What Employers Need to Know About Electronic I-9s

Ed. note: U.S. Citizenship and Immigration Services (USCIS) issued a new edition of the Form I-9 on April 3, 2025. The new form, dated Jan. 20, 2025, expires May 31, 2027, and has only minor changes from the previous version. Employers may continue to use the previous edition issued Aug. 1, 2023 until its expiration date on July 31, 2026 or May 31, 2027, depending on the form.

Human resource managers who rely on error-ridden paper I-9 forms or use noncompliant electronic I-9 software may be at risk of costly fines and legal consequences. Even minor errors in the verification process can lead to significant penalties, making compliance a top priority for organizations.

As more businesses transition to electronic I-9 systems, it’s essential to carefully assess these platforms for both compliance and efficiency. However, not all I-9 systems — including well-known, name-brand platforms — meet federal requirements. Choosing the right system is critical to ensuring accuracy, avoiding legal exposure, and protecting your organization. 

This overview provides general guidance to SHRM members on electronic I-9 compliance. It is critical that adequate diligence is conducted on any electronic I-9 system for both regulatory requirements as well as usability, workflows, and reporting capabilities. Further regular reviews are necessary because system updates could introduce compliance risks, particularly during digitization and migration. This toolkit outlines baseline requirements for electronic I-9 vendors but is not a replacement for legal advice.

Electronic I-9 Form and System Requirements

Employers using an electronic system must comply with 8 CFR 274a.2(e)-(i), which governs electronic I-9 processes. The regulation is enforced by U.S. Immigration and Customs Enforcement (ICE).

Employers may complete Form I-9 electronically but are not required to do so. U.S. Citizenship and Immigration Services provides a fillable and printable form, but employers can use their own electronic I-9 system if:

• The resulting form is legible.
• The name, content, and sequence of data elements and instructions remain unchanged.
• No extra data or language is added.
• The system meets regulatory standards.  

Employers generally are not in a position to develop, let alone maintain, their own electronic I-9 systems due to the complexity of maintaining compliance. Forms must be retained in accordance with federal regulations, and electronic storage systems must:

• Ensure integrity, accuracy, and security.
• Prevent unauthorized changes, additions, or deletions.
• Maintain an audit trail for tracking alterations — namely, the who, what, where, and when for changes or actions done to electronic Form I-9s.
• Include inspection and quality assurance measures.
• Allow immediate access to any record.
• Ensure high readability when displayed or printed.

Access Requirements

Government agents must not be hindered in accessing a system by any third-party agreements. ICE agents must be able to access the system, including records, personnel, software, and documentation, without limitations.

Pro Tip: The regulation is product-neutral, meaning any system that meets the compliance standards is acceptable, without requiring specific technology.

Electronic Signatures

Employers may accept electronic signatures, provided that the system:

• Asks signatories to acknowledge that they read the attestation.
• Affixes the signature when completing the form.
• Verifies the signatory’s identity.
• Provides a printed confirmation upon request.

Many electronic signature tools fail to:

• Require the signatory to acknowledge reading the I-9 attestation.
• Maintain a verifiable record of the signer’s identity.
• Generate a comprehensive audit trail.

Pro Tip: Common tools such as Docusign generally do not meet I-9 regulations unless they are integrated into a compliant system.

Business Process Requirements

There are business process standards electronic I-9 systems must meet in order to adhere to federal regulations. Those fall into several categories, including:  

Documentation: Employers using electronic I-9s must maintain documentation detailing how they:

• Create, modify, and maintain electronic I-9s.
• Ensure authenticity and integrity (e.g., audit trails).

Security standards: Employers must implement a security program to:

• Limit access to authorized personnel.
• Protect against data loss (e.g., backups).
• Train employees to prevent accidental changes or deletions.
• Maintain an audit trail tracking all system activity.

Failure to meet these standards can violate the Immigration and Nationality Act and can result in the I-9 being considered not created.

Storage options: The rules say that employers may store Forms I-9 using:

• Paper records.
• Electronic systems.
• A combination of both.

Employers can switch electronic systems if they ensure compliance with federal regulations. The I-9s from both the old and new systems must meet the rules. It is critical that you obtain information about your system’s security protections from your existing vendor before switching systems. 

Member Resource: How to Conduct an I-9 Audit

Migration Considerations

Transferring I-9 records from one electronic system to another can be done, but it requires careful planning because transferring data (whether via transcription or exporting and importing) can be complex. Paper I-9s can be scanned, but the resulting forms must still meet all requirements for electronic retention. 

To meet the requirements for electronic retention:

• The forms must have reasonable controls to ensure the prevention of unauthorized or accidental creation, alteration, deletion, or deterioration of the form.
• The data needs to be indexed properly, and consideration should be made to ensure the ability to produce reports on migrated I-9s and retrieve all relevant documents.   

Digitization Considerations

Digitization is not simply scanning a paper I-9 into a PDF. A compliant system must:

• Prevent unauthorized alterations or deletions.
• Include an indexing system for easy retrieval.
• Ensure secure access controls.
• Generate an audit trail tracking all actions.

In some cases, retaining paper I-9s instead of digitizing them may be preferable. Before migrating or digitizing, an audit should be conducted to address any existing compliance issues. 

Pro Tip: Many vendors offer “auditing” or “inspections” of I-9s before migration. These have value in some cases, but not all. Retain experienced legal counsel to work with HR before digitizing and destroying original I-9s. 

Government Requests During a Form I-9 Inspection

Employers must provide to Homeland Security Investigations (HSI) or ICE:

• A detailed description of their electronic system.
• Documentation of indexing and retrieval processes.

Employers must also provide a compliance package from their electronic I-9 provider, which should include:

• Internal business processes for Form I-9 management.
• System details for electronic signatures and indexing.
• A sample audit trail (ICE requires an audit trail for each Form I-9).

Direction from the Government 

Though ICE has provided limited information regarding what constitutes a compliant electronic I-9 system, the government has offered guidance on certain topics to help employers. These include: 

Audit trail: The audit trail is intended to capture the who, what, where, and when actions occur on electronic Forms I-9. Per HSI guidance, an employer must implement an effective “records security program” that:

1. Limits access to only authorized personnel.
2. Provides a backup for recovery of records to protect against data loss.
3. Ensures that employees are trained to minimize the risk of unauthorized and accidental alteration of the data.
4. Ensures the audit trail tracks dates and times of access, identification of the person who accessed the electronic record and the particular action taken.  

ICE and the U.S. Department of Justice have also released joint guidance on electronic I-9 software, including an HSI employer fact sheet that outlines compliance requirements for I-9 software programs. 

Download a Sample I-9 Audit Checklist

Electronic signatures: In its fact sheet, HSI reminded employers that “merely typing a name in a signature box (i.e., signing Forms I-9 electronically by using a ‘word processor’ such as Adobe Acrobat or Docusign and providing a name in the attestation in Section 2) does not constitute a compliant electronic signature when the employer did not comply with the electronic Form I-9 regulations (highlighting the importance of security and audibility standards).”   

Unless the Form I-9 is completed in a compliant system, it must be printed out and signed in ink. You cannot use a fillable PDF and place an electronic signature on the form. Instead, you must print the form out and sign in ink.  

Pro Tip: Electronic signature platforms may be fine to use in a compliant electronic I-9 system, just not as a replacement for a “wet” signature on a paper I-9. 

Electronic creation: HSI has also stated that “completing Form I-9 by using ‘word processing’ software does not result in an electronically generated Form I-9 that complies with the regulations.”  

Remember, the government has not approved any electronic I-9 system or vendor. In the event of any compliance failure, the government will look to the employer, not the vendor, for any I-9 violations.