What Is ERISA? Plans Covered and Employer Duties
ERISA is the federal law governing private benefit plans. What it covers, which plans are exempt, and what a small employer with a 401(k) has to do.
What Is ERISA?
The federal law that sits underneath almost every private sector retirement and health plan in the country. What the acronym stands for, which plans it covers and which are exempt, the four duties it puts on a plan sponsor, and the short list of things a small employer with a 401(k) and a group health plan is actually required to do
The first time ERISA came up in my own business, it was not in a compliance meeting. It was a broker asking, almost as an afterthought, whether we had a summary plan description for the health plan. I said we had the booklet from the carrier. He said that is a different document, and the difference is a federal statute.
That is how most small employers meet this law. Not through a training session, but through one offhand question that reveals a file everybody assumed somebody else was keeping. The obligations had been running for years. Nobody had ever named them.
This is the employer side explanation: what the acronym stands for, which plans fall inside the law and which sit outside it, the four duties it creates, and the short practical list for a business running a 401(k) and a group health plan without a benefits department.
I build the people and records tooling for exactly that kind of business at FirstHR. This is general information rather than legal or tax advice, and plan specific questions belong with your ERISA counsel or third party administrator.
What ERISA Stands For
ERISA stands for the Employee Retirement Income Security Act of 1974. It was signed into law on September 2, 1974 as Public Law 93-406, after a decade of Congressional attention to pension promises that turned out to be worth nothing when the sponsoring company failed.
The name undersells the reach. Retirement income is in the title, but the same statute governs your group health plan, your dental and vision coverage, your group life insurance and most of your disability coverage. The Department of Labor describes ERISA as setting standards for retirement and health plans alike (Department of Labor guidance on ERISA).
Three agencies share the work. The Department of Labor enforces participant protections and fiduciary standards. The IRS handles tax qualification and most of the contribution rules. The Pension Benefit Guaranty Corporation insures certain traditional defined benefit pensions, which is why a frozen pension from a failed employer still pays something.
What the Law Does and Does Not Require
ERISA does not require any private employer to offer a retirement plan or a health plan. It is a conduct statute, not a mandate. What it governs is how you run the plans you have voluntarily chosen to offer.
That distinction matters more than it sounds. Employers who think of ERISA as a benefits mandate spend their attention on whether they have to offer something. The real question is narrower and more urgent: given what you already offer, what paperwork and conduct does the law expect from you?
ERISA also preempts most state laws that relate to covered benefit plans. That preemption is the reason a self funded health plan can run the same design across every state you operate in, and the reason state insurance mandates reach fully insured plans but not self funded ones. It is a genuine operational advantage buried inside a compliance statute.
Which Plans ERISA Covers
ERISA covers two families of plans: pension benefit plans, which provide retirement income or deferral of income, and welfare benefit plans, which provide medical, disability, death or similar benefits. Almost every benefit a private employer sponsors falls into one of the two.
| Benefit | ERISA plan? | Notes for a small employer |
|---|---|---|
| 401(k) or profit sharing plan | Yes | Pension benefit plan. Full document, disclosure, reporting and bonding duties apply |
| Group medical, dental, vision | Yes | Welfare benefit plan, whether fully insured or self funded |
| Health FSA and HRA | Yes | Both are group health plans in their own right and need document and disclosure coverage |
| Group life and AD&D | Yes | Employer sponsored or employer endorsed coverage is a welfare plan |
| Employer paid disability coverage | Yes | Insured or trust funded disability benefits sit inside ERISA |
| Vacation and holiday pay from general assets | No | Treated as a payroll practice rather than a welfare plan |
| Health savings account | Usually no | Stays outside ERISA where employer involvement is limited and employees direct the account |
| Workers compensation | No | Maintained solely to comply with state law, and excluded on that basis |
Two rows on that table catch small employers repeatedly. A health flexible spending arrangement is not a payroll convenience, it is a group health plan with its own documentation duties. The same is true of an HRA, which many businesses adopt as a cheaper alternative to group coverage without registering that they have just become the sponsor of another plan.
Coverage does not depend on formality. There is no filing that creates an ERISA plan and no registration you can decline. If a reasonable person could identify the benefits, the beneficiaries, the source of funding and the procedure for receiving benefits, a plan exists, whatever you called it internally.
Which Plans Are Exempt
Four exclusions do most of the work: church plans, governmental plans, payroll practices, and plans covering only a business owner. Each is narrower than employers assume.
The payroll practices exclusion is the one worth reading carefully, because it decides whether your leave policy is a benefit plan. The regulation excludes compensation paid out of an employer’s general assets for time not worked, which is why ordinary paid time off is not an ERISA plan (29 CFR 2510.3-1).
There is a fifth exclusion that comes up in small business benefits conversations: the voluntary plan safe harbor. Insurance offered to employees where the employer contributes nothing, does not endorse the product, and limits its role to collecting premiums through payroll can fall outside ERISA. The endorsement condition is strict, and describing the coverage as a company benefit in an onboarding packet is often enough to fail it.
State retirement mandates work on similar logic. Programs run by states generally use payroll deduction individual retirement accounts, structured so that a participating employer is facilitating deductions rather than sponsoring a plan. That is a design choice worth understanding before you assume that a state program gives you the same standing as a plan of your own.
The Four Duties of a Plan Sponsor
Once a plan is covered, ERISA imposes four categories of obligation. Everything else in this article is a detail of one of them.
Notice which duties scale with plan size and which do not. Reporting has genuine small plan relief built into it. Fiduciary conduct has none: the standard applied to a company with a handful of participants is the same standard applied to a plan with billions in assets, and courts have not shown much sympathy for the argument that a small employer did not know.
Reporting and Disclosure
Disclosure has two halves: what you give participants, and what you file with the government. The participant half is where small employers are most often short.
Every covered plan must be established and maintained under a written instrument, and participants must receive a summary plan description written to be understood by the average participant. A newly covered participant is entitled to one within ninety days of coverage beginning, and a new plan has one hundred twenty days from the date it becomes subject to the statute.
Updates run on their own clock. An SPD must be reissued every five years when the plan has been amended in the interim, and every ten years even when nothing has changed. Material modifications between reissues are communicated through a summary of material modifications, which is one of several notices employers owe on a schedule rather than on request.
The government half is the annual report on Form 5500. Retirement plans file every year, and the deadline falls on the last day of the seventh month after the plan year ends, which is July 31 for a calendar year plan. A Form 5558 extension request buys two and a half additional months.
Welfare plans with fewer than one hundred participants that are unfunded, fully insured, or a combination of the two are generally excused from filing altogether. The mechanics of preparing and filing the return deserve their own guide and are not covered in depth here.
Fiduciary Conduct and Personal Liability
A fiduciary is anyone who exercises discretionary authority over the plan or its assets, or who gives investment advice about the plan for a fee. It is a functional test, not a job title, and most small business owners who sponsor a 401(k) are fiduciaries without ever having been appointed to anything.
| Duty | What it means in practice |
|---|---|
| Exclusive purpose | Act solely in the interest of participants and beneficiaries, for the purpose of providing benefits and paying reasonable plan expenses |
| Prudence | Follow a documented process a knowledgeable person would follow. Outcomes are judged by the quality of the process, not by hindsight |
| Diversification | Do not expose the plan to large losses through concentration, which in practice shapes the investment menu you offer |
| Follow the plan documents | Administer the plan as written, and amend the document if the written terms no longer match how you actually operate |
| Reasonable expenses | Know what the plan pays in fees, know what services those fees buy, and revisit both on a schedule |
| Personal liability | A fiduciary who breaches a duty is personally liable to restore losses to the plan, and the liability follows the individual |
The statutory language is short and unusually blunt about the standard of care expected (29 U.S.C. 1104). The Department of Labor publishes a plain language guide for sponsors that is the best free starting point I have found (Meeting Your Fiduciary Responsibilities).
Two practical consequences follow for a business without an HR department. First, hiring a professional does not transfer the duty: you remain responsible for selecting and monitoring the people you hire, which means periodic review rather than a one time decision.
Second, prudence is provable only if it was recorded. A committee of two people that meets twice a year and writes down what it looked at is in a far better position than an owner who made better decisions and kept no notes.
The ERISA Fidelity Bond
Every person who handles plan funds or other plan property must be covered by a fidelity bond. It is a statutory requirement, it is separate from insurance you buy to protect yourself, and it is the compliance item small employers most often discover during an audit rather than before one.
The bond must be at least ten percent of the plan funds handled in the preceding plan year, with a floor of one thousand dollars and a ceiling of five hundred thousand dollars. Plans holding employer securities carry a higher ceiling of one million dollars. The bond protects the plan against loss from fraud or dishonesty by the people handling its money.
For a first plan, the bond is inexpensive and easy to arrange through your existing business insurance relationship. The reason to handle it during setup rather than later is that the amount is recalculated each year against plan assets, and a plan that grows quickly can outgrow a bond that was correctly sized when it was purchased.
Participation and Vesting
For retirement plans, ERISA sets a floor on who must be allowed in and how quickly employer money becomes theirs to keep. You can be more generous than the floor. You cannot go below it.
| Rule | The statutory floor | What it means for your plan design |
|---|---|---|
| Age and service | Age twenty one and one year of service is the strictest general condition a plan may impose | A two year service condition is allowed only where employer contributions vest immediately, and it can never be applied to the salary deferral side of a 401(k) |
| Long term part time staff | Two consecutive years at five hundred or more hours earns an employee aged twenty one or over the right to defer, for plan years beginning after December 31, 2024 | Hours tracking for part time staff became a plan compliance task rather than a payroll detail |
| Employee deferrals | Always one hundred percent vested immediately | Money an employee defers from pay is theirs from the first dollar |
| Employer contributions | In a defined contribution plan such as a 401(k), no slower than three year cliff or six year graded vesting | A traditional defined benefit pension runs on a slower floor of five year cliff or seven year graded. Safe harbor contributions vest immediately |
| Breaks in service | Rules govern how prior service counts when someone returns | Rehires need a service history check rather than a fresh start by default |
The part time rule is the one that changed long established practice. Employers who had comfortably excluded part time staff from the plan for years now have to track hours across consecutive years and admit people who cross the threshold. It is an administrative burden that lands hardest on businesses without a system that already counts hours.
Vesting interacts with plan design in a way worth knowing before you pick a formula. A safe harbor design requires immediate vesting of the safe harbor contribution in exchange for skipping the annual nondiscrimination tests, so the retention value of a vesting schedule is one of the things you trade away.
Enforcement and What Failure Costs
ERISA is enforced from two directions at once: by the Department of Labor, and by participants themselves in federal court. The second is the reason it has real weight, because it does not depend on an agency choosing to look at you.
Every plan must maintain a reasonable claims and appeals procedure with defined response times, and a participant who exhausts it can sue to recover benefits, enforce rights under the plan, or clarify rights to future benefits. Fiduciary breach claims run on a separate track and seek to make the plan whole rather than the individual.
Penalties attach to the paperwork as well as the conduct. A plan administrator who fails to furnish requested documents within thirty days of a written participant request can face up to one hundred ten dollars per day. Late or missing annual reports carry a Department of Labor penalty of up to $2,739 per day for 2026, which is the number that turns a forgotten filing into a genuinely dangerous problem.
Voluntary correction exists and is dramatically cheaper than discovery. Delinquent filers can use a Department of Labor program that caps the amount owed at a small fraction of the daily maximum, and comparable correction programs exist on the IRS side for operational plan failures. The pattern is consistent across both agencies: self reporting costs a fraction of being found.
What a Small Employer Actually Has to Do
Strip away the statutory structure and a business running a 401(k) and a group health plan has a finite list. Most of it is annual, and most of it is delegated to providers who need you to confirm rather than to produce.
None of that is exotic work. It is records work, which is precisely why it drifts in a business where benefits administration is somebody’s fourth priority. The documents get created once at setup, then nobody owns keeping them current, and three years later the file no longer matches the plan.
Where Small Employers Get It Wrong
Five patterns account for most of what I have seen, and the first is the one that surprises people.
Assuming ERISA is a large employer statute is first. There is no size threshold. The plan document, the summary plan description, the fidelity bond and the fiduciary standard apply to a plan covering a handful of people exactly as they apply to a plan covering thousands.
Treating carrier materials as the plan document is second. This is the most common single gap in a small business benefits file, and it is the cheapest to fix, because a wrap document costs a fraction of what the exposure does.
Forgetting that a health FSA or an HRA is its own plan is third. Employers who set one up as a tax efficiency measure rarely register that they have added a group health plan with its own document, disclosure and continuation obligations attached to it.
Believing that hiring a provider transfers the fiduciary duty is fourth. Selecting and monitoring a provider is itself a fiduciary act, so delegation changes the nature of your responsibility rather than removing it.
And failing to document anything is last. Prudence is a process standard, and a process with no written record is functionally indistinguishable from no process when somebody asks two years later what you considered.
If you are setting up a retirement plan for the first time, the practical move is to treat the ERISA duties as part of the launch rather than as a follow up project. The document, the disclosure and the bond are all cheaper to arrange during setup, and a new plan launch is the only moment when everyone involved is already paying attention to the paperwork.
Frequently Asked Questions
What is ERISA in simple terms?
ERISA is the federal law that sets minimum standards for retirement and health benefit plans offered by private sector employers. It does not force any employer to offer benefits. What it does is govern the plans you choose to offer: the plan has to be in writing, participants have to be told in plain language what the plan promises, most plans file an annual report, the people who control plan money owe legal duties to participants, and participants can sue in federal court when a plan does not honor its terms. The Employee Benefits Security Administration at the Department of Labor administers it.
What does ERISA stand for?
ERISA stands for the Employee Retirement Income Security Act of 1974, signed into law on September 2, 1974 as Public Law 93-406. The name is slightly misleading, because the statute covers far more than retirement income. Title I reaches welfare benefit plans as well, which is why your group health plan, dental plan, group life insurance and disability coverage all fall inside the same framework as the 401(k). Responsibility is split across three agencies: the Department of Labor handles participant protections, the IRS handles tax qualification, and the Pension Benefit Guaranty Corporation insures certain traditional pension plans. The statute was signed on Labor Day, after years of Congressional work on pension promises that collapsed when the sponsoring company failed.
Which plans does ERISA cover?
Two broad categories. Pension benefit plans include 401(k) plans, profit sharing plans, traditional defined benefit pensions, employee stock ownership plans and 403(b) plans sponsored by private tax exempt organizations. Welfare benefit plans include group medical, dental and vision coverage, prescription drug plans, health flexible spending arrangements, health reimbursement arrangements, group life insurance, short and long term disability coverage where the employer funds or insures it, and some employee assistance and severance arrangements. If your business is a private employer and you sponsor any of these, you are almost certainly an ERISA plan sponsor whether or not anyone has used the word.
Does ERISA apply to small businesses?
Yes. ERISA has no minimum employer size. A private company with a single group health plan and one participating employee is subject to Title I on exactly the same basis as a national corporation. Some obligations scale with plan size: small welfare plans that are unfunded or fully insured are generally excused from filing the annual Form 5500, and simplified reporting is available for small retirement plans. The core duties do not scale at all. The written plan document, the summary plan description, the fidelity bond and the fiduciary standard apply regardless of how few people the plan covers. Plan size changes the volume of paperwork, not the existence of the duty.
Is a carrier booklet the same as an ERISA plan document?
No, and this is the single most common gap in small business benefits files. The booklet or certificate of coverage your insurer produces describes the insurance contract. It rarely contains the plan administrator, the plan number, the named fiduciary, the plan year, the amendment and termination procedures, or the statement of ERISA rights that the regulations require. Most small employers close the gap with a wrap document, which is a short instrument that wraps the carrier materials and adds the missing required content. Ask your broker whether you have one, because the answer is often no. A wrap document is inexpensive relative to the exposure it closes.
Is a 401(k) an ERISA retirement plan?
Yes. A 401(k) sponsored by a private employer is a defined contribution pension benefit plan under ERISA, and it carries the full set of obligations: a written plan document, a summary plan description for participants, an annual Form 5500, a fidelity bond covering everyone who handles plan funds, statutory limits on eligibility and vesting, and fiduciary responsibility for selecting and monitoring the plan investments and service providers. The one common exception is a plan covering only the owner, or an owner and spouse, with no participating common law employees, which sits outside Title I until an eligible employee joins. Hiring a recordkeeper or an adviser does not move those duties off the employer.
Is paid time off covered by ERISA?
Generally no. Regulations exclude payroll practices from the definition of a welfare plan, so paying employees for time they did not work out of your general assets is treated as compensation rather than as a benefit plan. Ordinary vacation, holiday pay, jury duty pay and self funded sick pay usually fall on the payroll side of that line. The exclusion turns on funding, not on generosity. Set money aside in a trust to pay those benefits, or insure them through a carrier, and the arrangement can become an ERISA welfare plan with all the documentation duties that follow. The regulation drawing that line is 29 CFR 2510.3-1.
What happens if you do not comply with ERISA?
Exposure comes from three directions. The Department of Labor can investigate, require correction and assess penalties, including up to $2,739 per day for a late or missing Form 5500 for 2026. A participant who requests plan documents in writing and does not receive them within thirty days can pursue a penalty of up to $110 per day against the plan administrator. And a fiduciary who breaches a duty is personally liable to make the plan whole for the resulting losses, which is a liability that follows the individual rather than the business entity. Voluntary correction programs exist and cost dramatically less than being found.