What Is Work Authorization? A Guide for Small Business Employers

If you are hiring your first or second employee, the phrase "work authorization" probably appeared on the I-9 form, in a job posting template, or in a compliance guide. And your immediate question was: what does this actually mean, and what do I need to do about it?

The short answer: work authorization is the legal right to be employed in the United States. Every employer must verify it for every new hire, regardless of company size.

This guide explains what work authorization means for you as an employer, how to verify it correctly through the I-9 process, which documents count as proof, and how to build the verification step into your onboarding workflow so you never miss a deadline.

What Is Work Authorization?

For employers, work authorization is not an immigration question. It is a compliance question. You are not required to understand immigration law, determine visa categories, or assess someone's eligibility for a green card. You are required to do one thing: verify that every person you hire is authorized to work in the United States by completing Form I-9 correctly and on time.

Who Has Work Authorization in the United States

The critical point for employers: you do not need to determine which category a new hire falls into, and you do not need to understand their immigration status. Your job is to examine the documents they present, check that they appear genuine and relate to the person, and complete I-9 Section 2.

The employee chooses which documents to present. You cannot request specific documents or reject valid ones because you would prefer a different one. The E-Verify FAQ provides the official Department of Homeland Security (DHS) definition of work authorization.

What You Can and Cannot Ask Before the Offer

Work authorization questions cause more trouble at the application stage than at the I-9 stage, because the I-9 has instructions and the interview does not. Two questions are standard and lawful on an application form or in a screening call:

"Are you legally authorized to work in the United States?" This is the question you actually need answered. It is a yes-or-no question about eligibility, not about status.

"Will you now or in the future require sponsorship for employment visa status?" This is the question that tells you whether the role creates a sponsorship obligation you are not prepared to take on. Ask it of every applicant for the role, not just the ones with accents or foreign-sounding names.

What you should not do: ask whether someone is a US citizen, ask where they were born or what their national origin is, ask to see documents before you have made an offer, or ask follow-up questions of some candidates and not others.

Requesting documents at the interview stage is the classic slip on that list, usually made by an employer trying to be organized rather than one trying to discriminate. The Form I-9 document review belongs after the offer is accepted, and USCIS warns that asking for documents before hire because a candidate looks or sounds foreign, or says they are not a US citizen, may violate federal discrimination law.

What "US Work Authorization Required" Means on a Job Posting

The line means one thing on your side: whoever you hire has to be able to prove on Form I-9 that they may lawfully work in the United States. It is not a request for a citizenship status, a country of birth or a particular document, and it gives you no right to ask about any of those before an offer exists.

The version most employers actually intend is longer, and it names sponsorship rather than authorization: authorized to work in the US without current or future employer sponsorship. That phrasing screens for a commitment rather than a status, and it has to go to everyone applying for the role. Our guide to H-1B sponsorship for employers covers what that commitment involves before you write it into a posting.

The related phrase, work authorization status, comes from Section 1 of the I-9 itself, where the new hire picks one of four attestations: US citizen, noncitizen national, lawful permanent resident, or a noncitizen authorized to work with the date that authorization ends. That choice is the employee's to make and yours to accept. Your job starts afterwards, with the documents they decide to show you.

The 3 Things Every Employer Must Do

What Counts as Proof of Work Authorization

A typical combination for US citizens: driver's license (List B) plus Social Security card (List C). The simplest option: a US passport (List A alone). For non-citizens: a green card, the Employment Authorization Document, or a foreign passport with I-94 (all List A).

You cannot reject a valid document because it looks unfamiliar or because you are unsure about a visa category. If the document reasonably appears genuine and relates to the person presenting it, you must accept it.

Who Needs an I-9 (and Who Does Not)

The rule is that every person hired to work in the United States after November 6, 1986 needs a Form I-9. The complications are all in the edge cases, and small businesses hit them constantly because their first several workers are rarely all standard W-2 hires.

The authorized representative option is the one small employers misunderstand most often. US Citizenship and Immigration Services (USCIS) does not require a notary, an attorney, or any credential at all: you may designate any person to examine documents and complete Section 2 on your behalf, including a friend of the company in the employee's city.

Two practical cautions come with that freedom. You remain liable for whatever your representative does, so send them the form instructions rather than assuming they know the rules. And if you use a notary, they are acting as your agent and not in their notarial capacity, which means no stamp and no notarial certificate on the form.

Fitting Work Authorization Verification Into Your Onboarding Workflow

Work authorization verification is not a standalone task. It is one step in the onboarding workflow that includes offer acceptance, paperwork collection, Day 1 orientation, and the first 90 days. Here is how it fits.

This workflow takes 20 to 30 minutes per hire when done correctly. Most of the time is spent examining documents and completing Section 2. I built the task workflows in FirstHR with this timeline in mind: you can set up Section 1 and Section 2 as separate tasks in the onboarding plan, the new hire handles theirs through the self-service portal, and the completed form is kept in document management.

When Documents Expire: Reverification in Practice

Reverification is where an otherwise clean I-9 process quietly falls apart, because it happens months or years after the hire, when nobody is thinking about paperwork. Start with what you must never reverify.

US citizens are never reverified. Lawful permanent residents who showed a green card are never reverified, even when the card itself expires, because the card expires and the status does not. List B identity documents are never reverified either: an employee whose driver's license expires in year two does not owe you anything.

What you do reverify is temporary employment authorization that has an end date on it, and you do it on or before the day it expires. On the current edition of the form, you record it on Supplement B, which replaced what older guides call Section 3.

At reverification the employee again chooses which document to present, and it does not have to be the same type as last time. You may not demand a renewed version of the original document.

Employment Authorization Documents are the common case, and the mechanics have changed in a way that catches employers off guard. According to the USCIS announcement of October 29, 2025, anyone who files to renew an EAD on or after October 30, 2025 no longer receives an automatic extension of that document.

The practical effect is that the date printed on the card is now the whole answer. A receipt notice for a pending renewal is not evidence of continued authorization on its own, so an employee whose card lapses while USCIS works through the application has nothing to present at reverification unless they hold another acceptable document.

Two narrow exceptions survive the change. Extensions granted by statute still run, and Temporary Protected Status documentation extended by a Federal Register notice is still valid for the period that notice sets, so check the category on the card before you conclude the date on it is final.

Employees who filed before October 30, 2025 may still be carrying an automatic extension of up to 540 days under the earlier rule, evidenced by the expired card together with a Form I-797C receipt notice showing a matching eligibility category. Put whatever end date applies on the calendar, because when it runs out the employee is out of authorization even though nothing in your office changed.

A single tracking sheet keeps those dates in one place, and it only holds the people who actually need reverifying. Citizens and permanent residents never appear on it. Everyone else gets a row with the expiry, the reminder date ahead of it, and the dates of what you did when the reminder fired.

E-Verify: Do You Need It?

E-Verify is a free online system that compares I-9 information against DHS and Social Security Administration (SSA) records to confirm work authorization. It is mandatory for some employers and optional for others.

That table covers the broad mandates on private employers. Several more states require E-Verify of public employers and of anyone holding a state or local contract, so check your own state before concluding you are outside it, particularly if you bid for public work.

If no state mandate reaches your business and none of your federal contracts or subcontracts carries the Federal Acquisition Regulation (FAR) E-Verify clause, E-Verify is optional. Many small business founders choose to opt in anyway for two reasons: it provides an additional layer of verification that strengthens your audit defense, and it enables remote document examination (the DHS alternative procedure).

If E-Verify Returns a Mismatch

Opting into E-Verify means opting into its procedures, and the one that matters is what happens when a case comes back as a Tentative Nonconfirmation, now labeled a mismatch. A mismatch does not mean the employee is unauthorized.

The causes E-Verify lists are mostly ordinary record and data-entry problems: a name changed after marriage and never updated with SSA, a hyphenated surname entered differently, a naturalization that SSA records have not caught up with, or a transposed digit in the case you created.

The rule that carries the most risk is the one telling you to do nothing. According to E-Verify, an employer may not terminate, suspend, delay training, withhold or lower pay, or take any other adverse action against an employee because of the mismatch until it becomes a Final Nonconfirmation. Everything below happens while that person keeps working normally.

The referral timelines come from the E-Verify user manual, and they are short enough that a delay on your side eats the employee's window rather than yours. Print the Further Action Notice the day the mismatch appears, not the day you next think about it.

Two rules govern how you use the system at all. The first is timing. You may not prescreen: the E-Verify rules and responsibilities forbid running a case on an applicant. The order is fixed: complete Form I-9 first, then create the case, which E-Verify requires no later than the third business day after the employee starts work for pay.

The second rule is coverage. You must run every new hire at a participating location, not just the ones whose paperwork looked unfamiliar. Selective use of E-Verify is itself a discrimination claim, and it is the one an investigator can prove from your own case history.

Common Work Authorization Mistakes Small Employers Make

None of the five mistakes below takes immigration expertise to avoid. Each one comes down to a deadline, a document, or a filing habit, and each has a simple fix.

Completing Section 2 late. Section 2 must be completed within 3 business days of the first day of paid employment. Not "when we get around to it." Not "at the end of the first week." Three business days. Under 8 CFR 274a.10, paperwork penalties run from $288 to $2,861 for each individual the violation involves.

Asking for specific documents. "Bring your passport on your first day" breaks the Form I-9 rule that the employee chooses which documents to present. You can provide the list of acceptable documents (the I-9 instructions include it) but cannot direct the employee to a specific document or combination. Aimed at some hires because of their citizenship status or national origin, the same request is document abuse.

Over-documenting. Some employers photocopy documents "just in case." If you photocopy for some employees but not others, you create evidence of discriminatory practice. Either photocopy for everyone or no one. E-Verify employers who use the alternative remote procedure must retain copies.

Storing I-9 forms in personnel files. USCIS recommends keeping I-9 forms separate from employee personnel files so they can be produced quickly during an Immigration and Customs Enforcement (ICE) audit without exposing other employee records. It is a recommendation rather than a legal rule, and worth following: keep all I-9s in one dedicated folder (physical or digital), organized by current vs terminated employees.

Not reverifying when an EAD expires. If a non-citizen employee's EAD carries an expiration date, you must reverify their work authorization on or before that date, using Supplement B on the current edition of the form. Failure to reverify means you may be continuing to employ an unauthorized worker, which sits in a much higher penalty tier: $716 to $5,724 per worker on a first order.

Fixing I-9 Errors and Surviving an Audit

Nearly every small business that has been hiring for a few years has defective I-9s: missing signatures, blank date fields, documents recorded in the wrong list column, forms that were never completed at all. Finding them is good news, because errors corrected before an inspection are treated very differently from errors found during one.

How to correct an existing form. Draw a single line through the incorrect entry, write the correct information, then initial and date the change in the present. Never use correction fluid, never erase, and never write over an old entry so that the original is unreadable. If Section 2 was never completed, complete it now using today's date for your certification signature.

Backdating is the one thing that converts a paperwork problem into a serious problem. An inspector who spots a Section 2 signed on a date the reviewer demonstrably was not there is looking at a falsified federal form, which is a different category of exposure than a late one.

How to correct a missing form. Complete a new I-9 with the employee immediately, using the employee's actual original hire date in the hire date field and today's date for the signatures. Attach a short signed memo explaining when and why the form was created. Do not fabricate a form made to look as if it was completed at the time of hire.

The memo is what turns an obvious gap into a documented one, and it takes five minutes to write while the correction is in front of you. It records what was wrong, who fixed which section, on what date, and what has changed so the same gap does not open again. A fill-in memo for exactly this, along with a self-audit tracker to work through the whole file drawer, sits in the I-9 documentation guide.

Who corrects what. Only the employee may correct Section 1, and only the employer may correct Section 2. If a former employee cannot be reached to fix their own section, attach a memo explaining that rather than fixing it yourself.

What an inspection looks like. According to ICE, an audit starts with a Notice of Inspection, and you get at least three business days to produce the I-9s. That is why the separate-folder recommendation matters: three days is not much time to pull forms out of individual personnel files.

Violations are sorted into technical or procedural failures, which you must be given at least ten business days to correct, and substantive failures, which get no correction period and can be fined.

Penalty amounts are normally adjusted for inflation each year, although the 2026 adjustment was canceled and the 2025 amounts still apply. Knowingly employing an unauthorized worker is penalized in a much higher tier than paperwork violations, and a pattern or practice of it brings criminal exposure.

The practical routine is an annual self-audit: pull every I-9, check each one against the current form instructions, correct what can be corrected in the manner above, purge the forms that have passed the retention period, and document that you did it. A demonstrated good-faith compliance program does not erase penalties, but good faith is one of the five factors ICE weighs in setting them.

When You Actually Need an Immigration Lawyer

For most domestic hires (US citizens and permanent residents), you do not need a lawyer. The I-9 process is straightforward and well-documented by USCIS. You need a lawyer in three situations.

First, if you want to sponsor a foreign national for an employment visa (H-1B, O-1, L-1). Visa sponsorship involves petitions, labor condition applications, prevailing wage determinations, and strict deadlines. This is not a DIY process.

Second, if you receive a Notice of Inspection from ICE. An ICE audit means federal agents will examine your I-9 forms. Contact an immigration attorney immediately. Once the notice has arrived, do not attempt to "fix" I-9s before the audit.

Third, if you have reason to believe an employee's documents are fraudulent. Do not confront the employee or investigate on your own. Consult a lawyer to understand your obligations and protect yourself from liability.

For everything else, a lawyer is not necessary: completing the I-9 for domestic hires, understanding List A/B/C documents, setting up your verification process, and building the workflow into onboarding. A well-structured onboarding platform with I-9 task tracking, document storage, and deadline reminders handles the compliance requirements that most small businesses face.

Frequently Asked Questions