lifts its state exemption salary floor to $70,304 a year, or $1,352 a week, with the computer professional exemption at $122,573.13 and the licensed physician hourly rate at $107.17. Salary is only half the test in every one of those states, so the duties test still has to be met independently.
Pay transparency kept spreading, and the state count is not the number to trust
Published counts for 2026 range from sixteen to eighteen states depending on whether the source counts posting mandates, on-request disclosure or pay data reporting, so we name jurisdictions instead.
Requiring a pay range in the job posting itself, as of mid-2026: California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New York, Rhode Island, Vermont, Washington and the District of Columbia. Delaware joins them on 26 September 2027. Ohio has no statewide law but Cincinnati, Cleveland, Columbus and Toledo each impose local requirements.
Two 2026 additions are easy to miss. California's SB 642 took effect on 1 January 2026 and tightens what a good-faith range means, and Rhode Island began requiring a written pay notice for new hires on the same date. The trap for a remote employer is unchanged and still catches people: a role that could be filled from a covered state triggers that state's rule, whatever your headquarters address says.
Four jurisdictions now regulate AI in employment decisions
California's Civil Rights Council rules on automated decision systems took effect on 1 October 2025 and are the strictest of the four. Under the final text of the automated decision system regulations, discriminatory use of an automated system is treated exactly as human discrimination would be, all data related to the system must be kept for four years, and liability extends to an employer's agent, meaning anyone performing a function the employer traditionally performs, including recruitment and screening.
The detail employers keep missing is the evidentiary one: the absence of anti-bias testing can itself be used against you in a claim, so choosing not to test is not a neutral choice.
Illinois came second. House Bill 3773 amended the Illinois Human Rights Act with effect from 1 January 2026, barring AI use that has the effect of discriminating on a protected basis and requiring notice to employees and applicants when AI is used in recruitment, hiring, promotion, discipline, discharge or anything affecting the terms of employment.
The state's human rights department withdrew its proposed implementing rules, which means the statutory duty is live while the shape of a compliant notice is still unsettled. Give notice anyway.
New York City remains the oldest of the four. Local Law 144 requires an annual independent bias audit, published results and candidate notice for any automated employment decision tool screening city candidates.
The penalty is $500 for a first violation and any further violations the same day, then $500 to $1,500 for each subsequent one, and each day of non-compliant use is a separate violation. Enforcement has been light, which is why the State Comptroller's audit of 2 December 2025 matters: it found the city's enforcement of the law ineffective, and the expected response is a stricter phase rather than a quieter one.
Colorado is the one to stop worrying about in its original form. Senate Bill 24-205 was pushed from February 2026 to 30 June 2026 and then repealed outright by Senate Bill 26-189, signed on 14 May 2026, which replaces it with a disclosure and rights framework for automated decision-making technology effective 1 January 2027.
Texas is the mirror image: the Responsible Artificial Intelligence Governance Act took effect on 1 January 2026 but was narrowed before passage to government use and intentional misuse, so it is not the private-sector hiring burden some summaries still describe.
Three states started paying family leave benefits
Delaware's paid family and medical leave insurance programme moved from collecting contributions to paying benefits on 1 January 2026, with a maximum weekly benefit of $900. Minnesota switched contributions and benefits on simultaneously the same day, funded by a 0.88% payroll tax split evenly between employer and employee, with a maximum weekly benefit of $1,423.
Maine begins paying benefits on 1 May 2026, having collected since January 2025 at 1.0% for employers with fifteen or more staff and 0.5% for smaller ones. The administrative burden is what surprises people: each programme has its own claim portal, benefit calculation, notice requirements and coordination rules with your own paid leave, so an employer in six programme states is running six leave systems on top of FMLA.
Non-competes went back to being purely a state question
The Federal Trade Commission's 2024 non-compete rule is finished. Having acceded to the court's vacatur, the Commission removed 16 CFR part 910 from the Code of Federal Regulations effective 12 February 2026, so there is no federal restriction at all and enforceability is entirely a matter of state law.
Four states void employee non-competes outright however narrowly they are drafted: California, Minnesota, North Dakota and Oklahoma. Washington is the one to diary rather than act on today. Substitute House Bill 1155 was signed on 23 March 2026 but does not bite until 30 June 2027, when existing non-competes become void, with written notice to affected current and former workers due by 1 October 2027.
Pulled together, here is the whole 2026 change set with the action each one forces:
| Change | Effective | What you have to do |
|---|---|---|
| Federal overtime threshold restored to $684 a week | 15 May 2026 | Re-run exemption tests against the restored federal floor and against every applicable state floor, then reconcile the two |
| California SB 642 pay range rules | 1 January 2026 | Tighten how job posting ranges are set and documented as good faith |
| Rhode Island written pay notice for new hires | 1 January 2026 | Add a written pay notice step to the offer process |
| Illinois HB 3773 AI notice and non-discrimination duties | 1 January 2026 | Notify applicants and employees where AI is used, and audit the tool for disparate impact |
| Texas Responsible AI Governance Act | 1 January 2026 | Confirm scope. As enacted it targets government use and intentional misuse, not ordinary private hiring tools |
| Delaware paid family and medical leave benefits begin | 1 January 2026 | Stand up claim handling and coordinate with your own leave policy |
| Minnesota paid leave contributions and benefits begin | 1 January 2026 | Set up the 0.88% payroll deduction and employer share, plus claim administration |
| FTC non-compete rule removed from the CFR | 12 February 2026 | Review restrictive covenants state by state. There is no federal backstop either way |
| Maine paid leave benefits begin | 1 May 2026 | Prepare for claims against contributions already collected since January 2025 |
| Colorado AI Act repealed and replaced | Repeal 14 May 2026, successor 1 January 2027 | Stop building to SB 24-205 and re-plan against the new disclosure framework |
| Washington non-compete ban enacted | Signed 23 March 2026, effective 30 June 2027 | Stop issuing new covenants to Washington staff and plan the notice due by 1 October 2027 |
| Delaware pay transparency | 26 September 2027 | Add pay ranges to postings once the 25-employee threshold applies to you |
One quiet 2026 development worth knowing about penalties: the Department of Labor made no inflation adjustment to its civil money penalties this year, because the Bureau of Labor Statistics did not publish October 2025 consumer price index data during a funding lapse and the statute allows no substitute calculation. Penalty amounts therefore sit at their 2025 levels. That is a pause, not a reduction.
Compliance load growing faster than your HR team?
We take on the employment, payroll and statutory compliance work for your people wherever they sit, so your team can stop chasing rule changes.
What are the most common HR compliance issues in 2026?
Almost all compliance failures come from a short list of repeat offenders, and almost none of them are failures of knowledge. They are failures of process, which is why the same twelve appear year after year. Each one below carries a worked example of what non-compliance looks like in practice, because the abstract version of these rules is easy to nod along to and hard to spot in your own operation:
1. Employee misclassification
Treating someone as an independent contractor when they meet the legal definition of an employee triggers back taxes, unpaid overtime claims and missed benefits at once. The IRS applies a three-factor analysis covering behavioural control, financial control and the type of relationship, and several states apply a stricter test on top of it.
Example: a marketing agency engages a graphic designer on a 1099, then sets her schedule, supervises her tasks and requires her to use company equipment. Any of those three facts on its own is survivable. All three together let the IRS or a state agency reclassify her, with back taxes, interest and penalties owed. Our guide to telling a contractor from an employee walks the tests in order.
2. Wage and hour violations
Unpaid overtime, a miscalculated regular rate, or paying below the applicable minimum wage are the most common wage claims in the United States, and the applicable minimum is rarely the federal one. Over twenty states and dozens of cities sit above $7.25 an hour, and several states run tiered rates by region rather than a single figure.
Example: a retail chain pays part-time staff in Oregon the federal $7.25. Oregon's published minimum wage schedule sets three rates from 1 July 2026: $16.80 in the Portland metro area, $15.55 as the standard rate and $14.55 in non-urban counties, with no tip credit at all. Each underpaid employee can recover unpaid wages, liquidated damages and attorneys' fees, and a single employer with sites in two Oregon zones can be underpaying against two different figures simultaneously.
For comparison, the District of Columbia has the highest state-level rate in the country at $18.40 an hour from 1 July 2026, up from $17.95, with a tipped rate of $10.30. Several individual cities sit above even that, so a national pay floor set to any single state's figure will be wrong somewhere.
3. FMLA denials and retaliation
Refusing eligible leave, or retaliating against someone who takes it, breaches the FMLA twice over, because interference and retaliation are separate causes of action.
Example: a logistics company with 75 employees refuses an unpaid family leave request from a worker caring for a parent with a serious illness, on the grounds that the absence would disrupt operations. Operational disruption is not a defence at that headcount, and the refusal supports a retaliation claim on top of the denial. Our leave of absence guide sets out the practical rules.
4. Anti-discrimination failures
Bias in hiring, pay, promotion, discipline or termination can produce a charge even where nobody intended it, because Title VII reaches effects as well as intent. Consistent documentation is the only reliable defence.
Example: a company promotes male engineers over female engineers carrying similar performance ratings, over several cycles. No individual decision looks discriminatory in isolation, and the pattern still supports a disparate impact claim. Building the pattern check into your HR strategy is what catches it before a charge does.
5. OSHA safety violations
Failing to supply required protective equipment, training or hazard communication is a citable offence, and the standards that apply to you are industry-specific rather than generic. A construction site and a clinic face almost no overlapping hazards, so a single generic safety programme satisfies neither.
Example: a construction firm runs a site with airborne silica dust but provides neither respirators nor fit testing. OSHA can assess penalties per exposed worker per day, so the arithmetic compounds quickly on a site with a large crew and a long exposure window. Our workplace compliance tips for employers cover the recordkeeping side.
6. Form I-9 and immigration errors
Late, incomplete or missing I-9 records attract per-form fines, and the calculation is worth understanding because it is proportional rather than flat. Per ICE's I-9 inspection factsheet, the number of substantive violations is divided by the number of forms that should have been produced, and the resulting violation percentage sets the base fine band. Fixing nine of ten defective forms therefore reduces the fine on the tenth, which is the case for running an internal audit before anyone else does.
Example: a restaurant hires ten people in a quarter and completes forms for six. That is a 40% violation rate, which lands the employer in a materially higher fine band than four isolated errors across a workforce of a thousand would. Confirming work authorisation within three business days of the first day of work is the whole obligation.
7. Pay transparency violations
Posting a role without the salary range a covered state requires attracts fines and complaints, and remote postings are where this bites hardest because the trigger is where the role can be filled from, not where you sit.
Example: a Florida-based technology company posts a remote engineering role open to candidates in any US state and omits the salary range. Because a California resident could fill it, California's rule applies. The same posting simultaneously breaches the rules of every other covered state on the list, so a single posting can generate parallel exposure in a dozen jurisdictions.
8. Data security and privacy failures
Holding employee personal data without adequate security creates breach liability under state privacy law, and the point employers still get wrong is that employee data is in scope, not just customer data. The California Consumer Privacy Act covers your own workforce records.
Example: an HR team keeps Social Security numbers on an unsecured shared drive. The breach exposes the data and the company faces regulatory penalties and class action claims from its own staff at the same time. Our guide to securing employment data across jurisdictions covers the controls that hold up under audit.
9. Improper background checks
Running a check without the disclosures and authorisations the Fair Credit Reporting Act demands creates liability independent of whether the report was accurate or the decision was fair.
Example: a staffing firm uses a third-party vendor but skips the standalone disclosure step, burying it inside the application form. The report is accurate and the candidate is hired, and the missing standalone disclosure is still a violation. Getting pre-employment screening right is mostly a sequencing problem, not a vendor problem.
10. Non-compliant leave policies
State and local leave laws covering paid sick leave, family leave and jury duty routinely go beyond federal FMLA and vary by city, and with three new state programmes paying benefits in 2026 the gap between a federal-only policy and the law widened this year rather than narrowing.
Example: a New York employer applies federal FMLA rules only and ignores New York Paid Family Leave, denying paid leave the employee is entitled to. Whichever rule is more generous is the one that governs, and your accrual calculations have to be built to the stricter of the two from the start.
11. Unpaid or late final wages
State law fixes when the final paycheque is due and the deadlines differ sharply, from immediately on discharge to the next regular payday. California's waiting time penalty is the one most often triggered by a payroll calendar that was never adjusted for the state.
Example: a California employer waits three weeks to issue a terminated employee's final cheque, because that is when the next payroll ran. State law required payment on the day of termination, and the employee can claim up to thirty days of wages as a penalty, which will usually exceed the wages actually in dispute. Following a documented termination process removes the timing risk entirely.
12. AI bias in hiring tools
Screening tools producing disparate impacts on protected groups breach Title VII, the ADA and the ADEA regardless of the state you sit in, and in California, Illinois and New York City they now breach a specific statute as well. New York City's automated employment decision tool rules add the annual bias audit and candidate notice on top.
Example: a company uses an AI resume screener that consistently rejects applicants over 50. That is an ADEA problem, and the employer remains liable even though a third party built and trained the tool. Under California's rules the vendor may be your agent, which extends rather than shares the exposure.
Every one of those twelve is findable in advance. The mechanism for finding them is a structured audit rather than a hope that someone raises it.
How do you conduct an HR compliance audit?
An HR compliance audit is a systematic review of your policies, processes and records against current legal requirements. Run one annually as a floor, with quarterly spot checks and a review after any incident. The six steps below are the sequence we use, and the order matters because step four is where most of the findings actually come from.
Work through them in order rather than in parallel:
- Define the scope: decide what you are auditing. A full audit covers hiring, classification, pay, leave, benefits, safety, recordkeeping and termination. A targeted one takes a single area such as wage and hour or I-9.
- Identify every applicable law: list the federal, state and local rules that reach your business, and note the employee-count threshold beside each. A multi-state employer typically tracks fifty to a hundred jurisdiction-specific rules.
- Review the documents: pull the handbook, offer letter templates, contracts, leave policies, safety procedures, I-9 records, payroll records and benefit documents, and compare each against current law rather than against last year's version of itself.
- Check practice against policy: a policy nobody follows is worse than no policy, because it evidences that you knew the rule. Spot-check timecards, classification records, performance reviews, disciplinary actions, accommodation logs and pay equity data.
- Document gaps and rank them: write a report listing every gap, its exposure and its priority. Rank by legal risk and dollar exposure, never by how easy the fix is.
- Build the action plan: assign owners, set deadlines and schedule follow-up. Most plans combine policy updates, manager training, documentation fixes and process changes. Book the next audit before you close this one.
An audit that produces a ranked list and named owners is worth running. One that produces a document nobody is accountable for is theatre, and it creates a written record that you were aware of the gap.
→ Read: EOR Compliance Audit Checklist: A Complete US Guide for 2026
How long do you have to keep HR records?
Longer than most employers assume, and for different periods under different statutes covering the same document. This is the quietest failure on the whole list, because nothing goes wrong until an agency asks for a record you no longer hold, at which point the absence of the record is itself the finding. The safe operating rule is to retain to the longest applicable period, not the shortest.
These are the federal minimums, and any state schedule that runs longer overrides them:
| Statute | Retention period | What it applies to |
|---|---|---|
| FLSA | 3 years | Payroll records, collective bargaining agreements, sales and purchase records |
| FLSA | 2 years | Records used to compute pay, including time cards, work and time schedules, and additions to or deductions from wages |
| ADEA | 3 years | Payroll records showing name, address, date of birth, occupation, pay rate and weekly compensation |
| Title VII, ADA, GINA, ADEA | 1 year | Applicant records, from the date the record was made, including records for candidates not selected |
| Title VII, ADA, GINA, ADEA | 2 years | Applicant records held by state and local governments, educational institutions and certain federal contractors and subcontractors |
| Equal Pay Act | 2 years | Wage rates, job evaluations, seniority and merit systems, and anything else explaining a pay difference between employees of opposite sexes |
| FMLA | 3 years | Leave records, kept to the FLSA section 11(c) standard |
| Form I-9 | 3 years from hire, or 1 year from termination, whichever is later | Every completed I-9, available for inspection by DHS, DOL or DOJ officials |
| California ADS regulations | 4 years | All data relating to an automated decision system used in employment decisions |
Two rows in that table catch people out. The I-9 retention clock is conditional rather than fixed, so a long-tenured employee's form is retained for the whole of their employment plus a year, and a purge run on a flat three-year rule destroys records you were required to hold. And the California four-year rule applies to automated decision system data, which usually lives with a vendor rather than in your own HRIS, so it needs to be written into the contract rather than into your retention policy.
What HR compliance best practices actually work?
The practices that hold up are unglamorous and repeatable. What fails is anything that depends on somebody remembering. Eight things close the gap between knowing the rule and following it, and the honest observation from practitioners is that most teams cannot say what is required of them in the first place.
"Ask most HR teams 'what training do we legally need, in every state we operate in, for every role we have' and watch the silence. It's not laziness, it's that the answer depends on headcount, industry, revenue, where your people sit, and what data you touch. And it changes constantly. So teams guess. They copy what a peer company does. They buy a bundle and hope it covers them. That's not a compliance strategy, that's a coin flip with your company's name on it."
Alex Seiler, an HR leader who describes himself as twenty years into the work, posting on LinkedIn. The list below is designed to replace the coin flip with something you can point to in a room:
- Apply policies consistently: inconsistent application creates a discrimination claim even where the policy itself is sound. Document every disciplinary action, leave decision and accommodation request the same way for every employee.
- Make it a shared responsibility: leadership sets the tone, HR owns the policies, managers handle daily application and employees flag issues early. When any one layer stops carrying its share, compliance breaks at that layer.
- Subscribe rather than search: follow your state labour department updates and the EEOC newsroom directly, and put a quarterly legal review in the calendar. Most changes land at the start of January or the start of July, so those are the two reviews that matter most.
- Put the rules in the system: modern HR management software handles timekeeping, classification, leave tracking, I-9 verification, payroll and audit logs in one place. Check that it encrypts sensitive data, supports role-based access and produces audit-ready reports.
- Keep separate checklists: one for hiring, one for offboarding, one for annual updates, and one per state once you cross into a third jurisdiction. Revise them the same week a law changes, not at the next annual review.
- Train managers, not just HR: managers cause more compliance issues than anyone else, because they are the ones receiving requests in real time. Annual training on discrimination, harassment, wage and hour, leave, accommodation and AI-use policy is the floor.
- Run a compliance calendar: mark every recurring deadline, including ACA reporting, EEO-1 filing, the OSHA 300A posting from 1 February to 30 April, W-2 distribution, I-9 retention dates and state-specific renewals.
- Audit on a fixed schedule: annual full audits, quarterly spot checks and post-incident reviews stop small gaps becoming systemic. A schedule beats a trigger, because the trigger usually arrives as a complaint.
None of those eight requires new headcount. They require somebody named to own each one, which is a different problem and a solvable one. What they do need is measurement, or you cannot tell whether any of it is working.
What HR compliance metrics should you track?
Four metrics carry most of the signal, and each one has a failure mode that is easy to misread. Track them quarterly, and read the direction rather than the absolute number, because a spike in reported violations can mean your reporting improved rather than your compliance deteriorated.
Here is what each metric measures, the target, and the way it misleads:
| Metric | What it measures | Target | How it misleads |
|---|---|---|---|
| Classification accuracy | Share of workers correctly classified as exempt, non-exempt or independent contractor | 100%, tested annually and on every role change | Looks perfect if you test against your own job titles rather than against the statutory duties test |
| Training completion rate | Share of employees and managers who completed mandatory training in the last 12 months | At or near 100% for discrimination, harassment and safety | Completion is not comprehension, and a 100% rate on the wrong course list is worth nothing |
| Time to resolve a compliance issue | Average days from a concern being reported to it being closed | Trending down, with no open item past its owner's deadline | Improves artificially if issues are closed without remediation, so pair it with a reopened-issue count |
| Policy violation incidents | Reported violations of major HR policies per quarter | Stable or declining once reporting has matured | A spike can mean better reporting, which is good, or a real systemic gap, which is not. Track both readings |
Add whatever your own risk profile demands. If you use AI tools, track bias audit completion against every tool in use, including the ones a vendor added by upgrade. If you post in pay transparency states, track posting compliance by state rather than in aggregate. And the moment you employ someone outside your home country, every metric on this list gets harder to compute.
How does HR compliance work for global and distributed teams?
The moment you employ anyone outside your home country, your compliance scope multiplies rather than extends. Each country brings its own labour law, tax rules, social contributions, leave entitlements and termination protections, and none of them map cleanly onto the US framework you already run. The specific trap is that the parts which look familiar are the parts most likely to differ.
A short sample of what changes shows the shape of the problem:
| Market | The obligations that surprise US employers most |
|---|---|
| United Kingdom | Off-payroll working rules for contractors, statutory sick pay, and pension auto-enrolment with employer contributions |
| Germany | Works councils and co-determination rights, plus statutory notice tied to length of service rather than a flat period |
| Singapore | Central Provident Fund contributions and Employment Act coverage thresholds |
| Canada | Provincial employment standards layered over federal EI and CPP, with common-law reasonable notice routinely exceeding the statutory minimum |
| Australia | Superannuation contributions, Fair Work Act minimum standards, and redundancy pay owed separately from notice |
| Brazil | Thirteenth-month pay and at least thirty days of paid vacation under the labour code |
Misreading any single row on that table creates real liability, and the exposure is usually discovered at termination, which is the worst possible moment to find out that notice, severance and final pay all work differently than you assumed.
In our experience companies hit one of three dead ends. They try to manage international compliance in-house and miss rules nobody told them existed. They set up local entities, which takes months and real money per country and leaves them with a permanent local filing obligation. Or they classify foreign workers as contractors and walk into misclassification exposure, permanent establishment risk and severance claims at the same time.
An Employer of Record is the fourth option and it removes the dead end rather than routing around it. The provider becomes the legal employer in the country where your person works and carries payroll, tax, statutory contributions, benefits and local compliance. You keep day-to-day direction, performance management and project oversight, and you pay one invoice per person per month.
→ Read: Global Compliance Management with EOR: Complete Guide 2026
→ Read: Global Payroll Guide 2026: Models, Compliance & How to Pay International Teams
How does Wisemonk help with global HR compliance?
Wisemonk is a leading Employer of Record that helps global companies hire, pay, and manage employees, without setting up a local entity. We become the legal employer of your overseas team where they work, and we carry the compliance load that comes with it, so your HR team spends its time on people rather than on rule changes.
Here's how we help businesses manage HR compliance more effectively:
- Payroll and statutory filings: calculated, withheld and remitted on time, with the employer tax obligations handled as part of the cycle rather than reconciled after it.
- Statutory benefits and contributions: pension, social security, healthcare and mandated funds, enrolled and maintained without you tracking each scheme.
- Locally compliant contracts: employment agreements drafted to the law that governs your employee, not translated from a template written for somewhere else.
- Classification protection: correct worker classification under local law, which removes both misclassification and permanent establishment exposure at source.
- Onboarding through exit: leave administration, the full employee lifecycle, and notice and severance handling on the way out, with audit-ready records kept throughout.
We work with 300+ global clients, manage 2,000+ employees and process $20M+ in annual payroll, and we hold a 4.8/5 rating on G2. Employer of Record pricing starts from $99 per employee per month. You keep full control of day-to-day management, performance reviews and project work, and we take the legal and administrative layer.
We are planning our expansion into more markets, so you get one reliable partner for your operations today and your broader international HR management journey ahead.
→ Read: Offboarding Process and Best Practices for HR (2026)
→ Read: What Is the Employee Lifecycle? 7 Stages, Models, and Metrics Explained
Hiring across borders without a local entity?
We become the legal employer for your overseas team and carry the payroll, benefits and compliance work that comes with it.
What do clients say about running compliance with Wisemonk?
Companies from the US, UK and Europe trust us to build their teams compliantly and fast. Three short case studies, each restated only from what the client themselves wrote:
An HR team that wanted to stop administering contracts and compliance
The problem: an HR function spending its attention on contracts, payments and compliance rather than on employees, while managing a remote workforce. The outcome:
"Wisemonk is an exceptional product that helps us manage our remote workforce. It has enabled our HR teams to focus more employee welfare rather than worrying about contracts, payments and compliances. Its seemless UI, competitive Forex rates and responsive support makes it a product of choice for us." - Neeraj S., Chief Executive Officer, reviewing Wisemonk on G2.
A small company that could not carry the operating cost of every country
The problem: a small business with staff scattered across several countries, unable to absorb the operating expense of maintaining a presence in each one. The outcome:
"Wisemonk is simple to set up and utilize. We have successfully hired and managed foreign employees. The Wisemonk staff provides outstanding support. When our staff are scattered all through the globe, and as a small business, we can't afford the high operating expenses of all countries, Wisemonk allows you to employ as borderless experience." - Deep B., CEO of ContextQA, reviewing Wisemonk on G2.
An HR operations team that needed the manual hours back
The problem: hiring and managing overseas staff was consuming manual time from a team that had other work, with queries taking too long to resolve. The outcome:
"Wisemonk is easy to implement and use. We have been able to hire and manage overseas resources without any hassle. The support by the Wisemonk team is top class, We have a dedicated account manager who ensures that all our queries are answered and resolved immediately. They saved a lot of our manual resource time." - Manasij G., Co-founder and CEO, reviewing Wisemonk on G2.
Frequently asked questions
What is HR compliance in simple terms?
HR compliance means following every law, regulation, contract and union rule that governs how you employ people. It covers wages, hours, leave, safety, discrimination, immigration, data privacy, AI use and collective bargaining at federal, state and local level, plus the country-specific rules that apply if you employ across borders.
What are the four main types of HR compliance?
Statutory compliance covers federal, state and local employment laws. Regulatory compliance covers the rules of a specific agency such as the EEOC or OSHA. Contractual compliance covers employment agreements, separation agreements, NDAs and benefit plan documents. Union law compliance covers collective bargaining agreements and rights under the National Labor Relations Act.
What changed in HR compliance in 2026?
Five things. The Department of Labor rescinded the 2024 overtime rule and restored the $684 per week federal threshold effective 15 May 2026. Illinois began regulating AI in employment on 1 January 2026 and Texas narrowed its AI act before it took effect the same day. Delaware and Minnesota started paying family leave benefits on 1 January and Maine follows on 1 May. The FTC non-compete rule was removed from the Code of Federal Regulations on 12 February 2026. And California's SB 642 tightened its pay range rules.
What is the current federal overtime salary threshold?
$684 per week, which is $35,568 a year, with the highly compensated employee threshold at $107,432 in total annual compensation. The 2024 rule that would have raised the figure to $1,128 per week, or $58,656, was vacated in November 2024 and formally rescinded on 14 May 2026. Several states set higher thresholds that override the federal one, including California at $1,352 a week for 2026.
How do you conduct an HR compliance audit?
Define the scope, identify every applicable federal, state and local law with its employee-count threshold, review your policies and documentation against current law, check what managers actually do against what the policy says, document and rank the gaps by legal and dollar exposure, then build an action plan with named owners and deadlines. Most companies run a full audit annually with quarterly spot checks.
What are the most common HR compliance issues?
Employee misclassification, wage and hour errors, FMLA denials and retaliation, anti-discrimination failures, OSHA safety gaps, Form I-9 errors, pay transparency violations, data security lapses, background checks run without the required FCRA disclosures, leave policies that ignore state law, late final wages, and bias in AI hiring tools. Nearly all of them are process failures rather than knowledge failures.
How long do you have to keep HR records?
Retain to the longest applicable period. The FLSA requires three years for payroll records and two years for the records used to compute pay. The ADEA requires three years for payroll records. Applicant records are kept one year under Title VII, the ADA, GINA and the ADEA, or two years for state and local government, educational institutions and certain federal contractors. The Equal Pay Act requires two years, FMLA three years, and Form I-9 three years from hire or one year from termination, whichever is later.
How does an Employer of Record help with HR compliance?
An Employer of Record becomes the legal employer of your overseas workers and carries local payroll, tax, statutory contributions, benefits and country-specific compliance. You keep day-to-day management, performance reviews and project direction. It is the fastest route into a country where you hold no entity, and it removes misclassification and permanent establishment exposure at source.
Ready to build your India team?
Tell us who you're looking to hire. We'll walk you through exactly how the setup works for your company, your timeline, and your budget.