What an FMCSA-Compliant Online Driver Application Actually Has to Collect

There is no official FMCSA driver application form. Carriers ask us this constantly, usually while looking for a PDF to download, and the answer is in FMCSA’s own published guidance: "There is no specified form to be used in an application for employment. Carriers may develop their own forms, which may be tailored to their specific needs. The application form must, at the minimum, contain the information specified in Sec. 391.21(b)." That guidance was published at 62 FR 16370 on April 4, 1997 — before FMCSA existed, under the Federal Highway Administration — and it has not been replaced.

Which means the form is on you. If it is wrong, that is your form being wrong, not a template you inherited. Below is what 49 CFR 391.21 actually requires, the two notices most carrier websites leave out entirely, and — just as important — the seven things no web form can do for you no matter who builds it.

What information is required on a truck driver employment application?

Twelve categories, listed at 391.21(b)(1) through (b)(12). There is no (b)(13), whatever a checklist blog tells you. The reference table at the end of this post gives one row per item with the regulation cite, what it looks like as a web form input, and the mistake that costs you.

Two of the twelve are worth pulling out now, because they are the ones web forms get structurally wrong.

391.21(b)(9) requires "a statement setting forth in detail the facts and circumstances of any denial, revocation, or suspension" of a licence — "or a statement that no such denial, revocation, or suspension has occurred." A blank field does not satisfy that. The form needs an explicit control for the negative declaration, because the rule requires the applicant to say that nothing happened, not to leave the box empty.

391.21(b)(12) prescribes the certification wording and where it goes: "The following certification and signature line, which must appear at the end of the application form and be signed by the applicant: This certifies that this application was completed by me, and that all entries on it and information in it are true and complete to the best of my knowledge." The rule dictates both the words and the placement. A multi-step web form that captures a signature at step two, or that paraphrases the certification into friendlier language, is not tracking the rule.

One useful piece of latitude, from the same 1997 guidance: a third party may fill out the application, provided the applicant signs it. And 391.21(c) lets you ask for more than the twelve items — you just cannot ask for less.

How many years of employment history — 3 or 10?

Both, and they are different windows with different scopes. This is the single most-confused point in the rule, and getting it right is most of what separates a real form from a copied one.

391.21(b)(10) requires three years of all employers — every job, regardless of industry — with four sub-elements each, including whether the applicant was subject to the FMCSRs at that employer and whether the job was designated safety-sensitive under 49 CFR part 40 for periods after October 29, 2004.

391.21(b)(11) then adds, for applicants who will operate a commercial motor vehicle as defined by part 383 — that is, CDL applicants — "a list of the names and addresses of the applicant’s employers during the 7-year period preceding the 3 years contained in paragraph (b)(10) of this section for which the applicant was an operator of a commercial motor vehicle, together with the dates of employment and the reasons for leaving such employment."

So the three precision points, none of which survive in most summaries:

1. Three plus seven equals ten, so "ten years" is directionally right — but the two windows are not the same thing and do not collect the same data.
2. The seven-year block applies only to CDL applicants. A non-CDL driver of a commercial motor vehicle owes you the three-year block and nothing more.
3. Inside the seven-year block, only employers where the applicant actually drove a commercial motor vehicle must be listed. The three-year block covers every employer, trucking or not.

Worth knowing if you go reading the guidance: FMCSA’s own 1997 summary glosses (b)(11) as requiring "10 years of prior employment information on the driver," which is looser than the regulation text. The text controls.

Separately — and this trips people constantly — the safety performance history investigation under 391.23 reaches back three years, never ten.

Can a driver application be signed electronically?

Yes, and this is the section almost no page in this niche covers. 49 CFR 390.32 provides that anyone required to generate, maintain or exchange documents under parts 300 through 399 "may use electronic methods to satisfy those requirements," and that "An electronic signature may be made using any available technology that otherwise satisfies FMCSA’s requirements."

The conditions are in paragraph (d), and they are where web forms fail. Electronic records do not satisfy the section if "they are not capable of being retained, are not used for the purpose for which they were created, or cannot be accurately reproduced within required timeframes for reference by any party entitled to access." And they do not satisfy it if they "do not include proof of consent to use electronically generated records or documents, as required by 15 U.S.C. 7001(c)" — the E-SIGN consumer-consent provision.

Four consequences for the form on your website:

• It has to capture E-SIGN consent to use electronic records. Most carrier forms do not capture it at all.
• The signature method has to identify and authenticate the specific person. An unauthenticated typed name is thin.
• Submissions must be retainable and accurately reproducible on demand. A form that only fires an email notification and stores nothing fails this outright.
• This is a general provision. FMCSA has not approved any particular product, vendor or click-to-sign implementation for 391.21, and anybody telling you their form is FMCSA-approved is telling you something FMCSA has not said.

What 391.21(d) requires you to tell the applicant before they hit submit

This is the highest-value item in the rule for anyone who builds websites, because it is pure form-and-page copy. It is entirely within your control, and it is routinely missing.

Paragraph (d) imposes a duty, before the application is submitted, to tell the applicant that the (b)(10) employment information may be used and that previous employers will be contacted for the safety performance history investigation under 391.23(d) and (e).

It also requires written notice of the driver’s due-process rights under 391.23(i). That notice is owed to applicants with DOT-regulated employment in the preceding three years, and under 391.23(i)(1) it must be delivered "via the application form or other written document prior to any hiring decision." So the rule’s deadline for the second notice is the hiring decision rather than submission — but putting both on the form, above the submit button, is the design that cannot go wrong.

Those due-process rights are specific and worth stating on the page rather than paraphrasing: the right to review information provided by previous employers, the right to have errors corrected by the previous employer and re-sent, and the right to attach a rebuttal statement where the driver and the previous employer cannot agree. If the driver asks in writing, you have five business days to hand the records over.

Why one authorization checkbox is not a valid consent

Look at almost any carrier careers page and you will find a single checkbox along the lines of "I authorize you to contact all previous employers and obtain my records." That is not a compliant part 40 consent, and the prohibition is explicit.

Section 391.23(f)(1) requires the prospective employer to give the previous employer the driver’s consent meeting the requirements of 49 CFR 40.321(b), and 40.321(b) says: "‘Specific written consent’ means a statement signed by the employee that he or she agrees to the release of a particular piece of information to a particular, explicitly identified, person or organization at a particular time. ‘Blanket releases,’ in which an employee agrees to a release of a category of information… or to release information to a category of parties… are prohibited under this part."

Particular information. Particular, explicitly identified recipient. Particular time. An omnibus checkbox covering "all previous employers" is a category of information released to a category of parties — the exact thing the rule names. A form that is doing this properly generates a per-employer, per-request consent from the employment history the driver just entered.

And this is not a paperwork nicety. Section 391.23(f) provides that if the driver refuses that consent, or refuses consent for the Clearinghouse query, "the prospective motor carrier employer must not permit the driver to operate a commercial motor vehicle." Missing consent is a hard operational stop.

The same trap applies to PSP, if you use it. The PSP disclosure and authorization language must be used "in whole, exactly as provided," and — quoting the current published PSP enrollment agreement, last revised October 2024 — "the language on this form must exist as one stand-alone document. The language may NOT be included with other consent forms or any other language." So PSP consent cannot be a line item inside your application. Note that this obligation comes from the PSP account agreement and FCRA rather than from a CFR section, so do not let anyone tell you 49 CFR requires it.

What your form cannot do — the steps that happen after submit

This is where honest gets valuable, because the number of vendors implying a form delivers compliance is not small. Measured against the regulations, a website application cannot on its own satisfy any of the following.

• The MVR inquiry. Section 391.23(a)(1) requires an inquiry to each licensing authority where the driver held a licence in the preceding three years, and 391.23(b) requires it "in the form and manner each authority prescribes" — a state-by-state process no web form touches.
• The previous-employer safety performance history investigation. The form can collect the employer list and generate the consent. It cannot perform the inquiry, and 391.23(d) requires the request itself to carry specific contact information telling previous employers where to send the response.
• The Clearinghouse query and its consent. Section 382.701(a) requires a pre-employment full query before the driver performs any safety-sensitive function, plus at least one query per driver per year. And under 382.703(d), "A driver granting consent under this section must provide consent electronically to the Agency through the Clearinghouse prior to release of information to an employer." That consent structurally cannot live on your website. It is the cleanest single proof that a form is not compliance.
• The pre-employment drug test. Section 382.301(a) bars you from letting a driver perform safety-sensitive functions until you have a verified negative controlled-substances result in hand.
• Medical certification and the road test. And note that under 391.33 a carrier "may accept" a valid CDL in lieu of the road test — acceptance is permissive, and the substitution does not cover double or triple trailers or tank vehicles. Do not assume a CDL replaces your road test if you run tanks or doubles.
• The two files, and their retention. The driver qualification file under 391.51 and the separately secured driver investigation history file under 391.53.
• The annual obligations. Section 391.25 requires an MVR at least once every 12 months plus a documented annual review naming the person who performed it and the date.

What the form genuinely can and must own is the other list: all twelve 391.21(b) items including the negative declaration in (b)(9); the exact certification wording at the end per (b)(12); both 391.21(d) notices; a per-employer, per-request consent that satisfies 40.321(b); and, under 390.32, retainable and accurately reproducible records with an authenticating signature and E-SIGN consent.

The 30-day clocks, and what they actually start from

Most content on this topic has this backwards, and the error is expensive in both directions — it makes carriers think they cannot hire, and it makes them miss the deadlines that are real.

The MVR inquiry under 391.23(a)(1) is due "within 30 days of the date the driver’s employment begins." The safety performance history replies, or documentation of good-faith efforts to get them, go in the driver investigation history file within 30 days of employment start under 391.23(c)(1). Both clocks run from the date employment begins — not from the application, and not from a hiring decision.

The genuine pre-start gates are narrower: the pre-employment full Clearinghouse query with the driver’s consent given inside the Clearinghouse, a verified negative pre-employment controlled-substances result, medical certification, and road-test documentation before the driver operates a commercial motor vehicle.

The practical consequence, which nobody seems to say out loud: a driver can lawfully start before a previous employer has answered your inquiry. If someone has told you that you must wait 30 days for previous-employer responses before putting a driver in a truck, that is not what the rule says.

What if a previous employer never replies?

This is the question that comes up in every carrier forum, and the answers are almost always uncited. The regulation covers it directly.

Under 391.23(g), previous employers "must respond to each request for the DOT defined information in paragraphs (d) and (e) of this section within 30 days after the request is received. If there is no safety performance history information to report for that driver, previous motor carrier employers are nonetheless required to send a response confirming the non-existence of any such data." They must also keep a record of each request and response for one year, and provide contact information in case the driver wants to correct or rebut what was sent.

When they ignore you anyway, your obligations are documentary:

• Section 391.23(c)(2) requires a written record naming each previous employer, the address, the date you contacted or attempted to contact them, and the information received.
• Section 391.23(c)(3) says you should report a previous employer’s failure to respond to FMCSA using the complaint procedure in 49 CFR 386.12, and keep a copy in the driver investigation history file as evidence of a good-faith effort.
• Section 391.23(c)(4) covers the driver with no DOT-regulated employment in the preceding three years: you document that no investigation was possible, within the same 30 days.

A documented good-faith effort is the answer. That is worth designing for — your intake process should be recording the attempt, the date and the outcome, not just the reply.

Do I really need a driver qualification file?

Yes, and there are two files, not one. Section 391.51 requires a driver qualification file for each driver, which may be combined with the personnel file, retained for the period of employment plus three years.

Section 391.53 requires a second, separate driver investigation history file, "maintained in a secure location with controlled access," where access is limited to people involved in the hiring decision, and where the data "must only be used for the hiring decision." Your insurer may see that file — except the alcohol and controlled substances data, which 391.23(k) specifically bars you from providing to your own insurer.

One correction worth more than the rest of this section: the previous-employer safety performance history records go in the 391.53 investigation file, not the driver qualification file. Section 391.51(b), which enumerates DQ file contents, does not list them. Filing drug-and-alcohol history into the general DQ or personnel file is a mistake an auditor will find.

We are deliberately not publishing a DQ file checklist here, and you should be sceptical of the ones you find. The rule is genuinely in motion right now: the National Registry verification item at 391.51(b)(8)(ii) was written to run only through June 22, 2025, and the medical certificate item at (b)(6)(ii) is currently modified by an FMCSA exemption running April 11 to October 11, 2026 that allows a paper copy in the file for up to 60 days. Any static checklist published this year is describing a temporary state.

Who is exempt from the requirements of 49 CFR 391?

Fewer people than carriers hope, and more than the blanket statements suggest.

Part 391 applies to drivers of commercial motor vehicles as defined in 390.5, which starts at 10,001 pounds GVWR or GCWR — not at the 26,001-pound CDL threshold in 383.5. So a non-CDL driver of a 12,000-pound truck still needs a 391.21 application, an MVR under 391.23(a)(1), a safety performance history investigation, and a driver qualification file.

What that driver is not in is the part 382 testing programme or the Clearinghouse. Those apply to drivers subject to the part 383 CDL requirements, with further exceptions in 382.103(c) and (d). Worth flagging if you sell or buy consortium services: they are not universal to every CMV driver.

Also note that 391.21(a) opens "Except as provided in subpart G of this part" — see 391.61 on continuously employed drivers — so "every driver must complete this" is overbroad. And FMCSA grants case-by-case driver qualification exemptions.

Everything above is the federal interstate baseline. Under 49 CFR 350.305 a State may exempt commercial motor vehicles below 26,001 pounds from all or part of its intrastate safety rules, and under 350.303(b) States have up to three years to adopt an FMCSR change. If you run intrastate only, check your own State — we are not going to guess it for you.

FMCSA once asked whether this rule should be scrapped

In March 2019 FMCSA published an Advance Notice of Proposed Rulemaking titled "Qualification of Drivers; Employment Application" under docket FMCSA-2018-0247, seeking comment on reducing or entirely eliminating the 391.21 employment application requirement.

Nothing followed. It is the only Federal Register document in that docket, no proposed or final rule came out of it, and 391.21 was separately amended in 2022 with all twelve items intact. So if you are wondering whether this is a rule on its way out: it was considered, and it stayed.

Where the audit points actually are

This reframes the whole subject, and it is the part that should change how you spend your money.

FMCSA’s safety rating and safety audit scoring lists certain regulations as acute or critical. Appendix B to Part 385 names "§ 391.51(a) Failing to maintain driver qualification file on each driver employed (critical)," "§ 391.51(b)(2) Failing to maintain inquiries into driver’s driving record in driver’s qualification file (critical)," and "§ 391.51(b)(6) Failing to maintain medical examiner’s certificate in driver’s qualification file (critical)." Using a physically unqualified driver under 391.11(b)(4) and using a disqualified driver under 391.15(a) are both acute.

Sections 391.21 and 391.23 appear nowhere on that list. Neither does 391.25 or 391.53.

So the enforcement weight sits on the file, not on the form. Which is exactly why nobody should sell you a website as compliance — and why the form still matters, because a file cannot contain what the form never collected.

If you are a newer carrier, one more thing belongs on your radar: 49 CFR 385.321(b) lists sixteen regulations whose violation causes automatic failure of a new entrant safety audit, including knowingly using a disqualified driver and knowingly using a physically unqualified driver on a single occurrence. New entrant audits are aimed at exactly the carriers most likely to be running a hand-me-down application form.

One accuracy note while you are cleaning up: 49 CFR 391.27 is now [Reserved]. The 2022 Record of Violations rule eliminated the annual list-of-violations requirement as duplicative of the annual MVR inquiry. Older checklists and AI-generated summaries still list it as live.

What to do with this

Print the table below and go through your own application form line by line. If your form is missing the negative declaration in (b)(9), or paraphrases the (b)(12) certification, or does not carry both 391.21(d) notices, or uses one blanket authorization checkbox, or emails submissions without storing them — those are fixable, and they are all fixable in the form itself.

What is not fixable in the form is the part after submit. The inquiries, the queries, the tests and the two files are yours as the motor carrier, and no vendor can take them off you.