Organizations assess their employment compliance posture by asking whether their policies are current. It is the wrong question, or at least an insufficient one, because it treats compliance as a property of documents rather than as a claim the organization may one day be required to substantiate. The relevant question is narrower and harder. If an agency, a plaintiff’s counsel, or an acquirer asked the organization to demonstrate that a specific obligation was met with respect to a specific person on a specific date, could it produce the record?
An asymmetry that governance programs rarely model
The distance between those two questions is where most employment risk now accumulates. An organization can hold a policy suite that is substantively correct in every particular and still be unable to establish that any individual received the required notice, acknowledged the required disclosure, or was afforded the required opportunity. Substantive compliance and demonstrable compliance are separate capabilities, supported by different infrastructure, and only one of them is produced by a policy review.
Substantive compliance and demonstrable compliance are separate capabilities.
The asymmetry has become more consequential because the character of employment regulation has shifted. A significant share of recently enacted obligation is procedural rather than substantive. It does not tell the employer what decision to reach. It tells the employer what must be disclosed, to whom, within what interval, and by implication what must be capable of proof afterward. Obligations of that shape generate evidence requirements as their primary compliance surface. A policy document can state that the organization will comply. It cannot demonstrate that the organization did.
Obligations that generate records rather than rules
The pay transparency statutes taking effect across 2025 illustrate the pattern with unusual clarity, and they illustrate it in a domain most organizations classify as a posting-format question rather than a governance question.
The Illinois amendment to the Equal Pay Act, effective January 1, 2025, applies to employers with fifteen or more employees nationwide and requires that job postings include a pay or salary range together with a general description of benefits and other compensation. That much is a policy and template matter, correctable in a single revision cycle. The provision that is not correctable in a revision cycle appears alongside it: within fourteen days after an employer makes an external posting for a position, the employer must announce, post, publish, or otherwise make known the promotion opportunity to current employees. The statute also reaches postings for promotion and transfer, not solely for external hiring.
Consider what that obligation actually requires an organization to be able to produce. Not a policy stating that internal notification occurs, but a per-posting, date-stamped record establishing that a particular external posting was made on a particular date and that the corresponding internal announcement issued within the ensuing fourteen days, for every covered posting, retained for the applicable limitations period. No policy document generates that record. No annual policy review detects its absence. An organization with an exemplary internal mobility policy and no posting-level audit trail has satisfied the question it asked itself and failed the question that would be asked of it.
The pattern repeats across the 2025 cohort. Minnesota’s requirement took effect the same day as Illinois, applies at a thirty-employee threshold, and expressly prohibits open-ended ranges, which converts a drafting habit into a violation. New Jersey’s took effect June 1, 2025 at a ten-employee threshold. Vermont’s follows on July 1, 2025 at a five-employee threshold, the lowest among the states requiring posting disclosure. Massachusetts phases in later in the year. Each of these sits atop the earlier statutes in California, Colorado, New York, Washington, Maryland, and elsewhere, and the earlier statutes have not stood still.
Why currency decays faster than review cycles detect
Three features of this regulatory environment defeat the annual or biennial policy review as a control.
The first is threshold heterogeneity. The 2025 statutes alone set coverage at five, ten, fifteen, and thirty employees, and they count differently, some by employees in the state and some by employees nationwide. An organization’s coverage status is therefore a function of headcount composition rather than of headquarters location, and it changes without any deliberate act. Growth across a state line, or a single remote hire, can bring an employer within a regime it did not evaluate at the last review. Nothing in the organization signals that this has occurred.
The second is jurisdictional reach through remote work. Several of these statutes apply to positions that may be performed within the state, irrespective of where the employer is located. A remote posting is consequently a posting in every jurisdiction from which the role could be performed, which means the compliance surface of a single requisition is determined by the geographic scope the organization advertised rather than by where it intended to hire. Organizations rarely document that scope decision, and so cannot reconstruct it later.
The third is that the obligations attach to events rather than to periods. A policy is a standing artifact and can be reviewed on a schedule. A fourteen-day internal notification obligation attaches to each posting individually. Compliance is therefore not a state the organization occupies between reviews. It is a series of discrete performances, each of which either produced a record or did not, and the aggregate cannot be established retroactively.
The consequence is that an organization reviewing its policy stack on an eighteen-month cycle is not merely behind on content. It is measuring the wrong object. The policy may have been correct throughout the interval while the evidentiary record was accumulating gaps that the review is not designed to see and that no subsequent correction can repair.
Attestation and version control as evidentiary instruments
Employee acknowledgment and document version control are ordinarily treated as administrative housekeeping. They are more accurately understood as the instruments through which an organization’s substantive compliance becomes provable, and they should be specified with that function in view.
An acknowledgment establishes something specific: that a named individual was presented with an identified version of a document on a recorded date. Each of those three elements is load-bearing, and acknowledgment systems commonly capture only the first and the third. Where the organization cannot establish which version of a policy an employee acknowledged, the acknowledgment establishes that the employee acknowledged something, which is materially weaker than the record the obligation contemplates and may be weaker than no record where the versions differ in the relevant provision. Version control is therefore not a document management convenience. It is the element that makes the attestation evidentiary rather than merely administrative.
Retention discipline operates on the same logic. Federal recordkeeping regulations under Title VII and the Americans with Disabilities Act (ADA) require preservation of personnel and employment records for a defined period following the making of the record or the personnel action, with the obligation extending where a charge has been filed. State obligations layer on top with their own intervals. The practical effect is that an organization’s evidentiary capability has a defined half-life, and records not systematically retained at the moment of creation are generally not recoverable at the moment of need.
Governance implications
The operative recommendation is that employment compliance be assessed against evidentiary capability rather than against policy currency, and that the assessment be structured as a production test rather than as a document review.
The test is straightforward to specify and uncomfortable to run. Select a small number of covered events from the preceding twelve months, a promotion posting in a jurisdiction with an internal notification requirement, a policy revision requiring acknowledgment, a disclosure with a statutory interval attached. For each, attempt to produce the complete record: the version in force, the individuals to whom it applied, the date of transmission, the date and form of acknowledgment, and the retention location. Where the record cannot be assembled, the finding is not that the policy is deficient. The finding is that the organization cannot demonstrate compliance it may well have achieved, which is the exposure that matters.
Coverage determination should be maintained as a monitored condition rather than a periodic finding. Because thresholds turn on headcount and geography and both change without deliberate action, the organizational trigger for reassessment should be the hire or the posting rather than the calendar. Requisition workflows are the natural control point, since the jurisdictional scope of a posting is determined there and can be recorded there at negligible cost.
Acknowledgment infrastructure should bind the individual, the document version, and the date as a single record, and version control should be treated as a compliance system rather than as a feature of the document repository.
The broader point is continuous with the analysis of automated employment decision systems published in this series in May. In both cases the governing instruments impose obligations that are procedural in form and evidentiary in substance, and in both cases organizations have built toward the appearance of compliance while under-building the capability to demonstrate it. The distinction between procedural and evidentiary assurance is not academic. It is the distinction between a defensible position and a position that merely looks defensible until it is examined.
References
- Illinois Equal Pay Act of 2003, as amended by Public Act 103-0539, effective 1 January 2025, and Illinois Department of Labor guidance thereunder.
- Minnesota Statutes § 181.173, effective 1 January 2025.
- New Jersey P.L. 2024, c. 91, effective 1 June 2025.
- Vermont Act 155 (2024), effective 1 July 2025.
- Massachusetts An Act Relative to Salary Range Transparency, St. 2024, c. 141.
- 29 C.F.R. Part 1602 (Title VII recordkeeping); 29 C.F.R. Part 1602.14 (retention of personnel records).
- Novara Consulting Group, “The Development Exception: Internal Mobility Platforms and the Perimeter of Employment AI Governance,” May 2025.