OSHA compliance means meeting the specific standards that apply to your industry, meeting the general duty to protect workers from recognized hazards, and being able to prove both with records. It is not one checklist. It is a set of separate obligations with different trigger conditions, different deadlines, and different retention rules.
This guide covers all of them: who OSHA actually covers, the written programs and training an inspector will ask for, the four separate recordkeeping and reporting obligations under 29 CFR Part 1904, what happens during an inspection, what citations cost in 2026, and which rules are proposed but not yet in force. If you are working toward one date right now, it is November 20, 2026, when employers using hazardous chemical substances need their workplace labeling, written hazard communication program, and employee training updated for the revised Hazard Communication standard.
The Occupational Safety and Health Administration (OSHA) was created by the Occupational Safety and Health Act of 1970. Your obligations come from two places, and they work differently.
Specific standards. These are codified in Title 29 of the Code of Federal Regulations. Which set applies depends on the work, not the company: 29 CFR 1910 covers general industry, 1926 covers construction, 1915, 1917, and 1918 cover shipyards, marine terminals, and longshoring, and 1928 covers agriculture. A manufacturer doing a plant expansion can be subject to both 1910 and 1926 on the same site, in different areas, on the same day.
The General Duty Clause. Section 5(a)(1) of the OSH Act requires employers to furnish a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. It exists to cover hazards that no specific standard addresses. OSHA uses it where there is no standard on point, and it is how the agency currently cites heat exposure at the federal level.
There is a third layer that is not law, and confusing it with the first two is a common and expensive mistake. Consensus standards such as ANSI, NFPA, and ISO 45001 are voluntary unless OSHA has incorporated a specific edition into a standard by reference. ISO 45001 certification does not satisfy an OSHA requirement, and an OSHA-compliant program is not automatically ISO 45001 conformant. Many companies pursue both. Only one of them can generate a citation.
This determines which agency inspects you, which rules you follow, and which deadlines apply, so settle it before anything else.
Under Section 18 of the OSH Act, states may run their own programs if OSHA approves them as at least as effective as the federal program. According to OSHA's State Plan FAQs, 22 states and territories operate State Plans covering both private sector and state and local government workers. Six more states plus the U.S. Virgin Islands run plans that cover state and local government employees only; in those seven, private employers stay under federal OSHA.
Two consequences worth planning around:
State plans can be stricter, never weaker. California requires every employer to have a written Injury and Illness Prevention Program, which federal OSHA does not. Several state plans have adopted heat illness standards while there is still no federal heat standard. If you operate in more than one state, a single corporate program will not automatically satisfy every jurisdiction.
State and local government workers are not covered by federal OSHA at all. They have OSH Act protections only where a State Plan covers public employees. Municipal utilities, county road departments, and public school districts fall into this gap constantly.
Some workers are outside OSHA jurisdiction entirely, including the self-employed and workplaces regulated for occupational safety by another federal agency. Mining is the clearest example: those sites answer to MSHA, not OSHA.
Federal OSHA does not require every employer to maintain one general written safety program. Instead, individual OSHA standards require specific written programs when they apply to an employer's industry, operations, hazards, or workplace conditions. During an inspection, OSHA may request any applicable programs by name, such as hazard communication, respiratory protection, or lockout/tagout.
Hazard Communication (29 CFR 1910.1200). A written hazard communication program is required if employees may be exposed to hazardous chemicals. That reaches far past chemical plants: cleaning products, solvents, adhesives, coatings, fuels, and lubricants all count.
Respiratory Protection (1910.134). A written program with worksite-specific procedures is required wherever respirators are necessary to protect employees. Voluntary respirator use carries a narrower but still real set of obligations.
Control of Hazardous Energy, or lockout/tagout (1910.147). Documented energy control procedures are required for servicing and maintenance where unexpected energization could injure someone. The exception for simple machines is narrow and has multiple conditions that must all be met.
Bloodborne Pathogens (1910.1030). A written exposure control plan is required where employees have reasonably anticipated occupational exposure to blood or other potentially infectious materials, and it must be reviewed and updated at least annually. This standard reaches manufacturing plants with designated first responders, not just clinics.
Permit-Required Confined Spaces (1910.146). A written permit space program is required if you have permit spaces and employees will enter them. Construction work has its own confined space standard in 29 CFR 1926 Subpart AA, with different requirements.
Emergency Action Plans (1910.38). Required when another OSHA standard requires one, not universally. It must be in writing and kept in the workplace, except that an employer with 10 or fewer employees may communicate the plan orally.
Hearing Conservation (1910.95). A hearing conservation program is triggered when noise exposure equals or exceeds an 8-hour time-weighted average of 85 dBA, the action level. That is below the 90 dBA permissible exposure limit, which is where teams that only track the PEL get caught.
Where This Goes Wrong:
The plan exists as a template someone downloaded, and it describes a facility that does not match the one being inspected. Just as often, no plan exists at all, because no one knew a written program was required in the first place. A written program that names equipment you do not have, or omits a process you run daily, is worse than no program, because it documents that the hazard assessment was never performed. Neither version survives an inspection. Hazard communication, respiratory protection, and lockout/tagout hold their places on OSHA's annual Top 10 citation list year after year, and the absence of a compliant written program is a primary reason why.
Treating "annual training" as the whole picture is one of the more common misconceptions in EHS. OSHA does require annual training across a meaningful number of standards, roughly 27 within general industry alone, whether that takes the form of hands-on practice, a refresher, or a documented annual review. The problem is the assumption that runs in both directions. Many obligations are event-triggered, tied to a new hire, a process change, a new chemical, or an observed performance gap, and calendar-based scheduling misses them entirely. At the same time, some organizations run sessions yearly that their applicable standards never called for, while leaving a genuine annual requirement uncovered. OSHA Publication 2254, Training Requirements in OSHA Standards, maps the requirements standard by standard and is the place to verify what actually applies to your operation.
Hazard Communication training is event-based, not annual. OSHA requires effective information and training at the time of initial assignment, and whenever a new chemical hazard the employee has not been trained on is introduced into their work area. A calendar-driven annual refresher is a reasonable practice, and many companies do it, but it does not satisfy the standard on its own if a new hazard arrives in March and training waits until December.
Powered industrial trucks are evaluated every three years, not trained every year. Under 1910.178, each operator's performance must be evaluated at least once every three years. Refresher training is separately triggered by unsafe operation, an accident or near miss, an unfavorable evaluation, a change in the type of truck, or a change in workplace conditions.
A signed attendance sheet documents that employees were present; it does not prove they understood the training. If employees cannot understand the language used during the training, the sign-in sheet will not establish compliance.
Bloodborne pathogens training is at initial assignment and at least annually thereafter, which is one of the genuinely annual requirements.
Lockout/tagout requires a periodic inspection of the energy control procedure at least annually, which is an inspection of the procedure and the authorized employees applying it, not a training class.
One requirement applies across all of it. OSHA states that training must be provided in a language workers can understand. A signed English-language sign-in sheet from a crew that does not read English is not a defense; it is evidence.
Which is why the record matters as much as the session. Training you cannot evidence, by person, by requirement, by date, is training you cannot prove happened.
People collapse these into "OSHA logs." They are distinct, with different thresholds and different deadlines, and mixing them up is how establishments miss a filing they were required to make.
Employers with more than 10 employees must record injuries and illnesses that meet OSHA's recordability criteria and illnesses on the OSHA 300 log, complete a 301 incident report or an equivalent form like an IE form. for each recordable case, and prepare the 300A annual summary. Two partial exemptions apply: establishments with 10 or fewer employees at all times during the previous calendar year, and establishments in low-hazard industries listed in Appendix A to Subpart B of Part 1904. Appendix A to Subpart B of Part 1904 lists the partially exempt industries by NAICS code, and that list is built on the 2007 NAICS framework. Classify the establishment under 2007 NAICS, not under 2017 or 2022. A code that was renumbered, split, merged, or retired in a later revision does not carry an exemption forward on its own, and the reverse is also true: a code that appears exempt in a current NAICS lookup means nothing if the 2007 classification for that establishment falls outside Appendix A. Determine the correct 2007 code first, then check it against the appendix.
Cases requiring first aid only are not recordable. Records must be kept at the worksite for at least five years.
The 300A summary must be posted where employees can see it from February 1 through April 30 each year. It has to be certified by a company executive, which the regulation defines narrowly: an owner (sole proprietorship or partnership only), a corporate officer, the highest-ranking company official working at the establishment, or that person's immediate supervisor. An unsigned 300A is treated as noncompliant.
Electronic submission through OSHA's Injury Tracking Application is a separate obligation with its own coverage rules. Under 29 CFR 1904.41, three categories of establishment must submit, based on headcount at any time during the previous calendar year:
250 or more employees, in an industry required to keep Part 1904 records: submit Form 300A data.
20 to 249 employees, in an industry listed in Appendix A to Subpart E: submit Form 300A data.
100 or more employees, in an industry listed in Appendix B to Subpart E: submit Form 300 and Form 301 case detail in addition to the 300A.
The deadline is March 2 for the prior calendar year, and it applies to establishments under State Plans as well as federal OSHA. The third category is the newest and the most missed, because it turns on a designated-industry list rather than on size alone.
This obligation applies even to employers who are partially exempt from keeping records. Under 29 CFR 1904.39, you must report a work-related fatality within 8 hours, and a work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours. Reports go to the nearest OSHA Area Office, the 24-hour hotline, or OSHA's online reporting form.
Three details that decide real cases:
A fatality is reportable only if the death occurs within 30 days of the work-related incident. A hospitalization, amputation, or eye loss is reportable only if it occurs within 24 hours of the incident. An employee admitted three days later for a related condition is recordable but not reportable — this is also only a recordable if it otherwise meets OSHA's recording criteria and the employer is required to maintain records.
In-patient hospitalization means formal admission for care or treatment. Admission for observation or diagnostic testing only is not reportable.
If you learn about the event late, the clock runs from when it was reported to you or your agent, not from the incident.
Our deeper walkthrough of the logs, the ITA file format, and where manual processes break down is in OSHA incident reporting software: the complete guide.
OSHA publishes its most frequently cited standards each year, and the list is the closest thing the agency gives you to a public inspection preview. Eric Harbin, regional administrator for OSHA's Dallas region, presented the fiscal year 2025 preliminary data at the National Safety Council (NSC) Congress & Expo in September 2025. Fall protection topped the list for the fifteenth consecutive year.
Read it carefully before you plan around it. These counts are preliminary; OSHA releases finalized fiscal year data later, and the numbers generally rise. The list also reflects federal OSHA inspections only, so it understates activity in the 22 State Plan jurisdictions. And citation frequency is not the same as citation cost, since lockout/tagout and machine guarding are cited less often than ladders but are far more often classified as serious.
The practical read for a general industry site: five of the ten are 1910 standards, and hazard communication sits at number two. If you run a manufacturing plant and want the highest-yield self-audit, start with HazCom, lockout/tagout, respiratory protection, forklifts, and machine guarding. Current-year rankings are published on OSHA's Top 10 page. In addition, HazCom and Respiratory Protection standards for Construction are identical to General Industry.
OSHA has jurisdiction over millions of worksites and a compliance officer headcount that cannot come close to covering them, so it works from a priority order.
The scope differs by type, and this is worth knowing before the officer arrives. An unprogrammed inspection responding to a complaint or a reported fatality is generally limited to the hazard that prompted it (If the OSHA inspector observes other hazards or if records reveal related concerns, the inspector will expand the inspection). A programmed inspection is comprehensive by design.
The sequence is an opening conference, a walkaround where an employee representative may accompany the compliance officer, document requests, and a closing conference. The document requests are predictable: written programs, training records, the OSHA 300 logs, hazard assessments, inspection and maintenance records, and safety data sheets. How fast you can produce those, and whether they are internally consistent, shapes the rest of the inspection - Being honest about anything that can't be produced goes a long with inspectors as it can improve the person experience for both parties.
Citations are classified as other-than-serious, serious, willful, repeat, or failure to abate. A repeat citation generally requires a substantially similar violation that became a final order, typically within the prior five years, which is why an unresolved citation at one site raises the stakes at every other site you operate.
Penalty maximums are adjusted annually for inflation, but not this year. In a memorandum dated May 21, 2026, OSHA stated there are no inflation-based increases for 2026 and that 2025 amounts remain in effect. The statute requires the prior October CPI-U figure, and that data was not published. Current maximums:
Those are ceilings, not invoices. OSHA applies reduction factors for employer size, good faith, and history. A revision to Chapter 6 of the Field Operations Manual, effective July 14, 2025, expanded the maximum size-based reduction from employers with 1 to 10 employees to employers with 1 to 25.
After citations issue, you have 15 working days to file a written notice of contest with the OSHA Area Director. Miss that window and the citation, penalty, and abatement date become a final order of the Occupational Safety and Health Review Commission and are no longer contestable. Citations must also be posted at or near the location of the alleged violation.
The history matters here, because the two are routinely described backwards. OSHA promulgated the Hazard Communication standard in 1983, years before the United Nations Globally Harmonized System of Classification and Labelling of Chemicals (GHS) existed. GHS came later, and OSHA aligned the existing standard to it: to GHS Revision 3 in 2012, and again in a final rule published May 20, 2024 that aligns primarily to GHS Revision 7. HazCom was not built around GHS. It was retrofitted to it, twice.
The 2024 rule took effect July 19, 2024 with staggered compliance dates. Then, in a final rule published January 15, 2026, OSHA extended every one of those dates by four months, citing its own delay in publishing compliance guidance. Anything you read that still lists the original dates is out of date. The current schedule:
May 19, 2026 (passed): chemical manufacturers, importers, and distributors evaluating substances comply with the modified provisions.
November 20, 2026: for substances, employers update any alternative workplace labeling used under the standard, update the written hazard communication program, and provide additional employee training for newly identified physical hazards, health hazards, or other hazards.
November 19, 2027: manufacturers, importers, and distributors evaluating mixtures comply.
May 19, 2028: employers complete the same updates for mixtures.
Until your applicable date arrives, OSHA allows compliance with the 2012 standard, the 2024 standard, or a combination of both. That flexibility ends per date, not all at once.
The detail most summaries drop: HazCom includes a category called hazards not otherwise classified, covering adverse physical or health effects identified during classification that do not meet the criteria of any defined hazard class. It is awkward to explain, so it gets left out of training decks. It is also exactly the kind of omission that turns a program review into a finding.
Practically, the November date is a document-and-train exercise. Suppliers began issuing revised safety data sheets and labels after their May 2026 date, so the work is: pull the updated SDSs into your library, compare the new classifications against your existing workplace labels, revise the written program where your processes changed, and train affected employees on hazards that are newly identified for the substances they handle. See OSHA's hazard communication rulemaking page for the agency's own materials.
In January of 2025, a 60 day Regulatory Freeze was initiated that effectively put everything in the current rulemaking agenda on hold for review. What's come from this is a Deregulatory Rulemaking process that is designed to reduce redundancy and make certain rules less cumbersome to manage (Source).
The proposed standard. OSHA published a notice of proposed rulemaking, Heat Injury and Illness Prevention in Outdoor and Indoor Work Settings, on August 30, 2024. It is still proposed. There is no federal heat standard in effect, but that doesn't mean that no employer is required to comply with the proposal's provisions.
The enforcement program. OSHA issued a revised National Emphasis Program for outdoor and indoor heat-related hazards on April 10, 2026, effective for five years unless superseded. An NEP directs where OSHA inspects. It does not create a new employer obligation.
The clause OSHA actually cites. Federal heat citations are issued under the General Duty Clause, Section 5(a)(1), which requires a recognized hazard and a feasible means of abatement.
Separately, several State Plans already enforce their own heat illness prevention standards (California, Colorado, Maryland, Minnesota, Nevada, Oregon, and Washington). If you operate in one of those states, that is a real requirement today, independent of federal rulemaking.
OSHA's On-Site Consultation Program is delivered by state agencies and universities, funded largely by OSHA, and operated separately from the enforcement side. It is aimed primarily at small and medium-sized employers. Employers have to agree to correct anything serious that's identified by agreed upon deadlines with the understanding that if they don't, the consultation program can and will refer the matter to OSHA for enforcement.
At the FY2025 Top 10 presentation, Eric Harbin specifically encouraged small and medium-sized employers to use the program. It remains underused, largely because employers assume any contact with OSHA creates enforcement exposure.
How Do You Build an OSHA Compliance Program That Survives an Inspection?
Five things separate programs that hold up from programs that do not:
Software does not make you compliant. The obligation sits with the employer, and no platform changes that. What a platform does is remove the failure modes above by centralizing the record and automating the scheduling. EHS software also helps by providing more visibility, standardizing inspections and other processes and by providing a way to actually use the data being collected to do things like predict future incidents before they actually become incidents.
Here is specifically what EHS Insight does against the obligations in this guide:
Incident Management: The Incident Event form supports OSHA, WCB, RIDDOR, and MSHA reporting based on configured site settings. It includes OSHA 300, 300A, and 301 equivalent reports, plus OSHA ITA 300/301 and ITA 300A reports that display the data needed for OSHA's ITA CSV import. Case classifications (first aid, medical treatment, restricted work, lost time, fatality) feed TRIR, DART, LTIR, and severity rate reports by business entity, month, quarter, and year.
Compliance Tasks: Schedules one-time and recurring compliance activities, assigns them by business entity, role, or individual, and sends reminders and escalation notifications for upcoming and overdue items. Tasks appear on a Compliance Calendar and can be completed offline and synced later. This is the module that keeps a quarterly stormwater inspection or an annual lockout/tagout procedure review from silently lapsing.
Audit and Inspection Management: Configurable Question Sets define what each audit or inspection collects. Inspections can be grouped into Audit Routes, assets tagged with QR codes, and results recorded offline. Findings can generate mandatory or discretionary CAPAs directly from the audit, so the finding and its closure live in the same record.
Training Management: Training Requirements are assigned by position, position family, or training group, with grace periods for new hires, position changes, and newly added requirements. Automated 30/60/90 day expiry and forecast emails go to individuals and supervisors, and the Training Forecast report lists requirements projected to expire. SCORM and AICC content is supported with additional licensing, alongside the OpenSesame course library.
Safety Data Sheet management: Material records store composition and hazard properties with the SDS attached, and a site setting can require an SDS attachment on every material. The SDS Dashboard gives field employees a My Location view and a Company Library view, supports offline SDS access, and prints predefined or ad hoc container labels from the material record. Directly relevant to the November 2026 HazCom work.
Legal Register: Tracks legal and regulatory obligations as individual records with a status lifecycle (draft, awaiting review, active, archived), assigns applicability by business entity, and links obligations to the Compliance Tasks that support them. Regulatory content can be synced through the STP RegHub integration where that integration is licensed and enabled.
Notice the verbs: These modules track, schedule, assign, notify, and document. They support your compliance efforts and give you the evidence trail an inspection demands. They do not guarantee a compliance outcome, and any vendor who tells you otherwise is selling you a liability. If you are earlier in the evaluation, start with what EHS software is and what it should include, or browse the full module list.
What Does OSHA Compliance Mean?
OSHA compliance means meeting the specific standards in 29 CFR that apply to your work, meeting the General Duty Clause obligation to protect employees from recognized hazards where no standard applies, and maintaining the records that demonstrate both. It covers written programs, training, hazard controls, recordkeeping, and reporting. It ultimately means doing the things that help ensure workers are operating in a safe and healthy environment.
Which Employers Have to Keep OSHA 300 Logs?
Employers with more than 10 employees must keep OSHA 300, 300A, and 301 records, unless their establishment is in one of the low-hazard industries listed in Appendix A to Subpart B of 29 CFR Part 1904. Establishments with 10 or fewer employees at all times during the previous calendar year are partially exempt. Partially exempt employers still must report fatalities and certain severe injuries.
When Is the OSHA Electronic Reporting Deadline?
March 2 each year, for the previous calendar year. Establishments with 250 or more employees in industries required to keep records, and those with 20 to 249 employees in industries listed in Appendix A to Subpart E, submit 300A data. Establishments with 100 or more employees in industries listed in Appendix B submit 300 and 301 case detail as well. Headcount is measured at any point during the previous calendar year.
How Quickly Must You Report a Fatality to OSHA?
Within 8 hours of a work-related fatality, and within 24 hours of a work-related in-patient hospitalization, amputation, or loss of an eye. A fatality is reportable only if it occurs within 30 days of the incident; hospitalization, amputation, or eye loss is reportable only if it occurs within 24 hours of the incident. Hospitalization for observation or diagnostic testing alone is not reportable.
How Often Is HazCom Training Required?
At the time of initial assignment, and whenever a new chemical hazard the employee has not been trained on is introduced into their work area. It is not an annual requirement, though many employers run annual refreshers as a matter of practice. Separately, employers have until November 20, 2026 to provide additional training for hazards newly identified for substances under the revised standard, and until May 19, 2028 for mixtures.
What Is the Maximum OSHA Penalty in 2026?
$16,550 per serious or other-than-serious violation, $165,514 per willful or repeat violation, and $16,550 per day for failure to abate past the abatement date. OSHA did not apply an inflation adjustment for 2026, so the amounts set in January 2025 carry forward. These are maximums before reductions for employer size, good faith, and compliance history.
Does OSHA Require a Written Safety Program?
Federal OSHA does not require a single general written safety program. It requires specific written programs when the standard includes it as a require and that standard is applicable to the employer including hazard communication, respiratory protection, lockout/tagout, bloodborne pathogens, permit-required confined spaces, and emergency action plans where another standard requires one. Some State Plans go further; California requires every employer to maintain a written Injury and Illness Prevention Program.
What Is the Difference Between Federal OSHA and a State Plan?
A State Plan is a state-run program that OSHA has approved as at least as effective as the federal program, and it enforces workplace safety in place of federal OSHA for covered employers. Twenty-two states and territories run plans covering private sector and public sector workers. Six states plus the U.S. Virgin Islands run plans covering state and local government employees only, leaving private employers there under federal OSHA. State Plans may adopt stricter standards, never weaker ones.
Put Your OSHA Obligations in One System
If your compliance calendar lives in a spreadsheet and your training records live in three places, the November 20 HazCom deadline is a good forcing function. See how EHS Insight tracks recurring obligations, OSHA logs, training expirations, and audit findings in a single record: book a 20-minute demo.