What is OSHA? The plain-language guide for small business owners

Last updated 2026-07-09

What is OSHA and what does it actually do?

OSHA is the Occupational Safety and Health Administration, the federal agency that writes and enforces workplace safety law for most American employers. Congress created it through the Occupational Safety and Health Act of 1970, which President Nixon signed on December 29, 1970 ^[1]. The agency sits inside the U.S. Department of Labor and opened for business on April 28, 1971, a date now marked each year as Workers' Memorial Day.

Four jobs make up the work. OSHA writes safety and health standards, inspects workplaces, issues citations when employers fall short, and runs compliance help for smaller employers who want guidance without an inspection. That last piece matters most for small businesses, because OSHA's free On-Site Consultation Program runs separately from enforcement and keeps its findings confidential ^[2].

OSHA covers most private-sector employers and their workers in all 50 states, plus some public-sector workers in states running their own OSHA-approved plans. Federal government workers fall under a parallel program run by their own agencies, not by OSHA directly. Self-employed people with no employees aren't covered. Neither are farms with fewer than 11 employees that don't use temporary labor contractors ^[1].

For a fuller look at the agency's name and history, see our guide on osha meaning.

Which employers does OSHA cover, and which are exempt?

Almost everyone in private-sector employment is covered. OSHA estimates it reaches roughly 10.3 million workplaces and 144 million workers ^[1]. A handful of exemptions are real, and they're worth knowing.

Federal agencies run their own safety programs under Section 19 of the OSH Act. OSHA monitors those programs but doesn't inspect federal facilities directly. State and local government workers are covered only in the 29 states and two territories with OSHA-approved State Plans ^[3]. Work in a state without a State Plan, and your local government employer sits outside OSHA's reach entirely.

Small farms are the other real carve-out. OSHA's agricultural standards under 29 CFR 1928 apply to farms with 11 or more employees. Farms below that line, and not using temporary labor contractor crews, are generally exempt from OSHA inspections ^[1]. Congress has attached that rider to OSHA's appropriations nearly every year since 1976.

Everybody else is covered, from a two-person auto repair shop to a 5,000-employee plant. The "small business" label gets you free consultation and some compliance help. It does not shield you from citations or penalties.

What OSHA standards must employers actually follow?

OSHA standards live in Title 29 of the Code of Federal Regulations. Two of them come up over and over. 29 CFR 1910 covers general industry (manufacturing, warehousing, retail, healthcare, and most service businesses) ^[9]. 29 CFR 1926 covers construction ^[10]. Maritime work falls under 29 CFR 1915 through 1917, and agriculture under 29 CFR 1928.

Beyond the specific standards, every covered employer answers to the General Duty Clause, Section 5(a)(1) of the OSH Act. It requires employers to furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[1]. OSHA reaches for the General Duty Clause when no specific standard covers a known hazard, which makes it broader than it first sounds.

The standards cited most often, year after year, include fall protection (29 CFR 1926.502), hazard communication (29 CFR 1910.1200), scaffolding (29 CFR 1926.451), respiratory protection (29 CFR 1910.134), lockout/tagout (29 CFR 1910.147), and ladders (29 CFR 1926.1053) ^[4]. If your business touches any of those activities, that's where you start.

Many standards demand a written program. Hazard communication needs a written hazard communication program. Lockout/tagout needs a written energy control program. Respiratory protection needs a written respiratory protection program. These aren't suggestions. Citations for missing written programs are some of the most common OSHA writes. If you need to build those documents fast, SafetyFolio's safety program generator produces a compliant draft in about 15 minutes instead of the 15-plus hours it takes to build one from a blank page.

For the full breakdown of what training each standard requires, see our osha training guide.

What is OSHA 10 certification and is it required by law?

OSHA 10 is a 10-hour safety awareness course run through OSHA's Outreach Training Program, delivered by OSHA-authorized trainers and training organizations ^[5]. Finish it and you get a wallet card (officially a "completion card," not a license or credential) issued by OSHA's national office.

Is it required by law? Not at the federal level. OSHA's outreach courses are voluntary under federal rules. But a growing number of states, cities, and private contracts require it anyway. New York, for one, requires OSHA 10 for workers on public works construction projects under New York Labor Law Section 220-h ^[6]. Massachusetts, Missouri, Nevada, New Hampshire, and Rhode Island have similar rules for certain project types. Plenty of general contractors and project owners demand an OSHA 10 card for site access even when no law says they must.

OSHA 10 covers general safety and health awareness, not site-specific work. It doesn't replace the specific training required in 29 CFR 1910 or 1926. A worker holding an OSHA 10 card who uses a respirator still needs the respiratory protection training required under 29 CFR 1910.134(k). The card proves exposure to safety training. It proves nothing about competency on any given task.

The card is good for life. No expiration, no renewal, no continuing education from OSHA. Some employers and contracts impose their own refresh cycles, usually every five years, but that's their policy, not federal law.

How is OSHA 30 different from OSHA 10?

OSHA 30 is the same idea stretched to 30 hours and aimed at supervisors, foremen, and safety staff rather than line workers ^[5]. The construction version digs into fall protection, electrical safety, scaffolding, and excavation. The general industry version covers machine guarding, hazard communication, walking and working surfaces, and emergency action plans in more depth.

The cost gap is real. OSHA 10 courses run roughly $20 to $80 online through authorized providers. OSHA 30 runs roughly $99 to $300 online. In-person courses cost more, typically $150 to $350 for the 10-hour and $400 to $800 for the 30-hour, depending on provider and region. OSHA doesn't sell these courses itself. Only OSHA-authorized trainers and organizations can issue the official cards ^[5].

Here's my honest take. For construction employers, the 30-hour is genuinely useful for supervisors, because it spends real time on how to spot and fix hazards, more than recite what the rules say. For general industry supervisors managing people who face several hazard types, the 30 earns its cost. Run a small retail shop with low hazard exposure? The 30 is overkill. Skip it.

See our detailed guide on osha 30 and the osha 30 hour online course options if you're deciding whether to pursue it.

Course	Hours	Audience	Typical online cost	Card issued by
OSHA 10 (Construction)	10	Workers	$20-$80	OSHA national office
OSHA 10 (General Industry)	10	Workers	$20-$80	OSHA national office
OSHA 30 (Construction)	30	Supervisors	$99-$300	OSHA national office
OSHA 30 (General Industry)	30	Supervisors	$99-$300	OSHA national office

Can you get OSHA 10 certification online, and are free courses legitimate?

Yes. OSHA 10 is available fully online through OSHA-authorized online training organizations, and the online format is legitimate. OSHA started authorizing online delivery of the 10-hour and 30-hour courses in 2002 ^[5]. Content, minimum hours, and required topics are identical whether you take it online or in a classroom.

The card takes a little longer online. Once you finish, the training organization submits your information to OSHA, and OSHA mails the physical card. Figure 2 to 6 weeks. Some providers hand you a temporary certificate of completion to use in the meantime.

Now, about "free" courses. Search "OSHA 10 certification online free" or "OSHA 30 certification online free" and you'll get a pile of results, most of which won't get you an official OSHA wallet card. OSHA's own site has free educational resources, videos, and e-tools, but OSHA does not offer the outreach certification courses for free ^[5]. Any site promising a free official OSHA 10 completion card is either misrepresenting the product or handing you a card that job sites won't recognize when they check authorized-trainer records.

That said, some genuinely free training exists. The OSHA Training Institute Education Centers offer some subsidized or grant-funded courses for small employers. Susan Harwood Training Grants fund non-profits to deliver free safety training to small business workers, though availability shifts by year and grant cycle ^[2]. If your state runs an OSHA State Plan, the state agency often has its own free training.

Bottom line: for the official wallet card, pay a real provider. For safety education without a card, free and legitimate options exist through OSHA.gov and the OTI Education Centers.

What does an OSHA inspection look like and how should you prepare?

OSHA compliance officers (Compliance Safety and Health Officers, or CSHOs) run inspections, and in most cases they arrive unannounced. Section 8 of the OSH Act gives them the legal right to enter during normal business hours, though you can require a warrant if you want to slow things down ^[1]. Most small employers just let them in.

The sequence is predictable: opening conference, walkaround, employee interviews, records review, closing conference. During the walkaround, the CSHO looks at real conditions, equipment, and practices. They'll also ask for your written programs, OSHA 300 logs, and training records. Missing paperwork triggers citations on its own, separate from any physical hazard.

Inspections are ranked. Imminent danger comes first. A fatality or three or more hospitalizations triggers a mandatory inspection within 24 hours of OSHA being notified ^[1]. Formal worker complaints come next. Programmed inspections, the scheduled sweeps of high-hazard industries, come last.

Penalties as of 2024 run up to $16,131 per serious violation and up to $161,323 per willful or repeated violation ^[4]. Those figures adjust for inflation every year. Willful violations (OSHA proves you knew about a hazard and did nothing) and repeat violations (the same standard cited within three years) draw the top numbers.

For a deeper look at what happens during and after an inspection, our workplace safety news section tracks recent enforcement trends.

What injury recordkeeping does OSHA require?

Employers with 10 or fewer employees in any industry, plus employers in certain low-hazard industries at any size, are partially exempt from OSHA's routine injury and illness recordkeeping under 29 CFR 1904 ^[7]. But every employer, regardless of size or industry, has to report severe incidents to OSHA.

The rule is specific. Report any work-related fatality within 8 hours. Report any work-related inpatient hospitalization, amputation, or loss of an eye within 24 hours ^[7]. You report by calling 1-800-321-OSHA or through OSHA's online reporting portal.

Employers who do keep records use three forms: the OSHA 300 (log of work-related injuries and illnesses), the OSHA 300A (summary of the 300 log), and the OSHA 301 (incident report for each recordable case). The 300A summary has to hang in the workplace from February 1 through April 30 each year, covering the prior year's data ^[7]. For a complete walkthrough of that form, see our guide to osha form 300a.

Private-sector employers reported roughly 2.6 million nonfatal workplace injuries and illnesses in 2023, a rate of 2.4 cases per 100 full-time equivalent workers ^[8]. That's the benchmark to measure your own incident rate against, though rates swing wildly by industry.

How do OSHA State Plans work, and does your state have one?

Twenty-nine states and two territories (Puerto Rico and the Virgin Islands) run their own OSHA-approved State Plans ^[3]. State Plans have to be "at least as effective" as federal OSHA, and most adopt identical or nearly identical standards. Some go further. California's Cal/OSHA, for one, has stricter rules on heat illness prevention and certain chemical exposures.

If you're in a State Plan state, state inspectors handle your workplace, not federal OSHA. Your complaint calls go to the state agency. Your citations come from the state. State Plan states also cover public employees (state and local government workers), which federal OSHA does not.

State Plan states include California, Michigan, Washington, Oregon, Arizona, North Carolina, Virginia, and about 20 others. Federal OSHA covers the rest, and every federal employee everywhere.

You can find the current State Plan list on OSHA's website ^[3]. Run a business across several states and you might deal with both federal OSHA and one or more State Plan agencies, with standards that differ in ways that matter. Check whether your state has a plan, then pull that state's version of any standard you're working to meet. That's just good practice.

What written safety programs does OSHA actually require?

This trips up small businesses constantly. OSHA doesn't require one master "safety manual." It requires written programs and plans scattered across dozens of individual standards. And the requirement runs past paper: you have to train workers on each program, put it into practice, and review it when conditions change.

The commonly required written programs include a Hazard Communication Program (29 CFR 1910.1200), an Energy Control (Lockout/Tagout) Program (29 CFR 1910.147), a Respiratory Protection Program (29 CFR 1910.134), an Emergency Action Plan (29 CFR 1910.38, required for most employers), a PPE hazard assessment (29 CFR 1910.132), a Bloodborne Pathogens Exposure Control Plan (29 CFR 1910.1030, for workplaces with occupational exposure), and in construction, a site-specific Fall Protection Plan when alternative fall protection measures are used (29 CFR 1926.502) ^[9][10].

The exact list depends on your industry and the hazards you actually have. A general industry employer with no chemical exposures and no permit-required confined spaces won't need programs for those. The starting point never changes: walk your workplace, name each hazard, find the standard that addresses it, and check whether that standard carries a written program requirement.

Want to shortcut the research? SafetyFolio's safety program generator asks about your workplace and produces the specific written programs your operation needs, in about 15 minutes.

For a full breakdown of what each written program must contain, see our written programs guide.

How does OSHA enforcement data show where the real risks are?

OSHA publishes its "Top 10 Most Frequently Cited Standards" list every fiscal year, usually in October after the National Safety Council's Congress and Expo ^[4]. These are the standards that generated the most citations across all inspections that year, and the list barely moves from year to year.

Fall protection in construction (29 CFR 1926.502) has held the top spot for more than a decade. Hazard communication (29 CFR 1910.1200) and respiratory protection (29 CFR 1910.134) are perennial top-five entries. Scaffolding, ladders, lockout/tagout, powered industrial trucks, machine guarding, and fall protection training fill out the top 10 most years.

What the frequency data hides is severity. A missing chemical label is a serious violation on paper but carries a small fine. A lockout/tagout failure that costs a worker a hand can draw a willful citation at the maximum penalty. BLS data on fatal occupational injuries shows that falls, transportation incidents, contact with objects and equipment, and exposure to harmful substances account for the large majority of workplace deaths ^[11].

The practical read: in construction, warehousing, manufacturing, or agriculture, the high-frequency and high-severity hazards mostly overlap. Those are the written programs and training records OSHA reaches for first during an inspection.

How do you find a legitimate OSHA-authorized training provider?

OSHA keeps a public directory of authorized outreach trainers and authorized online training organizations on its website ^[5]. For the 10-hour and 30-hour courses, use trainers who show up in that directory. It's searchable by state and industry sector.

For an OSHA 10 or OSHA 30 card to be valid, the trainer has to be currently authorized. Authorization can lapse if a trainer misses activity requirements, so checking the directory instead of taking a provider's word for it is worth 60 seconds, especially when an employer or contract is requiring the card.

Beyond the outreach program, OSHA's Training Institute Education Centers offer more advanced courses, including the OSHA 500 (trainer course for construction) and osha 510 (occupational safety and health standards for construction). Those are for people aiming to become authorized trainers or safety professionals, not general workers.

For a broader look at osha 30 training providers and what the 30-hour course actually covers, we have a full guide with provider comparison tips.

Frequently asked questions

What does OSHA stand for?

OSHA stands for Occupational Safety and Health Administration. It's the federal agency inside the U.S. Department of Labor that writes and enforces workplace safety standards. Congress created it with the Occupational Safety and Health Act of 1970, and it started operations on April 28, 1971. For a deeper look at the name and history, see our guide on what does OSHA stand for.

Is OSHA 10 certification required by law?

Federal OSHA does not require the OSHA 10 card. It's a voluntary outreach program. But several states (including New York under Labor Law Section 220-h) require OSHA 10 for workers on public works construction projects, and many private contractors require it for site access. Check your state's rules and any contract requirements before assuming the card is optional on your job.

How long does OSHA 10 certification last?

The OSHA 10 wallet card has no expiration date. OSHA does not require renewal or continuing education to keep it valid. Some employers and project owners impose their own refresh policies, often every five years, but that's a private requirement, not a federal one. If a job site asks for a renewed card, that comes from the employer or contract, not from OSHA.

How much does OSHA 10 certification cost online?

Legitimate OSHA 10 online courses from authorized providers typically cost between $20 and $80. OSHA itself does not sell the course. Prices vary by provider. Be cautious of any site claiming to offer a free official OSHA 10 card; OSHA's outreach program has no free tier, and unofficial cards won't be recognized by contractors who verify through OSHA's trainer database.

What is the difference between OSHA 10 and OSHA 30?

Both are outreach training courses in OSHA's voluntary program. The 10-hour course is for general workers and covers basic hazard awareness. The 30-hour course is for supervisors and safety personnel and goes deeper on hazard identification, prevention, and OSHA standards. The 30-hour costs more (roughly $99-$300 online vs. $20-$80) and takes more time, but covers the same topic areas in greater depth.

What is the OSHA General Duty Clause?

Section 5(a)(1) of the OSH Act, known as the General Duty Clause, requires every covered employer to provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA cites this clause when no specific standard addresses a known hazard. It's broader than any single regulation and has been used to cite employers for ergonomic hazards, heat illness, workplace violence, and other emerging risks.

How do I report a workplace fatality or serious injury to OSHA?

All employers, regardless of size or industry, must report work-related fatalities to OSHA within 8 hours and work-related inpatient hospitalizations, amputations, or eye losses within 24 hours. You can report by calling 1-800-321-OSHA (1-800-321-6742) or by submitting a report through OSHA's online reporting portal at osha.gov. Failing to report is itself a citable violation under 29 CFR 1904.39.

What is the maximum OSHA fine for a serious violation?

As of 2024, the maximum penalty for a serious violation is $16,131 per violation. Willful and repeat violations carry maximums of $161,323 per violation. These figures adjust annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. OSHA can also lower penalties based on the employer's size, good faith, and history, so the maximum is rarely the actual fine for a first-time smaller employer.

Does OSHA cover small businesses with fewer than 10 employees?

Yes. OSHA covers virtually all private-sector employers regardless of size. Employers with 10 or fewer employees are exempt from routine injury recordkeeping under 29 CFR 1904, and farms under 11 employees have broader exemptions. But all employers must follow safety standards, report severe incidents, and can be inspected. OSHA's free On-Site Consultation Program is built to help small employers reach compliance without facing penalties.

What is OSHA's free On-Site Consultation Program?

OSHA funds a free On-Site Consultation Program that sends safety and health consultants to small and medium-sized businesses on request. These visits are confidential and fully separate from OSHA enforcement; findings are not reported to compliance officers and cannot trigger penalties. The program runs through state agencies or universities. Priority goes to high-hazard industries and small employers. You can request a visit through your state's program.

What OSHA records do employers need to keep on file?

Covered employers keep three core forms: OSHA 300 (annual log of recordable injuries and illnesses), OSHA 300A (yearly summary, posted February 1 through April 30), and OSHA 301 (individual incident report for each recordable case). Records must be kept for five years. Employers in low-hazard industries and those with 10 or fewer employees are partially exempt from these routine recordkeeping requirements under 29 CFR 1904.

Can OSHA inspect my business without warning?

Yes. OSHA compliance officers can arrive unannounced and have legal authority under Section 8 of the OSH Act to enter during normal working hours. You can legally require a warrant before entering, but that rarely helps small employers in practice and can make OSHA more aggressive. The best preparation is having your written programs, training records, and OSHA 300 log in order before any inspection happens.

What is a State Plan and how is it different from federal OSHA?

Twenty-nine states and two territories operate their own OSHA-approved State Plans that cover private and public employers in that state. State Plans must be at least as effective as federal OSHA and can be stricter. If you're in a State Plan state (like California, Washington, or Michigan), state inspectors handle your workplace, not federal OSHA. State Plan rules can differ from federal rules on topics like heat illness or certain chemical exposures, so always check your state's version of a standard.

Does an OSHA 10 card expire and do I need to renew it?

No. The OSHA 10 card has no expiration date under federal OSHA rules. Once issued, it's valid indefinitely. Some employers, unions, or project owners require workers to retake the course every five years as their own policy, and some states have added refresh requirements for specific project types. But from OSHA's standpoint, a card from 2005 and a card from 2024 carry the same official weight.

Sources

1. OSHA.gov, OSH Act of 1970 (Public Law 91-596): Congress created OSHA through the OSH Act signed December 29, 1970; General Duty Clause text; coverage of private-sector employers; farm exemptions
2. OSHA.gov, On-Site Consultation Program: OSHA's free On-Site Consultation Program is separate from enforcement and findings are confidential; Susan Harwood Training Grants exist for small employers
3. OSHA.gov, State Plans: 29 states and 2 territories operate OSHA-approved State Plans covering private and public-sector workers
4. OSHA.gov, Top 10 Most Frequently Cited Standards (FY2023): Fall protection (29 CFR 1926.502) is the most frequently cited standard; penalty amounts for serious and willful violations as of 2024
5. OSHA.gov, Outreach Training Program: OSHA 10 and 30 are voluntary outreach courses; online delivery authorized starting 2002; only authorized trainers issue official completion cards; public directory of authorized trainers
6. New York State Legislature, Labor Law Section 220-h: New York requires OSHA 10 training for workers on public works construction projects under NY Labor Law Section 220-h
7. OSHA.gov, Recordkeeping (29 CFR 1904): Employers with 10 or fewer employees in low-hazard industries are partially exempt from recordkeeping; all employers must report fatalities within 8 hours and hospitalizations/amputations within 24 hours; OSHA 300A must be posted February 1 through April 30
8. U.S. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses, 2023: Private-sector employers reported approximately 2.6 million nonfatal workplace injuries and illnesses in 2023, a rate of 2.4 cases per 100 full-time equivalent workers
9. OSHA.gov, General Industry Standards (29 CFR 1910): 29 CFR 1910 covers general industry; includes written program requirements for hazard communication (1910.1200), lockout/tagout (1910.147), respiratory protection (1910.134), emergency action plans (1910.38), PPE (1910.132), bloodborne pathogens (1910.1030)
10. OSHA.gov, Construction Standards (29 CFR 1926): 29 CFR 1926 covers construction industry; includes fall protection (1926.502), scaffolding (1926.451), ladders (1926.1053)
11. U.S. Bureau of Labor Statistics, Census of Fatal Occupational Injuries: Falls, transportation incidents, contact with objects and equipment, and exposure to harmful substances account for the large majority of fatal workplace injuries