Hazard communication right to know: what OSHA actually requires

Last updated 2026-07-09

What is the right to know law for workplace chemicals?

The federal right-to-know law for chemicals is OSHA's Hazard Communication Standard, 29 CFR 1910.1200 ^[1]. People call it HazCom, or just the Right to Know law. The idea is plain: if your workers can be exposed to hazardous chemicals, they have a legal right to know what those chemicals are, what harm they can do, and how to protect themselves.

Congress didn't write this standard. OSHA did, under the authority of the Occupational Safety and Health Act of 1970. OSHA published the first HazCom rule in 1983, overhauled it in 2012 to line up with the United Nations Globally Harmonized System of Classification and Labelling of Chemicals (GHS), and amended it again in 2024 ^[1][2].

The standard covers general industry (29 CFR 1910.1200), construction (29 CFR 1926.59), maritime, and agriculture. If your workers touch, breathe, or could otherwise be exposed to a chemical that meets OSHA's definition of hazardous, the rule applies to you. Cleaning products count. So do paints, solvents, fuels, welding rods, and hundreds of other everyday substances.

Almost every small business in manufacturing, construction, auto repair, food processing, healthcare, and janitorial services has obligations here.

What are the four main requirements of OSHA's Hazard Communication Standard?

HazCom stands on four legs: a written program, Safety Data Sheets, container labels, and employee training. Miss any one and you're open to a citation.

1. Written Hazard Communication Program You need a written document that spells out how your workplace handles chemical hazards. It has to describe how you manage labels, Safety Data Sheets, and training, and it has to include a list of every hazardous chemical on site. OSHA doesn't hand you a template. You write it yourself or use a generator. The written program must be available to employees and their designated representatives on request ^[1].

2. Safety Data Sheets (SDS) Every hazardous chemical your workers may be exposed to needs an SDS, the 16-section document that replaced the old Material Safety Data Sheet (MSDS) after 2012. You get these from your suppliers and keep them accessible during every shift, in every work area where the chemical is used ^[1]. Locked in the boss's filing cabinet after hours doesn't cut it.

3. Container Labels Every container of a hazardous chemical must carry a label with the product name, a signal word (Danger or Warning), hazard statements, precautionary statements, pictograms, and the supplier's name and address ^[1]. For containers you fill in-house, labeling them is on you. Unlabeled containers are one of the fastest ways to catch a citation during an inspection.

4. Employee Training Workers must be trained before their first exposure to a hazardous chemical and again whenever a new hazard shows up ^[1]. Training has to cover how to read an SDS, what the labels mean, how to spot a release, and which protective measures apply. A generic safety video by itself usually won't satisfy this. The training has to match the chemicals and conditions in your actual workplace.

The four pieces depend on each other. A great SDS library means nothing if workers don't know it exists or can't get to it.

Why does HazCom get cited more than any other OSHA standard?

HazCom has parked near the top of OSHA's citation list for over a decade. In federal fiscal year 2023 it was the second most-cited standard across all industries, with 3,213 violations ^[3]. In construction it has sometimes ranked first.

The reasons are boring, which is the point. Labels fall off or fade. Contractors haul unlabeled containers onto job sites. An SDS for something bought three years ago never made it into the binder. New hires get a five-minute tour and a handshake instead of real training. None of this is exotic. These are paperwork gaps that pile up when nobody's checking.

The penalties are real. A serious HazCom violation carries a maximum of $16,550 per citation item as of 2024 ^[4]. Willful or repeated violations can hit $165,514 apiece. OSHA does negotiate these down through the informal conference, and small businesses often qualify for a size reduction, but the exposure is still there.

Here's the upside. HazCom is one of the most fixable compliance gaps a small business has. No specialized equipment required. You need documentation, accessible SDSs, correct labels, and a training record you can put in front of an inspector.

What chemicals are covered under the hazard communication right to know standard?

A chemical is covered if it's classified as a physical hazard or a health hazard under OSHA's criteria, or if it's a simple asphyxiant, combustible dust, or pyrophoric gas, or if it hasn't been classified yet but could still cause harm ^[1].

Physical hazards include flammables, explosives, oxidizers, gases under pressure, and reactive chemicals. Health hazards include carcinogens, reproductive toxins, respiratory sensitizers, mutagens, and anything that causes organ damage. The manufacturer or importer classifies the chemical and provides the SDS and label. Your job as the employer is to pass that information along and get it in front of workers.

Some things are exempt. Hazardous waste regulated by the EPA, tobacco products, unprocessed wood (sawdust is a different story), articles that don't release a hazardous chemical under normal use, and food or drugs in final retail form are generally not covered ^[1]. Don't guess, though. If you can't tell whether a substance qualifies, check the SDS or call the supplier.

One spot people get wrong: household cleaning products. If a worker uses a product more often or longer than a normal consumer would, OSHA's position is that HazCom applies. A janitor running bleach for eight hours a day is not a consumer.

What must a Safety Data Sheet include, and where do you get them?

Under the GHS-aligned HazCom standard, every SDS follows a fixed 16-section format ^[1][2]. Here's what each section holds:

Section	Content
1	Identification (product name, supplier, emergency phone)
2	Hazard identification (classification, signal word, pictograms)
3	Composition/ingredients
4	First-aid measures
5	Fire-fighting measures
6	Accidental release measures
7	Handling and storage
8	Exposure controls and PPE
9	Physical and chemical properties
10	Stability and reactivity
11	Toxicological information
12	Ecological information (not enforced by OSHA)
13	Disposal considerations (not enforced by OSHA)
14	Transport information (not enforced by OSHA)
15	Regulatory information
16	Other information (revision date)

You get SDSs from the manufacturer or distributor, either in the box with the product or off their website. For common substances, NIOSH publishes pocket guides you can use to supplement the supplier's SDS data ^[5]. If a supplier won't provide an SDS for a hazardous chemical, that's a violation on their end, and you shouldn't use the product until you have one.

Keep them organized. Paper binders are fine. Electronic systems are fine too, as long as workers can pull up any sheet instantly, including during a power outage. That's why some employers keep a paper backup. OSHA accepts electronic SDS management, but expects you to have a plan for when the system goes dark ^[6].

For an example of what a well-formatted SDS looks like in practice, see our walkthrough of the hcl safety data sheet, a real 16-section document for hydrochloric acid.

What do GHS labels need to show on chemical containers?

A GHS-compliant label carries six elements: the product identifier (chemical or trade name), a signal word, hazard statements, precautionary statements, pictograms, and supplier identification ^[1].

The signal word is either "Danger" for the more severe hazards or "Warning" for the less severe ones. The nine GHS pictograms are the red-bordered diamonds you've probably seen: flame, skull and crossbones, exclamation mark, health hazard, corrosion, exploding bomb, gas cylinder, environment (not enforced by OSHA), and oxidizer flame.

For containers you receive from a supplier, the label is already there. Your job is to leave it on, keep it readable, and replace it if it fades. For secondary containers you fill from a bigger vessel, you apply your own label. A product name plus the right hazard warnings is the minimum. You can point to the SDS instead of cramming every hazard detail onto a small bottle, but workers have to be able to find that SDS fast ^[1].

There's one exception. A portable container that a single worker fills for immediate personal use during a single shift doesn't need a label. The moment it sits overnight or passes to someone else, it does.

This trips up a lot of employers. A spray bottle of degreaser that gets refilled and stashed under the sink with no label is a citation waiting to happen.

What does employee training on hazard communication need to cover?

HazCom training happens at initial assignment and again whenever a new chemical hazard enters the workplace ^[1]. It has to cover:

• The requirements of the HazCom standard itself and where your written program lives
• Operations in the work area where hazardous chemicals are present
• Where and how to access the SDS for each chemical
• How to read and interpret labels and SDS information
• How workers can detect the presence or release of a chemical (smell, sight, monitoring)
• The physical and health hazards of the chemicals in their area
• Protective measures: engineering controls, work practices, PPE
• Emergency procedures

It doesn't have to be a classroom session. It does have to be effective and documented. OSHA has issued letters of interpretation saying that handing out written materials without checking that workers understood them may not be enough ^[6]. If your workers speak limited English, train them in a language they understand.

Keep a training record for every employee showing the date, the topics, and the trainer's name. If OSHA asks for training records, "we cover it verbally" is going to go badly.

For how HazCom fits your broader osha training obligations, that article maps out training requirements by industry.

What goes in a written hazard communication program?

Your written program describes how your workplace carries out each part of the standard ^[1]. At minimum it covers:

1. How you handle labeling, including secondary containers and pipes 2. How you obtain, maintain, and give access to SDSs 3. How and when you train employees 4. A list of the hazardous chemicals in your workplace by work area (this can point to your SDS index instead of duplicating it) 5. How you handle non-routine tasks involving hazardous chemicals 6. How you communicate hazards to contractors working in your facility

That last item catches people off guard. If a painting contractor sends workers into your building, you have to tell them about the chemical hazards where they'll be working, and they have to share SDS information for anything they bring in ^[1].

The program doesn't have to be long. A tight five-page document covers most small businesses completely. What matters is that it's accurate (it describes what you actually do, not what you wish you did), accessible (workers can get a copy), and current (updated when your chemical inventory or procedures change).

This is where SafetyFolio's safety program generator earns its keep. It builds your written HazCom program from your answers to a structured questionnaire, so you're not staring at a blank page. Most small businesses finish in about 15 minutes instead of losing days to research.

For the full picture, our hazard communication guide covers the standard from start to finish.

How do state right-to-know laws interact with OSHA's federal HazCom standard?

About half the states run their own OSHA-approved State Plans, which handle occupational safety regulation in place of federal OSHA ^[7]. State Plan states have to adopt standards "at least as effective" as federal OSHA's, and most copied the federal HazCom standard almost word for word.

A few states go further. California (Cal/OSHA), New Jersey, and Massachusetts all have right-to-know laws that reach past federal HazCom. California's Hazard Communication regulation adds requirements for specific substances and industries. New Jersey's Worker and Community Right to Know Act covers a longer chemical list than federal HazCom and requires extra reporting ^[8].

There's also a separate law on the community side. The EPA's Emergency Planning and Community Right-to-Know Act (EPCRA) of 1986 runs alongside OSHA's rule. EPCRA requires facilities that store hazardous chemicals above certain thresholds to report that to state emergency response commissions and local planning committees ^[9]. Store large quantities and you may owe both OSHA HazCom duties and EPCRA reporting.

Check your state's rules. Federal HazCom is the floor, not the ceiling.

What are the most common HazCom violations OSHA cites, and how do you fix them?

Based on OSHA's citation data ^[3], the most common HazCom failures land in five buckets.

No written program, or an outdated one. Fix: write it, date it, and review it every year or whenever your chemical inventory shifts.

Missing or inaccessible SDSs. Fix: inventory every substance on site, every closet, every spray can in the maintenance room, and confirm you have a current SDS for each. Store them where workers can reach them any time.

Unlabeled or illegible labels. Fix: walk the whole facility and read every container. Can't read it? Replace it. No label at all? Identify the contents, label it, or dispose of it properly.

Inadequate or undocumented training. Fix: build a simple sign-off sheet with date, topics, and each worker's signature. Retrain when new chemicals arrive.

Leaving contractors out. Fix: add a step to your contractor onboarding. Exchange SDS information and brief them on your site's chemical hazards before work starts.

Inspectors usually open a HazCom inspection by asking for your written program and SDS binder. If both are in order, the visit goes very differently than if you're digging for a binder last updated in 2009.

For how lockout tagout intersects with chemical handling, that standard covers controlling hazardous energy during maintenance, which often carries chemical exposure risk.

What OSHA penalties apply to hazard communication violations?

OSHA raises its maximum penalties every year for inflation under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. Here's where they stand as of 2024 ^[4]:

Violation Type	Maximum Penalty Per Violation
Other-than-serious	$16,550
Serious	$16,550
Willful or Repeated	$165,514
Failure to Abate	$16,550 per day

Those are ceilings, not what most employers actually pay. OSHA applies reductions for employer size, good faith, and history. Small businesses (fewer than 250 employees at the establishment and fewer than 2,500 across the company) typically get a 60 to 70 percent cut for size alone. A good-faith credit of up to 25 percent applies if you had a real safety program running before the inspection. A bad citation history can wipe out the good-faith credit and trigger the repeated-violation multiplier.

The expensive scenario is willful: you knew you were out of compliance and did nothing. Courts have upheld six-figure penalties in those cases. The cheapest fix is doing the work before an inspector walks in.

For how enforcement works, our osha overview covers inspection triggers, the citation process, and your rights as an employer.

How does right to know apply to contractors and multi-employer worksites?

Multi-employer sites are where HazCom gets genuinely messy. OSHA's multi-employer citation policy holds that both the controlling employer (the general contractor or facility owner) and the creating employer (whoever brought the hazard) can be cited for HazCom failures ^[10].

The standard says so directly. 29 CFR 1910.1200(e)(2) requires that the written program "include the methods the employer will use to provide the other employer(s) on-site access to safety data sheets for each hazardous chemical the other employer(s)' employees may be exposed to while working."

In plain terms: if you own the facility and a contractor's workers might be exposed to chemicals you use, share your SDS information with the contractor. If you're the contractor bringing chemicals onto someone else's site, share your SDS information with the owner and make sure your own crew can access it.

The practical move is a pre-job safety meeting where both sides trade SDS information and walk the hazards. Document it. A sign-in sheet from that meeting can be the difference between a citation and a warning during a multi-employer inspection.

Frequently asked questions

Is OSHA's hazard communication standard the same as the right to know law?

Yes, in workplace safety they mean the same thing. OSHA's Hazard Communication Standard (29 CFR 1910.1200) is the federal law that gives workers the right to know about chemical hazards on the job. People call it HazCom or the Right to Know standard. Some states have separate right-to-know laws that add requirements on top of the federal rule.

Does the hazard communication standard apply to small businesses?

Yes. HazCom has no small business exemption. Any employer with workers who may be exposed to hazardous chemicals must comply, no matter the company size. Small businesses do qualify for reduced penalties (usually a 60 to 70 percent cut based on size) if OSHA issues a citation, and a good-faith credit applies if you had a safety program in place before the inspection.

What is the difference between an MSDS and an SDS?

MSDS (Material Safety Data Sheet) was the old term. After OSHA updated HazCom in 2012 to match the UN's Globally Harmonized System, the format became standardized and the name changed to SDS (Safety Data Sheet). An SDS follows a specific 16-section format. Old MSDS documents in non-standard formats don't meet current requirements, so you need current SDSs from your suppliers.

How often do employees need to be retrained on hazard communication?

OSHA requires training before initial assignment and whenever a new chemical hazard enters the workplace. The HazCom standard sets no fixed annual retraining requirement, but OSHA expects workers to stay informed. In practice, many safety professionals run annual refreshers, and some state plans or other standards may require more frequent training depending on the industry.

Can you keep SDSs electronically instead of in paper binders?

Yes. OSHA permits electronic SDS systems as long as workers can access any sheet immediately during their shift without barriers. You also need a backup for when the system is down, such as a power outage. Many employers keep a current paper set alongside the electronic system. OSHA's acceptance of electronic systems is addressed in agency letters of interpretation.

Do you need to label every container in your workplace?

Every container of a hazardous chemical needs a label, except a portable container that one employee fills from a labeled source for their own immediate use during a single shift. If the container is left for the next shift, shared, or stored, it needs a label. Secondary containers, spray bottles, and storage drums all require labels with at least the product name and the right hazard warnings.

What is the GHS and why does it matter for hazard communication compliance?

The Globally Harmonized System of Classification and Labelling of Chemicals (GHS) is a United Nations framework that standardizes how chemical hazards get classified and communicated worldwide. OSHA adopted GHS in its 2012 HazCom update, which is why labels now use specific pictograms and signal words, and why SDSs follow the 16-section format. GHS alignment keeps SDSs and labels consistent across suppliers and countries.

What happens if a chemical supplier doesn't provide an SDS?

Manufacturers and distributors are legally required to provide SDSs for hazardous chemicals with the first shipment and on request. If a supplier refuses, that violates 29 CFR 1910.1200(g). As the employer, don't use the chemical until you have an SDS, document your request in writing, and if the supplier keeps refusing, contact OSHA. You can also check the manufacturer's website or an online SDS repository.

Are cleaning products in the workplace covered by the hazard communication standard?

Usually yes. The consumer-use exemption only applies when a chemical is used the same way, as often, and as long as a typical consumer would use it. A janitor running bleach eight hours a day, five days a week, is not using it as a consumer, and OSHA treats that as occupational exposure. Most commercial cleaning products have SDSs from the manufacturer. When in doubt, treat any chemical workers use regularly as covered.

What is a chemical inventory list and do you need one?

Yes. Your written HazCom program must include a list of all hazardous chemicals in your workplace, which is your chemical inventory. It doesn't need to be fancy: a spreadsheet listing each chemical by name, location, and SDS reference works. The inventory does two jobs. It helps you confirm you have an SDS for every chemical, and it tells employees which substances are present in which work areas.

How does EPCRA differ from OSHA's hazard communication right to know standard?

OSHA's HazCom standard (29 CFR 1910.1200) is about workers: it requires employers to inform employees about chemical hazards on the job. The EPA's Emergency Planning and Community Right-to-Know Act (EPCRA, 42 U.S.C. 11001 et seq.) is about communities: it requires facilities storing hazardous chemicals above set thresholds to report to state and local emergency planning bodies. Large chemical facilities may have to comply with both.

Can OSHA fine you if a contractor on your site doesn't follow HazCom?

Yes. Under OSHA's multi-employer citation policy, a controlling employer (facility owner or general contractor) can be cited for HazCom violations created by a subcontractor if the controlling employer knew or should have known about the hazard and could have corrected it. Your protection is to require SDSs from every contractor, put HazCom compliance in your contractor agreements, and document pre-job safety meetings.

What records do you need to keep for hazard communication compliance?

Keep your written HazCom program (no expiration, but keep it current), your SDS collection for all current chemicals and, per some interpretations, for discontinued chemicals if there was exposure history, and training records for each employee showing dates, topics, and trainer. OSHA can request any of these during an inspection. The HazCom standard sets no retention period for training records, but most compliance professionals keep them for the length of employment plus three years.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard (full regulatory text): Requirements for written program, SDS, labels, training, and chemical inventory under the federal HazCom standard
2. OSHA, Top 10 Most Frequently Cited Standards, FY 2023: Hazard Communication ranked second most-cited standard in FY2023 with 3,213 violations
3. OSHA, Civil Monetary Penalty Adjustments for Inflation, 2024: Maximum penalty of $16,550 per serious violation and $165,514 per willful or repeated violation as of 2024
4. NIOSH, Pocket Guide to Chemical Hazards: NIOSH publishes chemical hazard information usable to supplement SDS data for common industrial substances
5. OSHA, Letters of Interpretation: Hazard Communication (standard number 1910.1200): OSHA interpretations addressing electronic SDS systems, backup requirements, and adequacy of training methods
6. OSHA, State Plans (overview page): Approximately half of states operate OSHA-approved State Plans that must be at least as effective as federal standards
7. New Jersey Department of Health, Worker and Community Right to Know Act: New Jersey's Right to Know Act covers a broader chemical list than federal HazCom and requires additional reporting
8. EPA, Emergency Planning and Community Right-to-Know Act (EPCRA) overview: EPCRA requires facilities storing hazardous chemicals above threshold quantities to report to state and local emergency planners
9. OSHA, Multi-Employer Citation Policy (CPL 02-00-124): Controlling employers can be cited for HazCom violations created by subcontractors on multi-employer worksites