Electronic I-9 storage requirements: what 8 CFR 274a.2 asks of your system

You may complete, sign and store Form I-9 electronically, but the system has to meet the standards in 8 CFR 274a.2(e) through (i). In short: controls that keep records accurate and prevent unauthorized changes, an indexing system that finds any form, legible reproduction, documented business processes, a security program with a permanent audit trail of every change, and electronic signatures that are tied to the signer. At an inspection you must also supply whatever it takes for the inspector to retrieve and read the records, including the audit trails. Failing to meet these standards is itself a violation, separate from any error on the forms.

The companion page on I-9 retention rules covers how long to keep forms and lists paper, microfilm and electronic storage side by side. This page goes one level deeper into the electronic requirements, with questions to put to a vendor and to your own HRIS team.

The requirements, paragraph by paragraph

The audit trail, specifically

The audit trail is what most homegrown setups lack. The requirement is a secure and permanent record, created whenever an electronic I-9 is created, completed, updated, modified, altered or corrected, of the date of access, the identity of the person, and the action taken. A few consequences:

• Shared logins break it. If three coordinators use one "hr@" account, the audit trail cannot identify who acted.
• Overwrites break it. A correction must add to the record, not replace the old value invisibly. Paper corrections keep the struck-out entry legible; the electronic equivalent is a log that shows the old value, the new value, who and when. See common Form I-9 mistakes for how corrections should read.
• Editable logs break it. If an administrator can delete audit entries, the record is not permanent.
• Viewing is different. The regulation ties the audit record to creating and changing records; the retention rules page notes that simply viewing a record does not have to appear in it. Many systems log views anyway, which does no harm.

Building your own form versus buying a system

USCIS allows both. An employer that builds its own electronic Form I-9 must provide the instructions, keep the form legible, keep the original names and sequence of the data elements, and not add fields. A commercial product is acceptable if it meets the same standards and does not restrict government access to the records. Either way, the employer is responsible. A vendor's marketing claim of compliance does not move liability to the vendor.

One more obligation arrived this year. USCIS told employers using an electronic version of the form to update their systems to the version with a 05/31/2027 expiration date by 07/31/2026. If your system still generated the older 08/01/23 version after that date, new forms completed in it may be on an invalid edition.

Questions to ask a vendor, or your own HRIS team

1. Which Form I-9 edition does the system generate today, and how fast do you update when USCIS changes it?
2. Show me the audit trail for one record: every change, with the user, date, time, and old and new values. Can anyone edit or delete it?
3. How does the employee's electronic signature work in Section 1, and what printed confirmation do they receive?
4. How does the employer acknowledge reading the Section 2 attestation before signing?
5. How are document copies stored, at what resolution, and are they linked to the form?
6. How do I export every form, supplement, document copy and audit trail if we leave, and in what format?
7. How are records purged when retention ends, and is the purge itself logged?
8. What written documentation of your business processes can I hand an inspector?
9. Who can access the data, including your staff, and how is that controlled? A SOC 2 report helps answer this, though it is not an I-9 standard.
10. How are backups made and tested, and how quickly can records be restored?

Scanning legacy paper forms

USCIS's Handbook says you may scan and upload an original signed paper form, including any correction or update, and destroy the paper original once it is securely stored electronically. Before you shred anything:

• Check every scan for legibility, including initials on corrections and the back of document copies.
• Scan supplements, correction memos and document copies with the form, and index them to the same employee.
• Record the scan in the system's audit trail or an equivalent log, so there is a record of when the electronic version was created and by whom.
• Keep your retention clock based on the original hire and termination dates, not the scan date.

What an inspection asks of an electronic system

Inspectors give at least three business days' notice. Within that window you must produce the requested forms at the location they ask for, and for electronic records provide the hardware, software, personnel and documentation needed to locate, retrieve, read and reproduce them, their supporting documents and their audit trails. If asked, you must also provide reasonably available electronic summary files, such as spreadsheets, with the form fields, and E-Verify case numbers or case detail pages where applicable. Produce only what is requested; a system that can export a single employee's record with its audit trail is far easier to work with than one that can only dump the whole database. For preparing for that moment, see the I-9 audit checklist.

Mixed and remote environments

Most employers end up hybrid: old paper forms, a first system, a second system after a migration, and document copies from remote examinations. The regulation allows more than one system as long as each meets the standards and every record stays accessible. The risk is the forgotten one: a former vendor's archive nobody can log into, or scans on a shared drive with no index or audit log. Keep a written map of where every era of I-9 records lives and who can retrieve it.

A compliance checklist

• System generates the current Form I-9 edition.
• Named user accounts, role-based access, no shared logins.
• Permanent, non-editable audit trail for every create, update and correction.
• Electronic signatures captured in the system with signer identity and printed confirmation.
• Legible document copies linked to each form.
• Written documentation of business processes and the indexing scheme.
• Backups tested; export tested; a retrieval drill run at least once a year.
• A map of legacy paper, scanned and prior-system records.