OSHA Rules and Regulations: What Every Safety Manager Needs to Know

OSHA standards and regulations are the workplace safety and health standards issued under the Occupational Safety and Health Act of 1970 (the OSH Act) and published in Title 29 of the Code of Federal Regulations (CFR). Most private-sector employers must follow every standard that applies to their operations, plus the General Duty Clause for serious hazards that no specific standard covers.

The harder part, and the one that drives most citations, is knowing which standards apply to each site, what triggers each obligation, and what documentation proves you met it.

What Are OSHA Rules and Where Do They Come From?

The OSH Act created the Occupational Safety and Health Administration (OSHA) within the U.S. Department of Labor to set and enforce workplace safety standards. Safety managers run into three kinds of OSHA material, and only one is enforceable on its own:

· Standards and regulations are codified in 29 CFR and are legally binding. Example: OSHA's Hazard Communication standard, 29 CFR 1910.1200.

· Letters of interpretation explain how OSHA applies a standard to a specific situation. They create no new obligations.

· Guidance (fact sheets, QuickCards, eTools) explains good practice and is not enforceable by itself.

A proposed rule is not enforceable as a standard either. OSHA's Heat Injury and Illness Prevention in Outdoor and Indoor Work Settings proposal was published in the Federal Register on August 30, 2024. Its public hearing concluded July 2, 2025, and the post-hearing comment period closed October 30, 2025. It has not been finalized, so no federal heat standard is in effect. That does not leave heat hazards unenforced: OSHA can still cite a serious heat hazard under the General Duty Clause.

Which OSHA Standards Apply to Your Workplace?

OSHA organizes its standards by industry sector in 29 CFR:

· General industry: 29 CFR Part 1910 (manufacturing, warehousing, healthcare, and most fixed-site operations)

· Construction: 29 CFR Part 1926

· Maritime: 29 CFR Parts 1915 (shipyards), 1917 (marine terminals), and 1918 (longshoring)

· Agriculture: 29 CFR Part 1928

Applicability follows the work, not the company's industry label. A manufacturer under Part 1910 can trigger Part 1926 requirements when its own crews perform construction work, such as structural alterations or major renovation.

The OSH Act covers most private-sector employers in all 50 states, the District of Columbia, and U.S. territories, but not the self-employed, immediate family members of farm employers, or working conditions regulated by another federal agency, such as mining under the Mine Safety and Health Administration (MSHA). Federal OSHA does not cover state and local government workers, though many are covered by State Plans.

How Does the General Duty Clause Work When No Standard Applies?

Section 5(a)(1) of the OSH Act, known as the General Duty Clause, requires each employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." OSHA uses it for hazards such as heat, workplace violence, and ergonomics.

To sustain a General Duty Clause citation, OSHA must show four elements: a hazard existed and workers were exposed to it, the employer or its industry recognized it, it was causing or likely to cause death or serious physical harm, and a feasible and effective means of abating it was available.

Do State OSHA Plans Change the Rules?

Yes, depending on where you operate. There are 29 OSHA-approved State Plans: 22 cover both private-sector and state and local government workers, and 7 cover only state and local government workers. State Plans must be at least as effective as federal OSHA and must adopt maximum penalty levels that are at least as effective as federal OSHA’s, though they do not have to impose monetary penalties on state and local government employers.

"At least as effective" means a State Plan can be stricter or regulate hazards federal OSHA has not addressed. California, for example, has its own heat illness prevention standards for outdoor and indoor workplaces. Multi-state employers should track federal and state requirements as separate obligations.

What Are OSHA's Recordkeeping and Reporting Requirements?

OSHA's recordkeeping rule, 29 CFR Part 1904, has three layers with different triggers.

What Goes on the OSHA 300, 300A, and 301 Forms?

Covered employers record qualifying work-related injuries and illnesses on three forms: the OSHA 300 Log, the 300A Annual Summary, and the 301 Incident Report. Each recordable case must be entered within seven calendar days of learning that it meets OSHA's recording criteria. The 300A must be posted from February 1 through April 30, and records must be kept for five years.

What goes on the forms also depends on which version you mean. The 300 Log and 301 forms you keep on site include employee names and other identifying details. The case-level data submitted electronically does not: it leaves out employee names from the 300 data, and employee names and addresses, treating health care professional names, and treating facility information from the 301 data.

Two partial exemptions apply to the logs only: employers with 10 or fewer employees at all times during the previous calendar year, and establishments in lower-hazard industries listed in Appendix A to Subpart B of Part 1904.

Which Injuries Must Be Reported Directly to OSHA?

Every employer covered by the OSH Act, including those exempt from keeping logs, must report certain severe, work related events directly to OSHA under 29 CFR 1904.39:

· A work-related fatality within 8 hours

· An in-patient hospitalization, amputation, or loss of an eye within 24 hours

Who Must Submit Injury Data Electronically?

Certain establishments must also submit data through OSHA's Injury Tracking Application (ITA) by March 2 of the year after the calendar year covered. For calendar year 2026 data, that deadline is March 2, 2027. Establishments with 250 or more employees in industries required to keep records submit Form 300A data, as do establishments with 20 to 249 employees in industries listed in Appendix A to Subpart E. Establishments with 100 or more employees in the high-hazard industries listed in Appendix B to Subpart E must also submit Form 300 and 301 data.

What Training Does OSHA Require?

OSHA has no single training rule. Training requirements sit inside individual standards, and they don't all run on the same schedule. OSHA does require a fair amount of annual training, whether that's hands-on practice, a refresher, or an annual review. About 27 general industry standards call for some form of it. Many other requirements are tied to events: a new hire, a process change, a new chemical, or a gap in how someone does the work. Programs slip in both directions. They miss event triggers because everything is scheduled by date, or they hold yearly sessions no standard requires while a real annual requirement goes uncovered. OSHA Publication 2254, Training Requirements in OSHA Standards, lists the requirements standard by standard and is the best place to confirm what applies to your operation. Four common examples:

· Hazard Communication (29 CFR 1910.1200): Training at initial assignment and whenever a chemical hazard employees haven't been trained on is introduced into their work area. It covers how to detect a release, the physical and health hazards present, protective measures, and how to read labels and Safety Data Sheets (SDSs). An annual refresher is a reasonable practice, but it doesn't satisfy the standard by itself. A new hazard that arrives in March can't wait for December training.

· Lockout/Tagout (29 CFR 1910.147): Retraining when a change in job assignments, machines, equipment, or processes presents a new hazard, or when energy control procedures change. Additional retraining is required when a periodic inspection reveals deviations, or whenever the employer has reason to believe an employee's knowledge or use of the procedures is inadequate. The annual periodic inspection itself reviews the procedure and the authorized employees who apply it. It is not a training class.

· Powered industrial trucks (29 CFR 1910.178): Each operator's performance must be evaluated at least once every three years. Refresher training is triggered separately by unsafe operation, an accident or near miss, an evaluation showing unsafe operation, assignment to a different type of truck, or a workplace change that affects safe operation.

· Respiratory protection (29 CFR 1910.134): Employees required to use respirators must be retrained annually. Retraining is also required sooner when workplace conditions or the type of respirator change, when an employee's knowledge or use of the respirator falls short, or when another situation makes retraining necessary. Annual fit testing for tight-fitting respirators is a separate requirement.

Across every standard, OSHA expects training to be delivered in a language and vocabulary workers understand. A signed attendance sheet documents that employees were present; it does not prove they understood the training. If employees cannot understand the language used during the training, the sign-in sheet will not establish compliance.

Keep records at the same level of detail as the requirements: who was trained, on which standard, when, and what triggered it. When an inspector asks, a training program is only as strong as the documentation behind it.

Which OSHA Rules Get Cited Most Often?

OSHA publishes its most frequently cited standards each year. Its preliminary fiscal year 2026 list, covering October 1, 2025 through August 31, 2026 and released September 15, 2026 at the NSC Safety Congress & Expo, ranks these as the top 10:

1. Fall Protection, General Requirements, construction (29 CFR 1926.501): 4,041 violations

2. Hazard Communication (29 CFR 1910.1200): 1,961

3. Control of Hazardous Energy (Lockout/Tagout), general industry (29 CFR 1910.147): 1,863

4. Scaffolding, construction (29 CFR 1926.451): 1,725

5. Ladders, construction (29 CFR 1926.1053): 1,659

6. Respiratory Protection, general industry (29 CFR 1910.134): 1,608

7. Powered Industrial Trucks, general industry (29 CFR 1910.178): 1,379

8. Fall Protection Training, construction (29 CFR 1926.503): 1,273

9. Eye and Face Protection, construction (29 CFR 1926.102): 1,120

10. Machine Guarding, general industry (29 CFR 1910.212): 1,072

Fall Protection (for the construction industry) has topped the list for 16 consecutive fiscal years. Hazard Communication, Lockout/Tagout, and Respiratory Protection all require a written program, so a missing or outdated document can produce a citation even when field conditions look acceptable.

What Happens During an OSHA Inspection and What Do Violations Cost?

OSHA prioritizes inspections in this order: imminent danger, severe injuries and fatalities, worker complaints, referrals, targeted inspections, and follow-ups.

Most inspections follow the same sequence. The compliance officer presents credentials and holds an opening conference to explain why OSHA is there and what the inspection will cover. During the walkaround, the officer observes conditions, interviews employees, and may take photos or samples, usually with an employer representative and an employee representative present. OSHA can also request injury and illness records, which you must provide within four business hours. At the closing conference, the officer reviews apparent violations and abatement expectations. Any citations follow by mail, within six months of the alleged violation.

Citations are classified as other-than-serious, serious, willful, repeated, or failure to abate, plus posting violations. OSHA adjusts penalties for inflation each year, but its May 21, 2026 memo confirmed there is no increase for 2026, so the 2025 amounts remain in effect:

· Serious violations: up to $16,550 per violation, with a minimum of $1,085 per serious violation (a figure set by OSHA's penalty policy, not by statute)

· Other-than-serious and posting violations: up to $16,550 per violation

· Failure to abate: up to $16,550 per day beyond the abatement date, generally capped at 30 days

· Willful or repeated violations: up to $165,514 per violation, with a minimum of $11,823 for willful violations

Employers have 15 working days from receipt of a citation to file a notice of contest. Workers who believe they were retaliated against for raising safety concerns generally have 30 days to file a complaint under Section 11(c) of the OSH Act.

For what inspectors ask for on site and how to build a program that holds up, see The Complete Guide to OSHA Compliance for EHS Teams.

How Can Safety Managers Stay on Top of OSHA Requirements?

Four practices close most of the gaps described above:

· Build a site-level applicability register listing each standard, its trigger, and its owner.

· Calendar the fixed deadlines: 300A posting, the March 2 ITA submission, annual Lockout/Tagout inspections and fit tests, and three-year forklift evaluations.

· Tie retraining to the event (a new chemical, machine, process, or incident) that triggered it.

· Track proposed rules and State Plan changes separately from enforceable standards.

EHS Insight supports each of these steps. The Legal Register module [INTERNAL LINK: Legal Register page] centralizes the legal and regulatory obligations that apply to your organization, lets you assign each obligation to the Business Entities where it applies, and links obligations to Compliance Tasks [INTERNAL LINK: Compliance Tasks page]. The Compliance Tasks module schedules one-time and recurring tasks and sends reminders and escalation notifications for upcoming or overdue items. The Incident Management module displays the data required to complete the OSHA 300, 300A, and 301 forms and the ITA CSV imports, and the Training Management module [INTERNAL LINK: Training Management page] tracks training requirements, forecasts expirations 30, 60, and 90 days ahead, and documents one-off retraining assignments after an incident.

Frequently Asked Questions

Are OSHA Guidelines the Same as OSHA Rules?

No. OSHA rules (standards) are codified in 29 CFR and are legally enforceable. Guidelines, fact sheets, and letters of interpretation explain recommended practices or how OSHA applies a standard, but they do not create legal obligations on their own. A proposed rule cannot be enforced as a standard until OSHA finalizes it, although OSHA can still cite the hazard it addresses under the General Duty Clause.

Do Small Businesses Have to Follow OSHA Rules?

Yes. Covered employers of any size must follow the OSHA standards that apply to their work. The 10-employee threshold is only a partial exemption from injury and illness recordkeeping under 29 CFR Part 1904; it does not exempt a business from safety standards or from reporting fatalities and severe injuries.

How Long Do I Have to Report a Serious Injury to OSHA?

Report a work-related fatality within 8 hours. Report a work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours. These deadlines come from 29 CFR 1904.39 and apply to all employers, including those exempt from keeping injury logs.

Is There a Federal OSHA Heat Standard?

Not yet. OSHA published a proposed heat injury and illness prevention rule on August 30, 2024, and the post-hearing comment period closed October 30, 2025, but the rule has not been finalized. Until a final rule takes effect, OSHA addresses heat hazards through the General Duty Clause and sanitation standards, and some State Plans, such as California's, enforce their own heat standards.