How long do I have to keep employee records?

Here is the list, by record type, with the rule behind each one.

How long do I keep Form I-9?

Keep each I-9 for three years after the hire date or one year after the termination date, whichever is later. That is the USCIS rule, 8 CFR 274a.2.

Work it out for a real employee. Someone hired January 1, 2023 and let go June 1, 2025. Three years after hire is January 1, 2026. One year after termination is June 1, 2026. The later date wins, so you keep that I-9 until June 1, 2026.

Store I-9s separately from personnel files. That keeps an inspection simple and keeps private information out of the wrong hands.

How long do I keep payroll records?

The Fair Labor Standards Act requires payroll records kept for three years from the date of the last entry, 29 CFR 516. That covers hours worked, wages paid, overtime, and deductions.

Keep the payroll records three years. If you are unsure whether a record counts as payroll or as a supporting record, keep it three years too.

How long do I keep employment tax records?

IRS employment tax records are kept four years. That covers the forms and records behind your payroll tax filings.

Four years is longer than the FLSA three years. So in practice, your payroll file stays four years, because the tax rule is the longer one. That is the pattern through this whole article: the longest timeline that applies is the one you follow.

How long do I keep personnel records?

The EEOC requires personnel and employment records kept for one year from the date the record was made or the personnel action was taken, whichever is later. That covers applications, resumes, hiring notes, promotions, demotions, transfers, and terminations.

One year is the federal minimum, and it is short. Most employers keep personnel files much longer, because a dispute can surface after a year, and because state rules often require more. Do not treat one year as a target. Treat it as a floor.

How long do I keep Ai decision records?

This is the new category, and the timelines differ by state.

California automated decision system records under FEHA are kept four years. That covers the tools you used, what they decided, and the records behind those decisions.

Colorado's replacement law asks for three years of records. That law is aimed at January 1, 2027, and the rules are still being written, so recheck the timeline before January.

What ties all of this together?

State rules can extend federal minimums. California asks for four years on automated decision records. Other states will ask for their own timelines as their Ai rules arrive. When two rules apply to the same record, use the longest one.

Two habits make this easy. First, keep a one-page retention list with the record type, the rule, and the date you can delete it. Second, review the list once a year, because the rules change. Colorado changed its whole Ai law in May 2026. Your list from last year may already be wrong.

What to do next

Pull your personnel files and your I-9s this week. Check the dates against the list above. If you find I-9s past their date, shred them. If you find records you should still have and cannot locate, that is a gap to close before an inspection finds it.

If you want someone to check your records and your Ai tools against the rules that apply to your business, that is what an Ai risk and compliance audit is for.

HR guidance, not legal advice.