How to determine which OSHA standards apply to your industry

Last updated 2026-07-10

What does OSHA actually regulate, and does it cover my business?

OSHA covers almost every private-sector employer in the country, plus federal government workers. Pay someone to do work, and you almost certainly fall under its jurisdiction. The only real carve-outs are self-employed people with no employees, family farms that hire only immediate family, and workplaces covered by other federal safety agencies (mines fall under MSHA, some airline operations under the FAA) ^[1].

The Occupational Safety and Health Act of 1970 gives OSHA the power to set and enforce workplace safety standards. Section 5(a)(1), the General Duty Clause, is the backstop. Even when no specific standard covers a hazard, OSHA can cite you if a recognized hazard exists that could cause serious harm and a feasible fix is available ^[2]. That matters in industries where the danger is real but OSHA hasn't written a detailed rule yet.

So the question isn't whether OSHA applies to you. It does. The real question is which standards you have to follow.

What are the four main OSHA sector categories, and which one fits my business?

OSHA files its standards under Title 29 of the Code of Federal Regulations, split into four sectors ^[1]. Match yours first, because it decides which whole body of rules you start from.

Sector	CFR Part	Typical Businesses Covered
General Industry	29 CFR 1910	Manufacturing, retail, healthcare, warehouses, offices, restaurants
Construction	29 CFR 1926	Building, demolition, excavation, renovation, road work
Agriculture	29 CFR 1928	Farms, nurseries, greenhouses with non-family employees
Maritime	29 CFR 1915-1919	Shipyards, marine terminals, longshoring, gear certification

General Industry is the default. If your work doesn't clearly fit Construction, Agriculture, or Maritime, you land in 29 CFR 1910. A wholesale distributor, a dental office, a brewery, and a call center are all General Industry.

Construction is triggered by the work itself, not where it happens. A plumber fixing pipes in an existing office is still doing construction under 29 CFR 1926. OSHA has said in letters of interpretation that the test is whether the work involves building, altering, or repairing structures ^[3].

One business can straddle two sectors. A company that builds prefab wall panels in a shop (General Industry) and sends crews to install them on job sites (Construction) has to follow 29 CFR 1910 in the shop and 29 CFR 1926 in the field. That's common. It trips up a lot of small contractors.

Not sure which sector fits? OSHA's website has a sector lookup, and OSHA's free On-Site Consultation Program, which is walled off from enforcement, will tell you without any penalty risk ^[1].

How do I use my NAICS code to find applicable OSHA standards?

Your North American Industry Classification System (NAICS) code is a six-digit number describing what your business does. Find yours on IRS correspondence, your state business registration, or by searching your activity at the Census Bureau's NAICS tool ^[4]. It's the fastest on-ramp to figuring out which standards target your industry.

OSHA uses NAICS codes to aim inspections, track injury rates, and flag high-hazard industries. The Bureau of Labor Statistics publishes injury and illness rates by NAICS code every year in its Survey of Occupational Injuries and Illnesses. High rate, more inspection attention ^[5].

To connect your code to actual standards, here's the practical path:

1. Look up your NAICS code at the Census Bureau. 2. Go to OSHA.gov and use the "Standards" search. Filter by your sector. 3. Search OSHA's industry pages. OSHA publishes "eTool" pages and sector guidance for dozens of industries, including healthcare, logging, retail, food processing, and construction. 4. Cross-reference the OSHA Hazard Recognition pages for hazards common in your sector.

NAICS codes don't map one-to-one to OSHA standards, though. Two businesses with the same code can face different rules if their operations differ. A metal fabricator and a plastic injection molder might both sit near NAICS 332 or 326, but one deals with machine guarding under 29 CFR 1910.212 and hot work, while the other deals with chemical exposure and confined spaces. What's actually in your workplace drives which standards apply, not the code alone.

Which OSHA standards apply across almost every industry?

Some standards are hazard-specific, and those hazards turn up almost everywhere. Even a small office has a few of these in play.

Here are the standards most employers run into, no matter the sector ^[1][2]:

Hazard Communication (29 CFR 1910.1200): If any employee could be exposed to a hazardous chemical, you need a written HazCom program, safety data sheets, and trained workers. This covers the cleaning supplies under your sink, not only industrial drums. Learn more about hazard communication requirements and what a proper program looks like.

Recordkeeping (29 CFR 1904): Most employers with 10 or more employees must keep OSHA 300 logs of injuries and illnesses. Some low-hazard industries are partially exempt, but even they must report severe injuries (hospitalizations, amputations, loss of an eye) within 24 hours and fatalities within 8 hours ^[1].

Emergency Action Plans (29 CFR 1910.38): Required any time a specific standard calls for one, or when employees need to evacuate in an emergency. That's almost everyone.

Personal Protective Equipment (29 CFR 1910.132): Requires a written hazard assessment to decide what PPE is needed. The employer pays for required PPE.

Lockout/Tagout (29 CFR 1910.147): Applies whenever workers service equipment that could unexpectedly energize. Manufacturing, maintenance, facilities, even restaurant equipment repair. If your employees clean a meat slicer or change a conveyor belt, this one likely applies. See our guide on lockout tagout for what a written program requires.

Walking-Working Surfaces (29 CFR 1910.22): Floors, aisles, and walkways have to be clean, dry, and clear. Nearly universal.

Bloodborne Pathogens (29 CFR 1910.1030): Required wherever workers have occupational exposure to blood or other infectious materials. Healthcare is the obvious one, but it also catches janitorial staff, first aid responders, and tattoo artists.

The pattern is simple. If a hazard exists in your workplace, find the standard that covers it. Don't wait to see whether your industry gets named.

How do state OSHA plans change which standards apply to me?

Twenty-nine states and territories run their own OSHA programs, approved by federal OSHA and required to be "at least as effective" as the federal program. Seventeen of those cover both private and public sector workers; the rest cover only public employees ^[6].

In a state-plan state, you answer to that state agency, not federal OSHA. The state plan can set stricter rules, and often does. California's Cal/OSHA requires a written Injury and Illness Prevention Program under Title 8 CCR 3203 that goes further than anything in federal 29 CFR 1910 ^[12]. Washington's L&I keeps ergonomics rules that federal OSHA dropped ^[6].

State plan states include California, Washington, Oregon, Michigan, North Carolina, and Virginia, among others. The full list is on OSHA.gov. If you're in one, start with your state agency's website, not federal OSHA's, because that's the law you actually follow. Federal standards are the floor. Your state may have raised it.

Multi-state businesses have to comply with each state's rules in each location. There's no preemption that lets you run the weaker standard in a stricter state.

What if my business has multiple work types, like office and field crews?

This is the most common source of confusion for small businesses, and getting it wrong is expensive.

If your business spans more than one OSHA sector, each location or work type gets evaluated on its own. Office staff (General Industry, 29 CFR 1910) face different standards than field crews doing installation (Construction, 29 CFR 1926). The rules don't blend, and you can't apply the weaker one everywhere.

Take an electrical contractor with a shop and field crews. In the shop, electricians assembling panels are under General Industry. On the job site, those same electricians are under Construction. The shop needs machine guarding and HazCom compliance. The job site needs fall protection under 29 CFR 1926.502, which has different trigger heights and requirements than the General Industry version in 29 CFR 1910.28.

Staffing agencies and labor brokers get a clear answer from OSHA's letters of interpretation: the staffing agency and the host employer share compliance responsibility. The host controls the work environment, but the agency still owns training and general duty compliance ^[3].

The honest answer is that if your operations cross sectors, you need a written safety program that handles each work environment separately. That's not paperwork for its own sake. Different hazard profiles just demand different controls.

How do I find the specific OSHA standard number for a particular hazard?

OSHA's Standards page lets you browse by Part number or search by keyword. That's the most direct way to find a specific standard by CFR number ^[1]. But most practitioners work backward from the hazard, not the code.

Here's how it actually goes:

1. Name the hazard first. What could hurt someone? Fall from height? Chemical exposure? Caught in machinery? Noise? 2. Search OSHA.gov using that description. The results usually surface the relevant standard and its guidance documents. 3. Read the standard's scope section. Every standard in 29 CFR 1910 and 1926 has a scope and applicability section (usually subsection (a)) that spells out exactly who it covers. 4. Check OSHA letters of interpretation when the language is ambiguous about your situation. These are OSHA's official written answers to specific compliance questions, they're binding guidance, and they're searchable on OSHA.gov ^[3]. 5. Cross-check the OSHA eTools for your industry. OSHA has interactive tools for construction, healthcare, logging, shipyards, poultry processing, and more that walk you through which standards apply to specific tasks.

If a hazard in your workplace is real but no specific standard covers it, that's where the General Duty Clause kicks in. OSHA can still cite you. The absence of a specific standard is not a safe harbor.

For high-stakes calls, OSHA's free On-Site Consultation Program sends consultants to your workplace confidentially. They find hazards and standards without triggering enforcement. For small businesses (under 250 employees at a site, under 500 total), it's one of the best free resources there is ^[1].

What is a written safety program, and which OSHA standards require one?

A written safety program is a documented set of procedures, responsibilities, and rules showing how your company manages a specific hazard or compliance area. OSHA requires written programs for many standards, one standard at a time, not as a single catch-all.

Standards that explicitly require a written program include ^[1][2]:

• Hazard Communication (29 CFR 1910.1200): written HazCom program
• Lockout/Tagout (29 CFR 1910.147): written energy control program
• Respiratory Protection (29 CFR 1910.134): written respiratory protection program
• Bloodborne Pathogens (29 CFR 1910.1030): written Exposure Control Plan
• Emergency Action Plan (29 CFR 1910.38): written EAP
• Fire Prevention Plan (29 CFR 1910.39): written FPP where required
• Permit-Required Confined Spaces (29 CFR 1910.146): written program
• Hearing Conservation (29 CFR 1910.95): written program when noise hits the action level
• Personal Protective Equipment (29 CFR 1910.132): written hazard assessment certification

Construction has its own parallels under 29 CFR 1926, including fall protection plans, scaffold safety programs, and excavation safety plans.

Here's why this matters for figuring out which standards apply. The written program requirement is a compliance checkpoint. If you use any chemicals and you haven't written a HazCom program, you're already out of compliance, incident or not. OSHA can cite you on a records inspection alone.

To build these programs without hiring a consultant, SafetyFolio's safety program generator walks you through which written programs your operation needs and produces compliant documents in about 15 minutes.

For OSHA training requirements tied to each standard, the training obligation almost always rides along with the written program requirement.

Does OSHA have different rules for small businesses?

Mostly no, but there are real exceptions worth knowing.

The biggest small-business carve-out is the recordkeeping partial exemption. Employers with 10 or fewer employees during the prior calendar year, plus employers in certain low-hazard industries (specific NAICS codes listed in Appendix A and B to 29 CFR 1904), are partially exempt from OSHA 300 log requirements ^[1]. Even exempt employers still have to report severe injuries and fatalities directly.

OSHA does scale fines by business size. Employers with 25 or fewer employees get a 60% reduction on proposed penalties. Those with 26 to 100 employees get 40%. But the size discount changes what a violation costs, not whether you have to follow the standard ^[1].

OSHA's On-Site Consultation Program is aimed at small and mid-sized businesses. Priority goes to high-hazard industries and businesses with fewer than 250 workers at a site. It's completely separate from enforcement, and consultants can't hand what they find to inspectors ^[1].

State plans sometimes add small-business provisions. Cal/OSHA, for one, runs a small employer consultation program with extra resources. Check your state plan's website if you're in a state-plan state.

How do I keep up with changes to OSHA standards over time?

OSHA standards change through federal rulemaking, which is slow by design. Proposed rules get published in the Federal Register, open for public comment, then finalized, sometimes years later. Emergency Temporary Standards move faster but are rare and often challenged in court.

The practical way to stay current:

Subscribe to OSHA's QuickTakes newsletter. It's free, comes out twice a month, and covers new rules, guidance, enforcement memos, and compliance deadlines. Sign up at OSHA.gov ^[1].

Watch the Federal Register. Set up email alerts on federalregister.gov for proposed and final rules tagged to OSHA in your industry. Free, straight from the source.

Follow your trade association. Industry groups track regulatory changes in their sector and flag OSHA activity in newsletters. Handy for Construction (AGC, NAHB) and Healthcare (AHA).

Check state plan updates separately. In a state-plan state, the state agency often moves faster than federal OSHA on specific hazards. Cal/OSHA and Washington L&I both run email update systems.

One thing I'd push back on: don't rely on a single annual review. Standards change, enforcement priorities shift (which affects how hard specific standards get cited), and letters of interpretation can alter how a standard is applied without touching the text. At a minimum, do a quarterly check of OSHA QuickTakes and your state plan's news page.

For a wider view of the whole framework, our OSHA overview breaks down how the agency is structured and how enforcement actually works.

What should I actually do first, step by step?

Here's the sequence that works for most small businesses.

Step 1: Confirm your sector. General Industry, Construction, Agriculture, or Maritime? If you cross sectors, name each. Unsure? Default to General Industry.

Step 2: Confirm your state. Federal OSHA state or state-plan state? That tells you whose rules you follow. The list is at OSHA.gov under "State Plans" ^[6].

Step 3: Walk your workplace and list your hazards. Don't start with the standards. Start with what could actually hurt someone. Chemicals? Heights? Moving equipment? Electrical? Noise? Each hazard usually maps to a specific standard.

Step 4: Match hazards to standards. Use OSHA.gov's Standards page and the industry eTools to find the CFR citation for each hazard. Write them down.

Step 5: Flag which of those standards require a written program. For each one that does, you need a document. For each one that requires training, you need documented training. You also need an incident report process, both for OSHA recordkeeping and your own hazard tracking.

Step 6: Check for industry-specific OSHA programs. OSHA's National Emphasis Programs (NEPs) and Local Emphasis Programs (LEPs) target specific industries for inspection. If your NAICS code sits on an active NEP, your inspection odds go up and the relevant standards get scrutinized harder. Current NEPs are listed on OSHA.gov.

Step 7: Build or update your written programs. Don't try to write everything at once. Prioritize by hazard severity. A chemical operation needs HazCom and respiratory protection before it worries about ergonomics documentation.

A simple operation takes a few hours of focused work. A complex facility might take a few days. Either way it's a one-time investment that gives you a defensible baseline, and you update it when operations or standards change.

For workers who need formal credentials, OSHA 30 training covers the major standards in depth for supervisors and managers, and it's a good way to make sure your team knows why the rules exist, not only what they say.

Frequently asked questions

Does OSHA apply to businesses with only one or two employees?

Yes. OSHA covers any private employer with at least one employee, regardless of size. The only exemptions are the self-employed with no employees and family farms employing only immediate family. Very small employers (10 or fewer employees) do get a partial exemption from OSHA 300 recordkeeping logs, but every other standard still applies fully, including training, written programs, and reporting of severe injuries.

How is General Industry different from Construction under OSHA?

General Industry (29 CFR 1910) covers permanent or semi-permanent workplaces like factories, offices, warehouses, and retail. Construction (29 CFR 1926) covers work that builds, alters, repairs, or demolishes structures. The trigger is the nature of the work, not the location. A maintenance crew renovating inside an existing building is doing construction work. Fall protection heights, scaffolding rules, and excavation requirements all differ between the two sectors.

What is the OSHA General Duty Clause and when does it apply?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause serious harm when no specific standard applies. OSHA uses it to cite employers for emerging hazards, ergonomic hazards, heat illness, and situations where no specific standard exists but a known danger does. The elements are a recognized hazard, serious potential harm, and a feasible way to fix it.

Do I have to follow both federal OSHA and my state OSHA plan?

No, you follow one or the other, not both. In the 29 state-plan states and territories, the state agency handles enforcement and you follow state rules. State plans must be at least as effective as federal OSHA, but they can be stricter. In non-state-plan states, federal OSHA is your regulator. Multi-state businesses follow each state's rules in each location. The full state plan list is on OSHA.gov.

What is OSHA's On-Site Consultation Program and is it really confidential?

The On-Site Consultation Program sends OSHA-funded but independently operated consultants to workplaces to identify hazards and compliance gaps. It's free for small and mid-sized businesses. By law, consultation findings can't be shared with OSHA enforcement staff, and consultations don't trigger inspections. State agencies run it, separate from enforcement. Businesses that fix all identified hazards can earn OSHA's SHARP recognition, which comes with inspection deferral.

Which OSHA standards require a written safety program?

Many do, including Hazard Communication (29 CFR 1910.1200), Lockout/Tagout (29 CFR 1910.147), Respiratory Protection (29 CFR 1910.134), Bloodborne Pathogens (29 CFR 1910.1030), Emergency Action Plans (29 CFR 1910.38), Permit-Required Confined Spaces (29 CFR 1910.146), and Hearing Conservation (29 CFR 1910.95). Each standard's scope section spells out the requirement. Construction standards under 29 CFR 1926 have parallel written program requirements for fall protection, scaffolding, and excavation safety.

How do I find out if my industry is a target of OSHA's inspection programs?

OSHA's National Emphasis Programs (NEPs) and Local Emphasis Programs (LEPs) list targeted industries and hazards on OSHA.gov. NEPs are national priorities, with current examples including heat illness, silica, and process safety management. LEPs are set by each OSHA regional or area office and target local industry clusters. Match your NAICS code against current NEPs and your regional office's LEP list to gauge inspection risk. BLS injury data by NAICS also signals where OSHA focuses.

Does OSHA have specific standards for office workers?

There's no single "office standard" in 29 CFR 1910, but offices still have applicable requirements. Hazard Communication applies if any chemicals are present. Emergency Action Plans are required. Walking-working surfaces rules cover floors and aisles. Electrical safety covers wiring and equipment. OSHA has no federal ergonomics standard (it was rescinded in 2001), but ergonomic hazards can still be cited under the General Duty Clause when they're recognized and causing serious harm.

What OSHA standards apply to restaurants and food service?

Restaurants fall under General Industry (29 CFR 1910). Key standards include Hazard Communication (cleaning chemicals), Lockout/Tagout (equipment servicing), Walking-Working Surfaces (wet floors, the leading cause of restaurant injuries), Emergency Action Plans, and Fire Prevention Plans. If grease traps or below-grade storage areas qualify as confined spaces, Permit-Required Confined Spaces (29 CFR 1910.146) applies. BLS data consistently shows cuts, burns, and slips as the leading restaurant injury types.

What's the difference between an OSHA standard and an OSHA letter of interpretation?

A standard is the actual regulation, published in the Code of Federal Regulations after formal rulemaking, with legal force. A letter of interpretation is OSHA's official written answer to a specific compliance question, issued by the agency's Directorate of Enforcement Programs. Letters don't create new law but explain how existing standards apply to specific situations. They're binding guidance, courts have given them substantial weight, and all letters are searchable on OSHA.gov.

How does OSHA enforcement work for multi-site businesses?

Each worksite is evaluated on its own. An inspector at one location can only cite conditions there, but OSHA can open inspections at other sites if patterns suggest systemic violations. Penalties are calculated per citation item and per worksite, though the size-based reduction applies to the company's overall headcount. Multi-site employers with a corporate safety program that's visibly failing across sites face higher willful citation risk.

Do staffing agencies or the host employer have to comply with OSHA standards?

Both do, under OSHA's joint employer interpretation. The host employer controls the work environment and is primarily responsible for site-specific hazards and standard compliance. The staffing agency is responsible for making sure workers get required training and that general duty obligations are met before placement. OSHA has issued guidance stating that host employers can't delegate away their responsibility just because workers are technically employed by an agency.

How often do OSHA standards actually change?

Major changes are slow, often taking 5 to 10 years through full rulemaking. OSHA finalized the updated Walking-Working Surfaces rule in 2016 after decades of work. The Silica standard finalized in 2016 took about 10 years. Emergency Temporary Standards can move faster (the COVID ETS took months) but are rare and legally contested. Enforcement priorities and penalty structures shift more often than the standards themselves, which is why watching OSHA QuickTakes quarterly matters.

Sources

1. OSHA, U.S. Department of Labor, OSHA Law and Regulations overview: OSHA covers private-sector employers, lists sector coverage, recordkeeping exemptions, penalty reduction percentages, On-Site Consultation Program details, and the Standards page for 29 CFR lookup
2. OSHA, U.S. Department of Labor, OSH Act of 1970 text, Section 5(a)(1) General Duty Clause: Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause serious harm; also the statutory basis for all OSHA authority
3. U.S. Census Bureau, NAICS Code search tool: NAICS six-digit codes classify business activities and are used by OSHA and BLS to organize injury data and inspection targeting by industry
4. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses (SOII): BLS publishes annual OSHA recordable injury and illness rates by NAICS code; OSHA uses these rates to identify high-hazard industries for inspection targeting
5. OSHA, U.S. Department of Labor, State Plans overview page: 29 states and territories operate OSHA-approved state plans that must be at least as effective as federal OSHA; 17 cover both private and public sector workers; state plans can set stricter standards
6. 29 CFR 1910, General Industry Standards, Code of Federal Regulations via eCFR: Full text of General Industry standards including 1910.22 (walking-working surfaces), 1910.38 (EAP), 1910.95 (hearing conservation), 1910.132 (PPE), 1910.134 (respiratory protection), 1910.146 (confined spaces), 1910.147 (lockout/tagout), 1910.1030 (bloodborne pathogens), 1910.1200 (hazard communication)
7. 29 CFR 1926, Construction Industry Standards, Code of Federal Regulations via eCFR: Full text of Construction standards including 1926.502 (fall protection systems), scaffolding, and excavation; establishes different trigger heights and requirements than General Industry equivalents
8. 29 CFR 1904, Recording and Reporting Occupational Injuries and Illnesses, eCFR: Recordkeeping requirements including the 10-or-fewer employee exemption, low-hazard industry partial exemptions (Appendix A and B), and requirements to report fatalities within 8 hours and severe injuries within 24 hours
9. OSHA, U.S. Department of Labor, On-Site Consultation Program: On-Site Consultation is free, confidential, funded by OSHA but operated separately from enforcement; findings cannot be shared with inspectors; priority given to small businesses and high-hazard industries; SHARP recognition available
10. California Department of Industrial Relations, Cal/OSHA Title 8 CCR 3203 IIPP requirement: California's state plan requires all employers to have a written Injury and Illness Prevention Program under Title 8 CCR 3203, which goes beyond any equivalent federal OSHA requirement