HR Compliance in 2026: Laws, Risks, and the Full Checklist

Is your HR compliance checklist still the one you wrote last year? If it is, it is already wrong in at least six places.

The federal overtime rule was rescinded in May. Virginia switched on five new employment laws on 1 July. Illinois started regulating artificial intelligence in hiring. Three states began paying family leave benefits. Every state you employ in adds a layer, and every country adds several.

We handle the employment paperwork behind hundreds of cross-border hires, so this reads like a client briefing rather than a statute. You get the laws, what actually changed this year, where compliance breaks in practice, the checklist, and how long you have to keep every record.

What is HR compliance?

HR compliance is the practice of making sure your company follows every law, regulation, contract and policy that governs how you employ people. It has two halves. You write policies that match what the law requires today, and you enforce them, stepping in when something goes wrong.

People often ask how this differs from HR itself. HR runs the whole employee relationship, from the first interview to the final paycheque. HR compliance is the part of that work with a legal consequence attached, where getting it wrong produces a fine, a charge or a lawsuit rather than a bad review.

Four types apply to most employers, and they are worth separating because each has a different enforcer and a different consequence when it fails:

Most companies put HR at the centre of all four, which is the right call. It only holds when leadership, managers and employees each carry a share, because a rule is usually broken by the person applying it rather than the person who wrote it. The discipline that wraps around all four types is compliance and legal management.

What are some examples of HR compliance?

Compliance is far easier to recognise in the concrete than in the abstract. These are the ordinary actions that count as HR compliance in a normal week:

• Confirming work authorisation and completing a Form I-9 within three business days of a new hire's first day
• Paying overtime at 1.5 times the regular rate to a non-exempt employee who worked 46 hours
• Putting a salary range on a job advert because the role could be filled from a covered state
• Granting a pregnant employee's request to sit while working, without demanding medical proof
• Keeping payroll records for three years instead of clearing them at year end
• Telling a candidate that an automated tool will screen their application
• Issuing a final paycheque on the day of termination in the states that require it

Every item on that list is small, routine and delegated to somebody junior. That is exactly why compliance fails at the delegation point rather than at the policy point.

Why does HR compliance matter more in 2026?

Because enforcement stayed heavy while the rulebook was being rewritten underneath it. In fiscal year 2025 the EEOC processed 88,201 new discrimination charges and resolved 90,743. Its Office of General Counsel filed 94 merits lawsuits, resolved 120, and recovered $26,636,882.66 for roughly 2,505 people, with a successful outcome in 96.5% of resolutions, according to the EEOC Office of General Counsel FY 2025 annual report. Read that carefully. Filings fell against the prior year while the win rate stayed near total. Fewer suits, not softer ones.

The second pressure is jurisdictional. A Florida company with remote staff in California, Colorado and New York answers to four rulebooks at once, and the errors live in the overlap. Practitioners describe the trigger the same way we hear it from clients:

"Most businesses don't realize they've triggered a whole new set of obligations the moment a single employee works from a different state." Zachary Craig, writing on LinkedIn about multi-state HR compliance.

He goes on to list what gets triggered: payroll tax withholding, state unemployment insurance, workers' compensation, paid leave laws and final paycheque rules, each different in every state. When non-compliance does surface, the cost arrives in five forms, and the expensive ones are rarely the budgeted ones:

• Agency penalties, assessed per violation, per form or per employee, so small process failures scale badly across a large headcount
• Private lawsuits, where wage and hour claims carry liquidated damages and shift the plaintiff's legal costs onto you
• Back pay and remediation, meaning unpaid overtime, employer tax shares, interest and benefits the worker never received
• Public record, because agency settlements and court filings are searchable and surface during due diligence years later
• Hiring drag, because candidates check pay ranges, leave policies and AI disclosures before they apply, so a gap reads as a culture signal

Read in reverse, that list is also the business case. Compliance done properly is the cheapest insurance an employer can buy, and it doubles as a recruiting asset. If a provider carries part of the load for you, employer of record compliance sets out where their duty ends and yours begins.

What are the key US HR compliance laws every employer must know?

Federal employment law rests on about a dozen foundational statutes, and each carries its own employee-count threshold. The law that applies to you at 14 employees is not the law that applies at 15, 20 or 50. Coverage triggers the duty, not company size in the abstract.

If someone asks which three matter most, the honest answer is the FLSA for pay, Title VII for discrimination and the FMLA for leave, because those three produce the largest share of claims. The rest still apply. The table below is ordered so the thresholds read down the column:

Two of those deserve a closer look. The FLSA sits at the top for a reason: the Wage and Hour Division's own FLSA guidance governs almost every employer in the country, and misclassification under it is the single most litigated question in US labour law.

The second is the Pregnant Workers Fairness Act, which is the gap we find most often in audits. A request can be verbal, in plain language, and can come from someone acting for the employee.

The regulation names four accommodations it calls predictable assessments, meaning they will virtually always be reasonable: water within reach, extra restroom breaks, the option to sit or to stand, and breaks to eat and drink. If your manager training has not been updated since June 2024, that is the highest-priority gap on this page and the cheapest one to close.

State and local law frequently goes further, and where it does you follow the stricter rule. For the wider federal and state picture, see HR rules and regulations.

What is the 80% rule in HR?

The 80% rule, also called the four-fifths rule, is the federal test for spotting discrimination in a selection process before anyone complains about it. It sits in the Uniform Guidelines on Employee Selection Procedures at 29 CFR 1607.4(D), which puts it plainly:

"A selection rate for any race, sex, or ethnic group which is less than four-fifths (4/5) (or eighty percent) of the rate for the group with the highest rate will generally be regarded by the Federal enforcement agencies as evidence of adverse impact."

Worked through, it is simple arithmetic. Say you interview 100 men and hire 50, a selection rate of 50%. You interview 60 women and hire 18, a rate of 30%. Divide 30 by 50 and you get 60%, which sits below the 80% threshold, so the process shows adverse impact and now needs a business justification you can defend.

Two cautions come with it. The rule flags a process for investigation, it does not prove discrimination. And a result above 80% can still be unlawful where the difference is significant in statistical and practical terms. Run the calculation on every screening step you automate, because that is the first number a regulator will run.

What actually changed in HR compliance in 2026?

More than in any year since 2020, and it landed in two waves. January brought AI rules, pay transparency tightening and three paid leave launches. July brought a second batch that most 2026 planning documents were written before, which is why so many checklists are now out of date.

The federal overtime threshold was reset, not raised

This one gets reported backwards more often than not, so read it slowly. The 2024 rule that would have lifted the white-collar exemption threshold to $1,128 a week was struck down nationwide in November 2024. The Fifth Circuit dismissed the remaining appeals on 5 May 2026, and on 14 May the Department of Labor issued a technical amendment restoring the earlier salary levels with effect from 15 May 2026. What came back is the lower figure: $684 a week, or $35,568 a year, with the highly compensated employee threshold at $107,432. The higher number is gone, not delayed.

The practical result is that the exemption question moved to the states, and the higher state figure always controls. California, New York, Colorado, Washington and Alaska all set their own floor. California's minimum wage of $16.90 lifts its state exemption salary floor to $70,304 a year, or $1,352 a week. Salary is only half the test in every one of those states, so the duties test still has to be met on its own.

Pay transparency spread again in July

Published state counts range from sixteen to eighteen depending on whether the source counts posting mandates, disclosure on request or pay data reporting, so we name jurisdictions instead.

Requiring a pay range in the posting itself: California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New York, Rhode Island, Vermont, Virginia, Washington and the District of Columbia. Maine joined on 29 July 2026 for employers with ten or more staff, and Delaware follows on 26 September 2027. Ohio has no statewide law, but Cincinnati, Cleveland, Columbus and Toledo each impose local requirements.

Virginia is the one to check first. Its law took effect on 1 July 2026 with no headcount threshold at all, and it bans salary history questions in the same breath, per the Virginia Department of Labor and Industry. The detail employers keep missing is that internal postings count too:

"Employers must disclose the wage, salary, or a good-faith wage or salary range in each public and internal posting for a: New job, Promotion, Transfer, Other employment opportunity." Bobby Mahon, posting on LinkedIn about the Virginia rule.

A promotion you never advertised externally is still a posting. California's SB 642 tightened what a good-faith range means from 1 January 2026, and Rhode Island began requiring a written pay notice for new hires on the same date. The trap for a remote employer is unchanged: a role that could be filled from a covered state triggers that state's rule, whatever your headquarters address says.

Four jurisdictions now regulate AI in employment decisions

California's Civil Rights Council rules took effect on 1 October 2025 and are the strictest of the four. Under the final text of the automated decision system regulations, discriminatory use of an automated system is treated exactly as human discrimination would be, all data relating to the system must be kept for four years, and liability extends to your agents, meaning anyone performing a function you traditionally perform, including recruitment and screening.

The evidentiary point is the one that bites: the absence of anti-bias testing can itself be used against you, so choosing not to test is not a neutral choice.

Illinois came second. House Bill 3773 amended the Illinois Human Rights Act from 1 January 2026, barring AI use that has the effect of discriminating on a protected basis and requiring notice when AI is used in recruitment, hiring, promotion, discipline or discharge. The state's human rights department withdrew its proposed implementing rules, so the statutory duty is live while the shape of a compliant notice is still unsettled. Give notice anyway.

New York City remains the oldest of the four. Local Law 144 requires an annual independent bias audit, published results and candidate notice for any automated tool screening city candidates.

Penalties run from $500 for a first violation to between $500 and $1,500 for each later one, and every day of non-compliant use counts separately. Enforcement has been light, which is why the State Comptroller's audit of 2 December 2025 matters. It found the city's enforcement ineffective, and the expected response is a stricter phase rather than a quieter one.

Colorado is the one to stop worrying about in its original form. Senate Bill 24-205 was pushed back twice and then repealed outright by Senate Bill 26-189, signed on 14 May 2026, which replaces it with a disclosure and rights framework for automated decision-making effective 1 January 2027.

Texas is the mirror image. Its Responsible Artificial Intelligence Governance Act took effect on 1 January 2026 but was narrowed before passage to government use and intentional misuse, so it is not the private-sector hiring burden some summaries still describe.

Paid leave and non-competes both kept moving

Delaware and Minnesota began paying family leave benefits on 1 January 2026, at maximum weekly benefits of $900 and $1,423, with Minnesota funded by a 0.88% payroll tax split evenly between employer and employee.

Maine started paying on 1 May and raised its maximum weekly benefit to $1,249.12 on 1 July. Virginia added two programmes at once on 1 July, a paid sick leave entitlement of one hour per thirty hours worked and a payroll-funded paid family and medical leave scheme, so your leave accrual calculations need rebuilding for both.

The administrative burden is what surprises people, because each programme has its own portal, benefit calculation, notice rules and coordination with your own policy.

On restrictive covenants, the Federal Trade Commission removed its 2024 non-compete rule from the Code of Federal Regulations on 12 February 2026, so enforceability is now purely a state question.

California, Minnesota, North Dakota and Oklahoma void employee non-competes outright. Tennessee banned them for anyone earning under $70,000 from 1 July 2026, and Virginia made them unenforceable where an employee is discharged without severance.

Washington's ban was signed on 23 March 2026 but does not bite until 30 June 2027, with written notice to affected workers due by 1 October 2027.

Three quieter July changes are easy to miss and expensive to discover late. Virginia dropped its Human Rights Act coverage threshold from fifteen employees to five, which pulls small employers into state discrimination law for the first time.

Washington tightened the process for criminal background checks at employers with fifteen or more staff. And Nebraska now requires ninety days' notice of a mass layoff or closing from employers with a hundred or more workers.

Pulled together, here is the whole 2026 change set with the action each one forces:

One quiet development on penalties is worth knowing. The Department of Labor made no inflation adjustment to its civil money penalties this year, because the Bureau of Labor Statistics did not publish October 2025 consumer price index data during a funding lapse and the statute allows no substitute calculation. Amounts therefore sit at their 2025 levels. That is a pause, not a reduction.

If the overtime reset changes who you owe, our guide to how to calculate overtime pay walks the regular rate calculation step by step.

What are the most common HR compliance issues?

Almost every failure comes from a short list of repeat offenders, and almost none of them are failures of knowledge. They are failures of process, which is why the same twelve appear year after year. The first of them turns on the IRS test for behavioural control, financial control and the type of relationship, and several states apply a stricter test on top of it. Here is each issue paired with the mistake that actually produces it:

The I-9 row rewards a self-audit more than any other. Per ICE's I-9 inspection factsheet, the number of substantive violations is divided by the number of forms that should have been produced, and the resulting percentage sets the base fine band. Fixing nine of ten defective forms therefore reduces the fine on the tenth.

Every one of those twelve is findable before a regulator finds it. Misclassification is the one worth testing first, and our guide to telling an independent contractor from an employee walks the IRS and state tests in order.

For the leave side of the list, see our practical rules on handling a leave of absence. The mechanism that catches the rest is a checklist and a fixed audit, not a hope that someone raises it.

What is an HR compliance checklist?

An HR compliance checklist is a written list of the legal duties attached to each stage of employment, with an owner and a review date against every line. It is not a policy document. It is the thing you tick, and the record proving you ticked it.

Build it around the employee lifecycle rather than around statutes, because that is the order the work actually arrives in:

Two lines in that table carry a trap worth spelling out. The Fair Credit Reporting Act disclosure has to stand on its own, so folding it into the application form is a violation even when the report is accurate and the hire is fair.

The other is the data line. The California Consumer Privacy Act covers your own workforce records, not just customer data, so the shared drive holding Social Security numbers sits squarely inside its scope.

Two rules separate a checklist that works from one that decorates a shared drive. Every line needs a named owner rather than a department, and it gets revised the week a law changes rather than at the next annual review. If a provider handles part of your employment stack, our EOR compliance audit checklist covers what to ask them for.

How do you conduct an HR compliance audit?

An HR compliance audit is a systematic review of your policies, processes and records against current legal requirements. Run one annually as a floor, with quarterly spot checks and a review after any incident. Work through these six steps in order rather than in parallel, because step four is where most of the findings come from:

1. Define the scope. A full audit covers hiring, classification, pay, leave, benefits, safety, recordkeeping and termination. A targeted one takes a single area such as wage and hour.
2. List every applicable law, with its employee-count threshold beside it. A multi-state employer typically tracks fifty to a hundred jurisdiction-specific rules.
3. Review the documents. Handbook, offer templates, contracts, leave policies, OSHA safety procedures, I-9 records, payroll and benefit documents, each compared against current law rather than last year's version of itself.
4. Check practice against policy. A policy nobody follows is worse than no policy, because it evidences that you knew the rule. Spot-check timecards, classification records, disciplinary actions, accommodation logs and pay equity data.
5. Document the gaps and rank them by legal risk and dollar exposure, never by how easy the fix is.
6. Build the action plan with named owners, deadlines and scheduled follow-up. Book the next audit before you close this one.

An audit that ends in a ranked list with named owners is worth running. One that ends in a document nobody is accountable for is theatre, and it leaves a written record that you knew about the gap. Our workplace compliance tips for employers cover the recordkeeping side in more detail.

Read: How to Terminate an Employee: Steps, Scripts and Checklist

Read: Offboarding Process and Best Practices for HR

How long do you have to keep HR records?

Longer than most employers assume, and for different periods under different statutes covering the same document. This is the quietest failure on the whole list, because nothing goes wrong until an agency asks for a record you no longer hold, at which point the absence is itself the finding. Retain to the longest applicable period, and treat any longer state schedule as the one that governs.

Two rows catch people out. The Form I-9 retention clock is conditional rather than fixed, so a long-tenured employee's form is held for the whole of their employment plus a year, and a purge run on a flat three-year rule destroys records you were required to keep. The California four-year rule covers automated decision system data, which usually sits with a vendor rather than in your own HRIS, so it belongs in the contract rather than in your retention policy.

The controls that hold up under audit are set out in our guide to securing employment data across jurisdictions.

What HR compliance best practices actually work?

The practices that hold up are unglamorous and repeatable. What fails is anything that depends on somebody remembering. The honest starting point, as practitioners describe it, is that most teams cannot say what is required of them in the first place:

"Ask most HR teams 'what training do we legally need, in every state we operate in, for every role we have' and watch the silence. It's not laziness, it's that the answer depends on headcount, industry, revenue, where your people sit, and what data you touch. And it changes constantly. So teams guess. They copy what a peer company does. They buy a bundle and hope it covers them. That's not a compliance strategy, that's a coin flip with your company's name on it." Alex Seiler, an HR leader posting on LinkedIn.

Eight things replace the coin flip with something you can point to in a room:

• Apply policies consistently, because inconsistent application creates a discrimination claim even where the policy itself is sound
• Share the responsibility, with leadership setting tone, HR owning policy, managers applying it daily and employees flagging issues early
• Subscribe rather than search, following your state labour department and the EEOC newsroom directly, with a legal review each January and July
• Put the rules in the system, using software that handles timekeeping, classification, leave, I-9 verification and audit logs with role-based access
• Keep separate checklists for hiring, offboarding and annual updates, plus one per state once you cross into a third jurisdiction
• Train managers, not just HR, because they receive the requests in real time and cause more compliance issues than anyone else
• Run a compliance calendar covering ACA reporting, EEO-1 filing, the OSHA 300A posting, W-2 distribution and state renewals
• Audit on a fixed schedule, because a schedule beats a trigger and the trigger usually arrives as a complaint

None of those eight requires new headcount. They require somebody named against each one, which is a different problem and a solvable one. On the tooling side, our roundup of HR management software covers what to check before you buy.

What HR compliance metrics should you track?

Four metrics carry most of the signal, and each has a failure mode that is easy to misread. Track them quarterly and read the direction rather than the absolute number, because a spike in reported violations can mean your reporting improved rather than your compliance deteriorated.

Add whatever your own risk profile demands. If you use AI tools, track bias audit completion against every tool in use, including the ones a vendor added by upgrade. If you post in pay transparency states, track posting compliance state by state rather than in aggregate. Building these checks into your wider HR strategy is what catches a pattern before a charge does.

How does HR compliance work for global and distributed teams?

The moment you employ anyone outside your home country, your compliance scope multiplies rather than extends. Each country brings its own labour law, tax rules, social contributions, leave entitlements and termination protections, and the parts that look familiar are the parts most likely to differ. A short sample shows the shape of it:

Misreading a single row creates real liability, and it usually surfaces at termination in a foreign jurisdiction, which is the worst possible moment to learn that notice, severance and final pay all work differently than you assumed.

In our experience companies hit one of three dead ends. They manage international compliance in-house and miss rules nobody told them existed. They set up local entities, which costs months and real money per country and leaves a permanent local filing obligation. Or they classify foreign workers as contractors and collect misclassification exposure, permanent establishment risk and severance claims all at once.

An Employer of Record is the fourth option, and it removes the dead end rather than routing around it. The provider becomes the legal employer in the country where your person works and carries payroll, tax, statutory contributions, benefits and local compliance. You keep day-to-day direction, performance management and project oversight, and you pay one invoice per person per month. Our guide to global compliance management sets out how the split works in practice.

How does Wisemonk help with global HR compliance?

Wisemonk is a leading Employer of Record that helps global companies hire, pay and manage employees without setting up a local entity. We become the legal employer of your overseas team where they work and carry the compliance load that comes with it, so your HR team spends its time on people rather than on rule changes. Here is what we take on:

• Payroll and statutory filings, calculated, withheld and remitted on time, with employer payroll taxes handled inside the cycle rather than reconciled after it
• Statutory benefits and contributions, covering pension, social security, healthcare and mandated funds, enrolled and maintained without you tracking each scheme
• Locally compliant employment contracts, drafted to the law that governs your employee rather than translated from a template written for somewhere else
• Correct worker classification under local law, which removes both misclassification and permanent establishment exposure at source
• Onboarding through exit, including leave administration, the full employee lifecycle, and notice and severance handling, with audit-ready records kept throughout

Those five together are what most teams mean when they say they want compliance off their desk. We work with 300+ global clients, manage 2,000+ employees and process $20M+ in annual payroll, and we hold a 4.8/5 rating on G2.

Employer of Record pricing starts from $99 per employee per month. You keep full control of day-to-day management, performance reviews and project work, and we take the legal and administrative layer.

We are currently planning our expansion into future markets including the US and the UK, so you get one partner for your operations today and for your broader international human resource management journey ahead.

What do clients say about running compliance with Wisemonk?

Companies from the US, UK and Europe trust us to build their teams compliantly and fast. Two short case studies, each restated only from what the client themselves wrote:

An HR team that wanted to stop administering contracts and compliance

The problem was an HR function spending its attention on contracts, payments and compliance rather than on employees, while managing a remote workforce. The outcome:

"Wisemonk is an exceptional product that helps us manage our remote workforce. It has enabled our HR teams to focus more employee welfare rather than worrying about contracts, payments and compliances. Its seemless UI, competitive Forex rates and responsive support makes it a product of choice for us." Neeraj S., Chief Executive Officer, reviewing Wisemonk on G2.

An HR operations team that needed the manual hours back

The problem was that hiring and managing overseas staff consumed manual time from a team with other work, with queries taking too long to resolve. The outcome:

"Wisemonk is easy to implement and use. We have been able to hire and manage overseas resources without any hassle. The support by the Wisemonk team is top class, We have a dedicated account manager who ensures that all our queries are answered and resolved immediately. They saved a lot of our manual resource time." Manasij G., Co-founder and CEO, reviewing Wisemonk on G2.