I-9 Self-Audits Won't Stop the New ICE Substantive Standard

On March 16, 2026, ICE rewrote the rules for Form I-9 enforcement with no fanfare. No Federal Register notice, no proposed rulemaking, no press release. Just a quietly updated fact sheet that pulled more than ten error categories out of the “technical” column and dropped them into “substantive,” according to a Morgan Lewis analysis of the change. 

That distinction used to buy employers time. Under the framework ICE followed for nearly thirty years, a technical error gave you ten business days to fix it once an auditor found it. A substantive error carried an immediate fine, no correction period. ICE's own Form I-9 Inspection fact sheet puts that fine at $288 to $2,861 per form, and a 200-form employer caught with newly reclassified errors could now face $57,600 to $572,200 in exposure, per Morgan Lewis's estimate.

The line between those two categories just moved. It moved against employers who built their compliance programs around the old map.

If your self-audit process still runs on a downloadable checklist written for the pre-March 2026 rules, you're checking your forms against a standard ICE no longer uses.

What actually changed  

The change with the widest reach touches Section 2. Employers who photocopy identity and work authorization documents used to have a safety net. If a document title or number was missing from the form itself, a retained copy let the employer treat the gap as a fixable technical slip. That safety net is gone. Missing or incorrect Section 2 data is now substantive no matter what is sitting in your files.

Remote verification took a similar hit. Since the 2023 update that added alternative procedure fields to Form I-9, employers using remote document review now have a substantive violation on their hands if the box goes unchecked or if E-Verify enrollment lapses at the moment of verification.

Why a checklist can't keep up

A checklist tells you what to look for. It does not tell you what changed since you built it, and it does not fix anything by itself. That gap matters more now than it used to, because of what a self-audit creates along the way: a paper trail.

An audit that finds a problem and stops there is not neutral. It's evidence.

The good faith exception written into the Immigration and Nationality Act has only ever applied to technical violations. OCAHO has treated that distinction as definitional, not discretionary, including in its 2025 ruling in United States v. John Ferguson Moving & Storage. It was never a defense against substantive violations. What the March 2026 fact sheet did was move a large batch of previously technical errors into the category that exception doesn't reach.

Run your checklist, find a dozen forms with the errors above, and file the results away without correcting them, and you've built a permanent record that you knew about substantive violations and chose not to act. That record can weigh against you in ICE's good faith penalty calculation. In more serious cases, it can feed a constructive knowledge argument about unauthorized workers.

An employer that never audited at all doesn't carry that record. An employer that audited, found the same issues, and sat on them is worse off, according to Morgan Lewis's reading of the current enforcement posture. That is the trap a checklist alone walks employers into: it documents the discovery and leaves the correction to chance.

What actually protects you

Correction before ICE ever shows up still matters. It just works differently than most checklists assume.

Fixing a form before a Notice of Inspection arrives does two things a downloadable PDF cannot do by itself. First, it stops the clock. Courts and OCAHO treat an uncorrected I-9 error as a continuing violation for as long as the employee stays on payroll, or, for former employees, until the retention period runs out. Correct the form and the five-year statute of limitations on that error starts moving. Second, a completed, documented remediation, rather than a spreadsheet of flagged fields, becomes your strongest evidence of good faith if ICE does show up. OCAHO has also held that a high violation rate on its own is not proof of bad faith. A documented history of real remediation is the rebuttal employers actually need.

Timing cuts the other way once ICE is already involved. OCAHO has held that corrections made after a Notice of Inspection do not reduce liability for substantive violations. The fix has to happen before the notice arrives, not after.

That is the gap between a checklist and remediation. A checklist can tell an HR team that Section 2 is missing an expiration date. It cannot retrain the person who completed that section, correct the form using the single-line strikethrough and initialed correction method ICE expects, confirm E-Verify status at the moment of a remote hire, or build a documentation trail that holds up if an OCAHO judge reads it two years from now. That work sits closer to legal remediation than to paperwork review, and it's specialized enough that most HR teams don't have the bandwidth to do it at scale, especially in construction, staffing, hospitality, manufacturing, and retail, the industries Morgan Lewis flags as already carrying the heaviest ICE penalties.

Clear I-9's full-service model was built for that gap. We handle the correction and build the audit trail documentation this enforcement environment now requires. Your HR team gets a completed remediation with the documentation to back it up.

If you're weighing whether your last self-audit actually covers you under the new standard, our review of recent I-9 enforcement actions breaks down what ICE has penalized employers for in similar cases. If remote hiring is part of your exposure, our look at I-9 verification for distributed teams covers what active E-Verify enrollment now requires under the alternative procedure. And our Form I-9 compliance guide walks through the reclassified error categories in more detail than a single article can hold.

A self-audit checklist was built for a rule that expired in March 2026. The forms it flags might be right. The fix still needs someone who knows the difference between finding a problem and closing it.