Safe Harbor 401(k) Plans: The 2026 Small Business Guide

Every 401(k) plan is subject to annual nondiscrimination testing. The ADP and ACP tests compare what owners and other highly compensated employees contribute against what everyone else contributes, and cap the first group based on the second. The top-heavy test looks at account balances and can require a minimum contribution to non-key employees. Small business plans fail these tests routinely.

A safe harbor 401(k) is exempt. In exchange for a required employer contribution deposited to employee accounts and fully vested when made, the plan is treated as passing. That exemption is the safe harbor.

The exemption is neither free nor unconditional. The contribution is a standing annual obligation with real cash implications, the formula you select determines both what it costs and who receives it, and several common design decisions — adding profit sharing, applying a vesting schedule, changing the plan mid-year — can forfeit part of the relief you paid for.

This guide covers what the rules require in 2026, what each contribution option costs, when the deadlines fall, and the tradeoffs to weigh before committing.

A safe harbor 401(k) plan is a 401(k) that satisfies IRS nondiscrimination requirements by design instead of by testing.

Traditional 401(k) plans must prove each year that contributions don't disproportionately favor highly compensated employees (HCEs) over non-highly compensated employees (NHCEs). That proof comes from annual testing. When a plan fails, the correction generally requires refunding contributions to the owners and executives who made them, typically in the spring after the money has been invested.

A safe harbor plan sidesteps the testing entirely. In exchange, the employer commits to two things:

• • A qualifying employer contribution — either a match or a nonelective contribution — that meets minimum formula requirements and vests immediately (or within two years for a QACA).
  • A participant notice, if the plan uses a matching formula.

There are two forms of safe harbor plan:

• • Classic safe harbor — the original design. Contributions are 100% vested when made. No auto-enrollment required.
  • QACA safe harbor — a Qualified Automatic Contribution Arrangement. It requires automatic enrollment, permits a slightly cheaper match, and allows up to a 2-year cliff vesting schedule.

An employee is an HCE for the 2026 plan year if either is true:

• • They owned more than 5% of the business (directly or by family attribution) at any point during 2026 or 2025, or
  • They earned more than $160,000 from the business during 2025 — the prior year.

HCE status is determined on a lookback basis: status for 2026 is based on 2025 compensation. The $160,000 threshold was unchanged from 2025 to 2026; it does not increase every year.

Compensation for this test is broader than taxable wages. It means Section 415(c)(3) compensation — total pay with pre-tax deferrals added back, including 401(k) contributions, cafeteria plan elections, and transit benefits. An employee earning $155,000 who defers $10,000 has $165,000 of compensation for HCE purposes and clears the threshold. The test counts pay from your business only, including any related companies treated as a single employer.

Employers with many employees above the threshold can make a top-paid group election, which adds a second condition: an employee must clear $160,000 and rank in the top 20% by compensation. More-than-5% owners are HCEs regardless of pay or ranking.

Key employees are used in the top-heavy test, not the ADP/ACP tests. An employee is a key employee if any of the following is true:

• • They are an officer earning more than the indexed officer threshold, or
  • They own more than 5% of the business, or
  • They own more than 1% of the business and earn more than $150,000 — a statutory figure that never indexes.

Key employees are identified as of the determination date — the last day of the prior plan year — so the 2026 top-heavy test applies the 2025 officer threshold of $230,000. Compensation is measured the same way as for HCEs, with pre-tax deferrals added back.

Not every officer is a key employee. The number of officers the plan must treat as key employees is capped by headcount:

If a business has more officers above the compensation threshold than the cap allows, the highest-paid of them are the key employees.

A safe harbor design produces advantages on both sides of the plan.

• • Guaranteed contributions. With no ADP/ACP testing, there is no risk of refunds to correct a failed test. Owners can defer up to the annual 402(g) limit — $24,500 in 2026, $32,500 at age 50 or older, and $35,750 at ages 60 to 63.
  • Simplified administration. ADP/ACP and top-heavy testing require substantial payroll data and technical calculation. A safe harbor design removes that work from the annual compliance cycle.
  • Recruitment. A required employer contribution that vests quickly is straightforward to advertise to candidates, particularly against employers whose match carries a multi-year vesting schedule.

• • Generous contributions. Safe harbor formulas require 3% to 4% of pay — $1,500 to $2,000 a year for an employee earning $50,000. The employer commits to that amount annually and can only reduce or suspend it mid-year under narrow conditions, unlike a discretionary match or profit sharing contribution.
  • Accelerated vesting. Classic safe harbor contributions are 100% vested when made. QACA contributions require no more than two years of service.

Safe harbor plans come in two forms — Classic and QACA. Both satisfy the same nondiscrimination requirements. They differ on automatic enrollment, vesting, and the maximum match.

The SECURE 2.0 automatic enrollment mandate. 401(k) plans established after December 29, 2022 must enroll employees automatically for plan years beginning after December 31, 2024. The default deferral rate must be between 3% and 10% of pay in the first year and increase by 1 percentage point annually to at least 10%, capped at 15%.

A QACA satisfies the mandate only if its escalation is set to reach 10%. The QACA’s own minimum schedule stops at 6%, so the two sets of requirements stack. A classic design does not satisfy the mandate on its own — a covered plan may still use a classic safe harbor formula, but must add a separate automatic enrollment feature that meets it. Plans established on or before December 29, 2022 are exempt, as are church and governmental plans, SIMPLE 401(k) plans, businesses in existence less than three years, and employers with 10 or fewer employees.

For a closer look at the choice, see Traditional Safe Harbor vs. QACA — How to Choose.

A plan’s contribution options depend on whether it is a classic or a QACA safe harbor. Each type offers three: a basic match, an enhanced match, or a nonelective contribution.

The basic match is tiered, which is why a 4% deferral earns 3.5% of pay rather than the full 4%: the first 3% of pay is matched dollar for dollar, and the next 2% at fifty cents on the dollar.

An enhanced formula reaches the same 4% maximum at a 4% deferral, but must also satisfy two conditions: the match rate cannot increase as the deferral rate increases, and no match may be provided on deferrals above 6% of pay.

Automatic enrollment: required. The QACA's own minimum default schedule is 3% in the initial period, then 4%, 5%, and 6% and thereafter. The default rate can't exceed 10% during the initial period, and can never exceed 15%.

Yes, and most plans do — 84.62% of plans in the study permit a profit sharing contribution. But it forfeits the top-heavy exemption for that plan year.

The exemption under IRC §416(g)(4)(H) applies only to plans consisting solely of elective deferrals, safe harbor contributions, and matching contributions that satisfy the ACP safe harbor: no match on deferrals above 6% of pay, total match no greater than 4% of pay, and a match rate that does not rise as the deferral rate rises. Three things break the exemption: a discretionary profit sharing contribution, a forfeiture allocation, or a match outside those conditions. Roughly half of safe harbor plans add a second, non-safe-harbor match, which must satisfy those conditions for the exemption to hold.

The consequence is often limited. The safe harbor contribution counts toward the 3% top-heavy minimum, so a plan making a 3% nonelective has already satisfied it. A plan making a match and then adding profit sharing, however, may owe a minimum contribution to non-key employees who did not defer.

Profit sharing allocation formulas. A profit sharing contribution can be divided among employees in several ways:

• • Pro rata — every eligible employee receives the same percentage of pay. The simplest formula, and the most even.
  • Integrated (also called permitted disparity) — a higher rate applies to pay above a threshold tied to the Social Security wage base, which modestly favors higher earners.
  • New comparability (also called cross-tested) — employees are divided into groups, and each group receives its own contribution rate. This allows the largest allocations to go to owners.

New comparability is the most flexible of the three, but the flexibility is conditional. To weight contributions toward owners, the plan must first clear a gateway minimum: a floor allocation to non-highly compensated employees, generally 5% of pay, or one-third of the highest rate any HCE receives if that produces a smaller number.

The safe harbor formula a plan uses largely determines which allocation formula it pairs with, as the next section shows.

The rules below apply to every safe harbor contribution, regardless of the formula selected. The first two are design choices that affect cost; the remaining three are compliance requirements.

• • HCEs may be excluded. Safe harbor contributions are required only for NHCEs. Excluding owners and executives is a common cost-control measure.
  • Match timing is flexible. Safe harbor matching contributions can be calculated each payroll period or annually. Payroll-period matching spreads the cost across the year; annual matching, or a year-end true-up, produces a more equitable result for employees with uneven pay.
  • Eligibility requirements must align. If employees can defer before qualifying for the safe harbor contribution, the plan loses safe harbor protection for top-heavy purposes. The eligibility requirements should match.
  • Allocation conditions are prohibited on the safe harbor contribution. It cannot be limited to employees who work 1,000 hours or who are employed on the last day of the year; every eligible employee receives it, including mid-year terminations. Those conditions may still be applied to a separate profit sharing contribution.
  • Deposit deadlines apply. Matching contributions calculated on a payroll-period basis must be funded by the last day of the following plan year quarter. Nonelective contributions are generally due within 12 months after the plan year ends; to deduct them for that year, they must be funded by the business tax filing deadline including extensions.

Our 2022 plan design study examined 4,330 small business 401(k) plans, 3,230 of which used a safe harbor design — 74.60%, up from 69.23% in 2019. The breakdown by formula:

Matching formulas are the majority. The basic match alone accounts for 52.79% of safe harbor plans. Across all designs, matching formulas total 73.34% against 26.66% for nonelective formulas. The reason is cost: a match pays nothing to employees who don't defer, which makes it cheaper than a nonelective contribution at typical participation rates.

Classic designs account for 95.42% of safe harbor plans, against 4.58% for QACAs. The SECURE 2.0 auto-enrollment mandate will shift this for plans established after December 29, 2022.

Which profit sharing allocation formula a plan uses depends heavily on its safe harbor formula:

Nonelective plans pair well with new comparability: 68.50% use it. Match-based plans split more evenly and are nearly three times as likely to skip profit sharing entirely.

The reason is the gateway minimum. A safe harbor nonelective already goes to every eligible employee, so it covers much of the gateway at no additional cost. A safe harbor match reaches only employees who defer, so a match-based plan adding new comparability may have to fund the gateway separately.

That combination — a 3% nonelective plus new comparability — brings an owner's total annual additions to the $72,000 limit at a controlled cost for staff. It is why a quarter of safe harbor plans accept the nonelective's higher contribution cost.

There are two separate costs: the contributions made to employees, and the administration fee paid to a provider. Both should be evaluated before adopting a plan.

The distinction that drives cost: a nonelective contribution goes to every eligible employee, so it costs a fixed 3% of eligible payroll. A match goes only to employees who defer, so its cost depends on participation.

The figures below assume $1,000,000 of eligible payroll:

Assumes participating employees defer at or above the rate needed to earn the full match. Actual costs run lower when some participants defer less.

Breakeven. The two approaches cost the same where the match's maximum rate multiplied by the participation rate equals 3%. For a 4% match, that is 75% participation. For a QACA's 3.5% match, it is approximately 86%. Below the breakeven, the match costs less; above it, the nonelective costs less.

Automatic enrollment raises participation by design. An employer adopting a QACA should model the match cost at high participation rather than at its current rate.

Administration fees vary widely across providers, and many are not published. Asset-based fees are common and increase as plan assets grow.

Employee Fiduciary publishes its fees. A full-service safe harbor 401(k) costs $1,500 per year for up to 30 eligible employees, plus $30 per additional employee, plus a 0.08% custody fee on plan assets. New plan setup is $500; converting an existing plan is $1,000. That covers recordkeeping and third-party administration, including the annual testing still required if the plan adds profit sharing.

For a plan with $1,000,000 of eligible payroll, that is roughly $1,500 per year in administration against about $30,000 in contributions. Contributions, not administration fees, are the principal cost of a safe harbor plan.

SECURE 2.0 expanded the credits available to small employers starting a new plan. Three apply to a new safe harbor 401(k):

Eligibility: 100 or fewer employees who earned at least $5,000 in the prior year, at least one NHCE participant, and no substantially similar plan covering the same employees in the prior three years.

Two limits on the startup credit. It cannot exceed 100% of qualified startup costs actually paid, and the $5,000 annual ceiling requires at least 20 eligible NHCEs. At Employee Fiduciary's fees — $500 to establish the plan and $1,500 per year — a typical small plan's startup credit totals $5,000 to $7,000 over three years rather than the theoretical $16,500 maximum.

The employer contribution credit is generally the largest of the three. A 50-employee business with 5 HCEs, automatic enrollment, and $100,000 in annual employer contributions could claim roughly $165,800 over five years — about $157,500 of it from the contribution credit. That assumes all 45 non-highly-compensated employees earn under $110,000 and each receives at least $1,000 in employer contributions.

Credits reduce the corresponding deduction. Tax credits offset liability dollar for dollar, but the deduction for startup costs and employer contributions must be reduced by the amount of credit claimed. The same dollars cannot support both.

Employer-specific estimates are available through our 401(k) tax credit calculator.

The Actual Deferral Percentage (ADP) test compares the average deferral rate of HCEs to that of NHCEs. The Actual Contribution Percentage (ACP) test does the same for matching and after-tax contributions. HCEs can only exceed NHCEs by so much:

If employees defer an average of 3%, HCEs as a group are limited to a 5% average. On a $200,000 salary, that is $10,000 against a $24,500 limit. The limit applies to the group average rather than to each individual, so one HCE may defer more if others defer less. Where the owner is the only HCE, the distinction has no practical effect.

A failed test requires refunds. The standard correction returns excess contributions to HCEs, taxable in the year received. Corrections are generally processed in the spring, after the prior year's tax planning is complete.

One qualifier on ACP relief. Safe harbor status covers a qualifying match — one that meets the ACP safe harbor conditions. Two situations restore the ACP test: allowing employee after-tax contributions, or adding a match that falls outside those conditions. ADP and top-heavy relief are unaffected. A plan consisting of elective deferrals plus a standard safe harbor match or nonelective contribution retains full ACP relief.

A plan is top heavy when key employees hold more than 60% of plan assets as of the last day of the prior plan year. This is common among small businesses, where owners typically have longer tenure and larger account balances than staff.

When a plan is top heavy, every non-key employee employed on the last day of the year must receive a minimum contribution equal to the lesser of 3% of pay or the highest contribution rate received by any key employee (including their own deferrals).

Employee Fiduciary studied 3,217 small business 401(k) plans:

*Excluding safe harbor plans, which are exempt from ADP/ACP testing. The ACP rate is measured only against plans with a match or after-tax feature.

Roughly one in four traditional plans failed the ADP test, and more than half of safe harbor plans were top heavy.

The second figure is not a contradiction. A safe harbor plan can be top heavy and remain exempt from the top-heavy minimum contribution, which is the requirement that carries a cost. The exemption holds as long as the plan receives nothing but elective deferrals and safe harbor contributions.

Catch-up contributions are not annual additions — they sit on top of the $72,000 §415(c) limit rather than counting against it. This is why the last row exceeds the limit above it.

Other 2026 figures that affect plan design:

• • Annual compensation limit: $360,000
  • HCE threshold: $160,000 (based on 2025 pay for 2026 testing)
  • Key employee / officer threshold: $235,000 — governs the 2027 top-heavy test; the 2026 test uses the 2025 figure of $230,000

New for 2026 — the Roth catch-up mandate. Employees whose 2025 FICA wages from your business exceeded $150,000 must make their 2026 catch-up contributions as Roth contributions. A plan that does not offer a Roth feature cannot accept catch-up contributions from those employees.

The threshold measures wages from the sponsoring business alone, not the employee's total income across employers. Self-employed individuals and partners have no FICA wages, so the mandate does not apply to them regardless of income.

The statutory requirement is in effect for 2026. The final regulations formally apply beginning in 2027, so plans operate under a reasonable, good-faith standard in the interim. Employers should confirm with their provider that payroll data correctly identifies affected employees.

The deadline depends on whether the employer is establishing a new plan or converting an existing one, and for conversions, on the contribution formula selected. The deadlines below apply to a calendar-year plan:

The final row reflects a retroactive option created by SECURE 1.0. An employer that learns in March 2027 that its 2026 ADP test failed can still make the 2026 plan year safe harbor by adopting a 4% nonelective contribution by December 31, 2027.

Limitation: the retroactive route is available only for nonelective contributions. It cannot be used if the plan provided a safe harbor match at any point during the year.

Only if the plan uses a matching formula.

• • Match-based plans: an annual safe harbor notice is required, distributed 30 to 90 days before the start of each plan year. New participants get one no earlier than 90 days before their entry date and no later than the entry date itself.

  • Nonelective-based plans: no safe harbor notice required. SECURE 1.0 eliminated it for plan years beginning after 2019. The one exception is a plan with a contingent — "maybe" — nonelective contribution, which needs a notice explaining the contingency plus a follow-up notice if the contribution is made.

The automatic enrollment notice is separate. SECURE 1.0 eliminated the safe harbor notice, not the automatic enrollment notice. A QACA, or any plan with automatic enrollment, must still provide participants an annual notice under IRC §414(w) describing the default deferral rate, the right to opt out, permissible withdrawals, and the default investment. A QACA nonelective plan is relieved of one notice, not both.

The notice must describe the safe harbor contribution formula, any other plan contributions including discretionary ones, what compensation employees can defer, how to make and change deferral elections, vesting and distribution provisions, and how to get more plan information.

Yes, subject to conditions. IRS Notice 2016-16 permits most mid-year amendments to a safe harbor plan provided the plan satisfies the requirements for updated notices.

If the amendment changes information contained in the safe harbor notice, the employer must distribute an updated notice 30 to 90 days before the amendment takes effect and give employees a reasonable opportunity to change their deferral election beforehand.

These changes are off-limits mid-year:

• Increasing the years of service required to vest QACA contributions
• Narrowing the group of employees eligible for safe harbor contributions
• Switching between safe harbor types
• Increasing the match formula, or adding a discretionary match — unless the change is adopted at least three months before the plan year ends, applied retroactively to the entire plan year, and paired with an updated notice and a new election opportunity

Reducing a safe harbor match is governed by the suspension rules below rather than by Notice 2016-16.

Yes, but only if one of two conditions is met: the business is operating at an economic loss for the year, or the safe harbor notice already distributed stated that the contribution might be reduced or suspended.

An employer meeting one of those conditions must provide participants a supplemental notice at least 30 days before the change, allow them to change their deferral elections, and run ADP/ACP testing for the entire plan year using the current-year testing method. A mid-year suspension does not produce a partial-year exemption.

Note the interaction with the notice rules. A nonelective safe harbor plan is not required to distribute a notice, but a plan that distributes none cannot rely on the reservation route and is limited to the economic-loss exception. An employer that wants to preserve the option may voluntarily distribute a notice containing the reservation language.

The mandate applies to most plans established after 2022 and changes the classic-versus-QACA analysis for new plans.

401(k) plans established after December 29, 2022 must include automatic enrollment for plan years beginning after December 31, 2024. The default rate must be between 3% and 10% of pay in the first year and escalate by 1 percentage point annually to at least 10% but no more than 15%.

Exempt from the mandate:

• Plans established on or before December 29, 2022 (permanent)
• Church and governmental plans (permanent)
• SIMPLE 401(k) plans (permanent)
• Businesses in existence less than 3 years (temporary — expires one year after the business completes its third year)
• Employers that normally employed 10 or fewer employees (temporary — expires one year after the close of the first tax year the employer normally employs more than 10)

The last two are grace periods rather than permanent exemptions. A growing business will eventually lose both, and the plan must be amended before that occurs.

Effect on safe harbor design. For a new plan already subject to the mandate, a QACA merits consideration: it permits a lower maximum match (3.5% versus 4%) and a 2-year vesting schedule, alongside automatic enrollment the plan must provide in any case.

However, a QACA built to its own minimum does not satisfy the mandate. The QACA escalation floor stops at 6%, while the SECURE 2.0 mandate requires escalation to at least 10%. A covered plan must set escalation above the QACA floor. The two requirements stack; one does not substitute for the other.

Final regulations on the mandate were still pending as of mid-2026. Plans comply with the statute under a good-faith standard in the meantime.

Yes. Before 2024, an employer had to maintain a SIMPLE IRA for the full calendar year before switching. SECURE 2.0 permits mid-year termination of a SIMPLE IRA and replacement with a safe harbor 401(k).

The steps must be completed in order:

1. Set the safe harbor plan's start date.
2. Terminate the SIMPLE IRA effective the day before that date, and notify employees of the termination.
3. Notify employees about the replacement plan.
4. Prorate the deferral limit. Employees' combined SIMPLE IRA and 401(k) deferrals for the year are subject to a blended limit based on how much of the year each plan covered.
5. Confirm no employee exceeded the limit before year-end, while corrections remain straightforward.

Employers typically make this change for one of two reasons: the SIMPLE IRA's lower deferral limit constrains the owner, or the employer wants vesting schedules and loan features a SIMPLE IRA cannot provide.

Choose safe harbor when:

• • Your plan will be top heavy. If a 3% top-heavy minimum is already owed, a 3% safe harbor nonelective costs approximately the same and adds ADP/ACP relief at no incremental cost.
  • Your plan will fail ADP/ACP testing. Where NHCE participation is low, a safe harbor design is the only reliable means for owners to reach the $24,500 limit.
  • You intend to make a substantial employer contribution regardless. An employer already planning to match can structure that match as a safe harbor formula at little additional cost and eliminate testing.
  • You are establishing a new plan subject to the auto-enrollment mandate. The QACA design aligns with a requirement the plan must satisfy in any case.

Choose a traditional 401(k) when:

• • Your plan will pass testing comfortably. Strong NHCE participation and a young, non-top-heavy asset base mean the safe harbor contribution purchases protection the plan does not need.
  • You want a vesting schedule on employer contributions. Safe harbor contributions vest immediately under a classic design, or within two years under a QACA. A traditional plan may use a 6-year graded schedule, which returns unvested contributions to the plan when employees leave early.
  • You want allocation conditions on your primary employer contribution. Traditional plans may require 1,000 hours or last-day employment. Safe harbor contributions cannot carry those conditions, although a separate profit sharing contribution may.
  • You want a stretch match. A formula such as 25% of deferrals up to 10% of pay encourages higher employee deferrals at the same employer cost. Safe harbor formulas do not permit it.

A practical test: project the ADP test using realistic employee deferral rates. If the owners cannot approach the deferral limit under those assumptions, the safe harbor contribution is providing testing relief the plan needs. If they can, it is not.

A safe harbor 401(k) is not the right answer for every business. It is a trade: a guaranteed employer contribution in exchange for guaranteed testing relief. Whether that trade is worthwhile depends on facts specific to your business — the number of employees, how much they save on their own, and how much the owners intend to contribute.

It should not depend on your provider's fee schedule. Safe harbor plans require less annual testing than traditional plans and should not cost more to administer. A provider that charges a premium for safe harbor administration, or that will not disclose its fees, warrants scrutiny.

Plan design questions of this kind are best resolved before committing to a contribution the business will owe every year. A transparent 401(k) provider should be able to model the options with you.