How Much Does Remote I-9 Verification Cost? 2026 Prices Compared
Read the article
The sentence we hear most on calls with mid-market HR teams is some version of "Workday handles I-9 for us," or ADP, UKG, SAP SuccessFactors, or whatever payroll platform came bundled with onboarding. The person saying it is usually right that the system captured a form at onboarding and stored it somewhere. They're usually wrong that those I-9s would survive an audit, and that gap is the most common reason well-resourced companies still pay per-form fines.
An HRIS is built to run payroll, benefits, and the employee record, while Form I-9 falls under a separate federal standard, and liability collects in the places where the two don't line up. Since ICE's March 16, 2026 fact sheet, an electronic I-9 system that fails the federal storage standards is a substantive violation in its own right, at $288 to $2,861 per form with no correction window. This playbook covers what Workday, ADP, and UKG tend to leave open, in the order we usually find it when we review a configuration, then the gaps that show up on every HRIS regardless of logo, and ends with the checklist we use for that review. The checklist still applies to platforms we don't name here, since the pattern doesn't change much from vendor to vendor.
Form I-9 liability is assessed per form against the employer as a single legal entity, and it never lands on the software vendor. Once ICE serves a Notice of Inspection, you have three business days to produce a complete, defensible Form I-9 for every employee in scope. "The system did it that way" isn't a defense, and nothing in your HRIS contract transfers the penalty.
The math is what makes the gap expensive, since paperwork penalties run $288 to $2,861 per Form I-9 under the January 2, 2025 Federal Register adjustment, which is still in force for 2026 (current figures are in our I-9 penalties guide). An employer with 200 forms carrying errors is looking at roughly $57,600 to $572,200 in paperwork exposure before any knowing-hire findings. A large HRIS doesn't shrink that count, because it standardizes whatever process was configured, and one misconfiguration repeats across every hire the system touched.
Every electronic I-9 system, whether it's a native module or a bolt-on, is measured against the electronic storage standards in 8 CFR § 274a.2. USCIS says a compliant system has to include all of the following.
The March 2026 fact sheet made the stakes explicit by classifying a failure on these standards as a substantive violation, in the same category as a missing date of birth or a missing hire date. What matters now is whether the form was stored to this standard, with an audit trail and an index an inspector can actually use, and simply having the form in your HRIS doesn't answer that. We wrote up what happens to each of these requirements when I-9s are split across systems in Why Storing Form I-9s in More Than One System Is a Compliance Risk.
Workday runs I-9 as part of onboarding and integrates E-Verify, which covers the common path well, so the gaps tend to show up at the edges of the standard.
Reverification is usually the first gap we find, because expiring work authorization on Supplement B is a date-driven obligation that somebody has to be watching. Two Workday customers told us this year, in nearly the same words, that they had to build a report to find expiring documents and didn't know they needed one until someone asked. A missed Supplement B is a substantive violation no matter how clean onboarding was, and that's what happens when reverification alerts aren't configured or sit in a report nobody owns.
Remote verification is the second gap, since the DHS alternative procedure is only valid for an active E-Verify participant in good standing, with the alternative-procedure box checked in Section 2. A configuration that lets recruiters examine documents over video without enforcing both conditions produces substantive violations at scale. Remote examination also means keeping clear front-and-back copies of every document examined, stored with the form where they can be retrieved, and not attached to a requisition that eventually gets archived.
Records from before go-live are the third, because migrated I-9s often lose their audit trail or arrive as flat images with no index, and those forms are still in scope in an audit.
The fastest way to know whether your HRIS is covering I-9 or just storing it is to test it against the federal standard before ICE does. Estimate your current exposure with our I-9 Risk Calculator, or book a free compliance call and we'll walk your Workday, ADP, UKG, or other HRIS configuration against the 8 CFR § 274a.2 checklist and the March 2026 substantive-violation list. You can also see how the HRIS integration works, with new hires triggered from the HRIS and the I-9 itself held to the standard, or book a demo.
ADP spans several products, and I-9 coverage varies by module and configuration. The gaps we keep finding are about whether the form meets the standard, since there's almost always a form.
Start with the audit trail, because storing a completed PDF isn't the same as keeping the change-level record the regulation requires, and the system should record who changed what and when on every field, including the electronic signature. Section 2 timing comes next, since the employer has to examine documents and complete Section 2 within three business days of the first day of work for pay. A workflow that lets Section 2 sit open past that window turns late completion into a substantive violation with no cure.
Corrections are where ADP configurations surprise people, because the employer can only correct Section 2 and Supplement B, using the line-through, initial, and date method, and a system that silently overwrites a field destroys the audit trail instead of fixing the form. Companies running ADP across several FEINs also tend to split I-9 records by entity, and an inspection pulls them all together, so any inconsistency in how each entity was configured shows up at once.
UKG is the platform where we most often hear some version of "the form filler is the problem." Two HR teams on UKG Pro came to us this year for that reason. One had already run an internal audit and found date-of-birth fields with the day and month swapped, missing signatures, and Section 1 entries typed by the wrong person, and was fixing them by hand every week. The other said it's just too easy to enter whatever you want, since nothing in the form stops a wrong DOB, a document number that doesn't match the document, or an incomplete field.
The deeper problem is the audit trail, because in the configurations we've reviewed, UKG stores the most recent update date on an I-9 and not the history of who changed which field and when, which is what 8 CFR § 274a.2(g) requires. The December 2023 DOJ and ICE joint guidance on electronic I-9 software says the system must "uniquely identify each person accessing, correcting, or changing a Form I-9." A last-modified stamp doesn't meet that bar, and an inspector who asks for the change history of one form will find that out quickly.
UKG's E-Verify Connector makes it worse with a documented behavior of sending "Yes" in the Verified field for every employee regardless of actual case status, so downstream reports can show verified employees who never had a case opened. The Social Security number field also can't be made mandatory on the form even though E-Verify requires it at submission, which means Section 1 can be completed and the E-Verify case fail afterward. Remote verification exists only as the employer-run DHS alternative procedure, with document copies uploaded by hand.
The three platforms above are where we see the most volume, but the same failure modes turn up on SAP SuccessFactors, Paycom, Paylocity, Paycor, Rippling, Gusto, BambooHR, Oracle HCM, and every other system that captures an I-9 during onboarding, and a few of them are worth checking no matter which platform you're on.
Employee-entered data is still your liability. Putting Section 1 in the new hire's hands changes where errors start, and the employer still owns every one of them, so a missing date of birth or an unsigned attestation is a substantive violation no matter who typed it. On the SAP side, one large employer ran for years believing its module tracked reverifications when it didn't, and the gap turned up in a migration instead of an audit, which is the lucky version of that story.
The form edition matters too, because since August 1, 2026, only the 01/20/25 edition (05/31/2027 expiration) is acceptable for new completions, and your vendor's update timeline became your compliance deadline. Confirm it now if nobody told you in writing that the edition switched. Our current Form I-9 edition guide covers what changed.
Some payroll platforms capture the I-9 but don't submit E-Verify cases at all, and Gusto is the common example (details here). For an employer in an E-Verify state, that means a second system, a second three-day clock, and hand-keyed data.
The retention rule is fixed, and each Form I-9 has to be kept for three years after the date of hire or one year after employment ends, whichever is later. Many platforms either never purge or purge on the wrong trigger, and purging too early is a violation, while keeping forms forever is exposure you don't need.
The three-day export test is the fastest check of any platform on this page. Ask for a complete, indexed export of every I-9 with audit trails, and storage that can't produce it within three business days doesn't meet the standard, whatever the marketing says.
This is the list we run when someone asks us to look at their HRIS setup, and it works on a native module or an integration. Any line your platform can't demonstrate is a gap an auditor can find.
"When I ask an HR team to pull up the audit trail on one migrated I-9, the room usually goes quiet. Not because anyone did anything wrong. The onboarding system captured the form and that felt like the end of it. Nobody told them the reverification queue, the alternative-procedure box, and the three-day production test were their problem and not the vendor's. That is the gap. The employer owns it," says Patricia Duarte, Director of Compliance at i9 Intelligence.
No single platform makes you compliant on its own. These systems capture and store I-9s, and some integrate E-Verify, but compliance depends on configuration and on the gaps the platform may not cover, like reverification tracking, remote-verification prerequisites, audit-trail depth, correction workflow, and retention logic, and the employer is liable for any violation either way.
Only when the system meets the electronic storage standards in 8 CFR § 274a.2, which means integrity and access controls, prevention of unauthorized changes or deletion, a complete audit trail of every change, a quality-assurance program, a detailed index for immediate retrieval, and high-legibility reproduction. Under ICE's March 2026 fact sheet, failing these standards is a substantive violation.
Reverification, almost every time. After that it's usually the remote-verification prerequisites (E-Verify participation and the alternative-procedure box), a change-level audit trail instead of a stored PDF, Section 2 timing, and retention or purge logic tied to the wrong trigger.
Yes. The DHS alternative procedure for remote document examination is only available to employers enrolled in E-Verify in good standing, applied consistently at each participating site, with the alternative-procedure box checked in Section 2 and clear copies of documents kept. An HRIS that allows remote examination without enforcing those conditions creates substantive violations.
Within three business days of a government request. Storage that can't export a complete, indexed set of I-9s with audit trails in that window doesn't meet the federal standard, and running a test export is the simplest way to find out before an inspection does.
No. The common pattern for employers on Workday or SAP is to keep onboarding in the HRIS and run I-9s in a dedicated layer connected to it. The HRIS triggers the I-9 when a hire is created, status flows back, and the I-9 record itself is held to the 8 CFR § 274a.2 standard. Why Most HRIS Systems Fail at I-9 Compliance covers the reasons that pattern exists.
A team that assumes its HRIS "has I-9 covered" can find out fastest by testing it against the federal standard before an audit does. Our US-based compliance team has 28 years of I-9 and E-Verify experience and can review your Workday, ADP, UKG, or other HRIS configuration, map the gaps, and help you close them, including remote verification via video call for distributed hiring.