Hazard communication program: what to put in your written PDF

Last updated 2026-07-09

What is a written hazard communication program?

A written hazard communication program is a site-specific document that spells out how your business complies with OSHA's Hazard Communication Standard, 29 CFR 1910.1200 ^[1]. It is not a generic template you print and file. It has to describe the actual chemicals in your workplace, the people responsible for managing them, and the procedures your employees follow to stay safe.

The standard says employers must "develop, implement, and maintain at each workplace, a written hazard communication program" ^[1]. That phrase matters. One document for a multi-site business is not enough unless it addresses each location's specific conditions.

Most people call this the HazCom program, the right-to-know program, or the written chemical safety program. All three point to the same legal obligation. If OSHA walks in tomorrow and asks to see it, you hand them a physical or electronic document that covers every required element. A folder of SDSs alone does not satisfy the requirement.

Does OSHA actually require a written HazCom program?

Yes, and they cite it constantly. The written hazard communication program requirement under 29 CFR 1910.1200(e) was the fifth most cited OSHA standard in federal fiscal year 2023, with 3,213 violations recorded ^[2]. It lands in the top ten year after year, not because the hazards are exotic but because the paperwork is easy to inspect and easy to fail.

The requirement applies to general industry (1910.1200), construction (29 CFR 1926.59), maritime, and agriculture ^[1]. If your employees might be exposed to hazardous chemicals, you are covered. The standard defines "hazardous chemical" broadly: any chemical that is a physical hazard (flammable, reactive, pressurized) or a health hazard (carcinogen, irritant, corrosive, sensitizer, and others) ^[1].

Small businesses sometimes assume the rule is lighter for them. It is not. There is no small-employer exemption for written hazard communication. The only partial relief covers office settings where the only chemicals present are consumer products used in normal consumer quantities, and that exception is narrower than most people think.

What sections must a written hazard communication program include?

OSHA names four required elements in 29 CFR 1910.1200(e)(1) ^[1]. Your written program has to address:

1. Labels and other forms of warning 2. Safety data sheets 3. Employee information and training 4. Methods the employer will use to inform employees of hazards in non-routine tasks and of chemicals in unlabeled pipes

Beyond those four, OSHA requires you to keep a list of the hazardous chemicals in each work area, using product identifiers that match the labels and SDSs ^[1]. That chemical inventory is part of the written program framework.

Here is how practitioners usually structure the actual PDF:

Section	What it covers
Purpose and scope	Which facilities, which employees, who owns the program
Responsibilities	Named person (more than a title) responsible for labels, SDSs, training
Chemical inventory	List of all hazardous chemicals by work area, updated frequency
Labels	How incoming containers are checked, what to do with damaged labels, secondary container labeling procedure
Safety data sheets	Where SDSs are kept, how employees access them, what happens when a new chemical arrives
Training	Initial training, refresher triggers, how training is documented
Non-routine tasks	How supervisors communicate hazards before tasks outside normal operations
Contractor coordination	How you share hazard information with on-site contractors
Multi-employer worksites	If applicable, how HazCom info flows between employers
Review and update schedule	How often the program is reviewed, who signs off

Contractor coordination trips up a lot of small businesses. 29 CFR 1910.1200(e)(2) requires you to give other employers whose workers may be exposed to your chemicals the hazard information for those chemicals ^[1]. If you have contractors on-site, they need to know what they might run into.

For how hazard communication works at the standard level, including GHS alignment and SDS format, that article covers the full regulatory picture.

What does the GHS update require that older programs missed?

OSHA aligned its Hazard Communication Standard with the Globally Harmonized System of Classification and Labelling of Chemicals (GHS) in 2012, with a compliance deadline of June 1, 2016 for most employers ^[3]. Programs written before that update are almost certainly out of compliance if nobody has revised them.

The GHS changes that hit your written program hardest:

Labels now require six specific elements: a product identifier, signal word (Danger or Warning), hazard statement(s), precautionary statement(s), pictogram(s), and supplier identification ^[1]. Your program must describe how you verify incoming labels contain all six and how you handle secondary containers.

SDSs must follow a standardized 16-section format ^[1]. If your program still says "MSDS" (Material Safety Data Sheet) in its procedures without acknowledging the switch to SDS, inspectors will read that as proof the program was never updated.

Hazard classification is now standardized. Chemicals are assigned to defined hazard categories (Flammable Liquids Category 1, 2, 3, or 4, for example) against set criteria. Your training section should reference GHS hazard categories instead of vague descriptors.

OSHA issued a final rule in May 2024 updating HazCom to align with GHS Revision 7, with most provisions carrying a compliance date in 2026 ^[4]. If you are writing a new program now, check which parts of the 2024 update have taken effect and write your document accordingly.

How do you build the chemical inventory list?

The chemical inventory is the spine of the whole program. The SDSs, the labels, the training all trace back to it.

Start by walking every work area and listing every product that contains a hazardous chemical. That means cleaning supplies, lubricants, adhesives, paints, solvents, fuels, compressed gases, and process-generated chemicals like welding fumes or cutting fluid mist. Consumer products used exactly as a normal consumer would use them at home are exempt, but that is a real-use test, not a product category test ^[8]. A janitor using a quart of bleach once a week is probably consumer use. A maintenance worker burning through a case of the same product daily is not.

For each chemical, record:

• Product name (must match the SDS and container label)
• Manufacturer or supplier
• Work area where it is used or stored
• SDS location reference

Keep the inventory in the written program itself or as a clearly referenced appendix. Update it every time a new chemical enters the building. Assign one person by name (more than by title) to own that update. Inspectors ask to see the inventory, then pull a few random SDS files to check they match. A product in the building but not on the list is a citation.

If your business runs a lockout tagout program, your chemical inventory can overlap with the energy control program wherever chemical energy sources like pressurized lines are involved. Cross-reference both documents so they stay consistent.

Where do you have to keep safety data sheets?

Safety data sheets must be "readily accessible" to employees during their work shift in their work area ^[1]. That phrase is the whole rule, and OSHA has given it shape through letters of interpretation.

Electronic access is fine, but only if every employee can reach the system without barriers. If SDSs live on a shared drive, workers need to know how to get there, have any login credentials, and reach a terminal fast. If a chemical exposure happens and your employee cannot find the SDS because the computer is locked, you have a problem bigger than compliance.

OSHA has also said electronic-only systems need a backup plan for power outages or system failures ^[5]. A binder at the supervisor's desk is cheap insurance.

Physical binders organized by work area are still the most inspection-proof approach for smaller shops. Keep them in a known, labeled spot. The written program should state exactly where SDSs live for each work area. Something like "SDSs for the paint booth are in the red binder on the south wall of the paint room" is specific enough to be useful.

If a new chemical arrives without an SDS, you have to get one before employees work with it. Your program should describe that process: who contacts the supplier, how long they have to respond, and what happens in the meantime.

For a worked example, the hcl safety data sheet article walks through every section of a real SDS using hydrochloric acid.

What does OSHA require for hazard communication training?

Training is required before employees are first exposed to a hazardous chemical and again whenever a new physical or health hazard shows up in the workplace ^[1]. The standard does not require annual retraining by default, but many programs build in a yearly refresher anyway because it is easy to defend and cheap to run.

Training must cover:

• The requirements of 29 CFR 1910.1200 and where to find your written program
• Operations in the work area where hazardous chemicals are present
• Location and availability of the chemical inventory and SDSs
• Methods to detect the presence or release of hazardous chemicals
• Physical, health, simple asphyxiation, combustible dust, and pyrophoric gas hazards
• Protective measures (PPE, work practices, emergency procedures)
• How to read and use labels and SDSs

One common gap: the standard requires training on how to read an SDS, more than where to find one. Your records should document the content covered and the date. A sign-in sheet is the minimum. A short written quiz score, even a simple one, adds credibility if a citation ever gets contested.

There is no OSHA-mandated minimum number of training hours for HazCom. What matters is that the training works for your specific chemicals and tasks. A forklift operator handling propane tanks needs different detail than an office worker who occasionally swaps copier toner. Match the training to the exposure.

More on general osha training requirements, including documentation standards, is worth reading alongside this.

How do you handle labeling for secondary containers?

When you transfer a chemical from its original container into a smaller one for use, you have made a secondary container. Those need labels too, with one narrow exception: if the chemical is for the immediate use of the employee who transferred it and that employee keeps the container through the shift, no label is required ^[1].

In practice that exception covers less ground than people assume. A worker fills a spray bottle of solvent and then goes to lunch? That bottle needs a label. Multiple workers might use it? It needs a label.

For secondary containers, your program should specify at minimum the product identity and the hazard warnings for that chemical. You do not have to reproduce the full GHS label on a small bottle, but the worker picking it up needs to know what is in it and what the main hazard is.

Pre-printed secondary container labels are available from safety supply vendors. A laminated card system, a label printer, or a permanent marker with a standardized format all work. Whatever you choose, describe it in the written program. Inspectors look for unlabeled spray bottles and containers sitting around work areas. It is an easy, high-frequency citation.

What are the most common HazCom citation types and how do you avoid them?

OSHA's HazCom citations cluster around a predictable set of failures ^[2]. Knowing them lets you self-audit before an inspector does it for you.

Citation type	What OSHA finds	How to prevent it
No written program	Program does not exist or cannot be produced	Have a current, signed document accessible immediately
Written program not site-specific	Generic template with no facility details	Name chemicals, locations, and responsible persons explicitly
Missing chemical inventory	No list, or list is outdated	Audit inventory quarterly, update on every chemical change
SDS not available/accessible	SDS missing, locked cabinet, electronic barriers	Physical backup binder, test electronic access
Unlabeled secondary containers	Spray bottles, buckets, decanted chemicals with no label	Label policy in program, enforce consistently
Training not documented	Training happened but no records	Sign-in sheets at minimum, quiz records ideal
No contractor coordination	Contractors on-site, no HazCom exchange	Written procedure for sharing SDS info with contractors
Program not updated after 2016 GHS revision	Still references "MSDS", pre-GHS label requirements	Review and revise; replace MSDS language throughout

The site-specific failure is the one that catches businesses who downloaded a template and filed it. OSHA's compliance officers are trained to spot generic programs. They look for named individuals, real chemical names, specific room or area references. If your program could describe any business in America, it does not meet the standard.

If you need a starting point built to be site-specific from the first question, SafetyFolio's safety program generator walks through the required elements and produces a document tied to your actual facility in about 15 minutes, which beats rebuilding a generic template by hand.

How do you format and distribute the written program as a PDF?

OSHA does not specify a format. The program can be a Word document, a PDF, a binder of printed pages, or a section of your employee handbook, as long as it is written, complete, and accessible. PDF is practical because it is hard to edit by accident, easy to version-control, and simple to hand to an inspector.

A few formatting decisions that matter for compliance:

Date and version-number every copy. When OSHA asks for your program, you want to hand over the current version. If the inspector finds an older copy in a drawer, version numbers make clear which one counts.

Include a signature or approval line from whoever owns the program. That is usually the owner, operations manager, or safety officer. It does not need to be notarized or witnessed. It just shows someone with authority reviewed it.

If you have multiple locations, either write a separate program for each or clearly section the document by location, with location-specific inventory lists and SDS locations.

Store the master PDF somewhere employees can actually reach: a shared network folder, a printed binder, or a posted copy in a break room. The written program must be available to employees on request, and to OSHA on request ^[1].

Review the program at least annually and any time something significant changes: a new chemical category, a facility change, a responsible-person change, or a regulatory update. Log the review date in the document.

What penalties does OSHA issue for HazCom violations?

OSHA penalty amounts adjust every year for inflation. As of 2024, the maximum penalty for a serious violation is $16,131 per violation, and willful or repeated violations can reach $161,323 per violation ^[6].

HazCom violations are almost always classified as "serious," meaning OSHA found substantial probability that the violation could cause death or serious physical harm. A missing written program plus employees working with solvents or corrosives is a textbook serious citation.

OSHA also weighs the number of affected employees when it calculates gravity-based penalties. A missing program at a 50-person shop draws a higher penalty than the same gap at a 5-person shop, all else equal.

The better news: OSHA offers penalty reductions for small employers (fewer than 25 employees get a 60 percent reduction), for demonstrated good faith, and for quick abatement ^[6]. If you get cited and fix the problem right away, document that abatement carefully and submit it with your informal conference request.

Average penalty per HazCom inspection sits well below the maximums. But a full inspection that finds several related violations (no written program, missing SDSs, unlabeled containers, no training records) can stack into a serious number even for a small employer.

How do you write a HazCom program for a multi-employer worksite like construction?

Construction sites are one of the most common multi-employer HazCom scenarios, but the same logic applies any time two or more companies share a work location.

29 CFR 1926.59 covers construction and mirrors the general industry standard ^[7]. The extra obligation is coordination between employers: if your workers might be exposed to chemicals another employer uses on the same site, each employer has to inform its own workers about those hazards.

In practice, the general contractor usually takes the coordination role. A written procedure in your HazCom program should describe:

• How you identify which other employers are on-site
• How you request their SDS lists for chemicals near your workers
• How you share your SDS list with them
• Who owns the exchange and when it happens (usually the pre-work meeting or site orientation)

Subcontractors sometimes assume the GC handles all of this. The GC does have coordination duties, but each employer's written HazCom program still has to address the multi-employer situation on its own. OSHA can cite a subcontractor whose program has no multi-employer section even when the GC's program is solid.

For any business doing construction work, the broader picture of osha requirements for the construction industry is useful context alongside your HazCom program.

How do you keep the program current as chemicals and regulations change?

A hazard communication program is not a one-time project. Chemicals come and go, employees change, facilities change, and OSHA's standard itself has moved twice since 2012: the 2016 GHS compliance deadline and the 2024 GHS Rev. 7 update ^[3][4].

Build a review cycle into the document itself. Most practitioners run an annual review plus a triggered review whenever any of these happen:

• A new hazardous chemical enters the facility
• A chemical is removed for good (take it off the inventory, archive rather than delete the SDS)
• A responsible person changes (update names immediately)
• An employee is injured or exposed (review whether the program addressed that scenario)
• OSHA updates the standard or issues relevant guidance

For the 2024 update, OSHA published a final rule in May 2024 that modifies classification criteria, adds new hazard classes (such as desensitized explosives and non-flammable aerosols), and updates label requirements for small containers ^[4]. Most provisions have phased compliance dates. If your program predates 2024, schedule a review against the new requirements.

The practical approach for a small business: put the annual review on the calendar, check the chemical inventory against the SDS files, confirm every named individual is still in their role, and verify training records cover all current employees. Once the program is well-built, that review takes a couple of hours. Keeping it current is far cheaper than a citation.

SafetyFolio's program generator produces a dated, versioned document you can regenerate quickly for a regulatory change or facility edit, which beats hunting through a static PDF to find what needs changing.

Frequently asked questions

Can I just download a free hazard communication program PDF template from OSHA's website?

OSHA provides sample written program language in its HazCom guidance, but a downloaded template alone does not satisfy the requirement. The standard requires your program to be specific to your workplace: named chemicals, named responsible persons, specific SDS locations, and your actual work areas. A template is a starting structure, not a finished program. You have to fill it in with your facility's real details before it is compliant.

How long does it take to write a hazard communication program?

For a small business with a short chemical inventory, a few hours of focused work is realistic once your chemical list and SDS files are in order. The slow part is usually building the chemical inventory from scratch by walking every work area and cataloging every product. If your SDS files are organized and your chemical list is current, writing the document itself can take less than a day.

Does my written HazCom program need to be in English?

OSHA's standard does not explicitly require English, but it requires training to be conducted in a language and vocabulary employees understand. If your workforce is primarily Spanish-speaking, your training and the accessible parts of the program should be in Spanish. OSHA guidance indicates that language barriers do not excuse non-compliance with the employee information and training requirements.

What is the difference between a hazard communication program and a written safety program?

A hazard communication program is one specific written safety program required by 29 CFR 1910.1200. A written safety program is a broader term for any OSHA-required written policy, from lockout/tagout to respiratory protection to emergency action plans. Your HazCom program is one of potentially several written programs your business needs, depending on the hazards present.

Are office workers covered by the hazard communication standard?

Generally yes, if hazardous chemicals are present in the work area. OSHA recognizes a practical limit: employees in offices who work only with consumer products used in normal consumer quantities face minimal hazard and fall under a narrow exemption. But an office worker who regularly uses cleaning products, toner, or correction fluid in quantities beyond typical consumer use is covered. When in doubt, include the chemical.

How often does OSHA require hazard communication training to be repeated?

The standard requires training before initial exposure and when new hazards are introduced. There is no mandatory annual retraining requirement in the text of 29 CFR 1910.1200. But OSHA compliance officers look for evidence that training actually worked, and many employers run annual refreshers as a practical matter. Any time a significant new chemical category enters the facility, that triggers a required training update.

What happens if a supplier sends a chemical without an SDS?

You must get the SDS before employees work with the chemical. Your written program should name who contacts the supplier, the acceptable response timeframe, and what happens in the meantime. OSHA has consistently held the employer responsible for having SDSs regardless of supplier behavior. If a supplier will not provide one, you can contact the chemical manufacturer directly or search OSHA's chemical resources online.

Do I need a hazard communication program for pesticides?

Pesticides registered under the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) are partially exempt from the SDS requirement when used in agriculture, but the labeling provisions still apply. For non-agricultural employers using pesticides (pest control services, building maintenance), the HazCom standard applies in full. When in doubt, check whether the pesticide has an SDS available; most manufacturers provide one voluntarily.

Can a hazard communication program be stored and accessed electronically?

Yes. OSHA permits electronic storage as long as employees can access the document without barriers during their work shift. The system must be reliable, employees must be trained to use it, and there must be a backup plan for system outages. OSHA has confirmed this in multiple letters of interpretation. For inspections, keeping a printed copy immediately available alongside the electronic version is the safest approach.

What is the difference between the HazCom standard and the GHS?

The Globally Harmonized System (GHS) is an international framework for classifying and labeling chemicals, developed by the United Nations. OSHA's Hazard Communication Standard (29 CFR 1910.1200) is the U.S. regulation employers must follow. In 2012, OSHA revised HazCom to align with GHS, adopting its classification criteria, pictograms, signal words, and 16-section SDS format. GHS is the international system; HazCom is the enforceable U.S. law.

Who is responsible for maintaining the hazard communication program?

The employer is legally responsible, but a specific person should be named in the document. For a small business, that is usually the owner or operations manager. For a larger operation, it may be a safety coordinator. The named person should own chemical inventory updates, SDS file maintenance, training coordination, and annual review. Unnamed responsibility is unowned responsibility, and OSHA inspectors will ask who is in charge.

Does a hazard communication program need to be signed or certified?

OSHA does not require a signature on the written program, but including one is smart. A signature from the responsible owner or manager shows someone with authority reviewed and approved the document. It also creates a natural prompt to review and re-sign during annual updates, which gives you a clear audit trail showing the program was actively maintained rather than filed and forgotten.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard (full regulatory text): Requires employers to develop, implement, and maintain a written hazard communication program covering labels, SDSs, training, non-routine tasks, and contractor coordination
2. OSHA, Top 10 Most Cited Standards FY2023: HazCom written program (29 CFR 1910.1200) was cited 3,213 times in FY2023, ranking among the top-10 most cited OSHA standards
3. OSHA, Hazard Communication: GHS alignment final rule and compliance timeline: OSHA aligned HazCom with GHS in 2012 with a compliance deadline of June 1, 2016 for most employers
4. OSHA, Hazard Communication Standard 2024 Final Rule (HCS Rev. 7 update): OSHA published a final rule in May 2024 updating HazCom to align with GHS Revision 7, adding new hazard classes and updating label requirements
5. OSHA, Letter of Interpretation: Electronic access to SDSs (March 20, 1998): OSHA confirmed electronic SDS systems are acceptable but require backup plans for power outages or system failures
6. OSHA, Penalties page (FY2024 adjusted maximums): Maximum penalty for a serious violation is $16,131 per violation; willful or repeated violations up to $161,323 per violation as of 2024
7. OSHA, 29 CFR 1926.59 Hazard Communication (Construction): Construction industry HazCom requirements under 29 CFR 1926.59 mirror general industry requirements and include multi-employer coordination obligations
8. OSHA, Small Entity Compliance Guide for the Revised Hazard Communication Standard: OSHA guidance confirms the consumer product exemption is a real-use test, not a product category test
9. United Nations Economic Commission for Europe, Globally Harmonized System of Classification and Labelling of Chemicals (GHS): GHS is the international framework for chemical classification and labeling that OSHA's HazCom standard adopted in 2012
10. BLS, Injuries, Illnesses, and Fatalities program data: BLS occupational injury and illness data providing context for chemical exposure incidents in U.S. workplaces