401(k) Auto-Enrollment Mandate Goes Live in 2026: SECURE 2.0 Section 101 Defaults Every New Plan at 3 to 10 Percent

Every new 401(k) and 403(b) plan established after December 29, 2022 must now operate as an Eligible Automatic Contribution Arrangement (EACA) under Section 101 of the SECURE 2.0 Act, with the mandate effective for plan years beginning after December 31, 2024 and a December 31, 2026 deadline for formal plan-document amendment. New plans must default participants at an initial deferral rate between 3 and 10 percent of compensation, escalate that rate by at least 1 percent per year, and continue escalating until the deferral reaches between 10 and 15 percent. The IRS finalized the implementing regulations in January 2025 and confirmed a narrow set of exemptions for governmental plans, church plans, employers with 10 or fewer employees, and businesses operating less than three years.

For plan sponsors, advisors with retirement plan books, and recordkeepers, 2026 is the first full year where every new plan-document submission must reflect the mandate. The compliance bar shifted from optional best practice to operational requirement, and the data from Vanguard’s How America Saves 2026 preview and Fidelity’s recordkeeper book make the practitioner case clear: auto-enrolled plans run at roughly 87 percent participation versus 52 percent for opt-in plans, and the gap is widening as default deferral rates trend above 4 percent.

Key Takeaways

• Section 101 mandate is live: Every 401(k) or 403(b) plan established after December 29, 2022 must operate as an EACA for plan years beginning after December 31, 2024.
• Default deferral: Initial automatic enrollment between 3 and 10 percent of compensation, with mandatory auto-escalation of at least 1 percent per year until the deferral hits 10 to 15 percent (plan sponsor selects the ceiling).
• Amendment deadline: Plans must be formally amended to document the EACA features by December 31, 2026.
• Vanguard data: 61% of Vanguard plans permit deferrals use auto-enrollment, rising to 79% for plans with 1,000+ participants (record high). 62% default at 4% or higher.
• Fidelity data: Auto-enrolled plans average 87% participation versus 52% for opt-in plans. Adoption rates split sharply by size: 28.3% among employers with 10 or fewer employees, 68.4% among 500–999 employee plans.
• Layered 2026 requirement: All defined contribution plans must now provide at least one paper statement annually starting in 2026, under a separate SECURE 2.0 provision.

What Does Section 101 Actually Require?

The statutory language of Section 101 imposes three distinct requirements on every new 401(k) and 403(b) plan, none of which existed as universal mandates before SECURE 2.0.

Automatic enrollment. Every covered plan must enroll eligible employees at a default deferral rate selected by the plan sponsor, with the rate set between 3 and 10 percent of compensation. The rate must be uniform across the eligible population (subject to limited exceptions for nondiscrimination testing) and applied automatically unless the employee affirmatively elects a different rate or opts out.

Automatic escalation. The default rate must increase by at least 1 percentage point per year on the anniversary of the employee’s enrollment until the deferral reaches a sponsor-selected ceiling between 10 and 15 percent. A plan defaulting at 3 percent and escalating by 1 percent annually reaches 10 percent in year 7 and 15 percent in year 12, but the plan sponsor can choose any ceiling within the 10-to-15 percent band.

Permissible withdrawal window. As an EACA feature, the plan must allow newly auto-enrolled participants to withdraw their automatic contributions, plus earnings, within 90 days of the first contribution without the 10 percent early withdrawal penalty. The mechanism preserves participant autonomy and reduces opt-out friction in the first months of enrollment.

The IRS finalized proposed regulations under Section 101 in January 2025, clarifying that the December 29, 2022 enactment date is the operative trigger for “new plan” status. A plan adopted on December 28, 2022 is not a “new plan” under Section 101 and remains eligible to operate without the EACA mandate. A plan adopted on December 30, 2022 is subject to the full mandate. Groom Law Group, Mercer, and the major recordkeepers issued client alerts in Q1 2025 walking through edge cases (plan mergers, controlled-group transitions, multi-employer plan dynamics) that the proposed regs left ambiguous.

Which Plans Are Exempt — and Why the Exemption Math Matters

Section 101 carves out four categories of exempt plans, and the carveouts are narrower than many plan sponsors initially expected.

• Pre-SECURE 2.0 plans: Any plan established on or before December 29, 2022 is grandfathered and may continue without an EACA indefinitely. The exemption survives plan amendments, recordkeeper changes, and corporate transactions that do not terminate the original plan document.
• Governmental plans: State, local, and federal government plans (including 403(b) plans for public school employees and 457(b) plans for state and local government employees, where applicable) are exempt.
• Church plans: Plans maintained by churches and church-controlled organizations are exempt.
• Small employers: Plans maintained by employers with 10 or fewer employees are exempt, as are plans of employers in existence for less than three years.

The small-employer exemption is the most contested. Industry comment letters during the 2024 proposed-reg period flagged that the “10 or fewer employees” test creates a cliff effect: an employer growing from 10 to 11 employees mid-plan-year falls into the mandate at the start of the following plan year. The IRS final regs in January 2025 confirmed the cliff and clarified that the employee count is measured under controlled-group aggregation rules, which prevents fragmentation of larger employers into sub-10 entities to avoid the mandate.

For advisors with small-business retirement plan books, the practical read is that the exemption shrinks as the client grows. A medical practice, professional services firm, or small-business plan that crosses the 10-employee threshold loses the exemption in the next plan year and must add EACA features by amendment. Many of the recordkeepers have built workflow alerts into their plan administration platforms to flag the transition before it triggers a compliance issue.

The Numbers: Auto-Enrollment Works, and the Data Keeps Getting Cleaner

Vanguard’s How America Saves 2026 preview, released in late April 2026 with full-year 2025 data, gave the cleanest read yet on what mandatory auto-enrollment actually produces at population scale. The headline figures across the Vanguard recordkeeping book:

Metric	2024	2025	Trend
Plans permitting deferrals using auto-enrollment	60%	61%	Steady
Plans with 1,000+ participants using auto-enrollment	77%	79%	Record high
Plans defaulting at 4% or higher	61%	62%	Rising
Plans with auto-escalation included	69%	71%	Rising
Participants who increased deferral during year	41%	45%	Rising
Average participant account balance	$148,170	$167,970	+13% YoY record

Source: Vanguard How America Saves 2026 preview, workplace.vanguard.com.

Fidelity’s complementary recordkeeper data, drawn from its plan sponsor attitudes survey and book of 401(k) business, shows the participation-rate delta more sharply. Auto-enrolled plans averaged 87 percent participation in 2025 versus 52 percent for plans that retained opt-in enrollment. The 35-percentage-point gap is the largest documented in the industry’s long-running auto-enrollment research, and it has widened from approximately 30 points a decade ago as default contribution rates have risen.

Adoption splits cleanly by employer size:

• Plans with 10 or fewer employees: 28.3% adoption (largely the universe exempted from Section 101)
• Plans with 50 employees: roughly 40% adoption
• Plans with 500–999 employees: 68.4% adoption
• Plans with 1,000+ participants: 79% adoption (Vanguard book)

The exempt small-employer band remains the segment where the participation gap is most stark and where the Section 101 mandate would, if extended, drive the largest behavioral improvement. The CRS and EBRI both flagged in 2025 comment letters that the small-employer exemption preserves the largest pocket of low-participation plans in the system.

Plan sponsor attitudes have shifted in parallel. Fidelity reported that 71 percent of plan sponsors now believe their auto-enrollment deferral rate plus employer match is sufficient to fund employee retirement, up from 46 percent in 2018. The shift correlates with rising default rates (now averaging 4 percent at enrollment versus 3 percent a decade ago) and broader adoption of qualified default investment alternatives (QDIAs) anchored in target-date funds.

What Plan Sponsors Need to Do Before December 31, 2026?

The amendment deadline is the operational pinch point for sponsors of plans that are subject to Section 101 but have not yet incorporated the EACA features into their plan document. Three concrete steps separate compliant plans from at-risk plans heading into Q4 2026.

Confirm plan establishment date. Sponsors should have their ERISA counsel or recordkeeper confirm the formal plan establishment date under IRS rules. The threshold is December 29, 2022. Plans adopted before that date remain grandfathered. Plans adopted on or after that date are subject to Section 101 and need EACA features in the plan document.

Adopt plan amendment by December 31, 2026. The IRS guidance provides plan sponsors with a uniform amendment deadline that postpones the requirement to formally document SECURE 2.0 changes until the end of 2026. The amendment must reflect the EACA default deferral rate, the escalation schedule, the cap (10–15 percent), and the 90-day permissible withdrawal window. Sponsors that miss the deadline risk operational compliance failure even if the plan has been administered correctly.

Coordinate with the recordkeeper on operational implementation. Recordkeepers have built mandate-ready plan templates since the IRS finalized the regs in early 2025. The dominant providers (T. Rowe Price, Vanguard Workplace, Fidelity Workplace, Empower, Voya, Principal) have published SECURE 2.0 cheat sheets and amendment templates that walk sponsors through the elections. Sponsors should review the elected default rate, escalation cap, and permissible withdrawal mechanics before signing the amendment.

The practitioner question is which default rate and escalation cap to select. The data argues for higher defaults: a 5 percent initial rate escalating to 12 percent produces materially better retirement outcomes than a 3 percent rate escalating to 10 percent, and the opt-out rate at 5 percent is statistically indistinguishable from the opt-out rate at 3 percent, according to BlackRock and Vanguard participant behavior research.

The Escalation Math: 3% to 10% to 15%

The escalation mechanic is the part of Section 101 that produces most of the long-run retirement-savings effect. A worker auto-enrolled at 3 percent who never escalates produces a fraction of the retirement balance that the same worker produces under a mandatory 1 percent annual escalation to a 10 percent cap.

Consider a 30-year-old worker earning $80,000 with a 3 percent employer match cap, contributing under three scenarios over a 35-year career:

1. Opt-in at 3% flat: 3% deferral plus 3% match, no escalation, no auto-enrollment. Outcome: roughly $750,000 at age 65 assuming 6.5% real returns.
2. Auto-enrolled at 3% with 1% annual escalation to 10% cap: deferral rises from 3% to 10% over 7 years, plus 3% match. Outcome: roughly $1.4 million at age 65, nearly double scenario 1.
3. Auto-enrolled at 5% with 1% annual escalation to 15% cap: deferral rises from 5% to 15% over 10 years, plus 3% match. Outcome: roughly $1.9 million at age 65.

Assumptions: $80,000 starting salary, 3% annual wage growth, 6.5% real annual return on a target-date fund portfolio, 3% employer match capped at 3% of pay, no early withdrawals. Illustrative math, not advice.

The math explains why the asset managers (Vanguard, Fidelity, T. Rowe Price, BlackRock) have lobbied consistently for higher mandatory default rates and faster escalation. The Section 101 baseline (3% default, 1% escalation, 10% cap) sets a floor that produces meaningful improvement over opt-in but leaves outcome upside on the table relative to plans that voluntarily default higher.

Participant behavior matches the design. Vanguard’s data shows that 31 percent of participants saw their deferral percentage increase from automatic escalation in 2025 alone, with the average annual increase concentrated in the 1-percentage-point bucket. The behavioral compounding effect, layered on rising equity markets, is what produced the $167,970 average participant balance figure at year-end 2025.

The 2026 Paper Statement Mandate Layered On Top

A separate SECURE 2.0 provision that took effect in 2026 requires every defined contribution plan to provide at least one paper statement annually. The provision applies regardless of whether the plan offers electronic delivery by default for other notices.

For plan sponsors, the operational implications include printing and mailing costs, data hygiene on participant addresses, and recordkeeping for proof of delivery. Most major recordkeepers have built the paper-statement workflow into their 2026 service models and are quoting fee structures that absorb the cost within existing per-participant pricing. Smaller TPA arrangements may pass the cost through.

The provision was a compromise during SECURE 2.0 negotiations between digital-delivery advocates (recordkeepers, asset managers) and consumer protection advocates (AARP, Pension Rights Center) who argued that pure electronic delivery disadvantages older, lower-income, and digitally underserved participants. The 2026 effective date gives the industry runway to absorb the operational load while preserving the participant-protection rationale.

What Should Advisors Watch in 2026?

Three specific data points will reshape the 2026 EACA conversation between now and Q4.

1. Adoption of higher default rates among newly-mandated plans. The Section 101 minimum is 3 percent, but the IRS rules permit defaults up to 10 percent. The recordkeeper data for plans that adopted EACA features in 2025 and 2026 will reveal whether sponsors are defaulting at the regulatory floor or anchoring closer to the 5–6 percent rate that produces materially better participant outcomes.

2. Q4 amendment-deadline crunch. The December 31, 2026 amendment deadline will produce a Q4 spike in plan-document amendments. Sponsors who miss the deadline face operational compliance risk even if the plan has been administered correctly under Section 101. ERISA counsel and TPA firms are pre-scheduling Q3 reviews to avoid the crunch.

3. Small-employer expansion legislation. The SECURE 3.0 / OPTIONS Act framework that the site covered in May 2026 includes a phased reduction of the small-employer exemption threshold from 10 employees down to 5, with implementation targeted for plan years beginning after 2027. The expansion would bring an additional 1.5 million small-business plans under the mandate, according to ICI and ASPPA estimates.

Advisors managing relationships with small-business plan sponsors should flag the SECURE 3.0 trajectory now, even if final passage is uncertain. The directional read is that the auto-enrollment requirement is expanding, not contracting, and the exempt window is closing for growing employers.

Three Questions for Plan Sponsors Reviewing 2026 Compliance

For advisors meeting with plan sponsor clients between now and Q4 2026:

1. What is your plan-document amendment status, and what is the formal deadline for adopting the SECURE 2.0 EACA language? If the answer is not “amendment drafted, awaiting board approval by Q3,” the project needs to move up the priority list immediately.
2. At what default deferral rate did you elect to auto-enroll, and what is the escalation cap? If the answer is “3 percent and 10 percent” by default rather than by deliberate analysis, the sponsor is leaving participant outcomes on the table.
3. How are you handling the new 2026 paper statement requirement, and what does it add to per-participant administrative cost? The answer reveals whether the recordkeeper is absorbing the cost or passing it through, and whether the sponsor has reviewed the 2026 service fee schedule.

The honest answers separate sponsors who treated SECURE 2.0 as a compliance project from sponsors who treated it as a plan-design opportunity.

Sources

• IRS Final Regulations under Section 101 of SECURE 2.0, January 2025
• Groom Law Group, “IRS Issues Guidance on Mandatory Automatic Enrollment”
• Mercer, “SECURE 2.0’s auto-enrollment mandate revs up with IRS proposal”
• Vanguard How America Saves 2026 preview, workplace.vanguard.com
• Vanguard corporate press release, “401(k) Plan Design Improvements Make Retirement Savers More Resilient”
• T. Rowe Price, “SECURE 2.0 Act cheat sheet” (Q1 2026 update)
• Empower, “What is SECURE Act 2.0?” and Automatic Enrollment Overview
• Fidelity Plan Sponsor Attitudes survey, 401kspecialistmag.com
• John Hancock Retirement, “Navigating SECURE 2.0 Mandatory Auto-Enrollment”
• ICI 2026 plan participation research

As of May 12, 2026. Plan-document amendment deadlines and IRS regulatory interpretations may evolve. Sponsors should consult ERISA counsel and their recordkeeper for plan-specific guidance. Illustrative math is not personalized advice.