ERISA basics for small employers: what the law requires of your benefit plans

The Employee Retirement Income Security Act of 1974 (ERISA) governs most employer-sponsored benefit plans in the private sector, including group health, life, disability and retirement plans. It applies regardless of employer size. If you offer one of these benefits, you are probably a plan sponsor and plan administrator with duties to write the plan down, tell employees what it provides, report on it, run it in their interest, and be personally liable when you do not.

What is an ERISA plan

ERISA has two parts that matter to employers. Title I covers pension plans (such as 401(k) plans) and welfare benefit plans: medical, dental, vision, prescription, life, accidental death, disability, severance and similar benefits. A plan exists if there is an employer program, a reasonably ascertainable benefit, a source of funding and a procedure for claims, and the employer has some discretion in setting it up. Buying a group policy for employees is usually enough.

Excluded from ERISA Title I are governmental plans, church plans that have not elected coverage, and plans maintained solely to comply with workers' compensation, unemployment or disability laws, such as New York's statutory disability benefit. Plans for owners alone, without common-law employees, generally do not qualify. A narrow safe harbor in Department of Labor regulations exempts "voluntary" benefits paid entirely by employees where the employer only allows the insurer to market and collect premiums through payroll, without endorsing the product. An employer who contributes to the premium, selects the product or promotes it more actively can lose the exemption. See voluntary benefits: what they are and how they work for that distinction.

State insurance law and ERISA interact. A fully insured plan is regulated indirectly through the insurance contract. A self-funded health plan is generally outside state insurance mandates because of ERISA preemption, and that is part of why employers consider it (fully insured vs self-funded health plans: which fits your business).

The core documents

1. Plan document. A written instrument that names the fiduciaries, funding, amendment procedure and benefits. An insurance policy or certificate does not satisfy the requirement on its own because it does not describe the employer's responsibilities. A "wrap document" attaches to the insurance certificate and covers what the policy omits.
2. Summary plan description (SPD). A plain-language description of the plan, given to participants within 90 days of becoming covered, or 120 days after a new plan is established. It should explain eligibility, benefits, claim and appeal procedures, the plan year and the right to sue under ERISA. An insurer's certificate often works as the SPD if it has the required content, but many do not.
3. Summary of material modifications (SMM). When the plan changes materially, notify participants within 210 days after the plan year in which the change was adopted (60 days for a reduction in covered services or benefits in a group health plan).
4. Summary annual report and Form 5500. Welfare plans with 100 or more participants file an annual report with the Department of Labor (form 5500 for health and welfare plans: who files and when) and give participants a summary of it.
5. Claims procedures. ERISA regulations require a reasonable claims and appeals process, with deadlines for decisions. For group health plans, urgent care claims must generally be decided within 72 hours, pre-service claims within 15 days and post-service claims within 30 days, subject to extensions. Denials must state the reason and the appeal rights.

Who is a fiduciary, and what the duties are

A fiduciary is anyone who exercises discretionary authority over a plan's management or assets, or who gives investment advice for a fee. For a small employer's welfare plan the owner or HR lead who picks the carrier, approves claims and decides what to pay for is usually a named or functional fiduciary, even without the title.

ERISA section 404 requires fiduciaries to act solely in the interest of participants and for the exclusive purpose of providing benefits and paying reasonable plan expenses, with the care of a prudent expert, and in accordance with plan documents. Fiduciaries are personally liable to restore losses caused by a breach. Co-fiduciaries can be liable for each other's breaches in some circumstances. The prohibited transaction rules (ERISA section 406) bar self-dealing and transactions with parties in interest, with statutory exemptions. In Cunningham v. Cornell University (U.S., April 17, 2025), the Supreme Court held those section 408 exemptions are affirmative defenses that defendants must prove, which makes prohibited-transaction claims easier to bring (opinion).

Participant contributions

Employee salary deferrals and premium contributions are plan assets as soon as they can reasonably be separated from the employer's general assets. Withholding premiums and then using the money for payroll is a common source of DOL enforcement against small employers. Deposit contributions promptly, and for insured premiums, remit to the carrier on time.

Selecting and monitoring vendors

Choosing a carrier, a third-party administrator, a broker or a PEO is a fiduciary act. The process matters: compare alternatives, document why you chose one, check fees and compensation disclosures, and review them periodically. See group health insurance for small businesses: how it works and what it costs for a buying process.

Bonding and insurance

ERISA section 412 requires every person who handles plan funds to be bonded, generally for at least 10% of the funds handled, with a $1,000 minimum and a $500,000 maximum per plan official ($1 million for plans that hold employer securities), according to DOL Field Assistance Bulletin 2008-04. The bond is a fidelity bond that covers loss from fraud or dishonesty by the person who handles funds; it is not fiduciary liability insurance. The bond has no deductible and the surety must be on Treasury Circular 570. Plans that are unfunded and only pay benefits from the employer's general assets are generally exempt from the bonding requirement; see ERISA fidelity bonds vs fiduciary liability insurance and employee theft coverage and fidelity bonds: what they cover and who needs one.

fiduciary liability insurance for employee benefit plans is a separate, optional product that responds to claims alleging breach of fiduciary duty and pays defense costs. ERISA does not require it, but fiduciaries are personally exposed, and an ordinary CGL or D&O policy may exclude ERISA claims. Wrongful acts in administering a plan, such as miscounting a deduction or failing to enroll someone, are the kind of mistake Employee benefits liability coverage: insuring HR administration errors addresses, usually as an endorsement to a general liability policy and not as a replacement for fiduciary coverage.

Other federal laws that sit on top of ERISA

ERISA is the base layer for other benefit rules enforced by the DOL, the IRS and HHS, including COBRA continuation coverage (COBRA continuation coverage: what employers must do), the Affordable Care Act's reporting and mandate rules (The ACA employer mandate: who must offer coverage and the 2026 penalties and ACA reporting: Forms 1094-C and 1095-C for large employers), mental health parity (mental health parity rules for employer health plans in 2026), HIPAA privacy and portability, and the requirement to provide a summary of benefits and coverage. A Section 125 plan adds IRS requirements. Multiple employer welfare arrangements must file Form M-1 with the DOL (Association health plans and MEWAs: what small employers need to know).

Penalties and enforcement

The DOL's Employee Benefits Security Administration investigates plans and can assess civil penalties. For 2026 the DOL held its penalty amounts at their 2025 levels, according to Mercer's summary of the agency's table (see Mercer). The amounts most employers meet are:

Participants can sue under ERISA section 502 to recover benefits, enforce rights or seek removal of a fiduciary. Courts often review a claim denial deferentially if the plan gives the administrator discretion, so the plan language matters. State law claims for improper claim processing are often preempted, which narrows remedies, but fiduciary breach claims are not.

A short compliance routine

1. Inventory every plan: medical, dental, vision, life, disability, FSA, HRA, EAP, severance.
2. Confirm each has a plan document and an SPD, and store them where you can find them.
3. Calendar annual tasks: Form 5500 (July 31 for calendar-year plans), notices at open enrollment, SMMs, bond review.
4. Document your vendor selection and annual review.
5. Remit employee contributions on time.
6. Ask your broker whether the entity holds fiduciary liability coverage and how the ERISA bond is written.
7. Watch state rules too; paid leave and disability mandates run alongside, not under, ERISA (state disability and paid family leave programs: every mandate in 2026).

Key takeaways

• ERISA applies to nearly every private-employer health, life and disability plan, regardless of size, and the employer is usually the plan sponsor, administrator and fiduciary.
• You need a written plan document, an SPD, a claims procedure, notices of changes and, at 100 or more participants, a Form 5500.
• Fiduciaries are personally liable for breaches, so document how you chose and monitor vendors and remit contributions promptly.
• The ERISA bond (10% of funds handled, $1,000 minimum, $500,000 maximum per official) is mandatory for those who handle funds; fiduciary liability insurance is optional and protects against a different risk.
• The DOL kept ERISA penalty amounts at 2025 levels for 2026, including up to $2,739 per day for a late Form 5500.