Why Do I Need an Attorney for I-9s if HR Handles It and We Use Software?
Quick answer: HR and electronic I-9 software manage the process of completing forms. They do not manage legal liability, which is a separate discipline involving immigration law, anti-discrimination law, and federal enforcement defense. An attorney is needed to run privileged self-audits that remain confidential, remediate errors lawfully, set defensible policy, and represent the company during an ICE inspection. As of March 2026, this gap matters more than ever: ICE now classifies many electronic-software deficiencies as substantive violations carrying per-form penalties of $288 to $2,861.
The rest of this article explains why, with current penalty figures and the specific work that requires a lawyer.
It's a fair question, and it usually comes from a place of genuine confidence. You've hired good HR people. You've invested in an electronic I-9 platform with built-in validations and E-Verify integration. The forms get completed, the boxes get checked, and audits aren't keeping anyone up at night.
So why bring a lawyer into it? Because in 2026, a clean-looking I-9 is no longer the same as a defensible one.
What changed in March 2026 (and why "we use software" no longer protects you)
On March 16, 2026, ICE updated its Form I-9 Inspection fact sheet, superseding key provisions of the 1997 Virtue Memorandum that had governed enforcement for nearly three decades. Two changes matter most:
Electronic system deficiencies are now substantive violations. Failures in audit trails, electronic signature protocols, and security documentation under DHS standards are no longer treated as harmless technical issues. They carry immediate penalties. In other words, your software itself can now be the source of a substantive violation.
The cure period is gone for many errors. Mistakes that employers could previously fix within 10 days after an audit are now penalized on first review.
This is the heart of the problem with relying on software alone: the platform that was supposed to reduce your risk is now an audited system whose configuration, retention, and signature handling are themselves subject to penalty. Software validates that a field is filled in. It cannot tell you whether your electronic system meets DHS's substantive standards — that's a legal determination.
Software validates fields. It cannot interpret law.
I-9 software is genuinely useful. It flags blank fields, enforces timing rules, and reduces clerical errors. If your only risk were sloppy data entry, software would mostly solve your problem.
But the hard I-9 questions are legal-judgment questions, and software is structurally incapable of answering them:
Does a remote hire's document review satisfy the physical or authorized-alternative examination requirements?
An employee's work authorization is expiring — does this require reverification, and when exactly does the clock start?
We acquired a company last quarter. Do we inherit their I-9s or redo them? (The answer depends on the deal structure — and getting it wrong creates liability for forms you never filled out.)
A manager thinks an employee's document "doesn't look right." What can we lawfully do, and what turns us into the defendant in a discrimination claim?
Software will let you complete a form perfectly while making a decision that is substantively unlawful.
HR fills out the form. Compliance is a different discipline.
Your HR team is good at onboarding, documentation, and following the process you've given them. But I-9 compliance sits at the intersection of three fields — immigration law, anti-discrimination law, and federal enforcement procedure — and almost no HR professional is trained as a specialist in all three.
This isn't a knock on HR. Worksite enforcement has become genuinely adversarial. The same step that protects you from a knowing-hire violation can expose you to a citizenship-status discrimination charge if handled clumsily. Threading that needle is a legal skill, not an administrative one. Asking HR to own it without counsel is like asking your bookkeeper to handle a tax audit — competent, well-intentioned, and operating outside their lane.
The real risk is the enforcement event, not the form
Here is what the current penalty schedule looks like. These figures come from the DHS inflation adjustment published in the Federal Register on January 2, 2025, and remain in effect through 2026:
Paperwork violations: $288 to $2,861 per Form I-9.
Knowingly hiring or continuing to employ an unauthorized worker: $716 to $28,619 per worker, depending on prior violations.
Document fraud (first offense): $590 to $4,730; higher for repeat offenses.
Because penalties are assessed per form, exposure scales with headcount fast. An employer with 500 Forms I-9 with about 50% containing errors that were previously treated as technical could now face paperwork penalties of roughly $72,000 to $715,250 under the new framework — from forms that "passed" internally because every box was filled in. That figure excludes any knowing-hire penalties, which run higher.
When an ICE Notice of Inspection arrives, you typically have three business days to produce your I-9s. That is not the moment to start wondering whether your process was defensible. By then, whatever you did or didn't do is already baked in. The only remaining variable is how well you're represented — and whether you involved counsel before the knock, when there was still time to fix things.
What an attorney does that software and HR cannot
Privileged self-audits. When an attorney directs an internal I-9 review, the work can be structured to protect candid findings and remediation analysis under attorney-client privilege. When HR runs the same review alone, those internal notes — including admissions of error — are generally fair game in an enforcement action. Who directs the audit changes its legal status.
Lawful remediation. Finding errors is easy; fixing them correctly is not. Some well-meaning "fixes" look like backdating or fabrication and can convert a paperwork problem into a fraud problem.
Electronic system review. Given the March 2026 changes, someone has to assess whether your software's audit trails, e-signatures, and retention actually meet DHS substantive standards. Your vendor won't certify this. Your HR team can't.
Enforcement defense. If you receive a Notice of Inspection, subpoena, or worksite action, you need someone who has litigated against the government — not someone learning the procedure on your dime.
Policy that holds up. An attorney builds the framework — written policy, training, remote-hire procedures, reverification protocols — so HR and your software are executing a defensible process rather than one that merely looks tidy.
The right model: HR, software, and counsel each doing their own job
This isn't an argument for replacing your HR team or ripping out your software. Both should stay. They're tools for executing compliance, not for owning it.
Companies that handle I-9s well use all three together: software to enforce process and reduce clerical error, HR to run that process daily, and an attorney to set the framework, run privileged audits, and stand between the company and the government when enforcement comes. When all three are in place, you're not just generating clean forms — you're building a position you can defend.
A simple gut check
Ask one question: If an ICE Notice of Inspection arrived tomorrow, do we know our I-9s are defensible — or do we just know they're filled out?
If you can't answer that with confidence, that gap is worth closing now, while it's cheap to fix and you're on your own timeline rather than the government's.
Not sure where you stand? A Compliance Assessment is the fastest way to find out. We'll review where your I-9 process is solid, where it's exposed — including whether your electronic system meets the new March 2026 standards — and what to prioritize before an auditor does it for you. Book a Compliance Assessment →
Learn more about Elevate Justice’s other immigration compliance offerings here.
This blog post is for informational purposes only and does not constitute legal advice. Immigration enforcement policies change frequently. Consult with a qualified immigration attorney for guidance specific to your situation.
