HR Compliance Checklist: The Short Answer
An HR compliance checklist is the working list of employment law obligations an employer has to meet, sorted by what triggers them rather than by who happens to handle them. For a US small business in 2026, HRStak groups those obligations into ten areas: hiring paperwork, wage and hour, worker classification, anti-discrimination and harassment, leave and benefits, workplace safety and postings, recordkeeping, termination, the employee handbook, and data privacy plus AI hiring rules.
Which of the ten actually bind you comes down to headcount, location, and the type of work your business and employees perform. Form I-9 and new hire reporting apply from your first employee. FLSA coverage depends on enterprise or individual coverage tests rather than a universal first-employee trigger, and workers' compensation rules vary by state. For example, Texas does not require most private employers to carry workers' compensation coverage. Title VII, the ADA, and the Pregnant Workers Fairness Act switch on at 15 employees. COBRA and the ADEA at 20. FMLA and ACA coverage at 50. EEO-1 reporting and the federal WARN Act at 100. State law often sets different thresholds.
This checklist is general information, not legal advice. Confirm the rules that apply to your business with the relevant federal and state agencies, and involve an employment attorney when a requirement or decision calls for legal judgment.
What HR Compliance Requirements and Tasks Actually Look Like
HR compliance requirements are the specific things employment law tells an employer to do. HR compliance tasks are the recurring work that keeps you doing them. The split matters when you build a checklist, because a requirement is a rule and a task is something that has to land on a named person's calendar. A useful checklist pairs the two on every item below.
Examples of HR compliance requirements, all drawn from the sections that follow: complete Form I-9 within 3 business days of a hire, pay the highest applicable minimum wage across the federal, state, and city rates, keep payroll records 3 years under the FLSA, store medical records in a file separate from the personnel file under the ADA, post the OSHA 300A summary from February 1 through April 30, and follow the applicable COBRA notice sequence and deadlines.
Examples of HR compliance tasks: checking each new hire's I-9 monthly, re-reading overtime classifications every quarter, refreshing the handbook once a year, tracking harassment training completion dates, and replacing workplace posters when a state updates them. The requirements barely move month to month. The tasks are what fail, and they fail because nobody owns them.
Why HR Compliance Matters More in 2026
Enforcement remains active. The DOL recovered more than $259 million in back wages in fiscal year 2025. For small businesses running without a dedicated HR team, missed requirements can create costly back wage, penalty, and legal exposure. HRStak's HR statistics page tracks the numbers behind that shift every month.
How to use this checklist
Work through it section by section. Each item names the requirement, the employee threshold that triggers it, and what you actually need to do. Start with the headcount table below so you know which sections carry legal weight for you today. If you are under 15 employees, several federal laws do not apply to you yet, but note the thresholds so you know exactly what changes as you grow.
Which Laws Apply at Your Headcount
Headcount is what makes an HR compliance checklist yours rather than generic, because most federal employment laws switch on at a specific employee count. Find your number below before you start checking boxes.
Federal Thresholds at a Glance
- Coverage tests, FLSA wage and hour coverage is not triggered simply by hiring a first employee. Review the DOL's enterprise and individual coverage tests, which consider the enterprise and the employee's work.
- 1+ employees, Form I-9 and new hire reporting. Workers' compensation thresholds are state-specific, and Texas does not require most private employers to carry coverage.
- 10+ employees, OSHA injury and illness recordkeeping in most industries.
- 15+ employees, Title VII, the ADA, GINA, and the Pregnant Workers Fairness Act.
- 20+ employees, ADEA age discrimination protections and COBRA continuation coverage.
- 50+ employees, FMLA (counting employees within 75 miles) and ACA employer coverage requirements at 50 full-time equivalents.
- 100+ employees, EEO-1 reporting and the federal WARN Act. Federal contractors hit EEO-1 at 50.
State laws often set lower thresholds than the federal ones, and some state anti-discrimination laws apply from your very first hire. When your state is stricter, the stricter rule wins.
1. Hiring Paperwork and Onboarding Compliance
Hiring paperwork is where most small business compliance gaps start, because every form has its own clock. Once the paperwork is in, HRStak's new hire onboarding checklist picks up the rest, from preboarding through day 90.
New Hire Requirements
- I-9 verification, You've got 3 business days from the hire date to complete Form I-9. Keep an eye on document expiration dates and reverify before they lapse. Applies to all employers, no headcount minimum.
- W-4 and state withholding forms, Collect federal and state tax withholding elections before you run that first payroll. Easy to overlook, painful to fix retroactively. The longer it goes uncorrected, the more back-calculations you are dealing with when someone finally catches it.
- New hire reporting, Most states want new hire reports within 20 days, and some want them faster. All employers, regardless of size.
- E-Verify, Federal contractors must use it. So do employers in AZ, MS, AL, SC, TN, UT, GA, NC, and a growing list of others. Check your state's current rules.
- Background check disclosures, FCRA requires written consent before you run any background check. Also, many states and cities have ban-the-box laws that restrict when you can even ask about criminal history, and the list keeps growing. Check your application forms against the current rules in every state where you hire.
- Offer letter essentials, Every offer letter should include the position, compensation, at-will status if applicable, start date, and any contingencies. And if you're posting jobs in states that now require pay range disclosure, that is not optional anymore.
2. Wage and Hour Compliance
Wage and hour rules are the part of an HR compliance checklist that touches every paycheck, which is why they generate substantial back wage recovery. For covered businesses and employees, the FLSA sets the federal floor. Your state, and often your city, may set stricter requirements.
FLSA and State Wage Laws
- Minimum wage, The federal floor is $7.25/hr, but 30+ states and dozens of cities have set higher rates. If you have employees in multiple jurisdictions, you need to check each one. These rates change every year.
- Overtime classification, Employees earning below the FLSA salary threshold must be classified non-exempt and paid overtime. Misclassification is one of the most common wage violations small businesses stumble into, and it compounds fast once back pay stacks up across multiple employees.
- Pay transparency, At least 10 states now require salary ranges in job postings. Colorado, California, Washington, and New York lead the list, and more are following. Check where you're hiring.
- Pay stub requirements, Most states require detailed pay stubs: hours worked, pay rate, deductions, net pay. What exactly you need to show varies by state.
- Final paycheck timing, States set their own deadlines here. California, for instance, requires same-day payment on involuntary termination. Other states give you more time. Know your state's rules before someone walks out the door.
- Independent contractor classification, Both the IRS and DOL have tests to determine whether a worker is truly a contractor. Getting this wrong triggers back taxes, penalties, and benefit obligations, potentially across years and every misclassified worker on your books. It is not a gray area you want to guess at.
Assign a named person to check official federal, state, and local sources on a recurring schedule. A calendar reminder can support that review, but it does not determine which rules apply or replace legal advice.
3. Worker Classification
Worker classification is the most expensive line on a small business HR compliance checklist, because one wrong call repeats on every paycheck until somebody catches it. Two separate questions live here. Is this person an employee or a contractor, and if they are an employee, are they exempt or non-exempt from overtime. HRStak keeps classification early in the checklist for that reason.
Classification Decisions to Document
- Employee or independent contractor, The IRS weighs behavioral control, financial control, and the nature of the relationship. The DOL runs its own economic reality test. Several states, California among them, add a stricter ABC test where the work has to fall outside your usual course of business for contractor status to hold. Clearing one test does not mean you clear the others.
- Exempt or non-exempt, Exempt status needs a salary above the FLSA threshold and duties that genuinely fit an exemption. The job title alone never carries it. A salaried "manager" who spends most of the week doing the same work as the crew is usually non-exempt, and owed overtime.
- Interns and apprentices, An unpaid internship has to satisfy the DOL primary beneficiary test, which asks who actually gains from the arrangement. Registered apprentices are employees: paid on the progressive wage schedule in the program standards, and covered by the same I-9, payroll, and safety rules as everyone else on the payroll.
- Minors, Federal rules limit the hours and permitted work for 14- and 15-year-olds in nonagricultural jobs. The FLSA permits 16- and 17-year-olds to work unlimited hours, but bars workers under 18 from specified hazardous occupations. Many states set stricter hours or work permit rules, so check the federal rules and the applicable state rules before a minor's first shift.
- Write down the reasoning, Keep a short dated note explaining why each contractor is a contractor and each exempt role is exempt. Two years later, when an auditor asks, that note is the difference between a conversation and an assessment.
Reclassifying someone yourself costs far less than getting caught. Back wages, unpaid payroll taxes, penalties, and benefit make-goods all stack per worker and per year, so a single misfiled role rarely stays a single problem.
4. Anti-Discrimination and Harassment
Anti-discrimination obligations are the section of this HR compliance checklist most tied to headcount. Title VII, the ADA, and the Pregnant Workers Fairness Act start at 15 employees, the ADEA at 20. State equivalents often start at one employee, so check your state list before assuming a rule does not reach you yet.
Equal Employment Obligations
- EEO-1 reporting, Required if you have 100+ employees, or 50+ as a federal contractor. You're submitting annual demographic workforce data, and missing the deadline is not a small thing.
- Anti-harassment policy, Many states require a written policy that covers sexual harassment, retaliation, and how employees can report incidents. It needs to reach every employee, not just sit in a drawer. Distributing it once during onboarding and assuming everyone remembers does not count.
- Harassment training, CA, CT, DE, IL, ME, NY, and others mandate it. How often and how long the training needs to be differs by state, and you need to track completion dates.
- Reasonable accommodation, ADA's interactive process applies at 15+ employees, though many states set lower thresholds. When an employee asks for an accommodation, ignoring it is not a legal option.
- Religious accommodation, Title VII requires you to accommodate sincerely held religious beliefs unless it creates genuine undue hardship. Applies at 15+ employees.
- Pregnancy accommodation, The Pregnant Workers Fairness Act now requires reasonable accommodations for pregnancy-related conditions at 15+ employees. This one is newer, so make sure your managers know about it.
5. Leave and Benefits Compliance
Leave and benefits is where a small business HR compliance checklist stops being federal and becomes a state by state map. FMLA and ACA coverage are the federal pieces and both begin at 50 employees. Everything below that line depends entirely on where your people sit.
Mandated Leave and Benefits
- FMLA, 12 weeks of unpaid, job-protected leave for qualifying events. Kicks in at 50+ employees within 75 miles. You need to track eligibility, issue required notices, and maintain health benefits throughout the leave.
- State paid family leave, CA, NY, NJ, WA, MA, CT, CO, OR, MD, DE, and MN have programs either active or rolling out. Contribution rules and benefit structures vary significantly. This is not one you can generalize across states.
- Paid sick leave, 15+ states and a long list of cities now mandate paid sick leave. Accrual rates, caps, and carryover rules are different nearly everywhere. Worth auditing annually.
- ACA compliance, If you're an Applicable Large Employer (50+ full-time equivalents), you must offer affordable minimum essential coverage. Annual 1095-C filings are part of the deal.
- COBRA, At 20+ employees, you're required to offer continuation coverage for 18-36 months after qualifying events. The notice deadlines are strict, so do not wing it.
- Workers' compensation, Coverage requirements and employee thresholds vary by state. Texas, for example, does not require most private employers to carry it. Check each state's insurance, notice, and injury reporting rules before hiring there.
6. Workplace Safety and Postings
Safety and posting rules are the items on an HR compliance checklist an inspector can verify by walking through the door, and they apply to a desk-based office as much as a warehouse. Posters have to be current and visible, and the OSHA 300 log has to be up to date on the day it is asked for.
OSHA and Workplace Requirements
- OSHA recordkeeping, If you have 10+ employees in most industries, you're maintaining an OSHA 300 log of workplace injuries and illnesses. The annual summary goes up February 1st and stays posted through April 30th.
- Required workplace postings, Federal law requires FLSA, FMLA, EEO, OSHA, and EPPA posters, plus whatever your state requires on top of that. Poster requirements change, so do not assume last year's set is still current.
- Safety training, OSHA mandates training for specific hazards. General industry and construction standards have their own detailed requirements, so one-size training does not work here.
- Workplace violence prevention, California now requires a formal workplace violence prevention plan. Other states are watching. Honestly, even where it's not mandated yet, having a plan is just good practice.
7. Recordkeeping and Data Retention
Recordkeeping is the quiet half of HR compliance. Every requirement above carries a retention period, and an audit tests the file, not your memory of doing the work. Keep documents dated, access-controlled, and searchable, and apply the retention rule for each record type.
Document Retention
- Personnel files, Hold onto these for at least 3 years after termination, longer for some record types. Secure storage with limited access, not a shared drive folder anyone can browse.
- Payroll records, FLSA says 3 years. Time cards and schedules need 2 years minimum. Some states want more. When in doubt, keep longer.
- I-9 forms, Retain for 3 years from hire date or 1 year after termination, whichever comes later. Store them separately from personnel files. This is an audit requirement, not just a suggestion.
- Employee data privacy, States are passing employee data privacy laws faster than most HR teams can track. The general direction: collect only what you need, store it securely, and give employees access when they ask.
- Medical records, ADA requires these to live in a separate file from the general personnel record, with restricted access. Keep them for the full duration of employment plus one year after, and make sure whoever manages your files actually knows that rule.
8. Termination and Separation
Termination is the highest-risk day on a small business HR compliance checklist, because several clocks start at once. Final pay timing, the COBRA election notice, and the unemployment claim response all run on deadlines measured in days, not weeks.
Offboarding Compliance
- WARN Act, 60 days advance notice is required for plant closings or mass layoffs affecting 50+ employees. Many states have mini-WARN acts with lower headcount thresholds and longer notice windows. Check before you announce anything.
- Final paycheck, Deadlines are state-specific. Some require immediate payment on involuntary termination. Where state law requires it, that final check needs to include accrued, unused PTO.
- COBRA notice, For qualifying events the employer must report, the employer generally has 30 days to notify the plan administrator. The plan administrator then generally has 14 days after receiving notice to send election notices to qualified beneficiaries. If the employer is also the plan administrator, a 44 day deadline generally applies, measured from the qualifying event or the loss of coverage depending on the plan. Employee-reported events and multiemployer plans can follow different rules, so check the plan documents and DOL guidance.
- Unemployment insurance, Respond to claims on time. Sloppy separation records make it hard to fight fraudulent claims, and fraudulent claims drive up your tax rate.
- Non-compete enforceability, The FTC and a growing number of states are restricting or outright banning non-competes. Any agreements you have already issued are worth reviewing with an employment attorney before you try to enforce them.
9. Employee Handbook and Written Policies
A current handbook is the paper trail that makes the rest of this checklist defensible. It shows up in nearly every unemployment hearing, discrimination charge, and wage dispute, usually as exhibit one.
Policy Essentials
- Annual handbook review, Pay transparency, leave, and AI rules have all moved in the past year. A handbook older than 12 months almost certainly says something that is now wrong.
- At-will statement, If you employ at will, say so clearly, and avoid contract-like promises elsewhere in the handbook that undercut it.
- Required written policies, Several states mandate specific ones: anti-harassment, paid sick leave, lactation accommodation, and expense reimbursement are the common four. Match the list to every state where you have employees.
- Signed acknowledgments, Collect a dated acknowledgment for every handbook version, not just at hire. An unacknowledged policy is hard to enforce.
- State addenda, One national handbook rarely covers a multi-state team. Add state supplements instead of averaging conflicting rules into one vague policy.
10. Data Privacy and AI Tools in HR
This is the newest category on the checklist and the one changing fastest. Regulators now treat employee data and AI-assisted hiring decisions as compliance surfaces in their own right. If any tool in your stack screens, scores, or ranks people, it belongs on this list.
Data and AI Obligations
- Employee data privacy, California's privacy law now extends to employee and applicant data, and other states are moving the same direction. Know what personal data you hold, why you hold it, and who can see it.
- AI hiring tool laws, New York City's Local Law 144 requires an annual independent bias audit and candidate notice for automated employment decision tools. Illinois regulates AI analysis of video interviews and, starting in 2026, AI use in broader employment decisions under its Human Rights Act.
- Colorado's AI Act, Adds duties for employers using high-risk AI systems in hiring, with obligations phasing in during 2026. If you hire in Colorado, get ahead of it now.
- Vendor review, If a vendor's AI screens your candidates, the legal exposure is still yours. Ask vendors directly how they test for bias and what documentation they can hand you.
- Human review, Keep a named person accountable for every hiring and termination decision. AI is genuinely useful for drafting, summarizing, and flagging, but the decision itself needs a human owner, legally and practically.
If you are bringing AI into hiring workflows, our guide to AI for recruiting covers what these tools do well and where they fail, and the broader AI for HR guide maps the whole category.
Use AI as an HR Assistant
HR AI tools can assist with first drafts, summaries, and routine HR work. A named person should verify output against current official guidance and get legal advice when needed.
Explore HR AI ToolsYour Monthly Compliance Rhythm
An HR compliance checklist is not something you audit once and forget, and the recurring cadence is the part small businesses drop first. Put these reviews on a shared calendar with a named owner:
- Monthly: Check new hires for I-9 completion, look up any minimum wage updates in your jurisdictions, and review workers' compensation requirements and coverage for any new state or role.
- Quarterly: Audit overtime classifications, scan for state-specific leave law changes, and swap out any workplace postings that have gone stale.
- Annually: Refresh the employee handbook, pull harassment training completion records, audit your ACA obligations, file EEO-1 if you're required to, and post the OSHA 300A summary on February 1st.
One more habit worth building: keep an audit folder ready. If a DOL, ICE, or state agency notice arrives, you will typically have days, not weeks, to produce I-9s, payroll records, and evidence of posted notices. Knowing exactly where those live turns an audit from a crisis into an errand.
Financial exposure depends on the facts, the number of affected workers, the duration of the issue, the available remedies, and the applicable law, so a generic dollar range is misleading. Use official enforcement data to understand the risk, but estimate potential liability only from your records and with qualified legal advice.
If you're handling HR for a small business without a compliance team behind you, use official agency updates as the source of truth. AI-powered tools can assist with drafting and summarizing, but a person must verify the result and own every legal judgment.
FAQ: HR Compliance for Small Businesses
How do I handle HR compliance as a small business without an HR department?
Assign it to one named owner, even if that is you, and put it on a calendar. Work this checklist once to find your gaps, fix the hiring paperwork and wage and hour items first because they carry the most enforcement risk, then run the monthly, quarterly, and annual rhythm above. Software can track deadlines and draft documents, and a payroll provider handles the tax filings, but one person needs to own the follow-through.
What payroll laws do small businesses need to follow?
FLSA minimum wage and overtime coverage depends on enterprise or individual coverage tests rather than a universal first-employee trigger. Federal tax rules, state pay requirements, and new hire reporting may apply regardless of size. Workers' compensation requirements vary by state, and Texas does not require most private employers to carry coverage.
Do HR compliance requirements differ by state?
Significantly. Minimum wage, paid sick leave, pay transparency, final paycheck timing, harassment training, and data privacy all vary state by state, and cities add their own layers. Federal law is the floor, not the ceiling. If you employ people in more than one state, you need a per-state view of every section in this checklist.
What tools help small businesses stay on top of HR compliance?
Three categories do the heavy lifting: a payroll provider that files taxes correctly, a poster or law-update subscription so changes actually reach you, and AI tools that draft policies and track deadlines. None of them replace an employment attorney for judgment calls, but they take the routine tracking off your plate.
How often should I review an HR compliance checklist?
Review your full compliance status annually and skim for changes quarterly. Minimum wage rates usually change January 1, many state laws take effect January 1 or July 1, and poster requirements update on their own schedule. HRStak refreshes this page as 2026 requirements shift, so check the updated date at the top.
What are some examples of HR compliance?
Completing Form I-9 within 3 business days of a hire. Paying the highest applicable minimum wage across the federal, state, and city rates. Keeping payroll records 3 years under the FLSA. Storing medical records in a file separate from the personnel file under the ADA. Posting the OSHA 300A summary from February 1 through April 30. For employer-reported COBRA qualifying events, notifying the plan administrator within 30 days and having the plan send election notices within 14 days after receiving notice. Each one is a rule with a deadline attached, which is what separates compliance from good practice.
What are the 7 pillars of HR?
There is no official list, and different training providers publish different sevens. The version cited most often covers recruitment and selection, performance management, learning and development, succession planning, compensation and benefits, HR information systems, and HR data and analytics. Compliance rarely appears as its own pillar, which is part of why it ends up unowned in small companies. Treat the pillars as a way to describe the HR function, not as a legal framework.