AED program requirements for small businesses: what you actually need

Last updated 2026-07-10

Does federal OSHA require AEDs in the workplace?

No. There is no OSHA standard under 29 CFR 1910 or 29 CFR 1926 that explicitly requires most private employers to own an automated external defibrillator. OSHA has said so directly in letters of interpretation. The agency confirms that the General Duty Clause (Section 5(a)(1) of the OSH Act) could theoretically be cited if a recognized cardiac hazard exists and a feasible fix (like an AED) is being ignored, but OSHA has not written a specific AED standard for general industry. ^[1]

"No federal rule" does not mean "no obligation." Two other forces create real requirements for small businesses: state laws, and voluntary standards that courts and regulators treat as the floor of reasonable care.

If your business sits in a state with an AED workplace mandate and you don't comply, you face state-level fines, civil liability in a wrongful-death lawsuit, or both. So the first thing to check is your state's statute, not the CFR.

Which states require AEDs in workplaces?

More than 30 states have enacted AED legislation. A smaller but growing group of those laws reach private employers, more than public buildings, schools, or gyms. The requirements vary a lot by state. ^[2]

Here is a rough breakdown of how state laws tend to be structured:

Category	Common trigger	Examples
Fitness centers / gyms	Any membership-based fitness facility	CA, FL, IL, NY, TX
Large workplaces	100+ employees on-site	Some county-level ordinances
High-traffic public spaces	Retail over a certain sq ft	Several Northeast states
State government buildings	Any state-owned building	Most states
Schools and universities	All schools	Nearly all states

California's Health and Safety Code Section 1797.196 requires AEDs in certain fitness facilities and in high-rise buildings. New York's Public Access Defibrillation Act is one of the broadest, covering many public and commercial buildings. ^[3]

The National Conference of State Legislatures (NCSL) keeps a running summary of state AED laws. Check it against your state health department's guidance, because the NCSL table sometimes lags new statutes by a year or more. ^[2]

Pull up your specific state statute before you do anything else. State law, not OSHA, is usually the enforceable requirement for a small private business.

What does a compliant AED program actually include?

Whether you're complying with a state mandate or installing AEDs voluntarily (which is a genuinely good idea in most workplaces, regardless of the legal floor), the American Heart Association and OSHA guidance describe the same core program elements. ^[4]

Here are the components a complete program needs:

1. A written AED program document. This is a short policy, usually two to four pages, that names who runs the program, where devices live, how they are maintained, and what responders are supposed to do. Treat it like any other written safety plan. It doesn't need to be long. It needs to be specific and accurate.

2. Designated responders with current CPR/AED certification. You need enough trained people on each shift that at least one is likely to be present during an emergency. The AHA recommends roughly one trained responder per 50 workers, though the right number depends on your layout and shift structure. ^[4]

3. A medical direction or medical oversight arrangement. Most state AED laws require a licensed physician or other medical authority to "prescribe" the AED for your facility and supervise the program. This sounds harder than it is. Many AED vendors and third-party program administrators handle it for a small annual fee, or your company's occupational medicine physician can fill the role. ^[3]

4. Device placement and accessibility standards. The generally accepted target is that an AED reaches the patient within three to five minutes of a cardiac event. Every minute without defibrillation cuts survival odds by roughly 10 percent. ^[5] In a 50,000 square foot single-story facility, that probably means more than one device.

5. Regular inspection and maintenance logs. AEDs run a self-check automatically, but a human still needs to verify the device is in its cabinet, the battery indicator is green, and the pads are not expired. Monthly visual checks with a log entry are the standard. ^[6]

6. A 911-first protocol. Every program should spell it out: call 911 first, then grab the AED and start CPR. AEDs support emergency medical services. They do not replace them.

7. Post-event review. After any AED use or activation, document what happened, review the device's event data (most AEDs record the incident), and debrief responders. This is both a quality-improvement step and a legal protection.

If you're building out your broader written safety programs and want a faster way to pull this together, SafetyFolio's safety program generator walks you through the documentation in a fraction of the time it takes to draft from scratch. The AED policy is one of the quicker written programs to finish, but it still has to be real and site-specific.

How many AEDs does your workplace need?

There is no universal federal formula. The practical standard, backed by AHA and OSHA guidance, is the three-to-five-minute response time target. ^[4] Work backward from that.

In a small office where everyone sits within 100 feet of a central hallway, one AED is probably enough. In a multi-floor building, the standard practice is one device per floor (or at minimum, every other floor with stairwell access). In a warehouse or plant, the large floor area and loud ambient noise usually call for multiple units.

Factors to think through:

• Number of employees and shift coverage. An AED in an empty building does nothing. Night-shift workers need coverage too.
• Physical layout. Distance matters more than headcount. A 200-person open office may need fewer AEDs than a 40-person operation spread across several buildings.
• Population risk factors. Older workforces, or workforces doing heavy physical labor, have higher cardiac event rates. Roughly 356,000 out-of-hospital cardiac arrests happen in the U.S. every year. ^[5]
• Customer or visitor traffic. If you run a fitness center, restaurant, or retail store, bystanders and customers raise your exposure.

For most small businesses with more than 20 employees, two devices is the practical minimum, unless your whole operation fits in one small room.

What are the real costs of an AED program?

The numbers below are real-world ranges, not marketing estimates. Prices swing by brand, features, and where you buy.

Item	Typical cost range
AED device (mid-tier, e.g., Zoll AED Plus, Philips HeartStart)	$1,200 to $2,500 per unit
AED cabinet / wall mount	$50 to $300
Replacement pads (every 2 years typically)	$30 to $75 per set
Replacement battery	$150 to $300 per device
CPR/AED training (per employee, group rate)	$25 to $75 per person
Medical direction / program oversight (annual)	$100 to $500 per site
Third-party program management (if outsourced)	$200 to $800 per year

For a small business buying two AEDs, training five designated responders, and handling annual maintenance in-house, a realistic first-year cost is $3,500 to $6,500. Annual recurring costs typically run $600 to $1,200. That is less than one OSHA citation penalty, and nowhere near the cost of a wrongful-death civil suit. ^[7]

Some states run AED grant programs, and some let AED purchases count toward workers' compensation premium discounts. Check with your state's department of health and your insurance carrier before paying full retail.

What CPR and AED training do employees need?

Training rules under state AED laws vary, but the consistent minimum across nearly every state that regulates AEDs is this: designated responders must hold a current CPR and AED certification from a recognized provider. ^[2]

The three most widely accepted certifying bodies are:

• American Heart Association (Heartsaver AED or BLS for Healthcare Providers)
• American Red Cross (CPR/AED certification)
• National Safety Council (First Aid/CPR/AED)

Certification cards are typically valid for two years. Your trained responders need to recertify every two years, and your training log has to reflect it. In a state audit or a workers' comp claim, the first thing a lawyer or inspector asks for is the training records.

A Heartsaver AED course runs roughly two to three hours. Blended-learning formats (online portion plus a short hands-on skills session) are now accepted by most state programs and take less time away from work. ^[4]

For how employee training fits into your overall safety obligations, the OSHA training overview covers structuring and documenting your training programs generally.

One honest caveat. Bystander willingness to use an AED matters as much as formal training. Studies consistently show that untrained bystanders can use AEDs effectively, because the devices talk users through each step. But trained responders act faster and with less hesitation, and that is where the survival benefit actually comes from. ^[5]

How do you write an AED program policy document?

A written AED program is a simpler document than something like a lockout tagout program or a hazard communication plan. It still has to be specific to your facility.

Here is the structure most state programs and the AHA recommend:

Section 1: Purpose and scope. One paragraph stating that the company keeps AEDs to respond to sudden cardiac arrest, who the policy covers, and when it was last reviewed.

Section 2: AED locations. A written list (and ideally a floor plan map) showing exactly where each device is. Include the building, floor, and specific spot ("mounted on the east wall of the main hallway, between the women's restroom and the fire exit").

Section 3: Designated responders. Names, job titles, and certification expiration dates for every current certified responder. Update this whenever someone leaves or gets certified.

Section 4: Response protocol. Step-by-step instructions: call 911, send someone to retrieve the AED, begin CPR, use the AED when it arrives, follow the prompts, continue until EMS takes over.

Section 5: Medical oversight. Name and contact information of the supervising physician or medical director.

Section 6: Maintenance schedule. Monthly visual inspection checklist (battery indicator, pad expiration, cabinet condition) and annual maintenance tasks.

Section 7: Post-event procedures. Who to notify, how to pull the device's event data, how to document the incident, and how to get the device back in service. Your incident report process should connect here.

Section 8: Training schedule. How often training happens, who schedules it, and where records live.

Keep the policy current. A review date from three years ago tells an investigator that nobody is actually running the program.

Does OSHA's General Duty Clause apply to AEDs?

Possibly, in specific situations. The General Duty Clause requires employers to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." ^[1] OSHA has been reluctant to cite employers for lacking AEDs under this clause, because the legal test requires showing that (a) the hazard is recognized, (b) it is likely to cause serious harm, and (c) a feasible fix exists.

OSHA's letter of interpretation from February 2004 addressed AEDs directly. It says OSHA does not require employers to have AEDs under the General Duty Clause in most circumstances, because the agency has not identified cardiac arrest as a recognized hazard in general industry workplaces the way it has for specific high-risk activities. ^[1]

There are exceptions. If your workers sit in a high-risk environment (a remote location where EMS response tops five to seven minutes, or a physically demanding job with documented cardiac risk), the math changes. OSHA's first aid standard at 29 CFR 1910.151 requires that "adequate first aid" be available, and in a remote location, an AED may be part of what "adequate" means. ^[6]

Some occupational health attorneys argue, and some OSHA compliance officers agree, that voluntary industry standards (like the AHA's guidance recommending AEDs in workplaces) can establish the "recognized hazard" prong of a General Duty Clause case. If you're in an industry where AED programs are common (construction camps, mining, oil and gas), the absence of one could support a citation. The risk is real even without a specific CFR number.

What liability protections do Good Samaritan and AED immunity laws provide?

Every U.S. state has some form of AED immunity or Good Samaritan statute that protects people who use an AED in good faith during an emergency. The scope of protection varies. ^[8]

Typically, the immunity covers:

• The individual who retrieves and uses the AED
• The person who provided CPR/AED training
• The physician who provided medical oversight (in states that require it)
• Sometimes the business that owns and maintains the device

Business-level immunity is the one that matters most for employers. Most states extend immunity to the AED owner as long as the device was properly maintained, registered with the required agency, and used in a genuine emergency. Some states require you to register your AED with the local EMS agency or state health department to qualify. Skip registration and you may lose the protection. ^[3]

This immunity does not cover negligent maintenance. If your pads were expired and the device failed because of it, a court could find the immunity does not apply. The maintenance log is more than good practice. It is what stands between you and successful civil litigation.

One more thing. The immunity protects bystanders and responders during the emergency itself. It generally does not protect employers from liability for failing to have an AED when state law required one.

How do you register an AED and stay compliant over time?

Registration requirements vary by state. Some states require you to register each AED with the state health department. Some require registration with the local EMS agency. Some require both. A few have no registration requirement at all. ^[2]

The practical steps for a new AED program:

1. Buy the device. Choose a reputable brand with readily available replacement parts. FDA-cleared AEDs are the standard. Buying a non-cleared device is a compliance problem and a liability problem. ^[9]

2. Register the device. Check your state health department website and your county EMS agency. In many states, registration is free and takes ten minutes online. It also means EMS knows you have an AED when they roll to your address.

3. Get a prescription or medical director. In states that require physician oversight, call a local occupational medicine clinic, your workers' comp insurer, or an AED program management company. Costs are usually modest.

4. Set up your maintenance log. Build a simple monthly checklist: device in place, battery indicator good, pad expiration more than 90 days out, cabinet unobstructed. Date it and sign it.

5. Train your responders. Get at least two to three people per shift certified, more if turnover is high.

6. Set calendar reminders. Pad replacement every two years (or per manufacturer spec), battery replacement per the device's schedule, recertification every two years, annual program review.

Ongoing compliance is where most programs die. The AED gets bought after someone reads an article like this one, goes in the cabinet, and nobody looks at it again until the battery is dead. A calendar reminder and a five-minute monthly walkthrough prevent that. ^[6]

If you're pulling together several written safety programs at once, tools like SafetyFolio's program generator help you build the AED policy alongside your other required programs so nothing slips.

Does having an AED affect your workers' compensation or business insurance?

Potentially, yes, though the effect varies by insurer and state.

Some workers' compensation carriers offer premium credits or wellness discounts to employers who install AEDs and keep a documented program. The logic is simple. An AED in a cardiac emergency reduces the severity of the claim outcome. A worker who survives a cardiac arrest with no neurological damage is a far smaller claim than a wrongful-death case or a long-term disability claim.

On the general liability and commercial property side, some insurers treat documented AED programs as a risk-reduction factor that can modestly move premiums or terms. The effect is rarely dramatic, but it is worth asking your broker directly.

The more tangible benefit is civil liability protection. A documented, maintained AED program with trained responders makes it much harder for a plaintiff's attorney to argue negligence if a cardiac event happens on your premises. Courts and juries respond to evidence of systematic preparation. A laminated maintenance log and three years of training records are worth more than almost any other single document in a premises liability case. ^[8]

What records do you need to keep for an AED program?

No single federal regulation sets AED recordkeeping retention periods, because no federal OSHA standard governs AEDs for most employers. State laws differ. As a practical matter, the standard advice from occupational health attorneys is to keep AED program records as long as your other safety records: at least five years, and longer if your state's statute of limitations for personal injury or wrongful death runs past that. ^[7]

Keep the following:

• Monthly inspection logs (date, inspector name, device status, any corrective action)
• Training records (names, training dates, certifying organization, certification expiration)
• Device registration documentation (state or EMS registration confirmation)
• Medical direction documentation (name of supervising physician, date of agreement)
• Post-event records (if a device was used, the incident documentation, EMS report if available, device event data download)
• Maintenance receipts (pad and battery replacements, any service calls)
• Written program document with each revision date

Keep these in one folder, physical or digital, dedicated to the AED program. Mixing them into general HR files makes them hard to find in an emergency. Your incident report files and your AED post-event records should cross-reference each other.

Frequently asked questions

Is there an OSHA fine for not having an AED?

There is no specific OSHA penalty for lacking an AED in most workplaces, because no 29 CFR standard requires one in general industry. State law violations can carry their own penalties, and OSHA could theoretically cite under the General Duty Clause in high-risk scenarios. The bigger financial risk is civil liability in a wrongful-death lawsuit, not an OSHA citation.

How often does CPR/AED certification need to be renewed?

Every two years, from all major certifying bodies including the American Heart Association, American Red Cross, and National Safety Council. Most state AED laws that require training also specify two-year renewal. Keep the certification cards and training attendance records on file, because those are what an inspector or plaintiff's attorney will ask to see.

Can any employee use an AED, or only trained ones?

Any person can legally use an AED in an emergency in all 50 states. Good Samaritan and AED immunity laws cover untrained bystanders acting in good faith. In practice, trained responders act faster and with more confidence, which improves survival odds. Having trained designated responders does not stop other employees from using the device if that is the only option.

Do I need a doctor's prescription to buy an AED?

FDA-cleared AEDs are prescription devices. In practice, most AED vendors handle the prescription requirement as part of the sale and include a form from a supervising physician. Separately, many state AED laws require ongoing medical oversight (a physician who authorizes the program), which is different from the purchase prescription and usually involves an annual agreement with an occupational medicine physician.

How long does an AED battery last?

Most AED batteries last four to seven years in standby mode, depending on the manufacturer and how often the device runs self-checks. Check your specific device's manual. Some batteries require replacement after a set number of shocks or after any use, regardless of age. Replacement batteries typically cost $150 to $300 and should be a scheduled expense, not a surprise.

Where should AEDs be placed in a small business?

The standard goal is a three-to-five-minute response time from anywhere in the facility. Place AEDs near high-traffic areas (main entrances, break rooms, production floors) rather than back offices. Wall-mounted cabinets at eye level with clear signage work best. In multi-story buildings, put one on each floor. Mark the locations on your facility emergency plan map.

Does a small business with fewer than 10 employees need an AED?

Possibly. If your state law applies to your facility type, headcount may not exempt you. Even outside a legal mandate, cardiac arrest can happen in a two-person office. The AHA's guidance sets no minimum employee threshold for recommending AEDs. For a tiny employer in a single room close to EMS, the risk-benefit math differs from an isolated facility, but the cost is low enough that most safety professionals recommend it regardless.

What should I do immediately after an AED is used at my workplace?

Call 911 if not already done, transfer care to EMS, then do three things: remove the device from service until inspected, download the event data (most AEDs have a USB port or Bluetooth for this), and complete an incident report documenting exactly what happened and when. Notify your medical director. Arrange a brief debrief with everyone involved. Then order a new pad kit, because used pads cannot be reused.

Can I use a defibrillator AED that is not FDA-cleared to save money?

No. Only FDA-cleared AEDs should be used in U.S. workplaces. Non-cleared devices may not qualify for state immunity protections, may not satisfy state program requirements, and create serious product liability and regulatory risk. Mid-tier FDA-cleared devices from Zoll, Philips, and Cardiac Science cost $1,200 to $2,000. That is not where to cut costs.

Do remote or construction worksites have different AED requirements?

Yes, and the calculus is actually clearer for remote sites. OSHA's first aid standard at 29 CFR 1910.151 (general industry) and 29 CFR 1926.50 (construction) require that adequate first aid be available. When EMS response tops three to four minutes, OSHA has interpreted this to mean employers should provide on-site first aid resources including, potentially, an AED. Remote construction camps and mining sites almost universally keep AEDs for this reason.

How do I find my state's specific AED law for workplaces?

Start with the National Conference of State Legislatures (NCSL) AED law database at ncsl.org, then verify against your state health department's website, because NCSL summaries sometimes lag recent amendments. Search your state health department's site for AED or public access defibrillation. If you're in a regulated industry (fitness, healthcare, childcare), your licensing agency may layer on additional requirements.

What is the survival rate difference when an AED is used promptly?

Survival from out-of-hospital cardiac arrest averages below 10 percent nationally. When a bystander uses an AED before EMS arrives, survival rates in documented cases rise to roughly 40 to 70 percent, depending on the study and setting. The American Heart Association notes that defibrillation within three to five minutes of collapse produces survival rates that high. Every minute of delay cuts the odds by roughly 10 percent.

Does an AED program need to be part of a broader emergency action plan?

Yes. OSHA's Emergency Action Plan standard at 29 CFR 1910.38 requires covered employers to keep a written EAP that includes procedures for reporting emergencies and evacuation. An AED response protocol fits logically inside the EAP's medical emergency section. Keeping them integrated means employees get a single coherent set of instructions rather than separate documents that may contradict each other.

Sources

1. OSHA, Letter of Interpretation on AEDs and the General Duty Clause (February 2004): OSHA has not identified cardiac arrest as a recognized hazard in general industry workplaces requiring AEDs under the General Duty Clause in most circumstances
2. National Conference of State Legislatures, State AED Laws: More than 30 states have enacted AED legislation covering various public and commercial settings
3. California Legislative Information, Health and Safety Code Section 1797.196: California requires AEDs in certain fitness facilities and high-rise buildings and specifies medical oversight requirements
4. American Heart Association, Recommendations for AED Programs in the Workplace: AHA recommends a trained responder ratio of approximately one per 50 workers and a response time target of three to five minutes; Heartsaver AED certification is a recognized standard
5. American Heart Association, Heart Disease and Stroke Statistics 2024 Update: Approximately 356,000 out-of-hospital cardiac arrest events occur annually in the U.S.; survival rises to 40-70% when AED is used within three to five minutes; survival drops roughly 10% per minute without defibrillation
6. OSHA, 29 CFR 1910.151, Medical Services and First Aid: OSHA's first aid standard requires adequate first aid be available; in remote locations this may include AEDs; monthly maintenance inspection is the standard practice
7. OSHA, 29 CFR 1926.50, Medical Services and First Aid (Construction): Construction standard requires adequate first aid availability; remote site EMS response times affect what 'adequate' means including potential AED requirements
8. National Conference of State Legislatures, Good Samaritan Laws and AED Immunity Statutes: Every U.S. state has enacted AED immunity or Good Samaritan statutes covering bystander users and, in most states, the AED-owning business when properly maintained and registered
9. U.S. Food and Drug Administration, Automated External Defibrillators (AEDs): AEDs are FDA prescription devices; only FDA-cleared AEDs should be purchased and used in workplaces
10. OSHA, 29 CFR 1910.38, Emergency Action Plans: OSHA requires covered employers to maintain a written Emergency Action Plan including procedures for medical emergencies
11. American Red Cross, CPR/AED Certification Programs: Red Cross CPR/AED certification is valid for two years and is accepted by most state AED programs as a recognized credential
12. Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2022: BLS fatal injury data provides context for cardiac-related workplace fatalities and the cost of inadequate emergency response