Small Business Compliance · 15 min read
Small Business Compliance: The Policies You Need at 15, 20, 50 and 100 Employees
Small business compliance means following the laws, industry rules and customer requirements that apply to your company, and being able to prove it when someone asks. The list is short at five people and grows with every hire, every new state and every larger customer, so the hard part is knowing what has switched on and keeping the policies, approvals and acknowledgment records that show you followed it.
We built AllyMatter on a simple mission, which is to get small and medium businesses compliant with whatever they want to be compliant with, whether that’s a federal law, a regulator, a certification or a customer’s security review. This guide is the starting point for that work: it sets out what federal law adds at 15, 20, 50 and 100 employees, what policies a small business needs, what changes for mid-sized companies in regulated or audited industries, and where each of our detailed guides fits.
Key takeaways
- Federal employment law adds obligations at 15, 20, 50 and 100 employees, and each law counts employees in its own way.
- Compliance comes from three places, the law, your industry and your customers, and for fast-growing businesses the customers often arrive first.
- Every one of those sources asks the same four questions: is there a written policy, who approved it, did the right people read it, and can you prove it.
- Between 50 and 500 people the job shifts from having policies to running a program, with owners, review dates and evidence ready every year.
Where small business compliance comes from
Most owners first meet compliance as a list of laws, but for a growing company it arrives from three directions at once, and the order depends on what you sell and who you sell it to.
The law grows with headcount, and the next section sets out the federal steps. Your industry arrives with the work you take on, so a ten-person clinic has HIPAA duties on day one and a small investment adviser needs a compliance manual long before it reaches 15 people. Your customers are often the first to ask, because a larger buyer’s security questionnaire or a request for a SOC 2 report can land on a 30-person software company years before any regulator takes an interest.
I’ve been through ISO 9001 audits more than ten times, as well as SOC 2, ISO 27001 and HIPAA, and what struck me every time was how similar the questions were underneath the different acronyms. Each one wanted to see the written policy, who approved it and when, whether the people it applied to had read the current version, and whether we could show all of that without a week of digging. Our sister site, Policy and Compliance, explains what individual standards require, and the rest of this guide is about getting those four answers right whatever your standard is.
Employment laws by number of employees
Federal employment law switches on in steps, which is why a 60-person company has far more to keep current than a 12-person one. The picture below shows the main steps, and the table after it gives the counting rule for each law, because they don’t all count employees the same way.
| Law | Applies at | How the count works | What it means for your policies |
|---|---|---|---|
| Fair Labor Standards Act and Equal Pay Act | Almost every employer, from the first employee | Coverage is broad, so assume it applies | Pay, overtime and timekeeping rules, and equal pay for equal work |
| Form I-9 | Every employer | Every hire, from the first one | A completed I-9 for each person, kept for the required period |
| OSHA injury and illness records | 11 or more employees | Peak headcount across the whole company in the last calendar year; some industries are partially exempt | Injury logs and a yearly summary, on top of the safety duties every employer has |
| Title VII, ADA, GINA and the Pregnant Workers Fairness Act | 15 or more employees | Employees on each working day in 20 or more calendar weeks of this year or last | Anti-harassment and equal opportunity policies, accommodation procedures, and proof staff received them |
| Age Discrimination in Employment Act | 20 or more employees | Same 20-week rule as Title VII | Age added to your equal opportunity policy and your hiring practices |
| COBRA | 20 or more employees with a group health plan | Employees on a typical business day in the previous calendar year | Continuation coverage notices in your benefits procedures |
| Family and Medical Leave Act | 50 or more employees | Employees on each working day in 20 or more workweeks of this year or last | A written leave policy, leave notices and records |
| ACA employer rules | 50 or more full-time employees, including full-time equivalents | Average over the previous calendar year, with full-time meaning about 30 hours a week | Health coverage offers and yearly reporting to the IRS on Forms 1094-C and 1095-C |
| EEO-1 report | 100 or more employees, or 50 or more for federal contractors that meet the contract criteria | Counted for the reporting period the EEOC sets each year | A yearly workforce report, and an owner who files it |
| WARN Act | 100 or more employees | Not counting part-time staff, or 100 or more including part-time staff who together work at least 4,000 hours a week | A notice procedure before a plant closing or mass layoff |
Sources: 42 USC 2000e(b), 29 USC 630(b), 29 USC 1161(b), 29 CFR 825.104, IRS, Determining if an employer is an applicable large employer, 29 CFR 1602.7, eeoc.gov EEO data collections, 20 CFR 639.3, 29 CFR 1904.1
State and local laws often start at lower headcounts and add their own leave, pay and training rules, so check where each of your employees works. This guide covers federal law only and is general information rather than legal advice.
How many employees for FMLA?
The Family and Medical Leave Act covers a private employer with 50 or more employees on each working day in 20 or more workweeks of the current or previous calendar year. Coverage of the company is only half the test, because an individual is eligible only after 12 months of service and 1,250 hours worked in the past year, at a site with 50 or more employees within 75 miles, which is why your leave policy should explain both.
Sources: 29 CFR 825.104, 29 CFR 825.110
EEO-1 reporting requirements
Private employers with 100 or more employees file the EEO-1 report each year, as do federal contractors with 50 or more employees that meet the contract criteria. The EEOC opens the collection once a year and sets the deadline then, so the practical step is to name the person who files it and put the opening on your compliance calendar.
Sources: 29 CFR 1602.7, eeoc.gov EEO data collections
COBRA requirements
Federal COBRA applies to a group health plan when the employer normally had 20 or more employees on a typical business day in the previous calendar year, and it requires continuation coverage and a set of notices when someone leaves or loses eligibility. Many states run their own continuation rules for smaller employers, so a 12-person company can still have obligations here.
Source: 29 USC 1161(b)
ACA employer mandate
The Affordable Care Act’s employer rules apply to applicable large employers, which have 50 or more full-time employees, including full-time equivalents, on average during the previous calendar year, with full-time meaning an average of at least 30 hours a week. These employers offer coverage that meets the rules or may owe a payment, and they report their offers to the IRS each year on Forms 1094-C and 1095-C, which is why the count of part-time hours matters as you approach 50.
Sources: IRS, Determining if an employer is an applicable large employer, IRS, Information reporting by applicable large employers
Federal contractors
Federal contractors carry extra duties once they reach 50 employees and hold qualifying contracts, including affirmative action programs for protected veterans and people with disabilities. The 2025 executive order that revoked Executive Order 11246 ended the separate affirmative action program for women and minorities, but the veterans and disability rules come from statute and remain in place.
Sources: Executive Order 14173 (January 2025), Vietnam Era Veterans’ Readjustment Assistance Act, Rehabilitation Act, Section 503
What policies does a small business need?
The laws above tell you what you must do, and your policies are how you tell your people to do it, so the policy list grows in step with headcount and with the customers you win. Most small and mid-sized businesses end up with policies in five groups.
| Group | Policies most small and mid-sized businesses need | When it usually becomes pressing |
|---|---|---|
| People | Employee handbook, equal opportunity and anti-harassment, leave, pay and timekeeping, code of conduct, discipline and complaints | From the first hires, and much more at 15 and 50 employees |
| Safety | Written safety programs for the hazards you have, emergency procedures, incident reporting | From day one wherever there is a physical hazard |
| Information | Acceptable use, information security, access control, data retention, incident response, AI use | As soon as a customer sends a security questionnaire, or you handle personal or health data |
| Money and integrity | Expenses, purchasing approvals, conflict of interest, gifts | When people other than the founder spend money, and at once for nonprofits and federal contractors |
| Your standard | The policy set your certification or regulator asks for, such as a quality manual for ISO 9001, a security policy set for SOC 2, or HIPAA privacy and security policies | When you decide to certify, or the work you take on brings a regulator |
The trap at this stage is treating a policy as finished once it’s written. A harassment policy nobody has read protects nobody, and a security policy with three “final” versions fails the first customer review that asks which one is in force, so each policy needs an approval, a send to the right people and a record that they read it.
What to have in place at each size
The jump from 15 to 50 people is mostly about adding policies, while the jump from 50 to 500 is about running them as a program, because the work spreads across HR, IT, finance, quality and operations and nobody can keep it all in their head anymore.
Under 15 people, keep it simple: get pay, hiring paperwork and safety right, write a short handbook, and keep every policy in one place everyone can find. Spending money on software at this size rarely makes sense unless a customer or regulator is already asking for proof.
From 15 to 49, anti-discrimination law applies and your first larger customers start sending questionnaires, so the policies that matter most are the ones you need to show someone else, with a record that your people received them. Our guide to answering a security questionnaire covers the customer side, and our HR compliance checklist covers the employment side.
From 50 to 500, and especially in regulated or audited work such as healthcare, behavioral health, financial advice, certified manufacturing or software sold to large customers, the question changes from “do we have a policy” to “can we show the program runs every year”. That means an owner for every policy, approval before anything goes out, review dates, a yearly round of acknowledgment where a standard asks for one, and evidence you can export on request. Our guide to policy governance explains how to set that up without a compliance department, and our guide to building a compliance program covers the wider structure regulators look for.
A small business compliance checklist
Run this list once a year, and again whenever you cross a headcount threshold, enter a new state or take on a customer or certification that brings new requirements.
- Count your people the way each law does. Check your headcount against 15, 20, 50 and 100 using each law’s counting rule, including part-time hours for the ACA.
- List what applies. Write down the federal laws, state laws, industry rules and customer or certification requirements that apply to you today.
- Map each requirement to a written policy. Every obligation should point to a policy or procedure, and every policy should have one owner.
- Approve every policy before it counts. Decide who approves which policies, and keep the record of who approved each version and when.
- Send each policy to the people it applies to. Define the audience by team, location and role rather than by an email list someone has to remember.
- Collect acknowledgments by name and version. Keep proof that each person read the version in force, and send changes back out.
- Set review dates. Give every policy a review date, usually every 12 months, and sooner for high-risk ones.
- Keep the records the law asks for. Hold personnel, payroll, safety and benefits records for the periods set out in our records retention guide.
- Put the dates on a calendar. Filing windows, posting periods and review dates belong on a shared compliance calendar, not in one person’s head.
- Check you can prove it. Once a year, pick three policies and produce the approval, the audience and the acknowledgments as if an auditor had asked.
When compliance software for small business is worth it
Compliance software for a small business is worth it when the record-keeping has become the hard part. That usually happens when an auditor, insurer or large customer starts asking for proof, when tracking who read which policy has turned into a spreadsheet someone updates by hand, or when policies are owned by several departments and nobody can say which version is in force.
Most compliance and policy tools are built and priced for enterprises, with implementation projects and a seat for every person who reads a policy. We built AllyMatter for the small and growing company instead: each policy goes through an approval workflow before anyone sees it, tags decide who receives it, each person acknowledges it while signed in with a record of their name and the version, automatic reminders follow up, review dates keep it current, and the audit trail exports as a PDF or CSV when someone asks. Our guide to policy management software for small and growing businesses goes through what to look for and what it costs.
Guides in this series
Each of these guides goes deeper into one part of small business compliance, and each links back here.
HR compliance checklist. The employment tasks and records a small or growing business keeps, from hiring to exit, with the proof to keep for each one.
Employee handbook for a small business. What to put in your first handbook, what changes as you grow, and how to get every version acknowledged.
Answering a security questionnaire. How a small company handles its first customer security review, and the policies the questionnaire will ask to see.
SOC 2 policies for small companies. The policy set a SOC 2 audit expects, and how to keep it approved, acknowledged and current through the audit period.
Compliance calendar. A month-by-month calendar of filings, postings, reviews and acknowledgment rounds for a small or mid-sized business.
AI acceptable use policy. How to write a policy for staff use of AI tools, and how to make sure people have read it.
Startup compliance documentation and From 2 to 20 employees. The documentation a young company should put in place before it needs it.
For running policies as a program once you pass about 50 people, start with our guide to policy governance, which links to its own guides on policy owners, the policy on policies and annual attestation.
Questions about small business compliance
What does small business compliance mean?
It means following the laws, industry rules and customer requirements that apply to your company, and being able to prove it. For most small businesses that starts with employment law, which adds obligations as headcount grows, and then adds whatever your industry regulator and your customers ask for.
How many employees do you need for FMLA to apply?
A private employer is covered by the Family and Medical Leave Act when it has 50 or more employees on each working day in 20 or more workweeks in the current or previous calendar year. An individual employee is eligible only if they have worked for you for 12 months, worked at least 1,250 hours in the past year, and work at a site with 50 or more employees within 75 miles.
Which employers must file an EEO-1 report?
Private employers with 100 or more employees file the EEO-1 report each year, and so do federal contractors with 50 or more employees that meet the contract criteria. The EEOC opens the collection once a year and publishes the deadline on its website.
When does COBRA apply to a small business?
Federal COBRA applies to group health plans of employers that normally employed 20 or more employees on a typical business day in the previous calendar year. Many states have their own continuation laws for smaller employers, so check the rules where you operate.
At what size does the ACA employer mandate apply?
The employer rules apply to applicable large employers, which means 50 or more full-time employees, including full-time equivalents, on average during the previous calendar year. Full-time means an average of at least 30 hours a week, and applicable large employers also report their coverage offers to the IRS each year.
What policies does a small business need first?
Start with an employee handbook that covers pay, conduct, equal opportunity and anti-harassment, plus written safety procedures for any hazards you have. Add information security and acceptable use policies as soon as you handle customer data or receive a security questionnaire, and add the policies your standard or regulator requires when you take on that work.
Is compliance software worth it for a small business?
It starts to pay for itself when someone outside the business asks for proof, such as an auditor, an insurer or a large customer, or when keeping track of who approved and who read each policy has become a recurring chore. Before that point, a tidy shared drive and a calendar reminder usually hold.
Compliance for a small business isn’t one project you finish, it’s a set of obligations that grows with you, and the companies that handle it well are the ones that keep the proof as they go rather than rebuilding it the week someone asks. On yearly plans, migration is on us, and we’ll move your policies from SharePoint, Google Drive, Confluence or Notion, usually within a week and often sooner.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.