10 rules for workplace safety every employer must know

Last updated 2026-07-09

Why do workplaces need formal safety rules at all?

Informal "be careful" culture falls apart the moment someone gets hurt. It falls apart faster during an OSHA inspection.

The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023 ^[1]. That number has fallen slowly for two decades, but what remains clusters in small employers. Large companies keep full-time safety staff. Small ones run on memory and habit.

OSHA's General Duty Clause, Section 5(a)(1) of the OSH Act, says each employer "shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees" ^[2]. That one sentence is the foundation every specific standard sits on. No matching OSHA standard for a hazard at your shop? The General Duty Clause still reaches it.

Written rules earn their keep three ways. They prove due diligence when OSHA shows up. They give supervisors something concrete to enforce. They give workers something to check against. Rules that live only in a foreman's head vanish the day that foreman calls in sick.

What are the 10 basic rules for workplace safety?

These are not invented categories. Each one maps to a specific OSHA standard, or a cluster of them, that generates citations year after year. Work through them in order and you will have covered most of what OSHA finds in general industry and construction.

Rule 1: Run a hazard assessment before any work starts

You cannot control what you have not identified. OSHA requires a written hazard assessment for PPE selection under 29 CFR 1910.132(d) ^[3], but the practice should run wider than PPE. Walk the job, write down what you find, date the document. A signed, dated hazard assessment is also your first defense against a "willful" citation, which carries penalties up to $16,550 per violation as of 2024 ^[4].

Rule 2: Provide and maintain the required PPE

PPE is the last line of defense, not the first. It is also the line OSHA checks most easily. 29 CFR 1910.132 through 1910.140 covers hard hats, chemical-resistant gloves, fall protection harnesses, and the rest. Small employers get two things wrong constantly. They buy the PPE but skip the training. They let it wear out past its useful life. Each is a separate violation. See our guide to osha training for the documentation side.

Rule 3: Train every worker before exposure, not after

OSHA's training rules scatter across dozens of standards, but the pattern holds: training happens before the worker faces the hazard, in a language the worker understands, and you document it ^[2]. The OSHA 10 and osha 30 courses teach broad hazard recognition. They do not replace task-specific training on the equipment and chemicals at your site.

Rule 4: Control hazardous energy before any maintenance

Lockout/tagout prevents an estimated 120 fatalities and 50,000 injuries a year, according to OSHA ^[5]. 29 CFR 1910.147 requires a written energy control program, a procedure for every machine that stores hazardous energy, and an annual inspection of those procedures. It lands in OSHA's top 10 most-cited standards every single year. Our lockout tagout guide has the full breakdown.

Rule 5: Communicate chemical hazards in writing

Any chemicals in your workplace, cleaning products included, trigger three requirements: a written hazard communication program, Safety Data Sheets for every chemical, and a label on every container. That comes from 29 CFR 1910.1200 ^[6]. HazCom has been the most-cited or second-most-cited general industry standard for years. See our hazard communication overview for the SDS rules, and our hcl safety data sheet article if you handle hydrochloric acid.

Rule 6: Keep walking and working surfaces safe

29 CFR 1910.22 requires floors kept clean, dry, and clear of hazards. Slips, trips, and falls sit consistently among the leading causes of workplace death in the private sector ^[1]. This rule sounds obvious until you walk a busy warehouse on a rainy morning. Wet floor signs, drainage mats, and a daily walkthrough are cheap. A comp claim from a broken hip is not.

Rule 7: Write an emergency action plan

29 CFR 1910.38 requires a written Emergency Action Plan for any employer with more than 10 workers. With 10 or fewer, you can communicate it orally, but you still need a plan. The EAP covers evacuation procedures, alarm systems, how you account for people after evacuation, and rescue and medical duties. Post it, drill it at least once a year, and update it whenever the layout changes.

Rule 8: Record and report injuries correctly

OSHA recordkeeping rules (29 CFR 1904) require employers with more than 10 employees in most industries to keep a 300 Log of work-related injuries and illnesses. Any work-related fatality goes to OSHA within 8 hours. Any in-patient hospitalization, amputation, or loss of an eye goes in within 24 hours ^[7]. Miss those deadlines and the miss is itself a citation. Our incident report guide walks through the 300, 300A, and 301 forms.

Rule 9: Enforce rules consistently, in writing

OSHA can cut or drop a penalty when you show you have a safety program and actually enforce it. The reverse bites hard. If workers routinely break a rule and supervisors look away, OSHA can classify a violation as "willful" even when management never knew about the specific incident. Document every safety talk, warning, and disciplinary action. Uneven enforcement amplifies citations.

Rule 10: Review the program at least once a year

A program written in 2018 for a different workforce, different machines, or a different building protects nobody today. OSHA expects programs kept current, and several standards demand annual review by name. The lockout/tagout inspection requirement at 1910.147(c)(6) is one ^[5]. Set a calendar reminder for the same week every year. If your osha knowledge is thin, the osha-30-training course is a fair starting point for whoever owns safety at your company.

Which OSHA violations are most common in small businesses?

OSHA publishes its top 10 most-cited standards every fiscal year. The FY2023 list ^[4] reads like this.

Rank	Standard	Topic
1	29 CFR 1926.501	Fall protection (construction)
2	29 CFR 1910.1200	Hazard communication
3	29 CFR 1926.503	Fall protection training
4	29 CFR 1910.147	Lockout/tagout
5	29 CFR 1910.134	Respiratory protection
6	29 CFR 1926.502	Fall protection systems
7	29 CFR 1910.178(l)	Powered industrial truck (forklift) training
8	29 CFR 1910.303	General electrical requirements
9	29 CFR 1910.305	Electrical wiring methods
10	29 CFR 1926.1053	Ladders (construction)

Four of the top 10 are training failures, not equipment failures. That tells you where small shops slip. They buy the right gear, then skip or shortcut the training, which is exactly backwards from a legal standpoint. Gear without training is still a violation.

If your workers run forklifts, 29 CFR 1910.178(l) requires operator training and evaluation before anyone drives unsupervised. Our forklift certification article covers what that training has to include.

Respiratory protection at rank 5 catches people off guard. Plenty of small employers hand out N95s or half-face respirators without the required medical evaluation, fit test, or written program. 29 CFR 1910.134 requires all three before a worker wears a tight-fitting respirator for the first time ^[8].

How do these general safety rules apply differently in small businesses?

The standards apply the same way regardless of company size, with a few narrow exceptions. The recordkeeping exemption for employers with 10 or fewer employees in low-hazard industries (Appendix A to 29 CFR 1904) is the one you will actually hit ^[7]. Those employers skip the 300 Logs, but they still report fatalities and severe injuries inside OSHA's deadlines.

What changes in a small business is bandwidth. A 12-person machine shop has no EHS director. The owner is the safety officer, the HR department, and the person running the floor. That is the real constraint.

So sequence your effort by risk. High-injury industries (construction, manufacturing, agriculture, warehousing) should hit fall protection, hazardous energy control, and chemical communication first, because those cause the worst injuries. A professional services firm with 8 people needs an emergency action plan and a HazCom program for its cleaning supplies, but the downside of getting those wrong is smaller than it is for a framing crew.

If you want a compliant written program without hiring a consultant, SafetyFolio's safety program generator builds a custom set of written programs based on your industry and hazards in about 15 minutes. That handles the paperwork. The human part, walking the job and training people, still takes whatever time it takes.

What should a written workplace safety program actually contain?

OSHA does not mandate one format for a written safety program, but a handful of elements appear across standards often enough to treat as universal.

Every written program should carry a scope statement (what operations it covers), an assignment of responsibility (who owns it), the procedures workers must follow, the training schedule and how you document it, and a review cycle.

For a small employer, a working program is not a 200-page binder. It is a current document a new hire could read and understand what they are expected to do and why. Standards that require a written program in plain terms include hazard communication (1910.1200), lockout/tagout (1910.147), respiratory protection (1910.134), bloodborne pathogens (1910.1030), and emergency action plans (1910.38) ^[6]. Each has its own required elements.

The written program is more than a legal artifact. Courts and OSHA administrative judges look at whether it was real: whether employees knew about it, whether it was actually followed, whether it was updated when conditions changed. A program that lives only in a drawer fails all three.

How do you enforce workplace safety rules without killing morale?

Safety consultants tend to sidestep this one, so here is the straight version: enforce safety rules the way you enforce any other work rule. Explain the reason, apply the rule the same way to everyone, and document departures.

Consistency is the hard part in a small shop. When the owner walks past a worker with no safety glasses and says nothing, every other worker clocks it. Selective enforcement tells the crew the rules are optional, and it strips you of your best legal defense if someone gets hurt.

A few things that actually work. Involve workers in writing the rules; a rule the crew helped build is a rule the crew follows. Make the safe way the easy way, because if the PPE station sits 200 feet from the work, nobody walks over to it, so put it where the work happens. Treat near-misses as information, not as offenses to punish. A worker who reports a near-miss is doing you a favor. A worker who hides one is protecting himself from a culture of blame.

None of that is soft. OSHA's own guidance on safety and health programs ^[9] names worker participation as a core element of an effective program, and there is reasonable evidence that participatory programs cut injury rates.

What are the OSHA penalties for ignoring workplace safety rules?

OSHA adjusts its penalty ceilings every year for inflation. As of January 2024 ^[4], the maximums are these.

Violation type	Maximum penalty per violation
Other-than-serious	$16,550
Serious	$16,550
Willful or repeated	$165,514
Failure to abate	$16,550 per day

Those are ceilings, not typical bills. OSHA runs a penalty calculation that weighs the severity of the hazard, the probability of injury, the employer's good faith, and the size of the business. Small employers (fewer than 26 employees) usually get a 60% reduction. Employers with 26 to 100 get 40%. Employers with 101 to 250 get 20%.

Good faith, meaning you have a written program and can show you are fixing problems, can shave another 25% off.

The bigger money risk for most small employers is not the OSHA fine. It is the workers' comp claim, the lost productivity, and the civil liability. The National Safety Council put the average cost of a work injury at $44,000 in direct and indirect costs in 2022, with days-away cases running higher ^[10].

That number matters more than any citation amount for most small businesses.

How often should you review and update your safety rules?

At minimum, once a year. Several OSHA standards require annual review by name, and the lockout/tagout procedure inspection requirement at 1910.147(c)(6) is the clearest ^[5], so annual is the floor, not the ceiling.

Review the program any time one of these hits: a serious injury or near-miss, new equipment, a process change, a big shift in the workforce, or a new OSHA standard or major revision to an old one.

The annual review does not need to be elaborate. Walk the facility with your most recent hazard assessment in hand, match what you wrote against what is actually happening, and fix anything that has drifted. Sign and date it. That signature carries weight during an inspection, because it proves someone looked at the document instead of just filing it.

Wrote your program more than three years ago and never touched it since? Start the review now. OSHA inspectors routinely ask when the written program was last updated, and "I'm not sure" is a bad answer.

Are there general safety rules specific to certain industries?

Yes. Some industries carry their own OSHA standards with requirements well past the general industry rules.

Construction runs under 29 CFR Part 1926, not 1910. The fall protection requirement in construction (1926.501) is the single most-cited standard in all of OSHA ^[4]. Any contractor working at 6 feet or more in construction (10 feet in general industry) needs a specific fall protection plan.

Agriculture (29 CFR Part 1928) has its own standards, and OSHA's reach over farms is narrower than most people think. Farms with fewer than 11 employees and no temporary labor camps are exempt from most OSHA standards, though state plans can differ ^[11].

Maritime work (shipyards, marine terminals, longshoring) sits under 29 CFR Parts 1915, 1917, and 1918. Healthcare employers face specific bloodborne pathogens requirements (1910.1030), and since the COVID-19 pandemic they have drawn several new OSHA enforcement initiatives.

State plan states set requirements stricter than federal OSHA, and they do. California (Cal/OSHA), Washington (L&I), and Michigan (MIOSHA) are among the 22 states and 4 territories running their own OSHA-approved plans ^[11]. If you are in one, check both the federal baseline and your state rules.

What is the single most cost-effective safety investment for a small employer?

Honest answer: the written programs OSHA requires in writing for the hazards you actually have.

This is not a dramatic claim. The math is simple. An OSHA inspection of a small employer with no written programs generates citations almost automatically, because the absence of a required written program is itself a citation. A hazard communication program takes two to four hours to write correctly from a template. The citation for not having one starts at several hundred dollars and can climb into thousands, depending on how many chemicals you keep and how the inspector classifies it.

Past the legal math, writing the program forces you to think through the procedure before an accident, not after. Writing a lockout/tagout procedure for one specific machine surfaces things you never noticed in the daily rush. That is the real value.

If you want those programs without starting from a blank page, SafetyFolio's program generator produces customized documents from your specific industry and hazard profile. The point is not to outsource your safety thinking. It is to hand you a solid structure so your time goes into tailoring and training instead of formatting.

Frequently asked questions

What are the most basic workplace safety rules every employer needs?

At minimum: a hazard assessment, required PPE for identified hazards, training before workers are exposed, an emergency action plan, and a written hazard communication program if any chemicals are present. These come from 29 CFR 1910.132, 1910.1200, and 1910.38. They apply regardless of company size, though the recordkeeping rules under 29 CFR 1904 exempt employers with 10 or fewer workers in low-hazard industries.

Does OSHA require a written safety program for small businesses?

OSHA requires a written program for specific standards, not one universal document. Chemicals mean a written HazCom program (1910.1200). Respirators mean a written respiratory protection program (1910.134). Maintenance on equipment with hazardous energy means a written energy control program (1910.147). Small size does not waive these. What changes is which standards apply, based on your actual operations.

What is the General Duty Clause and how does it affect my safety rules?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm. OSHA uses it to cite hazards no specific standard covers. If a hazard is recognized in your industry, by common sense, or in industry publications, you can be cited even without a matching CFR section. That is why general safety rules still matter when a specific standard seems not to apply.

How do I write a workplace safety rule employees will actually follow?

Write it in plain language, include the reason behind it, and involve the workers who do the job in drafting it. Rules that explain why ("gloves required because the solvent absorbs through skin and damages kidneys") get followed more consistently than rules with no reason. Pair the written rule with a setup that makes compliance easy: PPE at the point of use, guarded machines, marked walkways. Then enforce it the same way every time.

What is the difference between a safety rule and an OSHA standard?

An OSHA standard is federal law, published in the Code of Federal Regulations, and violating it carries fines and legal consequences. A workplace safety rule is your internal policy. Your rules should meet or exceed OSHA standards and can go further. OSHA requires fall protection at 4 feet in general industry; you can require it at 3 feet. Your rules cannot dip below the OSHA floor without creating legal exposure.

How often does OSHA inspect small businesses?

Federal OSHA runs roughly 30,000 to 35,000 inspections a year across all industries, with about 1,900 federal inspectors nationwide. Most small employers never see a planned inspection. What triggers one: worker complaints (OSHA must investigate formal written complaints), referrals from other agencies, severe injury reports, and emphasis programs targeting high-hazard industries. A complaint is one of the most common ways an inspection starts in a small business.

Can I use a generic safety program template, or does it have to be customized?

A generic template is a starting point, not a finished program. OSHA expects programs to reflect your actual workplace. A respiratory protection program that references equipment you do not own or chemicals you do not use raises more questions than it answers during an inspection. Take the template, cut the irrelevant sections, add your specific equipment and chemical names, and match the procedures to how work actually gets done at your site. Sign and date it.

What records do I have to keep to prove my safety program is real?

Keep training records with employee names, dates, topics, and the trainer's name. Keep hazard assessments with dates and signatures. Keep written programs with revision dates. Keep your OSHA 300 Log if you are covered. Keep records of inspections, equipment certifications, and corrective actions after incidents. OSHA can ask for five years of recordkeeping records under 29 CFR 1904, and thirty years of exposure records under 29 CFR 1910.1020.

What are the OSHA rules for reporting workplace injuries?

Any work-related fatality goes to OSHA within 8 hours. Any in-patient hospitalization, amputation, or loss of an eye goes in within 24 hours. Report by phone to the nearest OSHA area office, the 24-hour hotline (1-800-321-OSHA), or online at osha.gov. Employers with more than 10 employees in non-exempt industries must also keep an OSHA 300 Log and post the 300A summary from February 1 through April 30 each year.

Do workplace safety rules apply to remote workers?

OSHA's position has generally been that it will not inspect home offices and does not treat the home office as an employer-controlled workplace. If an employee runs a dedicated production area at home, does hazardous tasks there, or uses employer-provided equipment, jurisdiction gets murkier. For most remote office workers the real risk is ergonomics, which OSHA has no specific general industry standard for, so the General Duty Clause would apply if the hazard is serious.

What is the penalty for not having a written safety program?

For an other-than-serious or serious violation, penalties run up to $16,550 per violation as of 2024. OSHA often cites each missing written program as a separate violation. A small employer with no HazCom program, no lockout/tagout procedures, and no respiratory protection program could draw three separate citations. Size adjustments (60% off for employers under 26 workers) and good faith can bring the final number down substantially.

How do state OSHA plans affect my workplace safety rules?

Twenty-two states and four territories run their own OSHA-approved plans covering private employers. These plans must be at least as effective as federal OSHA, and many are stricter. California's Cal/OSHA, for example, requires every employer to have a written Injury and Illness Prevention Program (IIPP), which goes beyond what federal OSHA requires for most employers. In a state plan state, check your state agency's website before assuming federal CFR numbers are your ceiling.

What is a Job Hazard Analysis and is it required?

A Job Hazard Analysis (JHA), sometimes called a Job Safety Analysis (JSA), breaks a task into steps and identifies the hazard and control at each step. OSHA encourages JHAs as good practice and references them in guidance, but does not universally require them by name. Several standards require written procedures that amount to a JHA, particularly the machine-specific lockout/tagout procedures under 29 CFR 1910.147. In high-hazard industries, JHAs are a baseline expectation.

What training is legally required before a new employee starts work?

Training requirements vary by hazard. Before working with hazardous chemicals, workers need HazCom training under 1910.1200. Before operating a forklift, operators need training and evaluation under 1910.178(l). Before any maintenance on energy-controlled equipment, workers need lockout/tagout training under 1910.147. Emergency action plan training comes before employees face emergency situations under 1910.38. The pattern holds: training before exposure, documented, in a language the worker understands.

Sources

1. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2023: BLS counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023
2. OSHA, OSH Act of 1970 Section 5 General Duty Clause: Section 5(a)(1) of the OSH Act requires employers to furnish a workplace free from recognized hazards; training must be in a language the worker understands
3. OSHA, 29 CFR 1910.132 General Requirements for PPE: 29 CFR 1910.132(d) requires a written hazard assessment for PPE selection
4. OSHA, Top 10 Most Cited Standards FY2023 and 2024 Penalty Adjustments: OSHA top 10 most-cited standards FY2023 and maximum penalties: serious/other-than-serious $16,550, willful/repeated $165,514 as of January 2024
5. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Lockout/tagout prevents an estimated 120 fatalities and 50,000 injuries per year; 1910.147(c)(6) requires annual inspection of energy control procedures
6. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: 29 CFR 1910.1200 requires a written hazard communication program, Safety Data Sheets for every chemical, and labels on every container
7. OSHA, 29 CFR Part 1904 Recording and Reporting Occupational Injuries and Illnesses: Fatalities must be reported within 8 hours; in-patient hospitalizations, amputations, or eye losses within 24 hours; employers with 10 or fewer employees in low-hazard industries are exempt from 300 Log requirements
8. OSHA, 29 CFR 1910.134 Respiratory Protection Standard: 29 CFR 1910.134 requires medical evaluation, fit test, and written program before a worker wears a tight-fitting respirator for the first time
9. OSHA, Recommended Practices for Safety and Health Programs: OSHA guidance describes worker participation as a core element of an effective safety and health program
10. National Safety Council, Injury Facts: National Safety Council estimated the average cost of a workplace injury at $44,000 in direct and indirect costs in 2022
11. OSHA, State Plans page: 22 states and 4 territories run OSHA-approved state plans; farms with fewer than 11 employees and no temporary labor camps are exempt from most OSHA standards