OSHA rules explained: what every employer must know

Last updated 2026-07-09

What are OSHA rules, and who has to follow them?

OSHA rules apply to almost every private-sector employer with at least one employee. There is no minimum-size cutoff. Hire your first worker, and you are covered. OSHA, the Occupational Safety and Health Administration, came out of the Occupational Safety and Health Act of 1970 (29 U.S.C. § 651 et seq.) ^[1]. The law's stated purpose is to assure, so far as possible, every working man and woman in the nation safe and healthful working conditions.

Federal agencies and most state and local governments run under separate rules, though many states have their own OSHA-approved programs (called state plans) that cover public employees too ^[2]. Self-employed people with no employees generally fall outside OSHA's reach.

The rules come in two forms. The General Duty Clause (Section 5(a)(1) of the OSH Act) requires every employer to provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm ^[1]. Then there are the specific standards, codified in Title 29 of the Code of Federal Regulations. General industry standards live in 29 CFR Part 1910. Construction is in 29 CFR Part 1926. Agriculture is in 29 CFR Part 1928 ^[3].

Here is how they interact. If a specific standard exists for a hazard, OSHA cites that standard, not the General Duty Clause. The General Duty Clause fills the gaps where no specific standard covers the hazard. Workplace violence in healthcare is one example, since no specific OSHA standard covers it yet.

What are the most important OSHA standards for general industry?

General industry is OSHA's catch-all category for workplaces that are not construction, agriculture, or maritime. Run a restaurant, warehouse, office, retail store, or manufacturing plant, and 29 CFR Part 1910 applies to you. These are the subparts that come up most for small businesses:

Standard	CFR Citation	What it covers
Hazard Communication (HazCom)	29 CFR 1910.1200	Chemical labeling, Safety Data Sheets, employee training
Lockout/Tagout	29 CFR 1910.147	Control of hazardous energy during equipment maintenance
Respiratory Protection	29 CFR 1910.134	Respirator selection, fit testing, medical evaluations
Personal Protective Equipment	29 CFR 1910.132	Hazard assessment, PPE selection, training
Electrical (General Requirements)	29 CFR 1910.303	Wiring design, equipment guarding
Walking-Working Surfaces	29 CFR 1910.22	Housekeeping, floors, aisles
Emergency Action Plans	29 CFR 1910.38	Evacuation procedures for employers with 10+ employees
Fire Prevention Plans	29 CFR 1910.39	Handling of flammable materials, equipment maintenance
Bloodborne Pathogens	29 CFR 1910.1030	Exposure control for workers with occupational blood exposure

Hazard Communication lands in OSHA's top-ten most cited standards every single year ^[4]. If you sell or store chemicals, use cleaning products, or have workers who touch any substance with a Safety Data Sheet, HazCom applies. It requires a written hazard communication program, labeled containers, accessible SDS documents, and documented employee training ^[3].

Lockout/Tagout is the one that kills people when it gets ignored. Any time a worker services or maintains equipment that could unexpectedly start up, they need a written energy control procedure. The standard is specific: an energy control program, machine-specific procedures in most cases, and annual inspections of those procedures ^[3]. Skip the annual inspection and you have a citation waiting to happen.

What does OSHA's General Duty Clause actually require?

The General Duty Clause is the backstop. Section 5(a)(1) of the OSH Act states: "Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees." ^[1]

To cite it, OSHA has to prove four things: the employer knew or should have known about the hazard, the hazard was recognized (by the employer, the industry, or common sense), the hazard caused or was likely to cause serious harm, and a workable fix existed.

Workplace violence is the most common General Duty Clause target in healthcare and social services, where assaults by patients are a leading cause of injury ^[5]. Heat illness is another, since there is no federal heat standard yet. OSHA has cited ergonomic hazards this way too.

Here is the practical takeaway. You cannot say "there's no specific OSHA rule about this" and walk away. If a hazard is known in your industry and you could reasonably fix it, OSHA can cite you under Section 5(a)(1).

How much do OSHA violations actually cost?

A serious OSHA violation costs up to $16,550 per violation as of January 2024. Willful or repeat violations run up to $165,514 each. OSHA adjusts these amounts every year for inflation under the Federal Civil Penalties Inflation Adjustment Act ^[6]. Here is the current table:

Violation Type	Maximum Penalty Per Violation
Serious	$16,550
Other-than-Serious	$16,550
Posting Requirements	$16,550
Failure to Abate	$16,550 per day
Willful or Repeated	$165,514

Those are maximums, not what most small employers actually pay. OSHA applies reduction factors for good faith (up to 25%), clean history, and small size. An employer with fewer than 10 workers can get up to 70% off gravity-based penalties ^[6].

Willful violations are their own animal. If OSHA concludes you knew about a hazard and blew off the law anyway, the minimum penalty is $11,524 per violation and the maximum is $165,514 ^[6]. Repeat violations, meaning the same standard cited again within five years, also hit the $165,514 ceiling.

The fine is often the cheap part. OSHA's own materials point to research suggesting the indirect costs of an injury (lost productivity, retraining, overtime, administrative time) run four to five times the direct costs. The National Safety Council put the average cost per medically consulted injury at $44,000 in 2022 ^[5].

For a small business, one serious injury can end the company. The citation is usually the smaller problem.

What records does OSHA require employers to keep?

Employers with 10 or fewer employees at all times during the previous calendar year are exempt from most routine injury recordkeeping, but they still have to report fatalities and hospitalizations. Everyone else in a covered industry keeps injury logs. The rules live in 29 CFR Part 1904 ^[7].

If you have 11 or more employees and your industry is not on the partially exempt list (which covers lower-hazard sectors like retail, finance, and real estate), you must:

• Maintain an OSHA 300 Log of work-related injuries and illnesses
• Complete an OSHA 301 Incident Report for each recordable case
• Post the OSHA 300A Summary every February 1 through April 30 of the following year

A recordable injury is one that results in days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or a diagnosis of a significant injury by a healthcare professional ^[7].

Electronic submission rules got tighter in 2024. Under the 2023 final rule (effective January 1, 2024), establishments with 100 or more employees in high-hazard industries now submit their full OSHA 300 and 301 data electronically each year, more than the summary ^[7]. Establishments with 20 to 99 employees in high-hazard industries still submit only the 300A summary. The portal is OSHA's Injury Tracking Application (ITA).

Reporting deadlines are short and firm. Report a fatality within 8 hours. Report an in-patient hospitalization, amputation, or loss of an eye within 24 hours ^[7]. You can call the nearest OSHA area office, dial 1-800-321-OSHA, or report online.

Does OSHA require a written safety program?

No single OSHA standard says every employer must have a general written safety program. But several standards require their own written programs, and if any of those hazards exist in your shop, the writing is not optional. Hazard Communication (29 CFR 1910.1200) requires a written hazard communication program. Lockout/Tagout (29 CFR 1910.147) requires a written energy control program. Respiratory Protection (29 CFR 1910.134) requires a written respiratory protection program. Bloodborne Pathogens (29 CFR 1910.1030) requires a written exposure control plan. Each spells out its own content requirements in the standard itself ^[3].

OSHA's own Recommended Practices for Safety and Health Programs pushes hard for one overall program as the framework tying everything together ^[8]. There is a blunter reason to have one. When an inspector shows up and asks how you manage safety, "we handle it as things come up" is the worst answer you can give.

A written program is your evidence trail. It is what earns penalty reductions, and it is what protects you legally if an employee gets hurt and a lawsuit follows.

The blank page is where most owners stall out. If you want to skip that, SafetyFolio's safety program generator walks you through the required elements for the standards most likely to hit your workplace in about 15 minutes.

For exactly what each required program has to contain, the CFR text is the authority. OSHA.gov also publishes e-tools and compliance assistance documents for most major standards ^[8].

What training does OSHA actually require?

OSHA training is not one course. Training requirements are baked into dozens of individual standards, and what your workers need depends entirely on the hazards they face. There is no single class that checks every box.

Here are the common required topics and their standards:

• Hazard Communication: employees exposed to hazardous chemicals must be trained on reading labels and SDS documents and on protecting themselves (29 CFR 1910.1200(h)) ^[3]
• Lockout/Tagout: authorized employees who perform lockout and affected employees who work around serviced equipment both need training (29 CFR 1910.147(c)(7)) ^[3]
• Respiratory Protection: respirator users must be trained before first use and annually after (29 CFR 1910.134(k)) ^[3]
• Personal Protective Equipment: employees must learn why PPE is needed, how to put it on and take it off, its limits, and how to care for it (29 CFR 1910.132(f)) ^[3]
• Emergency Action Plans: employees must be trained on their role before the plan takes effect and whenever it changes (29 CFR 1910.38(e)) ^[3]

OSHA's 10-hour and 30-hour courses, run by OSHA-authorized trainers, are voluntary programs that give workers a broad safety orientation. On their own they satisfy no specific standard, though some states and job sites require them for certain workers. More on osha training and the osha 30 course lives on those pages.

Document everything. Keep records of who was trained, on what, by whom, and when. Inspectors ask for those records, and "we trained everyone" with nothing to show is the same as never training them.

What happens during an OSHA inspection?

OSHA works inspections in priority order: imminent dangers first, then fatality and catastrophe investigations, then complaints, then referrals, then planned high-hazard targeting, then follow-ups ^[9]. A random visit to a low-hazard office almost never happens. An employee complaint is a far more likely trigger.

When a compliance officer (CO) arrives, they show credentials and explain why they are there. You can request a warrant, but for most small employers that rarely helps the outcome and usually reads as bad faith. The CO runs an opening conference, a walkaround (you or your representative goes along), and a closing conference to cover what they found.

You do not have to answer questions on the spot beyond basic identification. You can say you need to pull documentation and get back to them. You can take your own notes during the walkaround. You can have your attorney present.

After the inspection, OSHA usually issues citations within six months. Each one names the standard violated, describes the violation, and lists the penalty. You then have 15 working days to contest, or the citation becomes a final order. To fight it, you file a Notice of Contest with the OSHA Area Director, and the case moves to the Occupational Safety and Health Review Commission (OSHRC) ^[9].

Informal settlement is common, and often the smart move. OSHA area offices can negotiate abatement dates, penalty cuts, and sometimes how a citation is characterized. Most contested cases settle before a formal hearing.

Are OSHA rules different in states with their own plans?

Yes, and it matters where your workers are. Twenty-two states and two territories run OSHA-approved state plans covering both private-sector and public workers ^[2]. Another six states and one territory have plans covering only state and local government employees. In those states, the state agency, not federal OSHA, enforces workplace safety.

State plans have to be at least as effective as federal OSHA, which means their standards must be at least as protective. Plenty go further. California (Cal/OSHA) has a heat illness prevention standard for outdoor workers (8 CCR 3395) that is far more detailed than federal OSHA's General Duty Clause approach. Washington State has an ergonomics rule. Michigan has its own standards for certain agricultural operations.

If you operate in a state-plan state, you comply with your state agency's standards, not federal OSHA's, for work done in that state. The current list is on OSHA.gov ^[2]. The 28 states and jurisdictions without their own plans fall under federal OSHA directly.

Cross state lines and you follow whichever rules apply where each employee works. A contractor with jobs in California, Nevada, and Oregon is juggling three separate sets of standards.

What rights do employees have under OSHA rules?

The OSH Act hands workers specific rights, and employers who trample them face extra legal exposure ^[1].

Employees can request an OSHA inspection without their employer learning who filed the complaint (though OSHA does not always keep complaints confidential in practice). They can join the walkaround inspection and speak privately with the CO. They can review the OSHA 300 Log, and they can access their own medical and exposure records under 29 CFR 1910.1020 ^[3].

Retaliation protections are real and enforced. Section 11(c) of the OSH Act bars employers from firing, demoting, disciplining, or otherwise discriminating against an employee for raising a safety concern, filing an OSHA complaint, or taking part in an OSHA proceeding. A worker who believes they were retaliated against can file with OSHA within 30 days of the adverse action ^[1].

Then there is the poster. Every covered employer must display the "Job Safety and Health: It's the Law" poster (or the state equivalent) where employees can see it. Not posting it is a citable violation on its own ^[6].

How do small businesses get help with OSHA compliance?

OSHA runs a free, confidential On-Site Consultation Program for small and medium-sized businesses, and it is walled off from enforcement. Delivered through state agencies (often labor departments or university extension programs), the consultants who visit your workplace cannot share what they find with OSHA's enforcement side ^[8]. That confidentiality is written into 29 CFR Part 1908.

Employers who correct all identified hazards can apply for the Safety and Health Achievement Recognition Program (SHARP), which exempts them from programmed (random) inspections for a set period ^[8].

OSHA.gov carries compliance assistance resources, e-tools, and industry-specific guides for most major hazards. The Small Business Administration and many trade associations publish safety guides built around OSHA's requirements too.

To build your written programs without staring at a blank page, SafetyFolio's safety program generator produces the specific documents OSHA's standards require, based on the hazards that actually exist in your workplace.

For training, osha training resources and authorized outreach programs run through OSHA's Training Institute and its Education Centers around the country. The osha 30 hour online course is legitimate for some roles, though it does not replace standard-specific training.

Here is what I would do as a 15-person manufacturer starting from zero. Call the free OSHA consultation program first. Get a baseline hazard assessment at no cost. Then build your programs around what they actually find. That beats paying a consultant $5,000 to hand you generic templates.

What are the most common OSHA violations, and how do you avoid them?

Fall protection is the single most cited OSHA standard, with 7,762 violations in FY2023. OSHA publishes its top-ten list every fiscal year, and it barely moves from year to year ^[4]:

Rank (FY2023)	Standard	Violations
1	Fall Protection (1926.501)	7,762
2	Hazard Communication (1910.1200)	3,213
3	Ladders (1926.1053)	2,978
4	Respiratory Protection (1910.134)	2,810
5	Powered Industrial Trucks (1910.178)	2,562
6	Lockout/Tagout (1910.147)	2,554
7	Fall Protection Training (1926.503)	2,481
8	Scaffolding (1926.451)	2,285
9	Eye and Face Protection (1910.133)	2,074
10	Machine Guarding (1910.212)	1,972

Source: OSHA, FY2023 Top 10 Most Frequently Cited Standards ^[4]

For general industry, the pattern is steady: chemical safety (HazCom), energy control (lockout/tagout), respiratory protection, and machine guarding are the chronic trouble spots. For construction, falls dominate everything.

Most of these citations do not come from employers trying to dodge the rules. They come from shops with no written program, undocumented training, or procedures that drifted after the initial setup. An annual internal audit, even a rough one, catches most of it before OSHA does.

Read what does osha stand for for a fuller history of the agency and how its authority grew.

Frequently asked questions

Does OSHA apply to companies with fewer than 10 employees?

Yes. OSHA's safety and health standards apply to private-sector employers with even one employee. The size exemption is narrow: employers with 10 or fewer employees are exempt from routine injury recordkeeping on the OSHA 300 Log, but they must still comply with all safety standards, report fatalities within 8 hours, and report hospitalizations and amputations within 24 hours (29 CFR Part 1904.1).

What is the difference between a serious violation and a willful violation?

A serious violation is one where OSHA finds a substantial probability of death or serious physical harm, and the employer knew or should have known of the hazard. A willful violation means the employer knew about the hazard and intentionally disregarded the law, or showed plain indifference to worker safety. Willful violations carry a minimum penalty of $11,524 and a maximum of $165,514 per violation as of 2024.

How long does OSHA have to cite an employer after an inspection?

OSHA must issue any citation within six months of the violation occurring. In practice, for inspections triggered by incidents or complaints, the clock starts when the CO conducts the inspection. For continuing violations, such as an ongoing lack of a required written program, the six-month window runs from when the violation was observed during the inspection.

Can an employee refuse unsafe work under OSHA rules?

OSHA's regulation at 29 CFR 1977.12 recognizes an employee's right to refuse work in good faith when they reasonably believe it poses imminent danger of death or serious injury, and there is not enough time to fix the danger through normal channels. The employee must have asked the employer to correct the condition first. This right has limits; it is not a blanket refusal right.

What is an OSHA 300 Log and who has to keep one?

The OSHA 300 Log records work-related injuries and illnesses. Employers with 11 or more employees in industries not on OSHA's partial exemption list must keep one. Each recordable case gets a line entry with dates, description, and outcome. Employers must post the annual OSHA 300A Summary from February 1 through April 30 each year and keep records for five years.

Do OSHA rules apply to remote workers working from home?

OSHA stated in a 2000 Letter of Interpretation that it will not inspect home offices and does not hold employers responsible for employees' home offices. However, if a home-based employee has a work-related injury, it may still be OSHA-recordable for covered employers. The agency's general position is that it does not inspect home-based worksites for safety conditions.

What is the OSHA poster requirement?

Every employer covered by OSHA must display the official 'Job Safety and Health: It's the Law' poster (OSHA 3165) in a conspicuous spot where employees can see it. Failure to post can bring a citation of up to $16,550. State-plan states have their own equivalent poster. The poster is free from OSHA and can be downloaded and printed from OSHA.gov.

How does OSHA decide where to do inspections?

OSHA prioritizes inspections in this order: imminent danger situations, fatality and catastrophe investigations, formal employee complaints, referrals from other agencies or the media, programmed inspections targeting high-hazard industries, and follow-up inspections to verify abatement. Random inspections of low-hazard workplaces are rare. Joining the OSHA consultation program and reaching SHARP status can exempt employers from programmed inspections.

What is the General Duty Clause and when does OSHA use it?

Section 5(a)(1) of the OSH Act requires every employer to provide a workplace free from recognized hazards likely to cause death or serious harm. OSHA uses it when no specific standard covers a hazard. Common targets include workplace violence in healthcare, heat illness where no federal heat standard exists, and ergonomic hazards. OSHA must show the hazard was recognized and that a feasible fix existed.

Are OSHA rules the same in California as in other states?

No. California runs Cal/OSHA under an OSHA-approved state plan with its own standards, many stricter than federal OSHA. Examples include Cal/OSHA's heat illness prevention standard for outdoor workers (8 CCR 3395), its indoor heat illness rules, and its COVID-19 non-emergency regulation. Twenty-two states and two territories have their own approved state plans covering private-sector workers.

Does OSHA require employers to have a written safety program?

No single OSHA standard requires a general written safety program for all employers. But specific standards, including Hazard Communication, Lockout/Tagout, Respiratory Protection, and Bloodborne Pathogens, each require their own written programs with defined content. OSHA's guidance strongly recommends an overall safety and health program as the management framework. During inspections, documented programs are the evidence of good-faith compliance.

What should an employer do immediately after a workplace fatality?

Report the fatality to OSHA within 8 hours by calling 1-800-321-OSHA, calling the nearest OSHA area office, or reporting online at OSHA.gov. Preserve the scene as much as safely possible. Document everything: photos, witness statements, equipment status. Do not make admissions of fault. Notify your insurer and legal counsel promptly. OSHA will investigate and may arrive at the site quickly.

How do OSHA's 10-hour and 30-hour courses fit into compliance?

OSHA's 10-hour and 30-hour outreach courses are voluntary general awareness programs. They do not satisfy specific standard training requirements, such as the annual training required for respirator users under 29 CFR 1910.134 or the training required under Lockout/Tagout. Some states and project owners require them for construction workers. Treat them as a foundation, not a compliance shortcut. See our pages on osha 30 and osha training for details.

Can OSHA inspect a workplace without advance notice?

Yes. OSHA inspections are almost always unannounced. Giving an employer advance notice, except in narrow cases like imminent danger situations or after-hours inspections that require the employer's presence, is a criminal violation under Section 17(f) of the OSH Act, punishable by a fine or up to six months in prison. The rule applies to OSHA compliance officers and anyone else who might tip off an employer.

Sources

1. U.S. Congress, Occupational Safety and Health Act of 1970 (29 U.S.C. § 651 et seq.): The OSH Act's stated purpose and the text of the General Duty Clause, Section 5(a)(1)
2. OSHA.gov, State Plans: 22 states and 2 territories operate OSHA-approved state plans covering private-sector workers
3. OSHA.gov, Regulations (Standards - 29 CFR): General industry standards in 29 CFR Part 1910, including HazCom (1910.1200), Lockout/Tagout (1910.147), Respiratory Protection (1910.134), PPE (1910.132), Emergency Action Plans (1910.38)
4. OSHA.gov, Top 10 Most Frequently Cited Standards FY2023: Fall Protection (7,762 violations), HazCom (3,213), Respiratory Protection (2,810), Lockout/Tagout (2,554) were top-cited in FY2023
5. National Safety Council, Injury Facts 2023: Average cost per medically consulted workplace injury was $44,000 in 2022; workplace violence in healthcare is a leading cause of injury
6. OSHA.gov, Penalties: Maximum penalties: serious violations $16,550, willful or repeat violations $165,514 per violation as of January 2024; small employer penalty reduction up to 70%
7. OSHA.gov, Recordkeeping Rule (29 CFR Part 1904): Employers with 10 or fewer employees exempt from 300 Log; fatalities reported within 8 hours; hospitalizations, amputations, and eye losses within 24 hours; 2023 final rule requires 300/301 electronic submission for large high-hazard establishments effective January 1, 2024
8. OSHA.gov, Recommended Practices for Safety and Health Programs: OSHA recommends a written safety and health program as the organizing framework; free consultation program described under 29 CFR Part 1908 with confidentiality protections
9. OSHA.gov, Enforcement: Inspection priority order, 15 working days to contest, and appeals to the Occupational Safety and Health Review Commission (OSHRC)
10. OSHA.gov, Workers' Rights (OSHA 3021): Employee rights under the OSH Act including right to request inspection, Section 11(c) retaliation protections, and 30-day window to file retaliation complaints
11. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2022: BLS injury and illness data supporting discussion of workplace injury rates and recordable case definitions