Considerations for Plan Administrators of Plans Covered by ERISA

Plan administrators of plans that are subject to the Employee Retirement Income Security Act of 1974 (ERISA) should review the following actions to be taken before the end of 2026 and focus on what to expect for 2027. 

The following checklist addresses plan amendments, notices, and other considerations for qualified retirement plans, welfare plans, and stock-based and nonqualified plans.

VIEW PDF

Amendments and Considerations for All Qualified Retirement Plans

SECURE, SECURE 2.0 and CARES Act Amendments: 

• Amendments to conform to the SECURE Act of 2019 (SECURE Act), the Coronavirus Aid, Relief, and Economic Security Act of 2020 (CARES Act), and the SECURE 2.0 Act of 2022 (SECURE 2.0) must be adopted by December 31, 2026, for qualified plans. Plan administrators should carefully review any administrative changes implemented under the SECURE Act, CARES Act, and SECURE 2.0 to ensure that amendments adopted in 2026 accurately reflect administration for all prior years. Plans that have not yet adopted required amendments should prioritize completion before the year-end deadline. 

SECURE 2.0 Act Changes Effective in 2026: 

• Highlights of the SECURE 2.0 retirement plan provisions that became effective in 2026 include:
  • Roth Catch-Up Requirement. Beginning in 2026, participants whose prior year FICA wages from the plan sponsor exceeded $150,000 (as indexed for inflation) may make catch-up contributions only on a Roth basis. Plan sponsors should coordinate with recordkeepers and review payroll systems to ensure compliance with this new requirement for 2026 and future years. Plan sponsors may wish to consider adding a Roth feature to their plan if one does not currently exist.
  • Requirement to provide paper statements for plan years beginning after December 31, 2025. Beginning with the 2026 plan year, for defined contribution plans, paper benefit statements must be provided to participants at least once annually, unless certain conditions are satisfied. For defined benefit plans, unless a participant elects otherwise, the statement that must be provided once every three years must be a paper statement.

Discretionary Plan Amendments: 

• Plan amendments reflecting discretionary changes that became effective in the current plan year (other than the SECURE Act, CARES Act, and SECURE 2.0 changes discussed above) must be adopted by the last day of the plan year (e.g., December 31, 2026, for a calendar year plan). Examples of discretionary changes include an increase in benefits, the addition of a new participating employer, and the addition of a new type of contribution. For defined benefit plans, advance participant notice may be required if an amendment significantly reduces the rate of future benefit accruals, such as a pension plan freeze.

Determination Letter Procedures: 

• The Internal Revenue Service (IRS) determination letter program permits determination letter requests for individually designed plans (i.e., plans not using pre-approved documents such as prototype or volume submitter documents) only for initial plan qualification, plan termination, or in the case of certain merged plans. An eligible plan merger is one that occurs in connection with a corporate merger, acquisition, or similar business transaction among unrelated entities, no later than the end of the plan year after the plan year that includes the date of the corporate transaction. If eligible, the application for determination on a merged plan must generally be submitted before the end of the plan year following the year of the plan merger. For instance, if a merger occurred in 2025, the determination letter request must be submitted no later than December 31, 2026, for a calendar year plan.

Determination Letter Procedures for 403(b) Plans: 

• The IRS expanded its determination letter program and will now issue determination letters for initial qualification and termination of individually designed 403(b) plans. The IRS is currently accepting determination letter applications for initial qualification review for plans that have not previously received an initial qualification letter.

Fee Disclosures – Action Required Annually: 

• Certain retirement plan service providers must provide an ERISA section 408(b)(2) fee disclosure to plan fiduciaries. The disclosure allows plan fiduciaries to evaluate whether fees paid from plan assets are reasonable, as required by ERISA. Plan fiduciaries should coordinate with their service providers to ensure they are receiving the required notices. Plan fiduciaries also must provide annual ERISA section 404(a)(5) fee disclosures to participants. Information on fees deducted from participants’ accounts also must be provided in quarterly statements.

Fiduciary Procedures: 

• Best practice is for retirement plan fiduciaries responsible for selecting and monitoring plan investments to meet on a regular basis (preferably quarterly) to review the performance of the plan’s investments and the reasonableness of investment-related fees that are paid directly from plan assets. Minutes of such meetings recording the fiduciaries’ decisions should be maintained and approved by the committee.

Safe Harbor Plans:

• Generally, safe harbor 401(k) amendments must be adopted before the beginning of the plan year. An employer that wishes to add or amend an existing safe harbor matching or nonelective contribution in a calendar year 401(k) plan for the 2027 plan year should adopt an amendment by December 31, 2026. Under the SECURE Act, however, an employer may adopt the 3% nonelective contribution safe harbor at any time before the 30^th day before the close of the plan year.

Forfeiture Accounts: 

• The IRS issued proposed regulations in February 2023 to address the timing and use of forfeitures that accumulate in a retirement plan, as follows:
  • Forfeitures arising in a defined contribution plan may be used to pay plan administrative expenses, reduce employer contributions, or increase benefits to other participants’ accounts. The regulations generally require that plan administrators use forfeitures no later than 12 months after the close of the plan year in which the forfeitures are incurred. The plan document must describe the treatment of forfeitures. Plan administrators should ensure that administrative practices with respect to forfeitures align with the plan’s written terms.
  • Forfeitures arising in a defined benefit plan cannot be used to increase the benefits of any employees. However, the anticipated amount of forfeitures can be used in determining funding under the defined benefit plan. 
  • The proposed regulations will be effective after the IRS issues final regulations but can be relied on now.

PBGC Premium Increase: 

• The Pension Benefit Guaranty Corporation (PBGC) per-participant flat-rate premium for plan years beginning in 2026 is $111 for single-employer plans. Such premium for plan years beginning in 2027 will be announced by the PBGC later this fall.

Cybersecurity and Data Privacy: 

• Plan sponsors should review (or adopt, if necessary) cybersecurity policies and procedures, confirm that plan service providers maintain adequate data security protocols, conduct periodic risk assessments, and provide timely breach notification. Department of Labor (DOL) cybersecurity guidance provides best practices for protecting participant data.

Service Provider Benchmarking: 

• Plan fiduciaries should periodically benchmark plan recordkeeper, investment management, and other service provider fees and services against the market. It is a best practice to engage in a formal request for proposal (RFP) process every three to five years.  

Summary Plan Description Updates and Summaries of Material Modification: 

• Whether any plan amendments adopted during the plan year require a Summary of Material Modifications (SMM) should be confirmed. SMMs must be distributed to participants within 210 days after the end of the plan year in which the change was adopted. Fully updated Summary Plan Descriptions (SPDs) must be furnished every five years (if plan amendments were made), or within ten years (if no plan amendments were made).

Missing Participants and Uncashed Checks: 

• Any uncashed distribution checks are handled in accordance with plan terms, DOL guidance, and other applicable laws.

Notices for Defined Contribution Plans

Discretionary Matching Contributions Notice – Annual Notice: 

• Adopters of pre-approved 401(k) plans that provide for discretionary matching contributions must notify participants that are eligible to receive the matching contribution. If the employer funds matching contributions annually, then the employer must provide the employee notice within 60 days after the matching contribution has been made to the plan. If the employer funds matching contributions less than annually (such as with every payroll, monthly, or quarterly), then the employer must provide the employee notice within 60 days after the last matching contribution has been deposited for the plan year. The notice requirement does not apply to sponsors of individually designed plans but may be considered a best practice.

Fee Disclosure: 

• As noted above, Plan fiduciaries must provide annual ERISA section 404(a)(5) fee disclosures to participants. Information on fees deducted from participants’ accounts also must be provided in quarterly statements.

QDIA Notice – Initial and Annual Notices: 

• The DOL Qualified Default Investment Alternative (QDIA) safe harbor regulations shield plan administrators from fiduciary liability with respect to default investments. Plans using QDIAs must provide notices to participants and beneficiaries that satisfy the regulations. An initial notice must be provided to newly eligible plan participants at least 30 days before such participants’ first investment in the QDIA. Plan administrators must also provide an annual notice at least 30 days in advance of each subsequent plan year. For calendar year plans, the annual notice must be provided by December 1, 2026.

 401(k) Plan Notices – Action Required 30 Days Before Plan Year: 

• Sponsors of 401(k) plans are required to notify participants at least 30 days before the beginning of the 2027 plan year if the following features will apply to the 401(k) plan for the 2027 plan year. The following notices must be issued to participants by December 1, 2026, for a calendar year plan:
  • 401(k) Safe Harbor Notice: Plan sponsors that intend to make safe harbor matching contributions for 2027 must provide a safe harbor notice to participants. The SECURE Act eliminated the notice requirement for plans that satisfy the safe harbor by making a nonelective contribution (e.g., a flat 3% of compensation contribution to all eligible plan participants).
  • QACA Notice: A Qualified Automatic Contribution Arrangement (QACA) is an automatic contribution 401(k) plan that is deemed to pass nondiscrimination testing. The QACA safe harbor requires annual increases to the automatic enrollment amount and safe harbor employer contributions.  
  • EACA Notice: An Eligible Automatic Contribution Arrangement (EACA) is another automatic enrollment feature that specifically permits a participant to withdraw automatic contributions made within 90 days after the first automatic contribution.  

Diversification Notice – Action Required 30 Days Before Direction: 

• Defined contribution plans that permit participants to elect to invest in publicly traded employer securities (e.g., a company stock fund) must provide participants with a notice of diversification rights. Plan administrators must distribute the notice at least 30 days before the first date on which a participant may direct the investment of the proceeds of employer securities.

Notices for Defined Benefit Plans

Benefit Statements – Action Required in 2027:

• Defined benefit plans are generally required to furnish participants with a pension benefit statement at least once every three years. A permissible alternative requires an annual notice notifying the participant of the availability of the pension benefit statement and how to obtain it.

Annual Funding Notice – Action Required in 2027 for 2026 Plan Year: 

• Within 120 days after the end of the plan year (April 30 for calendar year plans), defined benefit plans must provide the PBGC, participants, beneficiaries, unions, and contributing employers with detailed information about: (1) the funded status of the plan; (2) the plan’s investments; (3) the group covered by the plan; and (4) a description of the rules for terminating the plan. Plans with fewer than 100 participants must provide the notice by the due date for filing the plan’s annual return (Form 5500). Additional notice requirements apply if the plan is subject to benefit restrictions for being underfunded.

Considerations for Health and Welfare Benefit Plans

Gag Clause Prohibition Compliance Attestation Due December 31, 2026: 

• Group health plans may not enter into an agreement with a third-party administrator, a provider, a network of providers, or an entity offering access to a network of providers that includes a “gag clause.” A “gag clause” is a contractual term that restricts a health plan from sharing specific information with another party. Generally, plans may not enter into agreements that would prevent the disclosure of data or cost, quality of care, or certain other information to active or eligible participants, beneficiaries, enrollees, plan sponsors, or referring providers, or would restrict the plan from sharing such information with a business associate. Plans must submit an annual attestation of compliance through the Center for Medicare and Medicaid Services (CMS) web portal. The attestation is due by December 31 of every year. The attestation is made online here.

Cafeteria Plan Amendments:

• Amendments to Code section 125 cafeteria plans must be prospective. Any changes to a calendar year plan for the 2027 plan year, such as benefit options, must be adopted by December 31, 2026.

Nondiscrimination Testing: 

• Nondiscrimination testing should be performed. Such testing includes:
  • Code section 125 testing for cafeteria plans;
  • Code section 79 testing for group term life insurance;
  • Code section 129 testing for dependent care assistance flexible spending arrangements; and
  • Code section 105(h) testing for self-insured health plans.

Mental Health and Substance Use Disorder Benefit Parity: 

• Enforcement of the Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) regulations issued in 2024 has been paused due to ongoing litigation. Plans still must comply with the MHPAEA requirements in effect prior to the final regulations. These requirements include having a “comparative analysis” demonstrating parity with respect to nonquantitative treatment limitations (NQTL). Plan sponsors should confirm that they have an NQTL comparative analysis in case a participant or the DOL requests it.  

Prescription Drug Data Collection (RxDC) and Health Care Cost Reporting: 

• Pharmacy Benefit and Drug Costs Reporting (RxDC Reporting) is a reporting requirement implemented under the Consolidated Appropriations Act, 2021 (CAA). Group health plans and health insurance issuers offering group, individual, and self-funded health insurance coverage, as well as student health plans, must report information about prescription drugs and healthcare spending through the CMS web portal. Reporting instructions are found here.  

Reporting Health Plan Coverage to the IRS and Employees: 

• Code section 6056 requires Applicable Large Employers to report information about employer-sponsored health coverage to the IRS and employees. An Applicable Large Employer is an employer that employs at least 50 full-time employees, including full-time equivalent employees. In addition, sponsors of self-insured health plans that provide minimum essential coverage must file an annual return with the IRS and provide statements to employees. Returns are due to the IRS by March 31, 2027, and must be filed electronically. Statements to employees are generally due January 31, 2027 (no later than March 1, 2027). Legislation enacted at the end of 2024 established an alternative method of providing the employee statements. A Form 1095-C is deemed to be timely provided if the employer:
  • Provides notice to employees that they may request a copy of the Form 1095-C.
  • Provides the requested Form 1095-C by the later of:
    • January 31 of the year following the calendar year for which the information return was required to be filed; or
    • 30 days following the date of the individual’s request.

Patient-Centered Outcomes Research Institute (PCORI): 

• The PCORI fee applicable to health insurers and self-insured health plan sponsors is paid using IRS Form 720 and is due by July 31 of the calendar year following the last day of the plan year. The PCORI fee is based on the average number of covered lives during the plan year. The current fee for plans with plan years ending before October 1, 2026, is $3.84 per covered life.

Transparency in Coverage: 

• Group health plans and issuers must disclose (i) cost-sharing information for a covered item or service from specific providers to participants and beneficiaries through an internet self-service tool, and (ii) pricing information to the public through three machine-readable files. Disclosure must include payment rates between plans or issuers and providers, the unique allowed amounts a plan or issuer used and associated billed charges for out-of-network providers, and pricing information for prescription drugs. Sponsors of self-insured plans should coordinate compliance with their third-party administrators.

Fee Disclosure: 

• Under the CAA, “covered service providers” to group health plans must disclose to the plan’s fiduciary the direct and indirect compensation that the covered service provider expects to receive from providing services to the plan. Covered service providers include persons who provide “brokerage services” or “consulting” to ERISA-covered group health plans and reasonably expect to receive $1,000 or more in direct or indirect compensation in connection with providing those services. Before entering into, extending, or renewing a service agreement with a covered service provider, plan fiduciaries should ask to see the ERISA section 408(b)(2) disclosure.

Notice for No Surprises Act: 

• Group health plans and insurers were required to provide the initial notice regarding patient rights under the No Surprises Act by January 1, 2022. The annual notice must be made publicly available, posted on the plan’s website, and included in explanations of benefits. The government provided a model notice to meet the disclosure requirements that can be used to ensure good-faith compliance with the disclosure requirement. The model notice can be found here.

ACA Affordability Requirements: 

• The IRS increased the ACA affordability percentage for 2027 to 10.22%. To meet the ACA affordability requirement in 2027 and avoid associated employer assessments, Applicable Large Employers must offer at least one health plan option where employee-only coverage is less than 10.22% of the employee’s household income. Certain safe harbors apply for determining an employee’s household income for this purpose.

Medicare Part D Notices: 

• Employers offering group health plans providing prescription drug coverage to individuals who are eligible for Medicare must provide a notice of creditable or non-creditable coverage to such individuals before October 15 of each year. Such employers are also required to disclose to CMS whether their prescription drug coverage is creditable within 60 days after the beginning of the plan year.  Disclosure to CMS is made through the CMS creditable coverage disclosure webpage.

Student Loan Repayment Plans: 

• The One Big Beautiful Bill Act made permanent the ability of employers to offer up to $5,250 in tax-free student loan assistance under a Code section 127 education assistance program. The student loan repayment plan must be operated pursuant to a written plan document.

Summary of Benefits and Coverage: 

• Insurers and group health plans must provide a Summary of Benefits and Coverage (SBC) for each coverage option offered by the insurer or plan. Participants who enroll mid-year must be provided an SBC within 90 days of enrollment. The SBC should be provided at the beginning of open enrollment each year if renewal is not automatic or at least 30 days before the beginning of each plan year if renewal is automatic. Plans also must provide 60 days’ notice of changes to the content of an SBC.

HIPAA Notice of Privacy Practices: 

• The deadline to update self-insured group health plan notices of privacy practices to conform to new regulations regarding the treatment of substance abuse disorder treatment information was February 16, 2026. Employers who have not yet updated their notices should do so as soon as possible and verify that web postings and participants notices were updated and distributed as required. Health plans must remind enrollees of the availability of HIPAA Notice of Privacy Practices at least once every three years.

HIPAA Business Associate Agreements: 

• HIPAA business associate agreements with plan service providers that access protected health information should be reviewed to confirm compliance with the HIPAA Privacy and Security Rule and updated as applicable.

Wellness Program Compliance: 

• Plan sponsors should review wellness programs for compliance with ADA, GINA, HIPAA nondiscrimination, and ACA wellness program rules and confirm that any incentive-based program complies with applicable requirements regarding voluntary participation, reasonable alternatives, and notice.

COBRA Notices and Administration: 

• Plan sponsors should review COBRA election notices, qualifying event procedures, and vendor administration to confirm compliance with DOL model notices and coordinate with third-party administrators to ensure timely processing.

State and Local Leave/Benefits: 

• Employers should confirm compliance with applicable state and local paid leave, state continuation coverage (mini-COBRA), and other state-mandated benefit requirements in all jurisdictions where the employer has employees.

Annual Notices for Group Health Plans: 

• In addition to the notices described above, employers must continue to provide participants with the following annual group health plan notices:
  • Children’s Health Insurance Program Reauthorization Act Notice
  • Women’s Health and Cancer Rights Act Notice
  • Newborns’ and Mothers’ Health Protection Act Notice
  • Primary Care Provider Patient Protection Notice
  • ADA Wellness Program Notice
  • HIPAA Special Enrollment Notice

Stock-Based, Executive, and Director Compensation

ISO Exercises and ESPP Share Transfer Reporting: 

• Employers whose employees exercised an incentive stock option (ISO) in 2026 or made an initial transfer in 2026 of shares acquired under an employee stock purchase plan (ESPP) within the meaning of Code section 423 are subject to information reporting. Employers will report information to employees and the IRS relating to ISO exercises and initial transfers of ESPP shares on IRS Forms 3921 and 3922. The IRS filing deadline is March 1, 2027 (paper filing), or March 31, 2027 (electronic filing). Employers must provide this year’s employee statements by February 1, 2027. Note that these filings apply to all companies offering ISOs or an ESPP, not just publicly traded employers.

FICA Taxation of Nonqualified Deferred Compensation Plans: 

• Nonqualified deferred compensation plans are subject to special rules on the timing of Federal Insurance Contributions Act (FICA) taxation. In general, amounts deferred are taken into account in the year those amounts are first vested, rather than at the time of payment. This rule often results in a smaller portion of the deferred benefit being subject to Social Security and (depending on plan design) Medicare taxes than would be the case if taxes were withheld and paid upon distribution. A number of factors affect the amount of compensation taken into account for a given year, and the proper year of taxation must be carefully assessed in the case of defined benefit-type nonqualified plans. Employers have until December 31, 2026, to withhold and pay FICA taxes on compensation deferrals that are subject to this rule in 2026.

Nonqualified Plan Deferral Elections for 2027 Compensation: 

• Elections to defer compensation earned in 2027 must be completed by December 31, 2026, absent very limited exceptions. If a company plans to rely on any exception to the December 31, 2026, deadline, legal counsel should be consulted before year end.

For Deferred Compensation That Vests in 2027 or Later Years, Review and Correct any Code section 409A Violations: 

• Employers should review all nonqualified deferred compensation plans or agreements, under which compensation vests in 2027 or later years, to ensure that there are no Code section 409A violations. If employers identify the violation before the end of 2026, then documentary violations with respect to unvested amounts generally can be corrected by December 31, 2026, without penalties. Code section 409A corrections should correspond to methods described in formal guidance and should be reviewed by legal counsel.

Identify 2027 Specified Employees Under Code section 409A: 

• Unless a different identification period has been elected, publicly traded employers must identify individuals who were specified employees in the 12-month period ending on December 31, 2026. Specified employee status for these individuals applies for the 12-month period beginning April 1, 2027. If an employer intends to change their specified employee determination and effective dates, legal counsel should be consulted.

Deduction Limits Under Code section 162(m): 

• Code section 162(m) limits the deductibility of compensation in excess of $1 million paid to certain officers of a publicly traded employer. Changes enacted in 2025 under the One Big Beautiful Bill Act replaced the affiliated group and deduction limitation allocation rules for tax years beginning after December 31, 2025. The American Rescue Plan Act of 2021 (ARPA) added five additional employees to the group for whom a compensation deduction is limited, reaching any employee (not limited to officers) who is among the five highest-compensated employees for the taxable year, other than individuals already covered under Code section 162(m) as amended in 2017. ARPA’s changes are effective for taxable years beginning after December 31, 2026. Companies should evaluate the specific impact of these changes on a company’s affiliate structure and covered employee list and consult with counsel as needed. 

Evaluate Remaining Share Reserve and Expiration Date for Equity Plans: 

• A publicly traded company should determine whether the remaining share reserve under its equity compensation plans is sufficient for grants planned through 2027 and, ideally, 2028. If not, the company should begin preparing now for share increase and other amendments that may be necessary or desirable. Share increases and certain other changes are required to be approved by shareholders under New York Stock Exchange and Nasdaq Stock Market listing requirements and under tax rules relating to ISOs, where ISOs are offered under a plan. The company should consider both the timing of its annual meeting and its regular grant schedule as part of this planning. Similarly, steps should be taken to adopt and obtain approval of a plan amendment or new plan, as applicable, for plans expiring in 2027 or 2028, if continued operation of the program is desired. 

This checklist contains general, condensed summaries of actual legal matters, statutes, and opinions for information purposes. It is not meant to be and should not be construed as legal advice. Individuals with particular needs on specific issues should retain our services or the services of other competent counsel.