401(k) Auto-Enrollment: What Changed for Employers in 2026
SECURE 2.0's auto-enrollment mandate is now in effect for most new 401(k) plans — here's what employers need to check before 2026's plan year closes.
In this report 7 sections
Quick answer: Starting in 2026, most 401(k) and 403(b) plans created after December 29, 2022 must automatically enroll eligible employees at a default contribution rate between 3% and 10%, with automatic 1% annual increases up to at least 10%. Employers with 10 or fewer employees, businesses less than three years old, church plans, and governmental plans are exempt.
The 401(k) auto-enrollment mandate isn't new legislation. It's a provision of the SECURE 2.0 Act that's now fully in force, and 2026 is the year most employers are feeling it in practice rather than reading about it in a compliance memo. This guide walks through what changed, who's covered, and what payroll and HR teams need to check before an audit finds the gap first. It's written for small and mid-size employers setting up or maintaining a workplace retirement plan, not benefits attorneys.
At The Work Floor, we hear from HR and payroll teams every year who assumed auto-enrollment was optional guidance rather than a hard requirement. It isn't anymore, and the penalties for getting it wrong are real.
What SECURE 2.0's Auto-Enrollment Mandate Requires in 2026
The SECURE 2.0 Act of 2022 requires new 401(k) and 403(b) plans to include automatic enrollment starting with plan years beginning after December 31, 2024. For calendar-year plans, that means the 2026 plan year is the first full year most affected employers are operating under the rule, not just planning for it.
Under the mandate, eligible employees are automatically enrolled at a default contribution rate of at least 3% but no more than 10% of eligible pay. The employer picks the exact starting rate within that band. Employees aren't asked to opt in. Instead, they're enrolled by default and have to actively opt out if they don't want to participate.
The Internal Revenue Service (IRS) has published guidance clarifying that the mandate applies only to plans first established on or after December 29, 2022. A 401(k) plan that already existed before that date, even if it has never used auto-enrollment, is grandfathered out of the requirement. That distinction trips up a lot of employers who assume "new plan year" means "new plan" for mandate purposes. It doesn't. What matters is when the plan itself was created.
We've seen HR teams at growing companies get this backwards, assuming a plan amendment or a new recordkeeper reset the clock. It doesn't. The original plan establishment date is what the IRS checks.
How Auto-Enrollment Applies to New Hires
For a covered plan, every newly eligible employee gets defaulted into the plan on their eligibility date unless they affirmatively opt out. That means auto-enrollment paperwork now belongs in the same onboarding packet as tax withholding forms and benefits elections, not a separate mailing that goes out weeks later.
Practically, this changes the onboarding sequence. A new hire needs written notice of the automatic enrollment, the default contribution rate, their right to opt out, and where their contributions will be invested by default (usually a qualified default investment alternative, or QDIA, like a target-date fund). If your onboarding process already walks new hires through benefits in their first 30 days, this notice fits naturally into that window. See our guide to onboarding a new hire in the first 30 days for how other HR teams sequence that paperwork so nothing gets missed.
One detail worth flagging: the notice has to go out before the first automatic deferral is taken, not after. A retroactive notice doesn't satisfy the requirement, and it's one of the more common documentation gaps auditors flag.
Which Employers Are Exempt From the Mandate
Four categories of plans are exempt from the SECURE 2.0 auto-enrollment requirement: plans established before December 29, 2022, employers with 10 or fewer employees, businesses that have been in existence for less than three years, and church plans or governmental plans.
The small-business exemption is a genuine relief valve. A company with 10 or fewer employees can sponsor a 401(k) without auto-enrolling anyone, and can keep that exemption as it grows, as long as headcount stayed at or under 10 at the time the plan was set up and the exemption conditions are tracked correctly. The three-year exemption works similarly: a genuinely new business doesn't have to build auto-enrollment into its first retirement plan.
Eligibility for these carve-outs isn't just about total headcount, either. Since so much of 401(k) eligibility tracking still runs through how you classify your workforce, it's worth revisiting how exempt and non-exempt status is determined heading into 2026, since misclassifying workers can throw off both overtime calculations and retirement-plan eligibility counts at the same time.
None of these exemptions are automatic protection from scrutiny. The U.S. Department of Labor's Employee Benefits Security Administration (EBSA) has said plan sponsors claiming an exemption should keep documentation showing why it applies, not just assume it does.
How High Does the Default Contribution Rate Have to Climb?
How high does the default rate have to climb? Every covered plan must start eligible employees at a default rate of 3% to 10% of pay, then increase that rate by 1 percentage point each year until it reaches at least 10%, capped at 15%.
| Plan Year | Minimum Default Rate | Escalation Ceiling |
|---|---|---|
| Year 1 (enrollment) | 3% | 10% max |
| Year 2 | 4% | 11% max |
| Year 3 | 5% | 12% max |
| Year 4 | 6% | 13% max |
| Year 5+ | 10% minimum reached | 15% max |
For example, an employee auto-enrolled at a 4% default in year one who never changes it will see that rate climb to 5% in year two, 6% in year three, and so on, until it plateaus somewhere between 10% and 15%. Employees can override the default at any point, either raising it, lowering it, or dropping to zero by opting out entirely.
Employer matching contributions are a separate question from the default deferral rate. The mandate sets the employee's default deferral schedule; it doesn't require a specific match formula. Plenty of employers pair the mandatory auto-escalation with an unchanged match, which means the employee's own contribution keeps climbing even if the employer's doesn't.
What Happens If You Don't Comply
Failing to implement required auto-enrollment isn't a paperwork slap on the wrist. It can trigger an excise tax under Internal Revenue Code Section 4979, corrective contributions to affected employees who should have been enrolled, and in serious cases, disqualification of the plan's tax-favored status.
The corrective contribution piece is the one that catches employers off guard financially. If an eligible employee wasn't auto-enrolled when they should have been, the employer generally has to make a corrective contribution on that employee's behalf, calculated as if the missed deferrals had actually happened, plus any missed matching contributions. For a company with dozens of affected employees over multiple pay periods, that number adds up fast.
In our experience working with HR teams on 401(k) transitions, the compliance gap almost never comes from a deliberate skip. It comes from a new-hire workflow that never got updated after the plan added auto-enrollment, so new employees kept getting the old paperwork packet.
Compliance Checklist: Getting Your Plan Ready
Before your next plan year starts, walk through these steps to confirm your 401(k) auto-enrollment setup actually matches what SECURE 2.0 requires.
- Confirm your plan's original establishment date to determine if the mandate applies at all.
- Verify your headcount and business age against the small-employer and new-business exemptions.
- Check that your default deferral rate falls within the 3%-10% starting band.
- Confirm your plan document includes the required annual 1% auto-escalation.
- Update new-hire onboarding so the auto-enrollment notice goes out before the first deferral.
- Ask your recordkeeper for a report of any eligible employees who weren't enrolled on schedule.
This is also a good moment to loop in whoever owns your broader 2026 HR compliance calendar. Auto-enrollment isn't happening in isolation this year. It's landing alongside new pay transparency requirements taking effect in several states, and plenty of HR teams are managing both updates in the same review cycle.
The Bottom Line
If your 401(k) plan was established on or after December 29, 2022, and you don't qualify for the small-employer, new-business, church, or governmental exemption, auto-enrollment isn't optional in 2026. The fix is mostly procedural: confirm your plan's establishment date, check your default rate and escalation schedule against the required range, and make sure new-hire onboarding actually delivers the notice before the first paycheck is cut.
The Work Floor covers payroll, benefits, and HR compliance changes like this one as they take effect, not just when they're first announced. Talk to your plan's recordkeeper or a benefits attorney before making changes to your plan document, since the corrective-contribution rules get technical fast.
By Carlos Medina, Staff Writer at The Work Floor. Reviewed for accuracy as of September 2026.
The Work Floor covers work, careers, hiring, and HR for people building and running workplaces that actually function.
