OSHA compliance: what small businesses actually need to do

Last updated 2026-07-09

What does OSHA compliance actually mean for a small business?

OSHA compliance is not a certificate you earn once and file in a drawer. It's an ongoing legal duty under the Occupational Safety and Health Act of 1970, which requires every covered employer to provide a workplace free from recognized hazards likely to cause death or serious physical harm ^[1]. That's the General Duty Clause, Section 5(a)(1), and it applies even when no specific standard covers the hazard in front of you.

For most small businesses, compliance has four working parts: knowing which specific standards apply to your operations, having the required written programs, training employees to the level each standard demands, and keeping the records OSHA can ask to see during an inspection. Miss any one and you're exposed.

Here's what trips people up. There is no universal "OSHA compliance certification" that a third party stamps on your business. OSHA doesn't issue compliance certificates at all. What inspectors look for are documented programs, training records, injury logs, and the physical conditions at your worksite. If those line up with the applicable standards, you're compliant. If they don't, you get a citation.

About 6.5 million establishments fall under federal OSHA's jurisdiction; another 8 million or so sit under state-plan agencies that run their own programs under OSHA-approved rules ^[2]. If you're in California, Michigan, Washington, or one of the other state-plan states, your state agency may enforce standards that go past federal OSHA. Check your state before you assume the federal CFR is the whole story.

Which businesses does OSHA actually cover?

Federal OSHA covers most private-sector employers and their workers in all 50 states, the District of Columbia, and U.S. territories ^[2]. The main exceptions: self-employed workers with no employees, immediate family members working on a family farm, and workers regulated by another federal agency (miners fall under MSHA, for instance).

Farm operations that employ only immediate family members are exempt. Farms with fewer than 11 employees that did not maintain a temporary labor camp are also exempt from OSHA recordkeeping ^[3]. Hire one non-family worker, though, and you're in.

The 10-or-fewer threshold matters for recordkeeping specifically. If your business averaged 10 or fewer employees across the previous calendar year, you're partially exempt from the OSHA 300 log requirement. You still have to report any work-related fatality, inpatient hospitalization, amputation, or eye loss within the required timeframes ^[3].

State-plan states also cover public-sector workers that federal OSHA can't reach. If your business operates in a state-plan state, the state agency handles inspections and enforcement, and its standards are at least as protective as the federal ones, sometimes stricter. OSHA's website has the full list of state-plan states ^[2].

What are the most commonly cited OSHA standards?

OSHA publishes its top 10 most-cited standards every year, and the list barely moves. Fall Protection in construction has held the number-one spot for more than a decade. Fiscal year 2023 data put these at the top ^[4]:

Rank	Standard	Title	Violations
1	29 CFR 1926.501	Fall Protection (Construction)	7,762
2	29 CFR 1910.1200	Hazard Communication	2,978
3	29 CFR 1926.503	Fall Protection Training	2,860
4	29 CFR 1910.134	Respiratory Protection	2,639
5	29 CFR 1926.102	Eye and Face Protection	2,253
6	29 CFR 1910.147	Lockout/Tagout	2,218
7	29 CFR 1926.451	Scaffolding	2,205
8	29 CFR 1910.178	Powered Industrial Trucks (Forklifts)	2,162
9	29 CFR 1926.1053	Ladders (Construction)	2,143
10	29 CFR 1910.305	Electrical Wiring Methods	1,743

Hazard Communication (29 CFR 1910.1200) catches the widest variety of businesses. Any employer whose workers handle chemicals, cleaning products, or industrial materials needs a written HazCom program, a chemical inventory, Safety Data Sheets employees can actually reach, and training. It sits in the top three every year because the requirements are detailed and easy to get half-right.

Lockout/Tagout at 29 CFR 1910.147 trips up small manufacturers and maintenance shops constantly. The standard requires written procedures for each piece of energy-isolating equipment, more than a general policy. Plenty of employers have the general program and skip the machine-specific procedures. That gap is exactly what inspectors go looking for.

In construction, fall protection at 29 CFR 1926.501 is the risk that kills. Falls were the leading cause of construction death in 2022, accounting for 395 of 1,069 construction fatalities ^[5].

What written safety programs does OSHA require?

The honest answer: it depends on your hazards, not your industry label. OSHA standards that require a written program say so in plain text. Here are the ones that hit the most small businesses in general industry.

29 CFR 1910.1200 (Hazard Communication) requires a written HazCom program if employees are exposed to hazardous chemicals. 29 CFR 1910.147 (Lockout/Tagout) requires written energy control procedures for each piece of equipment with hazardous energy. 29 CFR 1910.134 (Respiratory Protection) requires a written program if employees use respirators. 29 CFR 1910.38 (Emergency Action Plans) requires a written plan for employers with more than 10 employees; those with 10 or fewer may communicate it orally. 29 CFR 1910.1030 (Bloodborne Pathogens) requires a written Exposure Control Plan wherever workers face occupational exposure.

That list isn't exhaustive. Standards for fire prevention (1910.39), confined spaces (1910.146), and powered industrial trucks (1910.178) each carry their own written-program or written-procedure requirement.

A written program doesn't have to be long. OSHA cares whether it's specific to your workplace, whether employees can get to it, and whether the procedures described actually happen day to day. A generic template you downloaded and never touched will fold in an inspection.

If you want a faster starting point, SafetyFolio's safety program generator builds a customized written program from your specific hazards and operations in about 15 minutes. It won't replace your legal judgment, but it gets the skeleton right.

What OSHA compliance training is required, and who needs it?

Training requirements live inside individual standards. There is no single "OSHA compliance training" course that covers all of them. Each standard that requires training spells out the topics, the frequency, and sometimes the qualifications of the trainer.

29 CFR 1910.1200 requires training "at the time of their initial assignment, and whenever a new chemical hazard the employees have not previously been trained about is introduced into their work area" ^[6]. 29 CFR 1910.147 requires training before employees perform lockout/tagout, plus retraining when a deficiency turns up. 29 CFR 1910.134 requires training before an employee uses a respirator, then annually after that. 29 CFR 1926.503 (fall protection) requires training before employees face fall hazards.

OSHA 10 and OSHA 30 are voluntary programs run through OSHA's Outreach Training Program. They teach general safety awareness, not standard-specific compliance. Finishing an OSHA 30 course does not make a worker compliant with any specific 29 CFR standard, and OSHA won't accept an OSHA 10 or 30 card as a substitute for standard-specific training during an inspection. Some states and general contractors require them anyway as a baseline. Fine. Just know what they are and what they aren't.

Online delivery is legitimate for most training topics. OSHA's Outreach Training Program allows fully online OSHA 10 and 30 courses. For standard-specific training, online formats are acceptable where the standard doesn't demand a hands-on demonstration. Respirator fit-testing has to happen in person. Hazard Communication training can run online. When you're unsure, read the training paragraph in the specific standard.

For a wider view of what training your operation actually needs, the osha training guide on this site breaks it down standard by standard.

Training records matter as much as the training. Keep the date, the topics covered, the trainer's name and qualifications, and employee names and signatures. Some standards set a retention period. The Respiratory Protection standard, for example, requires training records for the duration of employment ^[7].

How much do OSHA violations actually cost?

OSHA raises its penalty limits every year for inflation. For penalties assessed after January 15, 2024, here are the numbers ^[8]:

Violation Type	Maximum Penalty Per Violation
Serious	$16,550
Other-Than-Serious	$16,550
Posting Violation	$16,550
Failure to Abate	$16,550 per day beyond abatement date
Repeat	$165,514
Willful	$165,514

Those are the statutory ceilings. In practice OSHA adjusts penalties down based on employer size (businesses with 25 or fewer employees can get up to a 60% reduction), good-faith effort, and prior violation history ^[8]. A small employer with a clean record who fixed the hazard fast can end up paying a fraction of the posted maximum.

Don't build your safety program around those discounts. A serious violation tied to a fatality doesn't stay "serious" if OSHA finds you knew about the hazard and ignored it. They can reclassify it as willful. Willful penalties carry a floor, more than a ceiling: the minimum is $11,524 per violation ^[8].

The indirect cost of an injury usually dwarfs the fine anyway. The National Safety Council puts the average cost of a medically consulted workplace injury near $44,000 when you add up wage losses, medical costs, and administrative costs ^[9]. A fatality runs into the millions once you count workers' compensation, litigation, and lost productivity. The OSHA fine is the smallest line on that bill.

What are OSHA's recordkeeping requirements for small businesses?

The recordkeeping rule lives at 29 CFR 1904. Employers with more than 10 employees in most industries have to keep three forms: OSHA 300 (the injury and illness log), OSHA 300A (the annual summary), and OSHA 301 (the incident report) ^[3].

The OSHA 300A summary must be posted in the workplace from February 1 through April 30 every year, even in a year with zero injuries. This is one of the most commonly missed requirements, because it's easy to forget the summary goes up the February after the calendar year closes.

Partially exempt low-hazard industries include much of retail, finance, real estate, and certain service sectors. OSHA publishes the full list of exempt industries by NAICS code. If your NAICS code is on that list and you had 10 or fewer employees, you're off the hook for routine recordkeeping but still on the hook for severe injury reporting.

Severe injury reporting applies to every employer, no matter the size or industry. A work-related fatality has to be reported to OSHA within 8 hours. An inpatient hospitalization, amputation, or eye loss has to be reported within 24 hours ^[3]. You report by calling the OSHA area office, dialing 1-800-321-OSHA, or filing online at osha.gov.

Electronic submission has expanded in recent years. Establishments with 100 or more employees in designated high-hazard industries must submit their OSHA 300 and 301 data electronically through OSHA's Injury Tracking Application (ITA) by March 2 each year. Establishments with 20 to 99 employees in high-hazard industries submit only the 300A summary electronically ^[3].

What does OSHA require you to post in the workplace?

Four things. That's the whole list of what OSHA requires you to post ^[10]:

1. The OSHA "Job Safety and Health: It's the Law" poster (or the state-plan equivalent). Display it where employees can see it. 2. The OSHA 300A Annual Summary, from February 1 through April 30 each year, if you're required to keep records. 3. Any OSHA citations you receive. Post them at or near the place of the violation for three working days or until the violation is corrected, whichever is longer. 4. OSHA notices of any imminent-danger findings, if you ever get one.

The Job Safety poster is free from OSHA's website. Running an outdated version is a common mistake; employers are expected to use the current revision. OSHA does occasionally fine posting violations, up to $16,550, though first-time infractions corrected quickly rarely draw a penalty.

What happens during an OSHA inspection, and how do you prepare?

Most inspections start from a complaint, a referral from another agency, or a fatality or severe-injury report. OSHA also runs programmed inspections targeting high-hazard industries using BLS injury rate data. The complaint-driven ones make up the bulk of what hits small businesses.

An inspection runs in three parts. Opening conference: the compliance officer presents credentials, explains the scope, and asks for your OSHA 300 logs, injury records, and written programs. Walkaround: the officer tours the facility and may interview employees privately. Closing conference: the officer describes the apparent violations and walks you through what the citation process looks like.

You have the right to accompany the compliance officer on the walkaround. Do it. Take your own notes, ask clarifying questions, and point out abatement steps you've already taken. An employee representative also has the right to take part.

The single best preparation is making sure your written programs are current and accessible before anyone shows up. Outdated, generic, or machine-procedure-missing programs are the easiest thing for an inspector to cite. After that, make sure your OSHA 300 logs are accurate and available for the five most recent calendar years.

Get a citation and you have 15 working days from receipt to contest it. That window is strict. Miss it and you waive your right to challenge the citation and the penalty.

Does OSHA offer free help to small businesses before an inspection?

Yes, and most small employers never touch it. OSHA's On-Site Consultation Program gives free, confidential consultations to small and medium-sized businesses, with priority for small employers in high-hazard operations ^[11]. It's walled off from OSHA's enforcement arm. Consultants identify hazards and recommend fixes, but they don't issue citations and they don't report findings to enforcement unless there's an imminent danger the employer flatly refuses to address.

This is the most underused resource in safety compliance, full stop. A consultant walks your facility, reviews your written programs, and hands you a prioritized list of gaps, at no cost. The program is funded through OSHA and run by state agencies. To find yours, search "OSHA consultation" plus your state name or use the directory at osha.gov.

OSHA's website also has compliance assistance resources, including eTools and industry-specific guidance for construction, healthcare, retail, and others ^[10]. They aren't substitutes for reading the actual standards, but they're a decent place to start.

SBA resource partners like SCORE and Small Business Development Centers sometimes offer general safety guidance too, though their depth on OSHA specifics varies a lot.

How do state OSHA plans differ from federal OSHA?

Twenty-nine states and territories run OSHA-approved state plans ^[2]. Most cover both private and public-sector workers; a handful cover only public-sector employees and lean on federal OSHA for private-sector enforcement.

State plans must be at least as effective as the federal program, and many go further. California's Cal/OSHA requires an Injury and Illness Prevention Program (IIPP) for nearly every employer, something federal OSHA does not require ^[12]. Washington State (L&I) has stricter rules on several construction standards. Oregon OSHA runs its own penalty structure and timelines.

In a state-plan state, your compliance checklist starts with the state standards, not the federal CFR. The two are usually structured alike, and state plans often adopt federal language word for word, but the additions and tweaks are what get you. Go straight to your state plan agency's website.

Run worksites in more than one state and you have to comply with each state where you have workers. A national employer can't default to the loosest state's rules and assume that covers everyone.

How do you build an OSHA compliance program from scratch?

Start with a hazard assessment, not a standard. Walk your whole operation and list every hazard workers face: chemical, physical, biological, ergonomic. Then map those hazards to the OSHA standards that apply. That map tells you which written programs you need, what training is required, and which physical controls or PPE rules kick in.

Prioritize by severity and likelihood. A hazard that could kill someone or cause permanent injury on first exposure goes to the top. Housekeeping issues wait.

Once you know your required programs, write them to match your actual workplace. Generic templates work as scaffolding, but they'll fail you in an inspection the moment they reference equipment you don't own or procedures your people don't follow. Every program needs a named responsible person, specific procedures, and a training plan with a schedule.

For a faster start on the documentation, SafetyFolio's safety program generator walks you through your hazards and produces a customized written program you can put to work right away, instead of spending weeks reworking a template.

Build your training calendar next. Some training is annual (Hazard Communication). Some is task-specific and tied to when employees start or change jobs. Track completions. The most common training finding in an inspection isn't that training never happened; it's that it happened and nobody kept the record.

Then set a review cycle. Programs left untouched for three years drift away from your real operations, new equipment, and regulatory changes. Annual review is the floor; quarterly for high-hazard operations.

For a fuller picture of osha and how the agency works, that guide covers its structure and authority in more depth.

Frequently asked questions

What is the difference between OSHA compliance and OSHA certification?

OSHA does not issue compliance certificates to businesses. Compliance is a continuous legal status, not a credential you buy. OSHA 10 and OSHA 30 are training cards issued to individual workers through the Outreach Training Program, not business certifications. When a general contractor asks for an "OSHA 10" or "OSHA 30," they mean the worker finished that voluntary course, not that the company passed an OSHA audit.

How do I know which OSHA standards apply to my business?

Start with OSHA's two main rulebooks: 29 CFR 1910 for general industry and 29 CFR 1926 for construction. Agriculture sits at 29 CFR 1928. Map your actual hazards to the relevant standards. OSHA's website has industry-specific eTools and compliance guides. If your state runs an approved state plan, check that agency's standards too, since they can add requirements beyond the federal baseline.

What is the OSHA General Duty Clause and when does it apply?

The General Duty Clause is Section 5(a)(1) of the OSH Act of 1970. It requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA uses it to cite hazards no specific standard covers, like workplace violence in certain industries or heat illness outdoors. To make it stick, a compliance officer must show the hazard was recognized and a feasible fix existed.

Do businesses with fewer than 10 employees have to comply with OSHA?

Yes. Businesses with 10 or fewer employees are fully subject to OSHA standards and the General Duty Clause. The only break is recordkeeping: employers who averaged 10 or fewer employees all year are partially exempt from keeping OSHA 300 injury logs. They are not exempt from training, written programs, inspections, or citations. Severe injury reporting for fatalities and hospitalizations applies to every employer, regardless of size.

What counts as an OSHA-recordable injury?

An injury or illness is recordable if it's work-related, a new case, and meets at least one criterion: days away from work, restricted duty or job transfer, medical treatment beyond first aid, loss of consciousness, a significant injury diagnosed by a healthcare professional, or a needlestick or hearing loss meeting specific thresholds. First-aid-only cases are not recordable. The full criteria sit in 29 CFR 1904.7.

Can OSHA show up unannounced?

Yes. OSHA compliance officers don't need to give advance notice for most inspections. Advance notice is generally prohibited unless OSHA decides it would make the inspection more effective, like flagging an employer so a rarely-on-site safety officer can attend. If someone claims they'll give you advance notice in exchange for money, that's a scam, and OSHA wants to hear about it.

What is the difference between a serious violation and a willful violation?

A serious violation exists when there's a substantial probability that death or serious harm could result and the employer knew or should have known about the hazard. A willful violation means the employer intentionally disregarded the law or showed plain indifference to worker safety. Willful penalties start at $11,524 and reach $165,514 per violation. The line usually comes down to what the employer knew and when.

Is OSHA compliance training available online?

Much of it, yes. OSHA's Outreach Program (the OSHA 10 and 30 hour courses) runs fully online through authorized providers. Standard-specific training like Hazard Communication or forklift awareness can also run online when the standard doesn't require a hands-on demonstration. Respirator fit-testing and some equipment-specific tasks have to be done in person. Always check the training paragraph in the specific standard before you buy a course.

How long do I have to contest an OSHA citation?

Exactly 15 working days from the date you receive the citation. That deadline is firm. Miss it and you accept the citation and penalty with no right to appeal. To contest, send a written notice of contest to the issuing OSHA area office before the deadline. From there the case goes to the Occupational Safety and Health Review Commission, where both informal and formal settlement options exist.

What is OSHA's free consultation program and who qualifies?

OSHA's On-Site Consultation Program provides free, confidential safety and health consultations to small and medium-sized businesses, with priority for small employers in high-hazard industries. Consultants identify hazards and recommend fixes but don't issue citations and don't share findings with enforcement unless an imminent danger goes unaddressed. State agencies run it with OSHA funding. Any private-sector employer qualifies; contact your state's consultation office.

What OSHA posters are required in the workplace?

Every covered employer must display the current OSHA "Job Safety and Health: It's the Law" poster where employees can see it. State-plan employers post the state equivalent. Employers required to keep OSHA 300 records must post the 300A Annual Summary from February 1 through April 30 each year. Any OSHA citations received must be posted at or near the place of the violation for three working days or until corrected, whichever is longer.

What is the penalty for not having a written safety program?

OSHA doesn't cite a single "no written program" violation; it cites the specific standard that requires the program. Failing to have a written Hazard Communication program under 29 CFR 1910.1200 is a serious violation with a maximum penalty of $16,550. Failing to have written lockout/tagout procedures for each piece of equipment under 29 CFR 1910.147 can generate one citation per machine, which multiplies the exposure fast.

How often does OSHA update its penalty amounts?

OSHA adjusts its civil penalty maximums annually on January 15 for inflation, based on the Consumer Price Index. The authority comes from the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. The current maximums, effective January 15, 2024, are $16,550 for serious violations and $165,514 for willful or repeat violations. Check OSHA's website each January for the updated figures.

Do I need an OSHA 30 to be OSHA compliant?

No. An OSHA 30 card is voluntary and doesn't satisfy any specific standard's training requirement on its own. Some employers or general contractors require it as a baseline for supervisors, and some states mandate it on public construction projects, but holding the card doesn't make your business compliant. Standard-specific training required by 29 CFR standards has to be done separately, documented, and tied to actual job hazards.

Sources

1. OSHA, OSH Act of 1970 Section 5(a)(1) General Duty Clause: Every covered employer must provide a workplace free from recognized hazards likely to cause death or serious physical harm.
2. OSHA, State Plans overview page: 29 state and territory plans are OSHA-approved; federal OSHA covers most private-sector employers in all 50 states.
3. OSHA, Recordkeeping rule overview (29 CFR 1904): Employers with more than 10 employees must keep OSHA 300, 300A, and 301 forms; fatalities must be reported within 8 hours; hospitalizations, amputations, and eye losses within 24 hours.
4. OSHA, Top 10 Most Frequently Cited Standards FY2023: Fall Protection (1926.501) was the most cited standard with 7,762 violations in FY2023; Hazard Communication ranked second with 2,978 violations.
5. Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2022: Falls accounted for 395 of 1,069 construction fatalities in 2022.
6. OSHA, Hazard Communication Standard 29 CFR 1910.1200(h): Hazard Communication training must occur at the time of initial assignment and whenever a new chemical hazard is introduced.
7. OSHA, Respiratory Protection Standard 29 CFR 1910.134: Respiratory Protection training records must be retained for the duration of employment.
8. OSHA, Penalties page (civil penalty maximums effective January 15, 2024): Serious and other-than-serious violations carry a maximum penalty of $16,550; willful and repeat violations up to $165,514, with a minimum of $11,524 for willful violations, as of January 15, 2024.
9. National Safety Council, Injury Facts (Work Safety, Costs): The average cost of a medically consulted workplace injury is roughly $44,000 including wage losses, medical costs, and administrative expenses.
10. OSHA, Workplace Posting Requirements (29 CFR 1903.2): Employers must post the OSHA Job Safety and Health poster in a prominent location; citations must be posted at or near the place of violation for three working days or until corrected.
11. OSHA, On-Site Consultation Program for Small Business: OSHA's On-Site Consultation Program provides free, confidential safety consultations to small and medium-sized businesses; consultants do not issue citations and do not report findings to enforcement except for imminent dangers.
12. California Department of Industrial Relations, Cal/OSHA: Cal/OSHA requires nearly every California employer to maintain an Injury and Illness Prevention Program (IIPP), which federal OSHA does not require.