OSHA Requirements for Employers: The Full Obligation Set
Every OSHA duty a small employer carries: the general duty clause, the poster, hazard communication, competent person rules, training and reporting.
OSHA Requirements for Employers
The general duty clause, the required poster, the four parts of hazard communication, what a competent person actually is, which training obligations attach to you, the two recordkeeping exemptions, the eight and twenty-four hour reporting calls, and what happens when an inspector arrives
The first OSHA compliance list I ever wrote for a company of my own had four items on it and I was fairly pleased with it. Poster on the wall. Fire extinguishers checked. First aid kit stocked. Somebody trained in CPR. It took a safety consultant about ninety seconds to explain that only one of those four things was an obligation I actually carried.
What I actually carried was a written hazard communication program I had never heard of, safety data sheets for the cleaning chemicals under a sink, dated training records for the people who used a pallet jack, and a duty to phone a specific number within eight hours if anything ever went badly wrong. The poster was the only item on my list that appears anywhere in the regulations, and it was the cheapest thing on it.
That gap is the normal condition for a small business, and it is structural rather than careless. OSHA obligations are not published as a checklist you can read end to end. They are distributed across one broad statutory duty, a handful of universal rules, and whichever standards happen to match the hazards inside your building. This guide assembles the set. I build the training records, policy documents and employee files that a compliance position is made of at FirstHR. This is general information rather than legal advice, and regulatory dates move, so verify anything you rely on against the agency.
What OSHA Compliance Actually Means
OSHA compliance means meeting three layers of duty at the same time and being able to show it on the day somebody asks. There is no certificate, no scheduled audit and no authority that pronounces you compliant. It is a position you either hold or do not.
The retrospective part changes how you should think about the whole subject. Nobody grades you in advance. The assessment happens after an employee complaint, a referral, or a serious injury you reported yourself, and it is conducted against records you either created contemporaneously or did not. That is the same logic that runs through the rest of HR compliance, and it is why the paperwork is not the boring part.
One more framing point. Compliance is scoped to your hazards, not to your industry label. A print shop, a dental practice and a coffee roastery share almost no standards with a construction firm and still share four or five with each other, because they all store chemicals, service powered equipment and keep people on their feet near hot surfaces. Start with what is in the building.
Who OSHA Covers, and the Duties Nobody Escapes
OSHA covers most private sector employers and their workers in all fifty states and the territories, either directly or through a state agency operating an approved plan. Coverage does not depend on company size, revenue or industry.
The exclusions are narrow. Self-employed people are outside the Act. So are immediate family members of farm employers, and workers whose hazards are regulated by another federal agency such as the Mine Safety and Health Administration, the Department of Energy or the Coast Guard. Public sector employees are outside federal OSHA but protected in states that run an approved plan covering them.
| Duty | Where it comes from | Who it applies to |
|---|---|---|
| Furnish employment free from recognized hazards | OSH Act Section 5(a)(1), the general duty clause | Every covered employer, with no size or industry exemption |
| Comply with the standards that match your hazards | OSH Act Section 5(a)(2) | Every covered employer, standard by standard |
| Post the Job Safety and Health notice | 29 CFR 1903.2 | Every covered employer, at each establishment |
| Warn employees of hazards with codes, signs, posters or labels | OSH Act and the individual standards | Every covered employer with hazards to warn about |
| Train employees where a standard requires it | The individual standard, not a general training rule | Any employer the standard reaches |
| Give employees a way to report injuries, with no retaliation | 29 CFR 1904.35 | Employers required to keep injury records |
| Report a work-related death within 8 hours | 29 CFR 1904.39 | Every covered employer, no exemptions at all |
| Report hospitalization, amputation or eye loss within 24 hours | 29 CFR 1904.39 | Every covered employer, no exemptions at all |
| Keep the injury log, incident reports and annual summary | 29 CFR Part 1904, with the partial exemptions at 1904.1 and 1904.2 | Employers outside both partial exemptions |
Read the right-hand column rather than the left. The two reporting rows carry no exemption of any kind, which is the single most misunderstood fact in this area, and the recordkeeping row is the only one where being small genuinely changes the answer. Protection from retaliation for raising a safety concern comes from Section 11(c) of the Act and reaches every employee regardless of whether you keep a log, which is worth knowing before anybody responds to a complaint. The general shape of retaliation exposure is the same here as everywhere else in employment law.
The General Duty Clause Sits Above the Standards
Section 5(a)(1) of the OSH Act requires every employer to furnish each employee employment and a place of employment free from recognized hazards that are causing or are likely to cause death or serious physical harm. It applies whether or not a specific standard covers the hazard, which is what makes it the backstop.
Four elements have to line up for a general duty citation: a hazard existed, it was recognized either by your industry or by you specifically, it was likely to cause death or serious physical harm, and a feasible means of abating it was available. The recognition element is the one you influence, and you influence it in both directions.
That cuts against instinct. An employee complaint you filed away, a near-miss you never investigated, a note in your own incident record: each of those is evidence that the hazard was recognized by you. This is why an unanswered internal report is more dangerous than the condition it describes, and why an internal hazard reporting route that visibly produces answers is worth more than any binder. Workplace violence prevention is the clearest current example of a hazard with no federal standard and real citation risk.
The Notice That Has to Be on the Wall
Every covered employer must post the Job Safety and Health notice in each establishment, in a conspicuous place where notices to employees are customarily posted, and must make sure it is not altered, defaced or covered by other material. The requirement is at 29 CFR 1903.2 and it has no size exemption.
The poster is publication 3165 in English and 3167 in Spanish, and both are free from the agency in print or as a download. Reproductions have to be at least 8.5 by 14 inches with 10-point type, which is the detail that catches employers who shrink it to fit a crowded board. Employers covered by a state plan post the state version instead.
This is the cheapest item on any compliance list anywhere and the first thing an inspector sees, which is a bad combination if it is missing. It also travels with the rest of your workplace safety posters and sits alongside the federal and state notices you already owe employees, so the sensible move is to handle all of them in one afternoon rather than one at a time.
One wrinkle applies to distributed teams. A poster on a wall does nothing for somebody who works from a spare bedroom, and the agency has not written a remote-work posting rule. The practical answer used by most employers is to deliver the same notices electronically in a place employees can reach without asking, which is the approach the rest of remote employment compliance has converged on.
Hazard Communication, the Standard That Reaches Almost Every Workplace
The hazard communication standard at 29 CFR 1910.1200 applies wherever employees may be exposed to hazardous chemicals under normal conditions of use or in a foreseeable emergency. It is the standard most likely to apply to a business that does not think of itself as industrial, and it ranked second on the agency list of most frequently cited standards for fiscal year 2025.
Four obligations make it up, and all four have to be present. Employers routinely have one or two, most often the data sheets in a binder somebody assembled once, and treat that as the standard being met. It is not.
The scope question is where offices talk themselves out of it. The consumer product exemption reaches a product used for the purpose its manufacturer intended, where the duration and frequency of employee exposure is no greater than a consumer could reasonably experience. That sounds like it covers a cleaning cupboard and often does not. A janitorial closet holding institutional-strength disinfectant, a salon shelf of developer and remover, a clinic storing sterilant, a restaurant with a degreaser and a sanitizer: all of that is inside. So is anything you decant into an unlabeled spray bottle, which is the most commonly cited version of the labeling failure.
The standard itself was rewritten to keep pace with the Globally Harmonized System, and the deadlines have moved once already. On January 15, 2026 the agency extended every compliance date in the 2024 final rule by four months, so the schedule now runs like this (29 CFR 1910.1200).
| Who | What has to be done | Deadline |
|---|---|---|
| Manufacturers, importers, distributors | Reclassify substances, update labels and safety data sheets | May 19, 2026 |
| Employers | Update the written program, workplace labels and training for substances | November 20, 2026 |
| Manufacturers, importers, distributors | Reclassify mixtures, update labels and safety data sheets | November 19, 2027 |
| Employers | Update the written program, workplace labels and training for mixtures | May 19, 2028 |
The employer deadline in November is the one to diarize. New data sheets are already arriving from suppliers with hazard classifications and label elements that differ from the ones on your shelf, and your obligation is to update the written program, the in-house labels and the training to match. Put it in the compliance calendar now, because the work is small only if it is not discovered late.
The Competent Person, and Where the Standards Require One
A competent person is one who is capable of identifying existing and predictable hazards in the surroundings or working conditions which are unsanitary, hazardous or dangerous to employees, and who has authorization to take prompt corrective measures to eliminate them. That definition sits at 29 CFR 1926.32(f) and both halves are mandatory.
The regulation does not prescribe a course, a card or a number of hours. It describes a capability, which means the employer picks somebody and then owns the choice. That sounds permissive until an inspection, when the question becomes what your designation was based on and whether the person could actually do the second half.
The authority element is where small employers lose. A crew leader who knows exactly what is wrong with a trench and has to call the owner before anybody climbs out does not satisfy the definition (29 CFR 1926.32). If you designate somebody, delegate the stop-work authority in writing at the same time, and tell the crew that the designation exists. A stop-work authority nobody knows about is not one.
| Subject | Standard | What the competent person is there to do |
|---|---|---|
| Excavations and trenching | 29 CFR 1926.651 and 1926.652 | Inspect daily before work starts and as conditions change, classify soil and rock under Appendix A to Subpart P, remove employees when a hazard appears |
| Scaffolds | 29 CFR 1926.450 and 1926.451 | Supervise erection, moving, alteration and dismantling, and inspect for defects before each shift |
| Confined spaces in construction | 29 CFR 1926.1203 | Identify every confined space and evaluate which of them are permit spaces before work begins |
| Cranes and derricks | 29 CFR 1926.1412 | Carry out the shift and monthly equipment inspections, with the annual inspection left to a qualified person |
| Slings | 29 CFR 1910.184 | Inspect the sling and all fastenings each day before use, and again during use where service conditions warrant |
| Powered platforms for building maintenance | 29 CFR 1910.66 | Inspect the supporting structures and the equipment at intervals not exceeding twelve months, and train the operators |
| Telecommunications work | 29 CFR 1910.268 | Inspect pole and support structures before anyone is on them, tools and protective equipment each day, and vehicle brakes at the start of each shift |
Two general industry standards on that list surprise people. Slings and powered platforms are not construction rules, so a warehouse that lifts with slings or a building manager with a window-cleaning platform carries a competent person duty without ever visiting a job site. Check the standards that match your equipment rather than assuming the concept belongs to construction.
One caution about the definition itself. The powered platforms standard writes its own at 29 CFR 1910.66(d), turning on training and experience sufficient to identify hazardous conditions in platform installations and to train employees to spot them, without the authorization language the construction definition carries. Read the definition inside whichever standard you are working from before you rely on the three-part test above.
Training Obligations Attach to the Standard, Not to Your Headcount
There is no single OSHA training rule. Training duties are written into individual standards, which means the question is never whether you have to train but which standards apply to you and what each of them demands. The agency collects them in Publication 2254 for exactly that reason.
What the standards have in common is a pattern worth memorizing. Training happens before exposure rather than at some point during the first year. It is repeated when conditions change, when a new hazard appears, or when observation shows somebody has not retained it. And it has to be delivered in a language and vocabulary the employee actually understands, which the agency has been explicit about.
For a business with no safety function, the practical move is to fold safety training into the process you already run rather than building a parallel one. Whatever you use for compliance onboarding can carry hazard communication on day one, and the same records format works for the annual refreshers. The mechanics of running it are covered in the guide to employee safety training.
Retention is worth settling once. Training records are subject to your general record retention schedule, and specific standards impose their own periods on top, with exposure and medical records under the access standard running far longer than anything else in the file. Keep a dated training record for every session and do not throw any of it away on the general schedule without checking the standard first.
Injury Records, and the Two Exemptions That Are Not the Same
Employers must record work-related injuries and illnesses on the OSHA 300 log, document each case on a 301 incident report, and post the 300A annual summary, unless a partial exemption applies. Two separate exemptions exist and they work on different logic, which is where the confusion starts.
| Rule | Threshold | What it does |
|---|---|---|
| Size partial exemption, 29 CFR 1904.1 | Ten or fewer employees at all times during the previous calendar year, counted across the whole company | No 300 log, 300A summary or 301 report anywhere in the company |
| Industry partial exemption, 29 CFR 1904.2 | An establishment classified in a NAICS code listed in Appendix A to Subpart B | No 300 log, 300A summary or 301 report at that establishment only |
| Override of either exemption | A written request from OSHA or the Bureau of Labor Statistics | Both exemptions stop applying and you keep records for the period requested |
| Electronic submission of the 300A, 29 CFR 1904.41 | An establishment with 20 to 249 employees in an Appendix A to Subpart E industry | Submit the annual summary electronically by March 2 |
| Electronic submission of the 300A | An establishment with 250 or more employees that is required to keep records | Submit the annual summary electronically by March 2 |
| Electronic submission of the 300, 301 and 300A | An establishment with 100 or more employees in an Appendix B to Subpart E industry | Submit all three forms electronically by March 2 |
The two exemptions are counted differently and that is the trap. Size is company-wide and looks at the previous calendar year at all times, so taking on one extra person for a single month costs the exemption for the following year. Industry is per establishment, so a multi-site business can be exempt at the office and not at the workshop. Neither one is an exemption from anything except the forms.
Electronic submission is a separate question again, driven by establishment headcount and industry list rather than by whether you keep records at all, with a March 2 deadline every year. What makes a case recordable rather than first aid, how the annual summary gets certified and posted, and how privacy cases are handled are all worked through in the guide to OSHA forms 300, 300A and 301.
One habit is worth adopting even inside an exemption. A dated internal record of what happened, what you changed and when is the evidence that supports a good faith finding later, and it is the same information your workers compensation carrier will want anyway. Being exempt from the form is not a reason to have no record.
Reporting a Death, a Hospitalization, an Amputation or an Eye Loss
Every employer covered by the Act must report a work-related fatality to OSHA within 8 hours, and a work-related in-patient hospitalization, amputation or loss of an eye within 24 hours. This duty at 29 CFR 1904.39 has no size exemption and no industry exemption. It applies to the smallest employer on the smallest job.
Amputation is defined more broadly than the everyday word suggests. It covers the traumatic loss of a limb or other external body part, including fingertip amputations with or without bone loss, and it does not require the part to be severed cleanly. Employers routinely miss reportable events by applying a common-sense definition to a regulatory term.
The practical failure here is never willfulness. It is that the person on site at six in the morning does not know the number, does not know the deadline, and reasonably decides to wait for somebody senior. Put the number, the two deadlines and the three channels on a single card where supervisors will find it, and rehearse who makes the call. Failing to report is its own citable violation stacked on top of whatever caused the injury, which is discussed further in the guide to OSHA violations and penalties.
What an Inspection Looks Like From the Inside
An OSHA inspection follows a predictable sequence, and knowing the shape of it is most of what a small employer needs. Inspections are conducted without advance notice, and the compliance officer will work through the same stages whether the visit lasts two hours or two weeks.
Two things about that sequence deserve attention. The document request comes early, which means your compliance position is largely fixed before the walkaround starts. And the walkaround is a two-way exercise: an employer with their own photographs, notes and correction record is in a completely different position at the closing conference than one relying on memory.
The realistic trigger for a small business is almost never a random visit. It is an employee complaint, a referral from another agency, or an injury you reported yourself. That is worth sitting with, because two of those three are doors you have influence over long before anybody knocks.
State Plan States Run Their Own Version of All of This
Twenty-nine states and territories operate OSHA-approved State Plans. Twenty-two cover private sector plus state and local government workers, and seven cover only state and local government employees. Where a plan exists, the state agency is your regulator.
The states running plans that cover private employers are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington and Wyoming. Connecticut, Illinois, Maine, Massachusetts, New Jersey, New York and the Virgin Islands run plans covering public employees only.
For a single-site business this is a one-time lookup that changes which website you read. For a multi-state employer it is an ongoing obligation, because the requirement set genuinely differs by location: different posters, sometimes different reporting numbers, and occasionally an entire standard that exists in one state and nowhere else. Treat the state where the work is performed as controlling, the same way you would for any other item in the stack of employment laws you track.
Building the Requirement Set for Your Own Workplace
The fastest route to an accurate list is a walk through your own building with a notepad, not a search for a template. Write down every hazard you can see: chemicals, powered equipment, heights, vehicles, noise, hot surfaces, electricity, lifting. That list determines which standards you are on the hook for, and it doubles as the hazard assessment that supports a good faith finding later.
Then work the universal duties, which are the same for everybody: the poster on the wall, hazard communication if any chemical is present, a training record format you will actually maintain, the reporting numbers on a card, and a decision about whether either recordkeeping exemption applies to you. If you have no written safety document at all, a one-page health and safety policy naming your hazards and who is responsible for them is the thing that starts the file.
The free resource worth more than any of this is the agency consultation program, which is separate from enforcement, cannot issue citations, and will tell you which standards actually apply to your specific site. Most small employers have never heard of it. It is the only way to get a professional answer to the scope question without paying for one, and it is described in more detail alongside the penalty structure in the guide to OSHA violations.
Frequently Asked Questions
What are the OSHA requirements for employers?
They come in three layers rather than one list. The first is the general duty clause in Section 5(a)(1) of the OSH Act, which requires you to furnish a workplace free from recognized hazards likely to cause death or serious physical harm, and which applies even where no specific standard exists. The second is the set of universal duties: post the Job Safety and Health notice, warn employees about hazards, provide training in a language they understand, report a work-related death within 8 hours and a hospitalization, amputation or eye loss within 24 hours. The third is whichever published standards match the hazards actually present in your building, which for most small employers begins with hazard communication and grows from there.
What is OSHA compliance?
OSHA compliance is the state of meeting all three layers of obligation at once and being able to show it. The showing part matters more than employers expect, because most standards are written as duties to have a program, a record or a trained employee, and the only evidence of those on any given day is documentation. A company that trains its people and keeps no record is in a materially worse position during an inspection than an identical company that keeps a dated sheet with names on it. Compliance is not a certification you obtain and it is not audited on a schedule. It is a position you hold, evidenced by a written program, hazard assessments, training records and a corrected-hazard trail.
What is an OSHA competent person?
A competent person is defined in 29 CFR 1926.32(f) as one who is capable of identifying existing and predictable hazards in the surroundings or working conditions which are unsanitary, hazardous or dangerous to employees, and who has authorization to take prompt corrective measures to eliminate them. Both halves are required. Knowledge alone is not enough, and this is where employers fail: the person has to hold real authority to stop the work and spend money on the fix without seeking approval. The designation is also task-specific and site-specific rather than a permanent title. Standards that require one include excavations, scaffolds, confined spaces in construction, cranes and derricks, slings and powered platforms.
Does the hazard communication standard apply to an office?
Usually yes, at least in part. The standard at 29 CFR 1910.1200 applies wherever employees may be exposed to hazardous chemicals under normal conditions of use or in a foreseeable emergency, and it does not carve out offices. Cleaning products, disinfectants, toner, aerosols, pool and spa chemicals, and salon and clinic supplies all bring the standard with them. A consumer product is outside the standard only where it is used for the purpose its manufacturer intended and the duration and frequency of employee exposure is no greater than a consumer could reasonably experience, which is a narrower escape than most employers assume once a janitorial closet is involved. Where it applies, you owe a written program, labeled containers, accessible safety data sheets and training at initial assignment.
Which employers are exempt from OSHA recordkeeping?
Two separate partial exemptions exist, and they work differently. The size exemption at 29 CFR 1904.1 covers a company that had ten or fewer employees at all times during the previous calendar year, counted across the entire company rather than one location. The industry exemption at 29 CFR 1904.2 covers individual establishments classified in low-hazard NAICS codes listed in Appendix A to Subpart B, which means a multi-site company can have exempt and non-exempt locations at once. Both are exemptions from keeping the injury log and its related forms and from nothing else. Both are overridden by a written records request from OSHA or the Bureau of Labor Statistics, and neither touches the duty to report a death or a serious injury.
How long do you have to report a workplace fatality to OSHA?
Eight hours, running from the death itself under 29 CFR 1904.39(a)(1). Where you did not learn of the death at the time it took place, 1904.39(b)(7) instead gives you 8 hours from the moment it is reported to you or to any of your agents. The duty is triggered where the death results from a work-related incident that occurred within the previous thirty days. In-patient hospitalization, amputation or loss of an eye is reported within 24 hours, and there the underlying incident must have occurred within the previous 24 hours for the duty to attach. There are three acceptable channels: calling the nearest OSHA area office, calling the toll-free number, or filing through the reporting application on the agency website. A voicemail, a fax or an email does not satisfy the requirement, which catches employers whose incident happens at night.
Do OSHA rules differ by state?
Yes, in about half the country. Twenty-nine states and territories run OSHA-approved State Plans: twenty-two cover private sector plus state and local government workers, and seven cover only state and local government employees. A State Plan must be at least as effective as federal OSHA, which means it can be stricter but never weaker. Several of them are meaningfully stricter, with their own standards on subjects federal OSHA has not covered, their own reporting channels and their own posters. If you operate in a State Plan state, the state agency is your regulator and its rules are the ones to read first. Multi-state employers should assume the answer differs by location until they have checked each one.