HR Compliance for Startups: What You Must Have Before Hiring #10

Most founders discover their HR compliance gaps the expensive way — an EEOC complaint, a misclassified contractor audit, or a state labor board investigation. The fines are rarely what kills a startup. It's the distraction, the legal fees, and the reputation damage. This guide maps exactly what you need at each headcount milestone so compliance never becomes a crisis.

Why Startups Get HR Compliance Wrong

The move-fast culture that helps startups outpace established competitors is the same force that creates compliance blind spots. Hiring decisions happen quickly, paperwork feels bureaucratic, and legal obligations seem like a problem for "later."

The problem is that employment law doesn't care about your growth stage. The moment you hire employee #1, federal and state obligations attach immediately. Many of those obligations scale sharply at specific headcount thresholds — and founders who don't know where those thresholds are get blindsided.

No Dedicated HR Function

At most seed-stage startups, recruitment and HR administration fall on a founder, a COO, or an office manager juggling a dozen other responsibilities. Without someone whose job is specifically to track employment law changes, compliance gaps accumulate silently.

The Department of Labor updates FLSA guidance, states pass new leave laws, and the EEOC issues new enforcement priorities — none of which show up in a product roadmap or an engineering sprint. By the time a startup hires its first HR professional, the gaps may already be years deep.

The Real Cost of Non-Compliance

The financial exposure from HR compliance failures is not academic. EEOC penalties for Title VII violations can reach $300,000 per claimant for companies with 501+ employees, and $50,000 for employers with 15–100 employees. State labor board audits for payroll violations routinely result in back-pay assessments plus double damages. IRS penalties for misclassified contractors include back payroll taxes, interest, and a 100% trust fund recovery penalty for willful violations.

Beyond direct fines, consider the operational cost: leadership distraction during an investigation averages 6–12 months, legal fees for a single EEOC matter typically run $30,000–$150,000, and the reputational damage on employer review platforms can affect recruiting for years.

Hire #1: The Foundations

Before your first employee starts, four federal requirements must already be in place. These are not optional and they are not retroactive — you cannot get them in order after the hire date.

EIN, State Registration, and Payroll Setup

An Employer Identification Number (EIN) from the IRS is the tax identity your business uses for all payroll reporting. Apply online — it takes 15 minutes and is free. You also need to register with your state's department of revenue and department of labor for state income tax withholding and unemployment insurance (FUTA/SUTA).

Your payroll system must be set up and capable of calculating federal and state withholding, depositing taxes on the correct schedule (monthly or semi-weekly depending on tax liability), and filing Form 941 quarterly. Using a payroll provider is strongly recommended for companies without a dedicated finance function.

Form I-9 and W-4

Form I-9 verifies employment authorization. Every employee must complete Section 1 on or before their first day of work. You must complete Section 2 — examining original identity and employment authorization documents — within three business days of the hire date. Retain I-9 forms for three years after the hire date or one year after employment ends, whichever is later. USCIS audits can result in fines of $272–$2,701 per form violation.

Form W-4 collects the employee's withholding allowances for federal income tax. The 2020 redesign removed personal allowances — employees now indicate their filing status and any additional withholding directly. Keep completed W-4s on file; you do not submit them to the IRS unless specifically requested.

Workers' Compensation Insurance

Workers' compensation is mandatory from employee #1 in 49 states (Texas is the sole exception, though even Texas requires it in many industries and contexts). Operating without coverage exposes founders to personal liability for workplace injuries and can result in stop-work orders. Obtain coverage through your state's assigned risk plan or a private carrier before day one of employment.

Employees 2–14: Building the Basics

Once you move past your first hire, the compliance surface expands beyond tax mechanics. The legal obligations in this band are largely about documentation and policy — but that documentation becomes your primary defense if a dispute arises.

Employee Handbook

An employee handbook is not a formality — it is evidence. In employment disputes, the handbook demonstrates that policies were communicated, acknowledged, and consistently applied. At a minimum, your handbook should cover: at-will employment acknowledgment, anti-harassment and anti-discrimination policy, time-off and leave policies, expense reimbursement procedures, confidentiality expectations, and disciplinary procedures.

The handbook must also include legally required notices that vary by state. California employers, for example, must include specific sections on paid sick leave, sexual harassment, and whistleblower protections. Review state requirements where your employees actually work — not just where your company is incorporated.

Written Offer Letters

Verbal job offers create ambiguous expectations. Written offer letters specify compensation, start date, reporting structure, and any contingencies (background check, reference verification). Equally important: a well-drafted offer letter confirms at-will employment status and does not inadvertently create an implied contract through language like "permanent position" or "as long as performance is satisfactory."

Include a brief confidentiality and intellectual property assignment agreement with every offer letter, or as a separate document signed on Day 1. Startups that skip this often discover years later that key IP developed by early employees was never properly assigned to the company.

FLSA Classification: Exempt vs. Non-Exempt

FLSA employee classification determines whether someone is entitled to overtime pay. Non-exempt employees must receive 1.5x their regular rate for hours over 40 per week. Exempt employees — those meeting the salary threshold ($684/week as of the current DOL FLSA rules) and a duties test — are not entitled to overtime.

Many startups misclassify salaried employees as exempt without verifying that they actually meet the duties test. A salaried software engineer who spends most of their time on non-managerial, production work may not qualify for the administrative or executive exemption. For a full breakdown of classification rules, see our employee classification guide.

Anti-Harassment Policy

Federal law technically requires anti-harassment policies only at 15 employees (the EEOC threshold). In practice, California, New York, Delaware, Connecticut, Illinois, Maine, and several other states require written anti-harassment policies and mandatory training for all employers regardless of size. Even where not legally required, having this policy before any incident occurs is your best protection against personal liability claims.

Employee 15: The EEOC Threshold

At 15 employees, three major federal anti-discrimination statutes activate simultaneously. This is the single most important compliance threshold in startup employment law, and it arrives faster than most founders expect.

Title VII, ADA, and the Pregnancy Discrimination Act

Title VII of the Civil Rights Act prohibits discrimination based on race, color, religion, sex, and national origin. The Americans with Disabilities Act (ADA) prohibits discrimination against qualified individuals with disabilities and requires reasonable accommodation. The Pregnancy Discrimination Act prohibits treating pregnancy, childbirth, or related conditions less favorably than other temporary disabilities.

All three are enforced by the Equal Employment Opportunity Commission. Once you reach 15 employees, any employee can file an EEOC charge — and the burden shifts to you to demonstrate that your policies, practices, and decisions were non-discriminatory and consistently applied.

Mandatory Policies and Recordkeeping at 15

At this threshold, you must have written policies for: anti-harassment and anti-discrimination covering all protected classes, reasonable accommodation procedures, and a process for investigating internal complaints. These policies must be included in your employee handbook — not just posted on a bulletin board.

You must also retain employment records — job postings, applications, interview notes, promotion decisions, compensation records — for at least one year from the date of the record or the personnel action, whichever is later. EEOC investigations routinely demand records going back 2–3 years, so retention disciplines built at 15 employees protect you at 50.

EEO-1 Reporting at 100

EEO-1 Component 1 reporting — annual demographic data by race, ethnicity, sex, and job category — is required once you reach 100 employees (or 50 employees with a federal contract of $50,000+). The filing deadline is typically in March or April each year. Start collecting voluntary self-identification data well before you reach this threshold — retrofitting EEO data collection after you hit 100 employees is operationally painful.

Employee 50: The FMLA Threshold

At 50 employees within a 75-mile radius, the Family and Medical Leave Act kicks in. FMLA is one of the most operationally complex compliance obligations in employment law — not because the entitlement is unclear, but because administering it correctly while keeping the business running requires documented processes that most scaling startups don't have.

FMLA Eligibility and Required Notices

FMLA eligibility requires that an employee has worked for the company for at least 12 months and logged at least 1,250 hours in the preceding 12 months. Eligible employees can take up to 12 weeks of unpaid, job-protected leave per year for qualifying family and medical reasons, including serious health conditions, care for a covered family member, or the birth or adoption of a child.

The DOL requires employers to post the FMLA notice in a conspicuous location and to include FMLA rights in the employee handbook. When an employee requests leave that may qualify as FMLA, you must provide a specific eligibility notice within five business days, a rights and responsibilities notice, and a designation notice once you have sufficient information to determine FMLA eligibility.

Leave Policy and Intermittent Leave

FMLA can be taken intermittently — in blocks as small as one hour — which creates scheduling complexity for startups without dedicated HR administration. Your leave policy should specify the process for requesting leave, the documentation required (medical certification), how FMLA leave coordinates with your paid time off policy, and how you handle key-person coverage during absences.

Several states have their own family and medical leave laws that apply at lower headcounts than federal FMLA. California's CFRA applies at 5 employees, Oregon's OFLA applies at 25 employees, and New York's NYPFL applies at 1 employee. Know which state laws cover your workforce — federal FMLA is the floor, not the ceiling.

ACA Employer Mandate Considerations

The Affordable Care Act's employer shared responsibility provisions apply at 50 full-time equivalent employees. "Applicable large employers" must offer minimum essential coverage to full-time employees (those averaging 30+ hours per week) or face potential penalties. The IRS monitors ALE status through annual forms 1094-C and 1095-C. If you are approaching 50 FTEs, start tracking hours for variable-hour and part-time employees at least 12 months in advance — the ACA uses a measurement period methodology that can create surprises if you start counting too late.

Startup HR Compliance Checklist by Headcount

The table below summarizes the key federal compliance obligations by milestone. State-specific requirements layer on top of these — treat this as your federal minimum baseline.

The Hidden Compliance Risks Startups Miss

The headcount thresholds above are well-documented. The risks below surface far less often in founder guides — and they are the ones that generate the most costly surprises.

Contractor Misclassification and AB5

Contractor misclassification is the most financially dangerous compliance error in the startup world. The logic seems straightforward: hire contractors instead of employees, skip payroll taxes, avoid benefits. The problem is that both the IRS and the DOL apply substantive tests to determine whether a worker is truly independent — and the test is about the economic and behavioral reality of the relationship, not what you call it in a contract.

The IRS uses a 20-factor common law test. The DOL's 2024 independent contractor rule reinstated a six-factor "economic reality" test. California's AB5 applies an "ABC test" that is among the most stringent in the country: a worker is an employee unless they (A) are free from control, (B) perform work outside the usual course of the hiring entity's business, and (C) are customarily engaged in an independently established trade. For a startup whose product is built largely by contractors doing the same work as employees, AB5 presents serious legal exposure.

The Small Business Administration's employee hiring guide is a useful primer on proper classification before you make the first contractor offer.

Equity Compensation and 409A Valuations

Startups routinely grant stock options to early employees as part of total compensation. What many founders don't realize is that Section 409A of the Internal Revenue Code governs the strike price at which those options can legally be granted. If you grant options at a price below fair market value without an independent 409A valuation, the employee — not the company — faces immediate income recognition and a 20% additional tax on the spread, on top of ordinary income tax rates.

A 409A appraisal from a qualified independent appraiser creates a "safe harbor" that protects both the company and the employee. The appraisal must be updated after any material event — a new funding round, a significant revenue change, or 12 months elapsing since the last appraisal. Many early employees who received option grants without a 409A in place only discover the tax problem when they exercise options years later.

State-Specific Rules for Remote Workers

Every state where a remote employee works creates a separate compliance obligation. You must register for state income tax withholding and unemployment insurance in that state. Many states require additional notifications: California mandates specific wage theft prevention notices, New York has detailed requirements for written wage agreements, and Colorado requires posting state minimum wage notices in remote work contexts.

Non-compete enforceability also varies dramatically by state. California, North Dakota, Minnesota, and Oklahoma effectively prohibit employee non-competes. States like Florida and Texas enforce them broadly if they are reasonable in scope and duration. Issuing a standard non-compete without reviewing state enforceability means the clause may be unenforceable in the states where your most valuable early employees actually live.

If you are hiring employees in multiple states, you should know which state laws govern each employment relationship. Check our multi-state HR compliance checklist for a detailed breakdown by state.

Building Your HR Compliance Stack

Compliance at each stage requires different tools and processes. The right stack at employee #1 looks very different from what you need at employee #50.

0–15 Employees: Lightweight but Documented

At this stage, your compliance stack should cover: a payroll provider (Gusto, Rippling, or equivalent) that handles tax filings automatically; a digital document signing tool for offer letters, I-9 acknowledgments, and handbook sign-offs; and a cloud folder structure that stores I-9 forms, W-4s, and onboarding documents with version control.

Your employee handbook should be a live document, not a PDF emailed once and forgotten. When laws change, you need to update the handbook and get written acknowledgment from all employees that they received the updated version. This is operationally trivial at 8 employees and painful at 60 if you haven't built the habit early.

15–50 Employees: Add HR Process Infrastructure

Between employee 15 and employee 50, you need formal HR processes for: accommodation request handling, complaint investigation, FLSA time-tracking for non-exempt employees, and performance documentation. You also need an ATS that captures consistent, auditable hiring data — interview notes, scoring, and final decisions — so that if an EEOC charge is ever filed, you can demonstrate that hiring decisions were made on job-related criteria applied consistently.

An ATS built for startups serves a compliance function beyond just organizing applicants. Structured hiring records become your legal paper trail. An ad hoc spreadsheet does not. If you haven't already invested in an ATS, the EEOC threshold at employee 15 is the practical forcing function.

50+ Employees: Dedicated HR and Compliance Audit

At 50 employees, you need at minimum a part-time or fractional HR professional whose explicit responsibility includes compliance monitoring — not just hiring. They should conduct an annual HR compliance audit: reviewing I-9 inventory, checking FLSA classifications, confirming FMLA notices are posted and in the handbook, and verifying that all remote-employee state registrations are current.

You also need a formal HR information system (HRIS) at this stage — not because spreadsheets literally break, but because the audit trail for employment decisions, compensation changes, and disciplinary actions must be timestamped, versioned, and accessible. See our analysis of HR team size benchmarks for data on when startups typically staff their first dedicated HR hire.

Frequently Asked Questions

When does a startup need to start thinking about HR compliance?

From your very first hire. The moment you bring on a W-2 employee, federal and state obligations kick in immediately — EIN registration, Form I-9 verification, payroll tax withholding, and workers' compensation insurance in most states. Waiting until you have 10 or 15 employees to address compliance means you are already behind on foundational requirements.

What is the EEOC threshold for startups and why does it matter?

At 15 employees, Title VII of the Civil Rights Act, the Americans with Disabilities Act, and the Pregnancy Discrimination Act become enforceable. You must have anti-discrimination and anti-harassment policies in writing, maintain EEO records, and have a process for handling accommodation requests. Having documented policies before you reach 15 is essential — the EEOC can investigate complaints against employers at this threshold.

Does FMLA apply to startups?

FMLA applies once you reach 50 employees within a 75-mile radius. At that point, eligible employees (12 months of employment, 1,250 hours worked) can take up to 12 weeks of unpaid, job-protected leave per year. You must post the required FMLA notice, include FMLA policy in your employee handbook, and designate leave properly. Some states — including California (CFRA at 5 employees), Oregon, and New York — have equivalent laws that apply at lower headcounts.

What is contractor misclassification and why is it a major risk for startups?

Misclassification happens when you pay someone as an independent contractor but they function as an employee — set hours, company equipment, single client, supervised work. If audited, you owe back payroll taxes, penalties, and potentially benefits. California's AB5 and the DOL's 2024 independent contractor rule apply strict economic reality tests. Startups relying heavily on contractors should have each relationship reviewed by employment counsel.

What HR documents does a startup need before making its first hire?

Before your first hire: an EIN from the IRS, state employer registration, payroll system setup, Form I-9 and W-4 ready to complete on Day 1, a written offer letter, workers' compensation insurance, and a basic IP assignment agreement. An employee handbook is strongly recommended by employee #5 at the latest.

What are the most common HR compliance mistakes startups make?

The most common errors: misclassifying employees as contractors, missing state-specific registration requirements for remote workers, not completing or retaining Form I-9 properly, having no anti-harassment policy before the EEOC threshold, failing to track hours for non-exempt employees under the FLSA, and not updating the employee handbook as laws change. Many of these errors only surface during audits or litigation.

Do startups with remote employees face different compliance obligations?

Yes. Each state where a remote employee works creates a separate employer registration obligation — state income tax withholding, unemployment insurance, and workers' compensation in that state. States like California, New York, and Colorado have additional requirements including pay transparency rules and state-specific leave mandates. Hiring your first remote employee in a new state is effectively opening a new office from a compliance standpoint.

What is a 409A valuation and does it affect HR compliance?

Section 409A governs deferred compensation. For startups granting stock options, it requires that options be granted at fair market value based on an independent appraisal. Options granted below FMV without a 409A safe harbor expose employees to immediate income recognition and a 20% penalty tax. Obtain a 409A appraisal before each grant cycle and update it after any material funding event or 12 months from the last appraisal. See our startup equity compensation guide for a full breakdown.