401(k) auto-enrollment rules for small employers
Automatic enrolment moved from an option to a requirement for most new plans. Two separate sets of rules use the phrase, they have different percentages, and only one of them is mandatory — which is where most of the confusion comes from.
Most private-sector 401(k) plans established after the SECURE 2.0 enactment date must enrol employees automatically for plan years beginning after 2024, at a default of at least 3% escalating to between 10% and 15%.
Two different rules are both called automatic enrolment. One is a mandate that applies to most new plans. The other is a voluntary safe harbor design with its own numbers. They are frequently mixed up, and the percentages are close enough that mixing them up is easy and consequential.
The mandate: section 101 of SECURE 2.0
Section 101 requires most private-sector defined contribution plans established after December 29, 2022 to include automatic enrolment, for plan years beginning after December 31, 2024.
Plans that are subject to it need a default contribution level of at least 3%, and an automatic escalation provision of 1% per year to a level of at least 10% and no more than 15%.
Two exemptions cover a large share of small employers. Plans sponsored by an employer with 10 or fewer employees, and plans sponsored by an employer that has been in business for fewer than three years, are exempt. Plans that already existed on or before the enactment date are unaffected entirely — this is a rule about new plans.
If you are exempt today, it is worth knowing how the exemption behaves as you grow. An employer under the headcount threshold now will eventually cross it, and an employer under three years old will not be. Neither exemption is permanent, and the design question is easier to answer before the rule reaches you than after.
The other one: QACA
A qualified automatic contribution arrangement is a safe harbor design that happens to use automatic enrolment. It is voluntary. Its numbers are different: graduated defaults starting at 3% and increasing to 6%, capped at 10%, together with mandatory employer contributions — either a match or a non-elective contribution of 3%.
| SECURE 2.0 §101 mandate | QACA safe harbor | |
|---|---|---|
| Is it required? | Yes, for most plans established after the enactment date, for plan years beginning after 2024. | No. It is a design an employer chooses. |
| Default contribution | At least 3%. | Starts at 3%, graduating upward. |
| Escalation | 1% per year. | Increases to 6%. |
| Ceiling | At least 10%, no more than 15%. | Capped at 10%. |
| Employer contribution | Not required by this rule on its own. | Required — either a match or a non-elective contribution of 3%. |
| What it buys | Compliance with the mandate. | Safe harbor status, which removes the annual ADP test. |
These are two different rules that share a name. A plan can be subject to the mandate without being a QACA, and a QACA is not automatically the way to satisfy the mandate.
The other automatic contribution arrangements
Beyond QACA there are two further arrangements worth knowing by name, because plan documents use the terms.
- Basic ACA — employees are automatically enrolled in the plan unless they elect otherwise. The simplest form.
- EACA — an eligible automatic contribution arrangement, which applies default deferral percentages uniformly and gives employees a 90-day window to withdraw automatic contributions and their earnings. That withdrawal window is the distinguishing feature, and it materially reduces the friction of an employee who was enrolled without meaning to be.
What automatic enrolment obliges you to do
Whichever arrangement applies, the mechanics carry obligations. Employers must give employees notice before deferrals begin, allow employees to opt out, select qualified default investments for money that arrives without an investment election, and let employees change those investment choices.
That default investment choice is the one most often treated as an afterthought. Money contributed by someone who never made an election still has to be invested somewhere, and choosing where is a fiduciary act with a standard attached — not an administrative default.
Why it works, and the honest caveat
Automatic enrolment raises participation among employees who would not otherwise have enrolled, which is its point. It also has a useful side effect: because the ADP test depends on how much rank-and-file employees actually save, higher participation makes that test easier to pass. Where a plan is not a safe harbor, this is one of the few levers an employer has over a test it cannot otherwise control.
The caveat is that automatic enrolment is not consent, and it works best when the notice is genuinely readable and the opt-out is genuinely easy. An employee who discovers a deduction they did not expect is a worse outcome than one who declined on purpose — and the EACA withdrawal window exists precisely because that happens.
Common questions
Does my new 401(k) have to include automatic enrollment?
Most private-sector plans established after December 29, 2022 must, for plan years beginning after December 31, 2024. Plans sponsored by employers with 10 or fewer employees and by employers in business fewer than three years are exempt, and plans that already existed are unaffected.
What default contribution percentage does the mandate require?
At least 3%, with an automatic escalation provision of 1% per year to a level of at least 10% and no more than 15%.
How is a QACA different from the automatic enrollment mandate?
A QACA is a voluntary safe harbor design, not a requirement. Its defaults start at 3% and increase to 6%, capped at 10%, and it requires an employer contribution — either a match or a non-elective contribution of 3%. In exchange it removes the annual ADP test, which the mandate on its own does not.
What is an EACA?
An eligible automatic contribution arrangement. It applies default deferral percentages uniformly and gives employees a 90-day window to withdraw automatic contributions and their earnings — which is its distinguishing feature and a useful remedy for an employee enrolled without meaning to be.
What does an employer have to do when a plan enrolls automatically?
Give employees notice before deferrals begin, allow them to opt out, select qualified default investments for contributions that arrive without an investment election, and let employees change those choices. Choosing the default investment is a fiduciary act, not an administrative default.
Sources
- Congressional Research Service, Defined Contribution Retirement Plans: Automatic Enrollment — the SECURE 2.0 §101 requirement, which plans it applies to, the effective date, the default of at least 3% escalating 1% per year to between 10% and 15%, and the 10-or-fewer-employees and under-three-years exemptions
- Internal Revenue Service, Retirement Topics — Automatic Enrollment — the basic ACA, the EACA and its 90-day withdrawal window, the QACA graduated defaults starting at 3% increasing to 6% and capped at 10% with a required match or 3% non-elective contribution, and the employer's notice, opt-out and default-investment obligations
- Internal Revenue Service, 401(k) Plan Overview — that the ADP test depends on rank-and-file deferral rates, and that safe harbor designs remove it
- Internal Revenue Service, Retirement Plans Startup Costs Tax Credit — the separate $500 per year credit for a three-year period beginning with the first taxable year an employer includes an auto-enrollment feature
aipep401k.com is a pooled employer plan for small business 401(k) plans, operated by ThinkNirvana Foundation — plan administration handled by automation rather than assembled by hand.
Related: the credits for adding auto-enrollment, how a QACA relates to safe harbor status. To see what a plan design would look like for your own headcount, the plan design tool is free and needs no sign-up.