Hazard communication regulation: what every employer must do

Last updated 2026-07-09

What is the hazard communication regulation?

The Hazard Communication Standard at 29 CFR 1910.1200 is OSHA's rule that gives workers the right to know about the chemical hazards they face on the job ^[1]. Most people call it HazCom, or the "right-to-know" law. It reaches general industry, construction, maritime, and agriculture. That is nearly every workplace in the country where chemicals are present.

OSHA published the standard in 1983 and rewrote it substantially in 2012 to match the United Nations Globally Harmonized System of Classification and Labelling of Chemicals (GHS), which set one worldwide method for communicating hazards ^[1]. The 2012 revision phased in new label rules and a 16-section Safety Data Sheet format. Full compliance was due by June 1, 2016, for most employers.

OSHA revised the standard again in a final rule published May 20, 2024, refining classification criteria and label provisions, with phased compliance dates running through 2027 ^[2]. Set up your program years ago and never touched it since? The 2024 changes are worth a look.

The idea behind all of it is plain. If your workers can be exposed to a hazardous chemical, they need to know what it is, what it can do to them, and how to protect themselves. The regulation is the machinery that makes that knowledge happen.

Who does the hazard communication standard apply to?

The standard covers any employer in a regulated industry where employees may be exposed to hazardous chemicals under normal use or in a foreseeable emergency ^[1]. That net is wide. A restaurant with commercial degreasers is covered. A dentist's office with sterilization chemicals is covered. A landscaping crew spraying pesticides is covered.

Some things are carved out. Hazardous waste regulated by EPA under RCRA, tobacco products, wood and wood products in their natural state, foods and drugs the FDA regulates in consumer packaging, and a handful of other narrow categories are exempt ^[1]. Run a typical small business with any chemicals on hand, though, and you should assume you are covered.

Construction lands under 29 CFR 1926.59, which pulls in the same substantive requirements under a different cite. Maritime operations fall under 29 CFR 1915.99, 1916.45, and 1917.28 depending on the sector. State-plan states can enforce rules at least as effective as the federal standard, and some go further, so check your state if you operate under a state plan.

There is no small-business escape hatch. OSHA has never set a minimum employee count for HazCom. A sole proprietor with one part-time helper who uses a solvent-based adhesive is subject to the rule.

What are the four main requirements of 29 CFR 1910.1200?

HazCom rests on four requirements, and you need all four to be compliant.

1. Written hazard communication program. You must have a written program describing how your workplace handles labels, SDSs, and employee training ^[1]. It has to list the hazardous chemicals in each work area and spell out how the other pieces operate in your specific building. A template pulled off the internet does not clear this bar on its own. It needs your actual chemicals, your actual work areas, your actual training plan. If you want to build one fast without paying a consultant, SafetyFolio's safety program generator produces a site-specific written HazCom program in about 15 minutes.

2. Labels and other forms of warning. Chemical manufacturers and importers must label shipped containers with a product identifier, a signal word (Danger or Warning), hazard statements, precautionary statements, pictograms, and supplier contact information ^[1]. Your job as the employer is to keep those labels from being removed or defaced, and to label any secondary container you fill from the original with at least the product identifier and the applicable hazard information.

3. Safety Data Sheets. SDSs (formerly Material Safety Data Sheets) must exist for every hazardous chemical on site and follow the standard 16-section GHS format ^[1]. Workers and their designated representatives must reach them during every work shift. They cannot sit locked in a manager's office that closes at 5 p.m.

4. Employee training. Workers must be trained before they are first assigned to work with or near a hazardous chemical, and again whenever a new hazard enters their area ^[1]. Training covers how to read and use SDSs, how to read labels, the specific hazards in their work area, and the protective measures available.

These four hang together. A shop with beautiful SDSs but no written program and no training is still out of compliance, and inspectors cite each element on its own line.

How often is hazard communication cited by OSHA, and what are the penalties?

HazCom has stayed on OSHA's top-ten most-cited list every year for more than a decade. It ranked fifth in fiscal year 2023 with 3,213 violations across all industries ^[3]. Construction drives a big share, but manufacturing, wholesale trade, and healthcare pile up citations too.

Penalties turn on how the violation gets classified. OSHA's maximum civil penalty for a serious violation is $16,550 per violation for 2024 ^[4]. Willful or repeated violations run up to $165,514 each. In practice, OSHA adjusts penalties for employer size, good faith, gravity, and history, so a small employer with a clean record who cooperates during an inspection usually sees the number drop well below the ceiling. "Well below" can still mean thousands per citation item.

The citation items that show up most under HazCom: no written program (1910.1200(e)), SDSs missing or out of reach (1910.1200(g)), missing or bad labels on secondary containers (1910.1200(f)), and training not done or not documented (1910.1200(h)) ^[3].

Here is the practical lesson. HazCom violations are the easiest thing an inspector can see. The CSHO walks in, scans containers for labels, asks for the SDS binder, and asks whether employees were trained. Five minutes tells them whether you are compliant.

What must a hazard communication written program include?

Section 1910.1200(e) says the written program must describe how you handle container labeling, SDS management, and employee training in your specific workplace ^[1]. Around that frame, the program needs to:

• Name who owns each element (who manages SDSs, who runs training).
• Describe how the chemical inventory is kept and updated.
• Explain how employees get information and SDSs during their shift.
• Cover how non-routine tasks with hazardous chemicals are handled.
• Address how contractor employees learn about chemical hazards on the site.

The contractor piece trips up small employers constantly. If outside contractors work in your facility, you have to give them access to your SDSs and tell them about the chemical hazards they might hit ^[1]. It runs both ways. You also need information from contractors about chemicals they bring in.

The program does not need to be long. A tight, specific five-page document beats a 40-page boilerplate that never names a single real chemical or person. Inspectors read these. They know the difference.

Keep the written program where employees and their representatives can get it. An inspector can ask for a copy the moment they walk in, and you need to hand it over.

What are the GHS label requirements under HazCom 2012 and the 2024 update?

GHS labels on containers shipped from manufacturers must carry six elements under the current standard: product identifier, signal word, hazard statement(s), precautionary statement(s), pictogram(s), and supplier identification ^[1]. Signal words come in two flavors only: "Danger" for more severe hazards, "Warning" for less severe ones. Pictograms are the red-bordered diamonds covering flammable liquids, acute toxicity, corrosion, environmental hazards, and more.

As the downstream employer, your work is preservation and secondary labeling. You cannot remove or deface any label that arrived with the product ^[1]. When you pour a chemical into a smaller or secondary container (a spray bottle, a smaller drum, a portable tank), that container needs labeling too. At minimum it needs the product identifier plus words, pictures, or symbols that get the hazard across. For a workplace container you fill and empty within the same shift, the standard gives more slack, but the chemical still has to be identifiable.

The 2024 rule changed how certain concentration ranges get disclosed on labels, tightened bulk-shipment labeling, and updated some classification criteria ^[2]. Manufacturers have until 2027 to finish rolling out the label changes, so watch for updated labels on new shipments and update your SDSs to match.

Pipes and piping systems do not need to meet the container label rule, but OSHA still requires employees to know what hazardous chemicals run through them. Placards, posted signs, or other identification systems all work ^[1].

What are the Safety Data Sheet requirements?

Every hazardous chemical in your workplace must have a Safety Data Sheet in the standard 16-section format required since 2015 ^[1]. The 16 sections run in this order: Identification; Hazard(s) identification; Composition/information on ingredients; First-aid measures; Fire-fighting measures; Accidental release measures; Handling and storage; Exposure controls/personal protection; Physical and chemical properties; Stability and reactivity; Toxicological information; Ecological information; Disposal considerations; Transport information; Regulatory information; Other information.

Section 8, exposure controls, is the one your hazard communication program leans on most. It lists the OSHA permissible exposure limits (PELs) and ACGIH threshold limit values (TLVs) for the substance and recommends specific PPE.

You get SDSs from your suppliers. If a supplier ships a chemical without one, you have to request it ^[1]. Keep the sheets in a format employees can reach on every shift, whether that is a physical binder, a computer terminal, or a cloud system. The method does not matter as long as it actually works at 2 a.m. on a Saturday when your night crew needs it.

You do not have to keep SDSs for chemicals you stopped using, but OSHA's records rule at 29 CFR 1910.1020 requires retaining SDSs (or the exposure records that stand in for them) for 30 years for substances that could cause occupational illness, to support later medical surveillance ^[5]. Many employers just keep everything in an electronic archive. Storage is cheap. Litigation is not.

For a worked example of reading one sheet, the HCl safety data sheet walkthrough on this site breaks down what each section means in plain terms.

What does hazard communication training need to cover?

Training sits at 1910.1200(h) ^[1]. Employees must be trained at initial assignment and again whenever a new physical or health hazard enters their work area. The standard writes in no refresher interval, but OSHA has said in letters of interpretation that training must be effective, and an employer who never revisits training as chemicals and people change is failing that test in practice.

Training has to cover:

• The HazCom standard itself and where to find the written program and SDSs.
• Operations in their work area where hazardous chemicals are present.
• The location of the chemical inventory list and SDSs.
• How to detect a chemical's presence or release (appearance, odor, monitoring gear).
• The physical and health hazards of the chemicals they handle.
• Protective measures: work practices, emergency procedures, PPE.
• How to read and interpret SDSs and container labels.

OSHA does not require training to be in person or run by a certified trainer. Online training counts if it covers every required topic and lets employees ask questions ^[6]. There is no minimum length. A 20-minute session on the three chemicals used in a small shop can be fully compliant. A four-hour generic video that never names the chemicals in your building is not.

Document every session: date, trainer, attendees, topics, and how you checked understanding. If OSHA asks whether employees were trained, "yes, we trained them" with no records lands the same as never training them at all. For the wider picture of how OSHA defines training across standards, the OSHA training guide lays out the framework.

How do you build a chemical inventory list?

The chemical inventory list is the spine of your HazCom program. It is not a separate rule with its own CFR cite, but it is required inside the written program, which must describe the hazardous chemicals present in each work area ^[1].

Building one is simple if you work through it methodically. Walk every area with a clipboard. Open every cabinet, storage room, maintenance closet, and break-room supply shelf. List every product by the name printed on the label. Note the work area, the manufacturer, and whether you already have a current SDS. Cross off anything exempt (a consumer product used at the same duration and frequency a normal household would use it, for example).

Once the list exists, it doubles as your SDS checklist. Every item needs a sheet. Every item needs to show up somewhere in your training. New chemicals arriving should trigger an SDS request before anyone opens them.

Keep it current. Name a person, in writing, to update it when products change. Seasonal work, contractors, and equipment maintenance all sneak new chemicals in quietly. The employee who spots a new product on the shelf should know exactly who to tell.

A good target for a small employer is a one-page spreadsheet per work area with columns for product name, manufacturer, SDS on file (yes/no), SDS date, and primary hazards. That is enough.

How does the hazard communication standard interact with other OSHA rules?

HazCom is sometimes called a horizontal standard because it touches nearly every other OSHA rule involving chemicals. Knowing the overlaps prevents both gaps and wasted effort.

Process Safety Management (29 CFR 1910.119) applies to facilities holding highly hazardous chemicals above set threshold quantities. PSM asks far more than HazCom, but HazCom's SDS and labeling rules still run alongside it ^[7].

Lockout/Tagout (29 CFR 1910.147) controls hazardous energy during maintenance. Chemical energy is one category of hazardous energy under LOTO, and SDSs can feed the energy control procedures. If your maintenance crew services equipment holding hazardous chemicals, both standards apply. The lockout tagout standard carries its own written program and training.

The Bloodborne Pathogens standard (29 CFR 1910.1030) has its own labeling and training for biological hazards. HazCom flatly excludes biological hazards from its scope, so healthcare employers run both standards in parallel ^[1].

Permissible Exposure Limits under 29 CFR 1910.1000 (the Z-tables) and substance-specific standards (asbestos at 1910.1001, lead at 1910.1025, and others) set enforceable exposure limits that Section 8 of the SDS points to. Where a substance-specific standard exists, it controls. HazCom does not override it.

For how all these pieces snap into a full safety program, the broader OSHA framework article gives the whole picture.

What are the most common HazCom violations and how do you fix them fast?

OSHA's citation records keep pointing to the same failure points ^[3]. Here is where employers fall down and what actually fixes each one.

No written program, or a generic one. Fix: write or buy a program built for your workplace. Name your chemicals, name your responsible person, describe your SDS storage down to the room and cabinet. Two hours on this saves you thousands in penalties.

Missing or outdated SDSs. Fix: run your inventory against your binder. For every gap, email the manufacturer or distributor today and ask for the current SDS. Most keep them on their website or send them within 24 hours. Archive the old ones separately. Do not destroy them.

Labels removed or obscured. Fix: walk your storage areas. Any container with a peeling, smeared, or missing label gets relabeled before the walk-through ends. Buy a label printer and a laminator if your environment eats paper.

Secondary containers not labeled. Fix: buy pre-printed hazard labels for your common secondary containers (cleaner spray bottles, small solvent cans, refill dispensers). Keep a stack of blank secondary-container labels at the filling station with posted instructions.

Training not documented. Fix: make a one-page sign-in sheet for every session. Keep them in a folder. If you trained verbally and never wrote it down, hold a short refresher and document it this week.

Employees cannot find the SDS binder. Fix: move the binder to where people actually work, or post the access instructions where they can see them. Using a digital system? Verify the terminal or URL opens on every shift without a login your employees do not have.

Does the hazard communication standard apply to small businesses and home-based operations?

Yes, with one qualifier. OSHA's jurisdiction requires at least one employee. A sole proprietor with no other workers sits outside OSHA's employer jurisdiction entirely, but a home-based business with even one paid employee who faces chemical exposure is covered ^[8].

Self-employed people with no employees are not subject to OSHA standards at the federal level, though some state plans differ. Farms with ten or fewer employees that have had no fatality or catastrophe in the prior two years may be exempt from some OSHA inspections under congressional appropriations riders, but HazCom still applies to covered agricultural establishments ^[8].

Business size does not shrink your obligations, but it does move your penalty exposure. OSHA applies a penalty adjustment factor based on employee count. Employers with 25 or fewer employees receive a 60% cut from the gravity-based penalty before any good-faith adjustment ^[4]. That still leaves real money at risk if you are cited, but the exposure runs proportionally lower for the smallest employers than the published maximums suggest.

Never heard of HazCom before today? Start with your chemical inventory, gather your SDSs, write a one-page program, and train your people. That sequence, in that order, gets you to basic compliance. No consultant required.

What should you do if OSHA shows up for an inspection?

An OSHA inspector (a Compliance Safety and Health Officer, or CSHO) has the right to enter your workplace, and if a complaint prompted the visit, they may show up with no advance notice ^[9]. The first things they usually ask for are your OSHA 300 log, your written HazCom program, and your SDS binder. Having those three ready and reachable goes a long way.

You can require the inspector to get a warrant if you want to refuse entry, but very few small employers gain anything from that, and it tends to sour the situation. Cooperating and handing over documentation promptly usually produces the better outcome.

During the walk-around, the CSHO will look at chemical storage, check container labels, and watch how chemicals get handled. They may interview employees in private. Tell your employees to answer honestly. Coaching them to hide information is a serious offense, and an employee who cannot name the chemicals they use is the strongest evidence of a compliance failure.

If violations turn up, you get a citation with a proposed penalty and an abatement deadline. You can contest citations within 15 business days. Many small employers work out an informal settlement agreement with the OSHA area office, which often trims penalties in exchange for prompt abatement ^[9].

Good records before an inspection are your best protection. An incident report system plus solid training and SDS documentation tells an inspector you take this seriously.

Frequently asked questions

Is there a list of chemicals that trigger HazCom requirements?

There is no official OSHA list of every chemical that qualifies. Instead, 29 CFR 1910.1200 defines hazardous chemicals by criteria: anything that poses a physical hazard (flammable, explosive, reactive) or a health hazard (toxic, carcinogenic, corrosive, and so on). If a chemical meets the criteria, it is covered. If your supplier hands you an SDS, that is a reliable sign the chemical is regulated.

Can I use digital Safety Data Sheets instead of a paper binder?

Yes. OSHA allows electronic SDS systems as long as employees can reach the sheets immediately during their shift with no barriers. A computer that needs a login employees do not have, or one locked in an office, does not satisfy the rule. Keep a backup method for power or system failures. Inspectors will note it if you do not.

What happens if a manufacturer does not provide an SDS with a chemical shipment?

You must request one from the manufacturer or importer. If they still fail to provide it, you can report the violation to your OSHA area office. Manufacturers and importers are required under 29 CFR 1910.1200(g) to develop and supply SDSs for every hazardous chemical they produce or import. As the employer, document your request and the date you sent it.

Do I need to train employees again if I add one new chemical?

You must train employees whenever a new physical or health hazard enters their work area, per 1910.1200(h)(1). If the new chemical brings a hazard type your employees have not seen before, full training on that hazard is required. If it is similar in hazard to what they already handle, OSHA accepts focused training on the specific new chemical rather than repeating the whole program.

What is the difference between an MSDS and an SDS?

They carry the same kind of information in a different format. Material Safety Data Sheets (MSDS) followed various older formats before 2012. Safety Data Sheets (SDS) follow the standard 16-section GHS format OSHA required in its 2012 revision. Since the deadline passed in 2015 and 2016, every sheet from a compliant manufacturer should be in the 16-section format. MSDSs in your binder are probably outdated and should be replaced.

How long do I need to keep Safety Data Sheets?

For substances that could cause occupational illness, OSHA's Access to Employee Exposure and Medical Records rule at 29 CFR 1910.1020 requires keeping SDSs (or equivalent exposure records) for 30 years, even after you stop using the chemical. Many employers keep every sheet indefinitely in electronic storage given the low cost. Tossing SDSs for substances your workers were exposed to is a real legal and liability risk.

Do temporary or contract workers need HazCom training?

Yes. The host employer and the staffing agency share responsibility for temporary workers. The host employer usually handles site-specific and chemical-specific training since it controls the environment. The agency may cover general HazCom awareness. OSHA guidance makes clear neither party can assume the other handled it. Put the arrangement in writing in your contractor agreement.

What are the GHS pictograms and what do they mean?

There are nine GHS pictograms, each in a red diamond: flame (flammables, self-reactives), flame over circle (oxidizers), exploding bomb (explosives, self-reactives), skull and crossbones (acute toxicity), exclamation mark (irritants, less severe toxicity), corrosion (skin and metal corrosion), gas cylinder (compressed gases), health hazard (carcinogens, respiratory sensitizers, reproductive toxicity), and environment (aquatic toxicity). The SDS and label together tell you which specific hazard applies.

Are cleaning products and office supplies covered by the HazCom standard?

Consumer products like office cleaning sprays used the same way and at the same frequency a household consumer would use them are exempt under the consumer product exemption. But industrial-grade cleaners, consumer products used at higher frequency or concentration than normal home use, or large stored quantities likely fall outside the exemption. When in doubt, get the SDS and train your workers. The cost of compliance is low.

How does HazCom apply in construction?

Construction employers are covered by 29 CFR 1926.59, which adopts the same requirements as 1910.1200. The practical difference is that construction sites carry multiple employers and subcontractors, so SDS access and inter-employer communication matter more. Each employer on a multi-employer site must inform the others of the hazardous chemicals their workers might hit and give access to SDSs.

What is the penalty for not having a written HazCom program?

A missing written program is typically cited as a serious violation under 1910.1200(e). OSHA's maximum serious-violation penalty is $16,550 per violation for 2024. Employers with 25 or fewer workers receive a 60% reduction before other adjustments, putting the realistic starting point near $6,600, which can drop further for good faith and no prior violations.

Does OSHA's HazCom standard cover biological hazards like mold or bloodborne pathogens?

No. HazCom explicitly excludes biological hazards from its definition of a health hazard. Bloodborne pathogens are regulated separately under 29 CFR 1910.1030, which carries its own labeling (biohazard symbols), training, and exposure control plan requirements. Some states add rules for other biological hazards. Mold and similar workplace agents are handled mainly through general duty clause enforcement rather than HazCom.

What records do I need to keep for HazCom compliance?

The standard requires you to keep your written HazCom program, your chemical inventory list, and your SDSs (reachable at all times). Training records are not explicitly required by the HazCom standard itself, but OSHA has said in letters of interpretation that employers must be able to show training happened, and records are the practical proof. Retain training sign-in sheets, dates, trainer names, and topics indefinitely.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard (full regulatory text): Requirements for written program, labels, SDSs, and training; who is covered; exemptions; 16-section SDS format; secondary container labeling
2. OSHA, Hazard Communication Final Rule, Federal Register May 20, 2024: 2024 final rule updated classification criteria and label requirements with compliance dates running through 2027
3. OSHA, Top 10 Most Frequently Cited Standards FY 2023: Hazard Communication ranked fifth in FY2023 with 3,213 violations; common citation items include 1910.1200(e), (f), (g), and (h)
4. OSHA, Penalties page (current civil penalty amounts and adjustment factors): Maximum serious violation penalty is $16,550; willful/repeated maximum is $165,514; employers with 25 or fewer workers receive a 60% penalty reduction
5. OSHA, 29 CFR 1910.1020 Access to Employee Exposure and Medical Records: SDSs and equivalent exposure records must be retained for 30 years for substances that could cause occupational illness
6. OSHA, Letters of Interpretation (acceptability of computer-based HazCom training): Online or computer-based training satisfies HazCom training requirements if it covers all required topics and provides opportunity to ask questions
7. OSHA, 29 CFR 1910.119 Process Safety Management of Highly Hazardous Chemicals: PSM applies to facilities with highly hazardous chemicals above threshold quantities; HazCom requirements still apply alongside PSM
8. OSHA, Small Business page (jurisdiction and exemptions): Self-employed individuals with no employees are outside OSHA employer jurisdiction; no employee-count exemption exists for HazCom compliance
9. OSHA, Enforcement page (inspection process, employer rights, citations and penalties): OSHA inspectors can enter without advance notice; employers can contest citations within 15 business days; informal settlement agreements often reduce penalties
10. United Nations Economic Commission for Europe, Globally Harmonized System of Classification and Labelling of Chemicals (GHS): GHS established the standardized nine pictogram system, signal words, and 16-section SDS format that OSHA's 2012 HazCom revision adopted
11. OSHA, 29 CFR 1926.59 Hazard Communication (construction): Construction employers are covered under 1926.59, which adopts the same requirements as 1910.1200, including inter-employer communication and SDS access on multi-employer sites