Using an electronic disclosure safe harbor is how most plan sponsors now deliver 401(k) notices, yet very few can show that their electronic delivery actually met ERISA’s standard. Sending an email is easy. Proving that the right people received the right notice, by a permitted method, on time, is the part that matters when an auditor, the Department of Labor, or a participant’s attorney asks. This guide explains how the safe harbors work, where sponsors get them wrong, and what a defensible proof file looks like.
Why electronic delivery is a fiduciary question, not an IT question
ERISA requires the plan administrator to furnish required disclosures using methods “reasonably calculated to ensure actual receipt.” That duty belongs to the plan administrator, which for most plans is the employer unless the role has been formally delegated. Paper mail satisfies it by default. Electronic delivery satisfies it only if the plan follows one of the Department of Labor’s safe harbors, or can otherwise show that delivery was reasonably calculated to reach participants.
If electronic delivery fails the standard, the notice was not delivered. That can turn an otherwise clean SPD or summary of material modifications, a 404(a)(5) fee disclosure, or an automatic enrollment notice into a missed disclosure, with the consequences that follow.
The two DOL safe harbors
1. The 2002 safe harbor: “wired at work” and affirmative consent
The older rule lets a plan deliver electronically to two groups. The first is employees who can access the employer’s electronic information system at any location where they reasonably perform their duties, and for whom access is an integral part of those duties. The second is anyone else, such as terminated participants and beneficiaries, who affirmatively consents after receiving a clear statement of what will be sent, how to withdraw consent, how to request paper, and what hardware and software are needed.
The rule also expects the plan to take appropriate steps to confirm actual receipt, such as return-receipt or undeliverable-message tracking, to protect confidential information, and to tell recipients about the significance of the document and their right to a paper copy.
2. The 2020 safe harbor: notice-and-access and email delivery
The newer rule, which applies to ERISA retirement plans, lets the plan use an electronic address (an email address or, for some purposes, a smartphone number) provided by the participant or assigned by the employer for employment-related purposes. Documents can be posted on a website with a notice of internet availability, or sent directly by email. Before relying on it, the plan must send an initial paper notice explaining that disclosures will be electronic, how to request paper copies, and how to opt out of electronic delivery entirely.
The 2020 rule is more flexible, but it has its own mechanics: content and timing requirements for the notice of internet availability, rules for how long documents stay on the website, handling of invalid addresses, and steps to take when an employee with an employer-assigned address leaves. The specific timing and retention periods come from the regulation, so confirm them with your document provider or administrator rather than working from memory.
What the safe harbors do not cover
- IRS-required notices. Some notices, such as safe harbor contribution notices and distribution-related tax notices, are governed by IRS electronic-delivery rules, which are similar but not identical. A plan can satisfy the DOL rule and still miss the IRS one.
- Health and welfare plans. The 2020 rule was written for retirement plans. Health and welfare disclosures generally still rely on the 2002 rule.
- Paper benefit statements. SECURE 2.0 added a requirement that defined contribution plans provide at least one paper benefit statement each year unless the participant elects otherwise. How that interacts with your delivery method depends on your plan year, so confirm it with your recordkeeper.
- The people your system forgot. No safe harbor fixes a distribution list that leaves people out.
Where sponsors get electronic delivery wrong
1. Treating everyone as “wired at work”
Warehouse, field, driver, retail, and clinical staff often have a company email address they never use on the job. Having an address is not the same as integral access during work. These employees need consent under the 2002 rule, a properly assigned address with the initial paper notice under the 2020 rule, or paper.
2. Skipping the initial paper notice
The 2020 rule is not self-executing. If the initial paper notice was never sent, or nobody can find a copy with the date and mailing list, the plan cannot show it qualified for the safe harbor.
3. Forgetting terminated participants and beneficiaries
Former employees lose their work email the day they leave. Unless the plan collected a personal address or consent, notices to that address go nowhere. The same applies to beneficiaries and alternate payees. Build the recipient list from the recordkeeper roster, not the active payroll census, the same discipline used when reconciling payroll and recordkeeper data.
4. Ignoring bounce-backs
Undeliverable messages are evidence that delivery failed. Both safe harbors expect the plan to act on them, typically by obtaining a new address or sending paper. A folder of unread bounce notices is a liability, not a record.
5. Assuming the recordkeeper handles all of it
Recordkeepers deliver what they are told to deliver, to the addresses they have. They usually do not know which employees lack work access, whether the initial notice went out, or which notices the employer sends itself. Those gaps sit with the plan administrator.
An 8-step electronic delivery self-check
- List every required notice and who sends it: the plan, the recordkeeper, the TPA, or payroll.
- For each, note which rule you rely on: the 2002 safe harbor, the 2020 safe harbor, IRS rules, or paper.
- Split the population into wired-at-work employees, other employees, terminated participants, beneficiaries, and alternate payees.
- Confirm the initial paper notice was sent under the 2020 rule, and keep the version, date, and mailing list.
- Confirm consent records exist for anyone relying on 2002-rule consent.
- Check how opt-outs and paper requests are captured and honored.
- Review bounce-back handling: who sees them, and what happens next.
- Confirm departing employees are asked for a personal address before their work email is shut off, and that portal access and data security are handled at the same time.
What belongs in the proof file
For each notice cycle, keep the document version and date, the delivery method and rule relied on, the recipient list and the date it was pulled, delivery confirmations or bounce reports, the follow-up taken for failures, and any paper requests fulfilled. Record decisions about delivery policy in your committee minutes. The same file makes an audit and a recordkeeper conversion far easier.
What you can delegate, and what you cannot
You can delegate the mechanics: assembling notices, sending them, tracking bounces, and keeping the proof file. You cannot delegate the employer-only facts that drive the rules: which employees actually use email as part of their jobs, who has left, and what personal contact information you collected. Choosing to move to electronic delivery is a plan administration decision that should be documented, not something that simply happens because a vendor turned it on.
How Admin316 handles electronic disclosure
As a 3(16) plan administrator, Admin316 takes on the notice calendar, delivery method selection, recipient lists built from the recordkeeper roster, bounce follow-up, and the proof file. We also accept appointment as the plan’s ERISA 402(a) named fiduciary, a role most providers decline, so responsibility for getting disclosures right sits with a professional fiduciary rather than your HR inbox.
If you are not sure your electronic delivery would hold up, book a call with Admin316 and we will walk through your current notice process with you.
