HR Legal Compliance: Laws, Risks and 2026 Checklist

Which employment law did your company break last month without knowing it?

Most HR teams cannot, and the honest ones say so. We have helped over 300 global companies hire, pay, and manage more than 2,000 employees without setting up a local entity, and the pattern repeats: compliance failures are rarely a decision anyone made. They are the gap between what the law changed and what the process still does.

This guide covers what HR legal compliance means, where HR's ownership ends, the US laws that set the baseline, what shifted in 2026, and how to audit your own program. If your obligations already cross borders, our guide to global compliance management and our breakdown of HR rules and regulations pair well with this one.

What is HR legal compliance?

HR legal compliance is the practice of making sure your employment policies, records and daily decisions meet every law governing the employment relationship. It spans four sources of obligation: statutes passed by legislatures, regulations issued by agencies, contracts you signed, and collective agreements you are bound by.

The distinction matters because each source fails differently. A statutory breach produces back wages and liquidated damages. A regulatory breach produces a charge or citation from the EEOC, OSHA, IRS or a state body. A contract breach produces a damages claim from the counterparty, which is why your types of employment contracts deserve the same review cycle as your handbook. A union breach produces an unfair labor practice charge at the NLRB.

Treating all four as one duty is what makes teams over-invest in handbook language and under-invest in records. Separate them, and each gets an owner.

What is HR's role in legal compliance?

HR owns the process layer of compliance: writing the policy, running it consistently, keeping the evidence, and escalating the judgment calls. Legal owns interpretation and risk posture. When HR owns interpretation, decisions get slow and inconsistent; when Legal owns process, nothing gets documented.

That split works better written down than assumed.

Where does HR's ownership end and Legal's begin?

HR owns everything that repeats on a schedule and everything that produces a record. Legal owns everything that turns on how a rule is read.

In practice, HR carries these duties:

• Identify which federal, state and local obligations apply to each work location, and re-check when someone moves.
• Write and version the policies, then keep proof that employees received them.
• Run the recurring checks: classification tests, pay audits, accrual reviews, training completion.
• Keep records to the required period and produce them on demand during an audit.
• Escalate anything novel, anything involving a protected characteristic, and anything where two rules conflict.

Legal carries interpretation, litigation posture, and sign-off on anything changing the company's risk exposure. Understanding where payroll ends and HR begins closes the third gap most teams have, because wage and hour exposure sits on that seam.

Compliance is a shared duty, but shared duties fail without named owners, so write the split down with a date against each line.

What are some examples of HR compliance?

Examples of HR compliance include verifying work authorization on Form I-9 within three business days of the start date, classifying workers correctly as exempt, non-exempt or independent contractor, posting a good-faith pay range where the state requires one, and keeping payroll records for the statutory period.

Three more show how broad the duty runs:

• Paying the higher of the federal, state and local minimum wage for the work location, and calculating the regular rate before applying the overtime multiplier, which our guide to calculating overtime pay works through.
• Building leave accruals to whichever rule is more generous, including entitlements like paternity leave that vary by jurisdiction.
• Applying a documented test before treating someone as a 1099 independent contractor rather than a W-2 employee.

None are judgment calls. They either happened on time and left a record, or did not.

Which US laws set the HR compliance baseline?

US federal employment law applies in tiers based on headcount. FLSA, Form I-9 and OSHA bind you from your first employee. Title VII, the ADA, GINA and the PWFA start at 15. The ADEA and COBRA start at 20. FMLA and the ACA mandate start at 50.

Your tier tells you which duties are live and which arrive with your next few hires.

State law layers on top of every row, and the stricter rule usually governs. The Department of Labor's FLSA guidance is the reference for the wage and hour tier, and your employer payroll tax obligations follow the same work-location logic.

What is the 80% rule in HR?

The 80% rule, also called the four-fifths rule, comes from the Uniform Guidelines on Employee Selection Procedures at 29 CFR 1607.4(D). A selection process is flagged for adverse impact when a protected group's selection rate falls below four-fifths of the rate for the highest-scoring group.

The arithmetic is simple. If 60% of one group passes a screening step and 40% of another passes, the ratio is 67%. That sits below the threshold, so the step needs justification as job-related and consistent with business necessity.

It is a diagnostic trigger, not a verdict. Failing it does not prove discrimination, but you should run the calculation on every screening stage, especially automated ones. The full text of 29 CFR 1607.4 sets out the standard.

What changed in HR compliance in 2026?

Four things moved in 2026: the federal overtime threshold was restored rather than raised, pay transparency and paid leave expanded into new states, the biggest AI hiring rules slipped to 2027, and non-compete law kept fragmenting state by state.

Each one changes a process you already run, so take them individually.

The federal overtime threshold was restored, not raised

The salary floor for the white-collar exemptions returned to $684 a week, with the highly compensated threshold at $107,432, confirmed by the Department of Labor in May 2026. Several states set a higher floor and the higher figure governs, so an exemption test run only against the federal number is wrong.

Pay transparency and paid leave reached new states

Fourteen states plus the District of Columbia now have pay transparency laws in force, with Delaware joining in 2027. Delaware, Maine and Minnesota launched paid family leave during 2026, which means registration, contributions and claim handling, not a policy paragraph.

The major AI hiring rules moved to 2027

Illinois HB 3773 took effect on 1 January 2026, requiring notice where AI is used in employment decisions. Colorado amended its AI law through S.B. 26-189 and delayed it to 1 January 2027, cutting employer duties to notice, a human review step on adverse action, and three years of record retention. California's Automated Decision-Making Technology rules under the CCPA also start that day.

Work authorization rules were enjoined in September

DHS issued a final rule replacing duration of status with fixed admission periods for F, J and I nonimmigrants, due to take effect on 15 September 2026. On 14 September the US District Court for the District of Massachusetts granted a nationwide preliminary injunction on Administrative Procedure Act grounds. Duration of status therefore stands, with a status conference set for 2 October 2026. If you employ students or exchange visitors, hold your current reverification process.

Non-competes stayed a state question, with Tennessee banning them below $70,000, which is why non-solicitation agreements now carry more of the load.

In short, 2026 rewarded employers who test against the stricter of two rules.

What are the most common HR compliance issues?

The most common HR compliance issues are worker misclassification, wage and hour errors, FMLA denial and retaliation, Form I-9 gaps, pay transparency misses on remote postings, and employee data exposure. Almost all are process failures rather than intentional decisions.

Here is what each one looks like in practice:

• Misclassification: A 1099 worker whose schedule you set, whose tasks you supervise and whose equipment you supply. One fact is survivable; all three support reclassification with back taxes and penalties. Our guide to employee classification covers the tests.
• Wage and hour errors: Paying the federal floor where the state floor is higher, or missing off-the-clock time. In August 2026 the DOL recovered $113,199 in back wages from one employer for unpaid orientation and training.
• Improper deductions: Docking pay without a lawful basis, which our guide to when you can legally dock a wage covers, and mishandling wage garnishment orders.
• Form I-9 gaps: Missing forms rather than wrong ones. The violation rate sets the fine band, so completeness beats perfection.
• Pay transparency misses: Omitting a range on a remote posting. The trigger is where the role can be filled from, so one advert can breach several states.
• Employee data exposure: Treating privacy law as a customer matter when state privacy statutes cover your own workforce records.

Every item there is caught by a recurring check rather than a smarter decision, which is what a checklist does.

What does an HR compliance checklist look like?

An HR compliance checklist maps obligations to the employee lifecycle and gives each one an owner and a frequency. It runs from job posting through hiring, classification, pay, leave, safety, data and termination.

Work through it stage by stage:

1. Job posting: Good-faith pay range, AI screening notice where required, no salary history question. Every posting.
2. Hiring: Form I-9 within three business days, FCRA disclosure standalone, offer letter matching the role and work state. Every hire.
3. Classification: Exempt status tested against duties and the highest applicable salary floor; contractors against IRS and state rules. Every role change.
4. Pay: Correct minimum wage for the work location, regular rate calculated properly, overtime paid, pay statements retained. Every cycle.
5. Leave and accommodation: State program registered, accruals built to the more generous rule, accommodation requests logged and answered in writing. Quarterly.
6. Safety and data: Hazard training current, OSHA 300A posted 1 February to 30 April, access controls on records, bias audit for every screening tool. Quarterly.
7. Termination: Final pay on the state deadline, COBRA notice served, records retained. Every exit, using our guide to terminating an employee.

Mapping these against the employee lifecycle rather than departments stops items falling between payroll, HR and the hiring manager.

How do you run an HR compliance audit?

An HR compliance audit tests whether your documented process matches what actually happened. Pull real files, check them against the current rule rather than the one your policy was written under, and record each finding and its owner.

Run it in five steps:

1. Build the obligation inventory for every jurisdiction where someone works, including remote employees in states where you have no office.
2. Sample real records: twenty I-9s, a payroll cycle, every exempt classification, the last quarter of terminations.
3. Test each sample against the current rule and note the gap, not just the pass or fail.
4. Assign each gap an owner and a deadline. An issue closed without remediation is worse than an open one.
5. Re-test the failures next cycle rather than assuming the fix held.

Running this twice a year, in January and July, catches the two biggest waves of state law effective dates. Our compliance audit checklist sets out the document requests.

How long do you have to keep HR records?

Retention periods run from one to four years depending on the statute, and the correct answer is always the longest period that applies to that record. Payroll records run three years under the FLSA, applicant records one year under Title VII, and Form I-9s three years from hire or one year from termination, whichever is later.

These are the federal floors for the records auditors request most often.

The USCIS retention guidance covers the I-9 calculation, which trips up more teams than the rest combined. State rules often run longer, so set your destruction schedule to the longest figure.

Which HR compliance best practices actually work?

The practices that move the needle are narrow: assign every obligation a named owner, train managers rather than only employees, audit on a fixed calendar, and make the compliant path the easy path. Policy documents alone change little.

Two deserve unpacking, because they are where most programs fail.

How do you train managers and build accountability?

Managers make most of the decisions that become claims, and they make them without calling HR first. Train them on recognition rather than expertise: what an accommodation request sounds like, what makes a comment retaliatory, and when to escalate instead of deciding.

Then make accountability visible:

• Put compliance completion into the manager's own review, not just the employee's training record.
• Track time to resolve alongside a reopened-issue count, so nothing closes without a fix.
• Keep one register of obligations with an owner's name against each line.

Completion is not comprehension, so test a sample of managers on scenarios rather than trusting the dashboard.

Where does HR technology help, and where does it not?

Technology handles the mechanical parts: calculating accruals, holding records to a retention schedule, flagging deadlines, and producing the evidence pack during an audit. An HRIS removes the errors that come from spreadsheets and manual re-entry.

What it cannot do is decide which rules apply to you. A system configured against the wrong jurisdiction list produces confident, consistent, incorrect output. Our comparison of HR management software is vendor-neutral here.

Used well, technology raises your floor without raising your ceiling.

How does HR compliance change for global teams?

Once someone works outside your home country, you inherit that country's employment law in full. Notice periods, severance, mandatory benefits, and the threshold at which you create a taxable presence are local questions with no US analogue.

Three risks arrive together:

• Permanent establishment: Employing or directing people in a country can create a taxable presence for the parent, as our guide to permanent establishment risk explains.
• Co-employment: Shared control over a worker can make two entities jointly liable, a pattern set out in our guide to co-employment risk.
• Misclassification abroad: Contractor tests are stricter in most markets than the US, and long engagements convert to employment faster than teams expect.

Our guide on how to pay international employees covers the mechanics, and our guide to international human resource management is the broader frame.

You either build local expertise in every market or transfer the employer obligations to someone who has it.

How does Wisemonk help with HR compliance?

Wisemonk is an India-native Employer of Record. We become the legal employer for your team in India, which moves the statutory compliance duty onto our entity while you keep direction of the work. We process over $20 million in annual payroll for more than 2,000 employees across 300+ global companies, so the obligations below are ones we run every month rather than advise on.

Here is what that covers:

• Compliant hiring and employment contracts: We issue employment agreements meeting local statutory requirements, run background verification, and complete onboarding documentation so the relationship is properly constituted from day one. Read more in our guide to how an employer of record works.
• Payroll processing and statutory filings: We calculate gross to net, withhold and deposit statutory contributions, file the periodic returns on deadline, and issue compliant payslips, so the filing calendar sits with us rather than your HR team.
• Benefits administration: We enroll your team in health insurance and statutory benefit schemes, handle renewals and claims, and keep the enrollment records auditors ask for. See this guide to employee benefits packages if you are designing the offer.
• Contractor management and classification: We assess whether a role should be a contractor or an employee, issue compliant contracts for each, and convert engagements where the classification no longer holds. Refer to this guide on choosing an employer of record to compare providers.
• Offboarding and records: We handle notice, final settlement, statutory dues and document retention, so exits close cleanly and the evidence survives an audit years later. If you are eager to see the wider picture, read our guide to workplace compliance.

India is where we are strongest today. Employment, payroll, and compliance for your Indian hires are what we do best, and we are planning our expansion into markets such as the US and the UK.

What do clients say about running compliance with Wisemonk?

The first came from a CFO running an India team from Canada, where payroll and statutory compliance sit with us:

"We've been using WiseMonk to support our India team for the past six months, and the experience has been excellent. They've handled everything from payroll and statutory compliance to equipment procurement and benefits enrollment, all with a level of responsiveness and professionalism that makes managing a remote India team from Canada feel seamless. Nileena and the team are always quick to reply and proactive about flagging anything we need to know. We'd happily recommend WiseMonk to other companies looking to hire and manage talent in India." - Monika Russell, CFO, Minehub, Canada, reviewing Wisemonk.

The second came from a US company that had been carrying India payroll and benefits itself:

"Red Hill Technology Solutions has run its India engineering team on Wisemonk for the past year and a half. They handle payroll and benefits end to end, so I can offer my employees good health insurance without having to master the idiosyncrasies of Indian benefits myself. Payroll cutoff reminders arrive every month before I need them, and off-cycle bonus runs have never been a problem. Even equipment purchasing, a real headache for a US company shipping to Indian addresses, is as simple as telling them what I need. Exchange rates are fair and the pricing is transparent.

Deepika Elumalai, our point of contact, ties it all together. Whatever comes up, she pulls in the right people and sees it through. For any US company building a team in India, Wisemonk is an easy recommendation." - Tak Yamamoto, President, Red Hill Technology Solutions, Inc., reviewing Wisemonk.