Last updated: January 2025. Requirements verified January 2025 — state rules change often; verify with the named agency before committing.
Methodology: This guide maps each obligation to the level of government that administers it (federal or state), ranked by where the rule is actually set and enforced — not by how often it appears in generic online advice. Sources are dated, non-vendor authorities (IRS, EEOC, NCSL, IAPP). Verify current rules with your state agency and the IRS before acting; requirements change.
🎯 Only a small set of small business rules are federal in the US, including federal income tax (IRS), federal anti-discrimination law (EEOC) once you cross employee thresholds, immigration verification (Form I-9), and OSHA workplace safety. The larger share, including workers' compensation, most consumer privacy statutes, professional licensing, sales tax, and business registration, is state-administered and varies by state. The rule of thumb: money and hiring paperwork tend to be federal, while operating permissions and worker protections tend to be state.
TL;DR
- 4 buckets are reliably federal: IRS income and payroll tax, EEOC discrimination law (15+ employees for Title VII), Form I-9 employment eligibility, and OSHA safety standards.
- At least 5 major buckets are state-administered: workers' comp, sales/use tax, business entity registration, professional licensing, and most privacy laws (California, Colorado, Virginia, Connecticut, Utah, Texas and others).
- General liability and most business insurance is not federally mandated, but workers' comp is required by nearly every state (Texas is the main exception).
- The compliance failure mode: assuming a rule you read online is nationwide when it is actually per-state. Verify against the state agency, not a blog.
Definition: federal vs state business compliance
Federal vs state business compliance is the mapping of each obligation a US small business carries to the level of government that administers it: the federal government (uniform nationwide) or a state government (varying by state). A "state-administered business obligation" is any requirement whose rules, thresholds, filing addresses, and penalties are set and enforced by a state agency rather than a federal one. The distinction matters because a single business change — hiring your first employee, taking your first out-of-state client, storing customer data — can trigger a federal obligation, a state obligation, or both at once, and the answer is different in Delaware than it is in California.
Most compliance content gets this wrong by stating a "US rule" that is really a California rule or a New York rule. That is the category error this page exists to correct.
Why this distinction matters more now than five years ago
The gap is real: since 2018, state-level obligations have multiplied faster than federal ones. In 2018 exactly one US state (California) had a comprehensive consumer privacy law. By early 2025, roughly a dozen states have enacted comprehensive privacy statutes now in effect, each with its own thresholds, definitions of "sale," and cure periods, per the IAPP US State Privacy Legislation Tracker (updated 2025). For a 2- to 20-person business, that means the same customer-data practice can be lawful in one state and a violation in the next.
The four federal buckets
These obligations are set by federal agencies and apply the same way in every state, though state versions may add stricter overlays.
- Federal income and payroll tax (IRS). Every business files federal income tax; employers also withhold and remit payroll taxes (Social Security, Medicare, federal unemployment). Rules and forms are published by the Internal Revenue Service (accessed January 2025).
- Anti-discrimination law (EEOC). Title VII, the ADA, and related statutes are enforced by the U.S. Equal Employment Opportunity Commission. Coverage thresholds matter: Title VII and the ADA generally apply at 15+ employees, the ADEA at 20+. Below those counts, a state civil-rights law may still apply.
- Form I-9 employment eligibility. Every employer must verify work authorization for each new hire using Form I-9, administered by U.S. Citizenship and Immigration Services. This is uniform nationwide.
- OSHA workplace safety. Federal safety standards apply broadly, though about half the states run OSHA-approved state plans that meet or exceed federal rules.
The state-administered buckets
These vary by state in thresholds, filings, and penalties. Always confirm with the named state agency.
- Workers' compensation. Required by nearly every state once you have employees; rules and exemptions differ by state, and Texas is the main exception where private coverage is generally optional. See the National Conference of State Legislatures for state-by-state labor references (accessed January 2025).
- Sales and use tax. Rates, nexus thresholds, and filing cadence are set per state (and often per locality). Selling into a new state can create a filing obligation there.
- Business entity registration. LLCs and corporations register with a state agency (usually the Secretary of State), with fees and annual reports set by that state.
- Professional licensing. Trades and professions (contractors, cosmetologists, accountants, and many others) are licensed at the state level, sometimes with reciprocity, sometimes not.
- Consumer privacy. Comprehensive privacy laws are state statutes with differing thresholds and definitions; track status via the IAPP tracker cited above.
The rule of thumb, restated
Money and hiring paperwork (tax, payroll, I-9, federal discrimination law) tend to be federal and uniform. Operating permissions and worker protections (registration, licensing, sales tax, workers' comp, privacy) tend to be state and variable. When you read "the US rule," ask: is this actually a single state's rule reprinted as national? Verify against the state agency or the IRS directly.
FAQ
Is workers' compensation a federal or state requirement? It is state-administered. Nearly every state requires it once you have employees, with Texas as the main exception where private coverage is generally optional. Confirm with your state's workers' comp agency.
At how many employees does federal anti-discrimination law apply? Title VII and the ADA generally apply at 15 or more employees; the ADEA applies at 20 or more. Below those thresholds, a state civil-rights statute may still cover you.
Are consumer privacy laws federal in the US? As of January 2025 there is no single comprehensive federal privacy law. Roughly a dozen states have enacted comprehensive privacy statutes now in effect, each with its own thresholds and definitions.
Which business rules are the same in every state? Federal income and payroll tax (IRS), Form I-9 employment eligibility, EEOC anti-discrimination law (above employee thresholds), and OSHA safety standards are federal and apply nationwide, though states may add stricter overlays.
Note: This guide maps obligations by level of government; it is not legal or tax advice. Verify current rules with your state agency and the IRS before committing — requirements change.