Policies Written for 2019, Enforced in 2025: The Workspace Compliance Risks Your Legal Team May Not Have Found Yet

Compliance failures rarely announce themselves in advance. They surface in discovery documents, regulatory correspondence, and insurance claim reviews—at which point the organization is no longer managing a policy gap but managing a consequence. Workspace compliance is particularly susceptible to this dynamic, because the policies governing physical and hybrid work environments tend to be treated as administrative infrastructure rather than legal exposure, and administrative infrastructure does not get reviewed until something breaks.

For a significant number of US enterprises, something is quietly in the process of breaking.

The Policy Vintage Problem

Most corporate workspace policies were last comprehensively reviewed before March 2020. At that time, the operative assumptions were clear: employees worked in employer-controlled facilities, those facilities were governed by established occupancy and safety codes, data handling occurred on corporate networks, and the physical workspace was a fixed, auditable environment.

None of those assumptions hold universally today. Employees work across a range of environments that the employer does not control and cannot inspect. Data handling occurs on home networks, in shared coworking spaces, and across personal devices that may or may not meet corporate security standards. The definition of the workplace itself has become legally contested in ways that pre-pandemic employment and real estate law did not anticipate.

Organizations that have updated their remote work policies to address scheduling and availability expectations—but have not revisited the underlying compliance frameworks governing ergonomics, data security, accessibility, and occupancy—are operating on a foundation with structural gaps.

Ergonomic Liability in the Distributed Workplace

Occupational Safety and Health Administration (OSHA) guidelines on ergonomics apply to employer-designated workstations regardless of their physical location. When an enterprise formally designates an employee's home as a primary or secondary work location—as many hybrid work agreements now do—the employer's ergonomic obligations do not disappear at the front door of the corporate campus.

The practical compliance challenge is substantial. Most enterprises lack any systematic process for assessing home workstation ergonomics, and most hybrid work agreements do not include provisions that address this obligation explicitly. The result is a population of formally designated remote workers whose work environments have never been assessed against the standards that apply to their in-office counterparts.

Workers' compensation claims arising from remote work injuries represent a growing category of litigation that is testing how courts interpret employer ergonomic obligations in distributed work contexts. Several states, including California, have begun developing more prescriptive guidance on employer responsibility for remote workstation conditions. Organizations operating across multiple states face a patchwork of evolving standards that their pre-2020 policies were not written to navigate.

Data Security and the Shared Workspace Problem

Coworking spaces and shared work environments introduce a category of data security exposure that most enterprise information security policies have not formally addressed. When employees access sensitive client data, proprietary systems, or regulated information from shared physical environments—whether a national coworking chain, a hotel business center, or a coffee shop—the organization's data governance obligations do not suspend.

For enterprises in regulated industries—financial services, healthcare, legal, and government contracting—the exposure is acute. HIPAA, FINRA regulations, and various state-level data privacy statutes impose specific requirements on how protected information is accessed and handled, requirements that presuppose controlled physical environments. A policy framework that does not explicitly address how employees must handle regulated data in uncontrolled physical spaces is a policy framework with an unacknowledged compliance gap.

Data breach litigation increasingly examines the adequacy of employer policies governing remote data access as a factor in determining organizational liability. A policy that addresses network security without addressing the physical environment in which that network access occurs is increasingly unlikely to satisfy judicial scrutiny.

Accessibility Compliance in Hybrid Environments

The Americans with Disabilities Act imposes affirmative obligations on employers to provide reasonable accommodations that enable employees with disabilities to perform their essential job functions. In a fully in-office environment, these obligations are relatively well-understood: accessible building design, assistive technology, modified workstations, and similar physical accommodations.

Hybrid work has introduced a layer of complexity that ADA compliance frameworks are only beginning to address. When an employee with a disability requests a hybrid or remote accommodation, the employer's obligation to provide an accessible work environment does not diminish—but the mechanisms for fulfilling that obligation change substantially. Enterprises that have not updated their accommodation processes to account for hybrid work arrangements may be applying pre-pandemic frameworks to post-pandemic situations in ways that do not satisfy current legal standards.

The Equal Employment Opportunity Commission has issued updated guidance on disability accommodations in remote and hybrid contexts, and enforcement activity in this area is increasing. Organizations whose accommodation policies were last reviewed before hybrid work became a standard operational model face meaningful compliance risk.

Occupancy Density and Building Code Exposure

Many enterprises reduced their physical footprint during and after the pandemic, consolidating employees into smaller spaces or reconfiguring existing spaces to accommodate flexible seating arrangements. These reconfigurations were often executed under emergency conditions, without the systematic building code review that would accompany a formal renovation project.

Local fire codes and occupancy regulations impose maximum density limits on commercial spaces based on square footage, egress capacity, and intended use classification. Flexible seating arrangements that allow the same space to be used by different employee populations at different times may, on peak utilization days, exceed the occupancy classifications under which the space is permitted. Organizations that have not formally reviewed their reconfigured spaces against current occupancy certifications are carrying a compliance exposure that may not surface until an inspection or, worse, an incident.

Building a Current-Generation Governance Framework

Addressing these risks requires a structured approach that treats workspace compliance as a living governance function rather than a static policy document.

A current-generation workspace governance framework should include: a formal inventory of all work location types in which employees are designated to operate, including home offices and coworking arrangements; an ergonomic assessment protocol applicable to non-corporate locations; explicit data handling standards for uncontrolled physical environments, segmented by data classification level; an updated accommodation process that addresses hybrid and remote work contexts; and a recurring occupancy certification review process tied to any space reconfiguration activity.

This framework should be reviewed on at least an annual basis, with triggers for interim review when regulatory guidance changes, when workforce distribution patterns shift materially, or when the organization enters new geographic markets with different compliance environments.

The organizations that will navigate the emerging wave of workspace-related litigation and regulatory scrutiny most effectively are those that recognize workspace governance as a strategic legal function—not an HR administrative task. The policies written for 2019 were adequate for 2019. They are not adequate for what enterprises are actually operating today.