Safe Harbor 401(k) in 2026: Basic Match vs Enhanced Match vs 3% Nonelective, the October 1 Deadline, and Every SECURE 2.0 Change

A traditional 401(k) at a small firm fails ADP testing more often than it passes. The owner and a handful of highly compensated employees max out their deferrals; the rank-and-file employees defer 2% on average — sometimes zero — and Actual Deferral Percentage (ADP) testing under IRC §401(k)(3)(A)(ii) refuses the pattern. The plan's third-party administrator sends refund checks to the owners in March, capping their real deferral rate at whatever the rank-and-file happened to defer plus two percentage points. In extreme cases, a $180,000-earning owner who tried to defer the full $24,500 gets back $18,000 the following spring, taxable in the current year.^[1]

The Safe Harbor 401(k), codified at IRC §401(k)(12) for match formulas and IRC §401(k)(13) for automatic-enrollment variants, is the standard structural fix. In exchange for making a defined employer contribution — either a basic 4% match, an enhanced match, or a 3% nonelective — the plan is deemed to satisfy the ADP test as a matter of law.^[2] Owners can defer the full $24,500 for 2026 without a refund exposure. Highly compensated employees can defer without a refund exposure. Rank-and-file employees get a mandatory employer contribution regardless. And SECURE Act §103 plus SECURE 2.0 §102 added retroactive-adoption windows and stackable federal tax credits that make the first three years dramatically cheaper than a traditional plan.^[3]

This guide walks the Safe Harbor 401(k) end-to-end for the 2026 plan year: the three qualified formulas, the QACA automatic-enrollment variant, the ADP/ACP exemption mechanics, the top-heavy exemption and its narrow limits, the October 1 adoption wall for calendar-year plans, the SECURE Act §103 mid-year windows for nonelective safe harbors, notice requirements, tax credits, vesting rules, three worked case studies at 5-employee, 15-employee, and 30-employee firms, and the six most common mistakes that break the safe harbor status mid-year. Model the numbers as you read using the CalcLeap 401(k) calculator, which handles the 2026 IRS Notice 2025-67 limits and the SECURE 2.0 §603 mandatory Roth catch-up.

1. What a Safe Harbor 401(k) actually is

A Safe Harbor 401(k) is a 401(k) plan that satisfies one of the three qualified employer-contribution formulas set out in IRC §401(k)(12) or §401(k)(13). In exchange for making that contribution, the plan is deemed — as a legal matter, not merely presumed — to satisfy the Actual Deferral Percentage (ADP) test that would otherwise apply under IRC §401(k)(3)(A)(ii).^[2] If the safe harbor contribution is a match, the plan is also deemed to satisfy the parallel Actual Contribution Percentage (ACP) test on the matching contribution under IRC §401(m)(11).^[4]

The point is not that safe harbor "passes" the tests. The point is that the tests don't run. The plan skips ADP/ACP calculations entirely, and a plan administrator who correctly funds the safe harbor contribution never has to send refund checks to owners in March. That single mechanic — no refund exposure — is what makes safe harbor the default 401(k) structure for firms with fewer than 50 employees. Approximately 55–60% of small-employer 401(k) plans are safe harbor by design, and the share has been rising every year since SECURE 2.0 auto-enrollment mandates kicked in for new plans.^[5]

There is a second, less-discussed benefit. Under IRC §416(g)(4)(H), a plan whose only employer contributions are the safe harbor contributions is deemed not top-heavy. The top-heavy determination — whether key employees (5% owners, 1% owners earning over $150,000, and officers earning over $235,000 for 2026) hold more than 60% of plan assets — is unfortunately the routine outcome for a small owner-heavy business, and a top-heavy finding triggers a mandatory 3% employer contribution to every non-key employee. A pure safe harbor plan sidesteps both the ADP test and the top-heavy minimum in one contribution.^[6]

2. The three qualified safe harbor formulas

The safe harbor is not a single design. It is three alternative formulas, each of which independently satisfies §401(k)(12). Every dollar figure below assumes 2026 rules and the §401(a)(17) compensation cap of $360,000 per IRS Notice 2025-67.^[7]

Formula A: Basic match (100% × first 3% + 50% × next 2%)

Under IRC §401(k)(12)(B)(i)(I), the employer matches 100% of employee elective deferrals up to 3% of compensation, plus 50% of deferrals on the next 2%. An employee who defers 5% or more of pay gets the full 4%-of-compensation match. An employee who defers less than 5% gets a smaller partial match. An employee who defers 0% gets nothing.

The basic match is the cheapest safe harbor for an employer whose workforce defers modestly. If half the employees defer 0%, the average safe harbor cost drops to roughly 2% of aggregate payroll. But the employer is uncertain until year-end — actual cost depends on actual participation, which varies annually.

Formula B: Enhanced match (any formula at least as generous at every tier)

Under IRC §401(k)(12)(B)(i)(II), an "enhanced" match must produce at least as much match at every possible deferral rate as the basic formula. The IRS reviews the enhanced formula tier by tier. Any deferral rate at which the enhanced formula produces less match than the basic formula disqualifies it.^[8]

Three common enhanced formulas that pass the tier test:

• 100% match on the first 4% — costs the employer up to 4% (same ceiling as basic, but reached at a lower deferral rate).
• 100% match on the first 5% — costs the employer up to 5%; used by firms trying to push participation rates.
• 100% match on the first 6% — costs the employer up to 6%; the most generous variant that still qualifies as "enhanced" rather than requiring §401(m)(11) ACP testing on the excess over 6%.

Enhanced match capA safe-harbor match may not exceed 6% of compensation and may not increase as the deferral rate exceeds 6% — either would break the ACP test exemption under Treas. Reg. §1.401(m)-3(d)(3). Employers that want to match above 6% typically add a discretionary match on top and let ACP testing apply to the discretionary layer.

Formula C: 3% nonelective (paid to every eligible employee)

Under IRC §401(k)(12)(C), the employer contributes 3% of compensation to every eligible employee, regardless of whether the employee makes any elective deferral. A rank-and-file employee at $50,000 pay gets $1,500 whether they defer $0 or $24,500.

The 3% nonelective is more expensive on average than the basic match, but it has three practical advantages: (1) the employer's cost is deterministic — 3% × aggregate eligible payroll — with no participation uncertainty; (2) it doubles as the top-heavy minimum contribution if the plan turns out to be top-heavy; (3) SECURE Act §103 allows retroactive mid-year adoption up to 30 days before plan-year end, which the match formulas do not permit. Firms that want the flexibility to decide in November whether to be a safe harbor plan for the current calendar year almost always choose the 3% nonelective.

3. QACA — the automatic-enrollment safe harbor variant

IRC §401(k)(13), enacted by the Pension Protection Act of 2006 and expanded by SECURE 2.0, creates a separate safe harbor for plans that pair the employer contribution with mandatory automatic enrollment. The Qualified Automatic Contribution Arrangement (QACA) has three defining features:

1. Automatic enrollment at 3–10%, with automatic annual escalation of at least 1 percentage point per year up to at least 6% by year 4 (capped at 15% under SECURE 2.0 §101).^[9]
2. Employer-favorable match schedule: 100% of the first 1% deferred plus 50% of the next 5%, capping employer cost at 3.5% of compensation — half a percentage point less than the traditional basic match. The 3% nonelective option is available under QACA at the same rate.
3. Two-year cliff vesting permitted on the employer safe harbor contribution. Every other safe harbor formula requires 100% immediate vesting; QACA is the exception, allowing an employer to reclaim the safe harbor if the employee leaves within two years.

SECURE 2.0 §101, which took effect for plan years beginning after December 31, 2024, made automatic enrollment mandatory for essentially all new 401(k) plans established after December 29, 2022 (SECURE 2.0's enactment date), with narrow exemptions for firms with 10 or fewer employees, firms less than three years old, church plans, and governmental plans.^[10] The upshot is that most Safe Harbor 401(k)s adopted in 2026 will be QACAs whether the sponsor calls them that or not — the SECURE 2.0 auto-enrollment requirement makes the QACA structure the default rather than the exception.

4. The 2026 contribution limits and thresholds that apply

Every dollar figure in Safe Harbor 401(k) design is set by the same numbers that govern any 401(k) plan. IRS Notice 2025-67 (October 2025) set the 2026 amounts:^[11]

Two consequences follow. First, the safe harbor match on high earners is capped by the §401(a)(17) compensation cap: an owner earning $600,000 still only gets a match on the first $360,000 of pay, so a 4% basic match maxes out at $14,400, not $24,000. Second, the SECURE 2.0 §603 mandatory Roth catch-up applies to Safe Harbor 401(k) plans exactly as it applies to traditional 401(k) plans — any participant whose 2025 FICA wages from this employer exceeded $150,000 must make any 2026 age-50 catch-up as a Roth contribution rather than pretax. Plans that do not offer a Roth source at all must simply deny catch-up to §603-covered participants.^[12]

5. How safe harbor satisfies the ADP/ACP tests

The Actual Deferral Percentage test under IRC §401(k)(3)(A)(ii) compares the average deferral rate of highly compensated employees (HCEs) to the average deferral rate of non-highly compensated employees (NHCEs). An HCE for the 2026 plan year is either any 5%+ owner (at any comp level) or any employee whose 2025 compensation exceeded $160,000.^[13]

The traditional 401(k) formula is the "1.25 or 2%" rule. The HCE average deferral rate is limited to the greater of:

• the NHCE average × 1.25, or
• the lesser of (NHCE average × 2, or NHCE average + 2 percentage points).

In a small firm where NHCEs defer 3% on average, HCEs are capped at 5%. In a firm where NHCEs defer 1% on average, HCEs are capped at 3%. That is the mathematical trap: a high-earning owner who wants to defer 15% cannot, because rank-and-file participation is too low.

A Safe Harbor 401(k) is deemed to satisfy the ADP test by making the qualified employer contribution to every eligible NHCE. The plan document simply notes the safe harbor status, the third-party administrator does not run the ADP test, and HCEs can defer up to the full §402(g) ceiling ($24,500 base + $8,000 age-50 catch-up + $11,250 age-60–63 super catch-up). The parallel ACP test on employer matching contributions is deemed satisfied under §401(m)(11) so long as the match itself is the safe harbor match and any additional discretionary match does not exceed 4% of pay.^[4]

6. The top-heavy exemption and its narrow limits

The top-heavy determination under IRC §416 is a separate test from ADP/ACP. Its function is to make sure key employees don't accumulate more than 60% of the plan's total assets while rank-and-file employees get crumbs. A "key employee" for 2026 is any:

• officer of the employer earning more than $235,000 (2026 threshold per IRS Notice 2025-67),
• more-than-5% owner (at any compensation level), or
• more-than-1% owner earning more than $150,000.

If key employees hold more than 60% of aggregate plan account balances on the December 31 determination date, the plan is top-heavy for the FOLLOWING plan year — and the employer must contribute at least 3% of compensation to every non-key employee. In a small firm where the owner is 90% of the plan's balance, top-heavy status is essentially guaranteed.^[14]

IRC §416(g)(4)(H) exempts a plan from top-heavy status if the plan's only employer contributions are safe harbor contributions. That exemption is narrow. It breaks the moment any of the following occurs:

• The employer makes a discretionary match on top of the safe harbor match. The discretionary match is a non-safe-harbor employer contribution, so §416(g)(4)(H) no longer applies.
• The employer makes a profit-sharing contribution. Profit sharing is also outside the safe harbor.
• Forfeitures from unvested account balances are reallocated to participants rather than used to reduce employer contributions or offset plan expenses. Reallocated forfeitures count as employer contributions.

When the exemption breaks and the plan is top-heavy, the safe harbor contribution itself counts toward the 3% top-heavy minimum. A safe harbor plan using the 3% nonelective formula therefore satisfies top-heavy minimums automatically — the same 3% that satisfies the ADP exemption satisfies the top-heavy minimum. A safe harbor plan using a match (basic or enhanced) may still need to top-up NHCEs who defer zero and thus received zero match, but only up to the 3% minimum minus whatever match they did receive.^[6]

7. Adoption deadlines — the October 1 wall

A brand-new Safe Harbor 401(k) plan must be effective early enough in the plan year that eligible employees have at least three months to make elective deferrals. Treasury Regulation §1.401(k)-3(e) codifies the three-month minimum. For a calendar-year plan, October 1 is the last permissible effective date — later than that, the plan year is under three months long and the safe harbor status cannot be established.^[15]

Hitting October 1, 2026 for a new plan means:

• Plan document signed by: no later than September 30, 2026, but realistically 30–60 days earlier so a reasonable notice period exists.
• Safe harbor notice distributed to employees: for match plans only, the notice must be provided 30–90 days before the effective date under Treas. Reg. §1.401(k)-3(d). SECURE Act §103 eliminated the notice requirement entirely for 3% nonelective safe harbors, so nonelective plans skip this step.^[3]
• Payroll integration complete: employee deferrals must actually be deducted from paychecks starting no later than the first pay date on or after October 1, 2026.
• Recordkeeper onboarded: participant accounts must exist on the recordkeeping platform so deferrals can be deposited within the DOL's seven-business-day deposit rule (29 CFR §2510.3-102).

Miss October 1, and the safe harbor status cannot be established for the 2026 plan year — the plan simply runs as a traditional 401(k) subject to ADP/ACP testing, or adoption pushes to plan year 2027. However, SECURE Act §103 opened a partial workaround for one specific case: a 3% nonelective safe harbor can be retroactively adopted as late as 30 days before the end of the plan year (December 1 for a calendar-year plan). See section 8 below.

8. Mid-year adoption under SECURE Act §103 and SECURE 2.0

SECURE Act §103 (2019) rewrote the mid-year adoption rules for the 3% nonelective safe harbor. The change was substantial: an employer can now retroactively decide to be a Safe Harbor 401(k) after most of the plan year has already passed.

The rationale: a 4%-or-greater retroactive nonelective is so employer-favorable to NHCEs that the IRS is willing to accept the retroactive plan amendment through the following plan year. A 3% retroactive nonelective is more modest, so it must be committed to at least 30 days before year-end.^[3]

Two use cases dominate. First: a firm that ran a traditional 401(k) in 2026 and discovers in October that ADP testing is going to force $12,000 of refunds to owners can amend to a 3% nonelective safe harbor by December 1, 2026 and skip the test entirely — the safe harbor status wipes the ADP determination for the whole 2026 plan year. Second: a firm that had a strong 2026 in November can decide in mid-2027 to make a 4% retroactive nonelective for the 2026 plan year, both boosting the owner's real 2026 tax deduction and satisfying an old top-heavy exposure.

SECURE 2.0 §350, enacted in 2022, added a parallel mid-year window: an employer running a SIMPLE IRA can terminate the SIMPLE mid-year and replace it with a Safe Harbor 401(k) effective the day after SIMPLE termination, provided the safe harbor takes over the deferral obligations for the remainder of the plan year. Prior to §350, a SIMPLE IRA could only be replaced at year-end, forcing employers to choose their plan structure a full year in advance.^[16]

9. Notice requirements after SECURE §103

Traditional safe harbor match plans require an annual notice to all eligible employees describing (a) the safe harbor formula, (b) the employee's right to make and change elective deferrals, and (c) any plan features that could affect the safe harbor status. Treas. Reg. §1.401(k)-3(d)(3) requires the notice be distributed 30 to 90 days before each plan year begins — for a calendar-year plan, that means between October 3 and December 2 for the following plan year.^[17]

SECURE Act §103 eliminated the annual notice requirement entirely for the 3% nonelective safe harbor for plan years beginning after December 31, 2019. Nonelective safe harbor plans do not need to distribute a safe harbor notice at all — the IRS's reasoning is that a 3% employer contribution goes to every eligible employee regardless of whether the employee reads a notice, so the notice was pure paperwork with no behavioral consequence.

Two notice-related traps remain:

• A mid-year amendment INCREASING the nonelective contribution (say, 3% to 4%) reactivates the notice requirement — an updated notice must be distributed within a reasonable time before the effective date, typically 30–90 days.^[18]
• A mid-year amendment DECREASING or SUSPENDING the safe harbor contribution requires 30-day notice under IRS Notice 2020-52 and is only permitted if the employer either (a) is operating at an economic loss for the plan year or (b) the original safe harbor notice reserved the right to reduce or suspend.^[19]

10. SECURE 2.0 §102 tax credits — stacked

The single most attractive feature of a Safe Harbor 401(k) for a first-time sponsor with fewer than 100 employees is the stack of federal tax credits that SECURE 2.0 §102 added or expanded. Three credits can potentially apply to the same plan:

Credit 1: Startup credit — IRC §45E

SECURE 2.0 §102 amended IRC §45E to give an employer with 100 or fewer employees a credit equal to a percentage of "qualified startup costs" (administration, recordkeeping, participant education) for the first three plan years. The percentage is:

• 100% for employers with 50 or fewer employees, up to $5,000 per year.
• Phasing down between 51 and 100 employees — the maximum credit reduces by 1 percentage point per employee above 50, hitting 0% at 100 employees. In practice, the credit only meaningfully applies below ~75 employees.

Over three years, a firm with 50 or fewer employees can capture up to $15,000 of the startup credit.^[20]

Credit 2: Employer-contribution credit — IRC §45E(f)

SECURE 2.0 §102 also added an entirely new employer-contribution credit under IRC §45E(f). For firms with 100 or fewer employees, the credit is a percentage of the employer contributions made to non-highly-compensated employees, capped at $1,000 per NHCE:

The credit phases out linearly from 100% to 0% for employers with 51 to 100 employees. For an employer with 50 or fewer employees whose safe harbor contribution to each NHCE would otherwise be $1,000 or greater, the credit fully covers the employer contribution for the first two years, meaning the safe harbor is effectively free.^[20]

Credit 3: Automatic enrollment credit — IRC §45T

Any plan that adopts a QACA (or any Eligible Automatic Contribution Arrangement, "EACA") earns an additional $500-per-year credit for three years under IRC §45T. Because SECURE 2.0 §101 makes automatic enrollment mandatory for essentially all new plans, this credit is close to automatic for a 2026 Safe Harbor 401(k) startup.^[21]

Credit stacking — what it looks like

A firm with 25 employees adopting a QACA Safe Harbor 401(k) in 2026 with 3% nonelective and $50,000 of qualified startup costs over three years could see, in aggregate:

• $15,000 startup credit ($5,000 × 3 years),
• Up to $50,000 employer-contribution credit (25 NHCEs × $1,000 × [1.0 + 1.0 + 0.75 + 0.5 + 0.25] scaled), and
• $1,500 auto-enrollment credit ($500 × 3 years).

Over three years, that is up to $16,500 of federal tax credits per year for the peak years. The credits are nonrefundable but can be carried forward if not fully absorbed. For a first-time small-employer sponsor, the stack routinely covers the entire cost of the safe harbor contribution to NHCEs plus most of the plan's administrative expenses for the first three years.

11. Vesting and the safe harbor exception

The general 401(k) vesting rules under IRC §411(a) allow employer contributions to vest on either a three-year cliff (100% at year 3, 0% before) or a two-to-six-year graded schedule (20%/40%/60%/80%/100% at years 2-6). Employees who leave before the vesting date forfeit unvested amounts, which the plan can use to offset future employer contributions.

Safe harbor contributions must be 100% vested immediately as a condition of §401(k)(12) — the only exception is the QACA safe harbor under §401(k)(13), which permits a two-year cliff on the safe harbor contribution itself. The rationale is that safe harbor is a legal substitute for ADP testing, so the contribution has to be treated as if it were an employee deferral, which is by definition immediately vested.^[8]

The employer can still impose a vesting schedule on discretionary match, profit-sharing, and other non-safe-harbor employer contributions. In practice, a QACA plan that layers a discretionary profit-sharing contribution on top of the safe harbor commonly uses a two-year cliff on the safe harbor and a six-year graded schedule on the profit-sharing — different vesting on the two employer sources within the same plan.

12. Three worked case studies at 5, 15, and 30 employees

Case 1: 5-employee dental practice, one owner, basic match

Setup. Solo dentist owner earning $400,000 net; four W-2 employees at $50,000 average pay. Owner wants to max out her own deferral. Basic 4% match, calendar-year plan, effective January 1, 2026.

Owner deferral. $24,500 base + $8,000 age-50 catch-up (owner is 52; her prior-year FICA wages were $400,000 > $150K, so the §603 mandatory Roth rule forces the $8,000 catch-up to Roth). Total deferral: $32,500.

Owner safe harbor match. §401(a)(17) caps compensation at $360,000. 4% × $360,000 = $14,400.

Rank-and-file safe harbor match. Assume the four employees defer at 5% on average (needed to earn full match). 4% × $50,000 × 4 employees = $8,000.

Total employer safe harbor cost. $14,400 (owner) + $8,000 (rank-and-file) = $22,400.

Federal tax credits year 1. Startup credit: $5,000 (assuming $50,000+ of qualified startup costs). Employer-contribution credit: 4 NHCEs × min($1,000, $2,000 actual) = $4,000. Auto-enrollment credit: $500. Total year-1 credits: $9,500.

Net owner cost. $22,400 employer cost − $9,500 credits = $12,900. The owner's own $32,500 deferral is completely uncontested; ADP testing does not apply. The owner has effectively bought a $32,500 tax-deferred savings vehicle for $12,900 of net incremental payroll spending in year 1.

Case 2: 15-employee marketing agency, two HCE partners, 3% nonelective

Setup. Two owner-partners earning $220,000 each; two managers earning $150,000; eleven staff earning $65,000 average. Partners want to max deferrals AND avoid running ADP testing every year. Plan year 2026, 3% nonelective safe harbor, adopted retroactively October 2026 under SECURE §103 workaround.

Partner deferrals. Each partner defers $24,500 base + $8,000 catch-up (both partners over 50; prior-year FICA wages $220,000 > $150K, so §603 forces Roth catch-up). Total per partner: $32,500. Combined partner deferrals: $65,000.

3% nonelective total. 3% × ($440,000 + $300,000 + $715,000) = 3% × $1,455,000 = $43,650.

Partner-specific 3% nonelective. Each partner gets 3% × $220,000 = $6,600. Two partners: $13,200.

NHCE-specific 3% nonelective. Two managers × 3% × $150,000 + Eleven staff × 3% × $65,000 = $9,000 + $21,450 = $30,450.

Federal tax credits year 1. Startup credit: $5,000. Employer-contribution credit: 13 NHCEs × min($1,000, employer contribution to that NHCE). All 13 NHCEs received at least $1,000 (min NHCE received $65K × 3% = $1,950), so credit is 13 × $1,000 = $13,000. Auto-enrollment credit: $500. Total year-1 credits: $18,500.

Net cost. $43,650 employer cost − $18,500 credits = $25,150 net. The plan skips ADP testing entirely, top-heavy is satisfied automatically, and each partner's $32,500 deferral plus $6,600 nonelective gives them $39,100 of tax-advantaged retirement each — for a combined $78,200 of partner benefit purchased at a $25,150 net cost.

Case 3: 30-employee tech services firm, QACA enhanced match, top-heavy

Setup. One owner-CEO earning $500,000, three technical directors at $180,000, twenty-six W-2 employees at $85,000 average. The owner-CEO holds 78% of plan account balances at year-end 2025 — top-heavy. Plan year 2026, QACA enhanced match (100% of first 5%), auto-enrollment at 6% escalating to 10% by year 4.

Owner deferral. $24,500 base + $8,000 catch-up (over 50; §603 forces Roth catch-up). Total $32,500.

Owner safe harbor match. §401(a)(17) caps comp at $360,000. 5% × $360,000 = $18,000. (Owner already deferring above 5%, so full match earned.)

Director safe harbor match. Assume each director defers 10%. 5% × $180,000 × 3 directors = $27,000.

NHCE safe harbor match. 26 employees auto-enrolled at 6% (above the 5% match ceiling, so full match earned by all). 5% × $85,000 × 26 = $110,500.

Total employer safe harbor cost. $18,000 + $27,000 + $110,500 = $155,500.

Top-heavy status. Because the plan is QACA safe harbor with only safe harbor employer contributions (no discretionary match, no profit sharing), §416(g)(4)(H) exempts the plan from top-heavy status. The 78% owner concentration does not trigger the 3% minimum.

Federal tax credits year 1. Startup credit: $5,000 (assuming ≤50 employees, which this firm satisfies). Employer-contribution credit: 29 NHCEs × $1,000 = $29,000. Auto-enrollment credit: $500. Total year-1 credits: $34,500.

Net employer cost. $155,500 − $34,500 = $121,000 for year 1. The owner deferral is uncontested; top-heavy is automatically satisfied; the QACA structure captures the maximum available tax credits. Firms in this range routinely find that the year-1 net cost of a Safe Harbor QACA is roughly 3–5% of aggregate payroll — expensive on the surface but comparable to a match-based benefit that could not otherwise avoid ADP failures.

13. Six mistakes that break safe harbor status

Safe harbor status is not a permanent legal grant. It attaches only when the plan operates in strict conformity with §401(k)(12)/(13) throughout the plan year. The six most common failure modes:

1. Layering a discretionary match on top of the safe harbor match without checking ACP. A discretionary match that exceeds 4% of pay, or that matches deferrals above 6% of pay, or that is only available to a select group blows the §401(m)(11) ACP exemption. The plan must then run ACP testing on both the discretionary match and any employee after-tax contributions.
2. Making a mid-year amendment that changes the safe harbor formula without proper notice. IRS Notice 2016-16 permits mid-year amendments only if the change is either (a) not a "prohibited" mid-year change (a defined list) or (b) accompanied by an updated notice at least 30 days before the effective date. Signing an amendment on July 1 to switch from 3% nonelective to enhanced match without notice breaks safe harbor for the rest of the year.
3. Failing to fund the safe harbor contribution by the plan's tax filing deadline (including extensions). Safe harbor contributions must be funded no later than the employer's tax filing deadline (typically April 15 of the following year, or October 15 with an extension). Missing the deadline triggers a §4972 10% excise tax on the missed contribution AND retroactive loss of safe harbor for the plan year.
4. Terminating the plan mid-year without proper notice. A safe harbor plan can only be terminated mid-year in very narrow circumstances — the employer sells or dissolves, or the employer is in an economic loss and reserved the right in the original notice. Otherwise the plan must run through year-end and ADP testing kicks in for the short year.
5. Missing the SECURE 2.0 §603 mandatory Roth catch-up implementation. If any participant with 2025 FICA wages over $150,000 makes a 2026 age-50 catch-up as a pretax deferral, the excess pretax catch-up is a §401(a)(4) qualification failure. Plans that discovered they were not §603-ready in early 2026 relied on IRS Notice 2023-62's extended transition relief, but the transition period ended December 31, 2025 — 2026 is the enforcement year.
6. Auto-enrollment not implemented for a new plan established after December 29, 2022. SECURE 2.0 §101 makes auto-enrollment mandatory for essentially all new plans. A safe harbor plan established in 2023 or later that does not auto-enroll is technically noncompliant with §414A, and IRS Notice 2024-2 confirms the noncompliance is a plan qualification failure — not a safe harbor failure per se, but the fix requires either QACA amendment or reliance on Employee Plans Compliance Resolution System (EPCRS) correction.

14. Your 8-item 2026 Safe Harbor 401(k) checklist

15. FAQ