Workplace safety compliance: what small businesses actually owe OSHA

Last updated 2026-07-09

What is workplace safety compliance and who does it apply to?

Workplace safety compliance means meeting the legal requirements set by the Occupational Safety and Health Administration under the OSH Act of 1970 (29 USC 651 et seq.). That law covers private-sector employers in all 50 states and U.S. territories. Have one employee? You're covered. The main exceptions are self-employed sole proprietors with no employees, family farms that employ only immediate family members, and workplaces already regulated by another federal agency, like mines (MSHA) or aircraft (FAA) ^[1].

Federal employees are covered separately through their agencies' own safety programs, which must meet OSHA standards. State and local government workers are not covered by federal OSHA at all unless the state runs its own OSHA-approved plan. Twenty-two states and two territories run such plans, and they must be "at least as effective" as the federal program, to quote Section 18 of the OSH Act ^[1].

This isn't optional or aspirational. It carries civil penalties and, in egregious cases, criminal referrals. The Bureau of Labor Statistics counted 2.6 million non-fatal workplace injuries and illnesses in 2023, and 5,283 fatal work injuries ^[2]. Those numbers are the practical reason the law exists, and they're why OSHA inspectors keep showing up.

What are the main OSHA standards small businesses need to follow?

OSHA splits its rules into four main parts of 29 CFR: Part 1910 (general industry), Part 1926 (construction), Part 1915 (maritime), and Part 1928 (agriculture). Most small businesses fall under 1910. The standards OSHA inspectors cite most often give you a working list of what the agency actually checks ^[3].

Here are the most commonly cited 29 CFR 1910 standards, based on OSHA's annual enforcement data:

Standard	Title	Why it matters
29 CFR 1910.1200	Hazard Communication	Chemical labels, Safety Data Sheets, employee training
29 CFR 1910.147	Lockout/Tagout	Energy control during equipment maintenance
29 CFR 1910.303	Electrical (Wiring)	Proper wiring, grounding, panel access
29 CFR 1910.212	Machine Guarding	Guards on moving parts
29 CFR 1910.132	Personal Protective Equipment	Hazard assessment, PPE selection, training
29 CFR 1910.178	Powered Industrial Trucks	Forklift operator training and equipment checks
29 CFR 1910.219	Mechanical Power Transmission	Guarding on shafts, pulleys, belts

Beyond specific standards, OSHA's General Duty Clause (Section 5(a)(1) of the OSH Act) requires every employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." That clause is the catch-all. OSHA reaches for it when no specific standard covers a hazard, so you can't just argue a hazard is unregulated.

For construction employers, lockout tagout and fall protection (29 CFR 1926.502) sit at the top of citation lists year after year. For any business using chemicals, hazard communication is non-negotiable.

One thing people get wrong: compliance isn't a one-time event. Standards change, new chemicals arrive, equipment gets modified. A program that was clean in 2020 may have holes today.

What does OSHA actually require you to put in writing?

Several standards flatly require a written program. Others say nothing about writing but effectively demand documentation, because an inspector will ask to see records. The distinction matters. If a standard says "written program," the absence of one is itself a citable violation, no matter how well you actually run things day to day.

Standards that require a written program include:

• 29 CFR 1910.1200 (Hazard Communication): Written plan describing how you manage labels, SDS sheets, and training
• 29 CFR 1910.147 (Lockout/Tagout): Written energy control program plus machine-specific procedures
• 29 CFR 1910.146 (Permit-Required Confined Spaces): Written permit space program if such spaces exist
• 29 CFR 1910.132 (PPE): Written hazard assessment certification (at minimum, a dated signature document)
• 29 CFR 1910.1030 (Bloodborne Pathogens): Written Exposure Control Plan for covered employers
• 29 CFR 1910.38 (Emergency Action Plan): Written plan required for employers with more than 10 employees; smaller employers may communicate it verbally ^[4]

A written Injury and Illness Prevention Program (IIPP) isn't required by any single federal OSHA standard, but California (Cal/OSHA), Washington, Hawaii, and several other state-plan states mandate one ^[5]. Plenty of safety consultants and industry groups push it anyway, because it gives you a framework that satisfies several standards at once.

When a small business owner asks me what to write first, I say start with hazard communication. It applies to almost everyone, inspectors check it constantly, and a good written program forces you to inventory your chemicals and train your people, which shakes loose other problems along the way.

How does OSHA recordkeeping work and which businesses are exempt?

Injury and illness recordkeeping lives in 29 CFR Part 1904. The basic rule: employers with more than 10 employees in industries not classified as "partially exempt" must record work-related injuries and illnesses on OSHA Forms 300, 300A, and 301 ^[6].

The partial exemption for low-hazard industries covers retail, finance, real estate, and similar sectors. OSHA publishes the specific NAICS codes that qualify; check your industry code against Appendix A to Subpart B of Part 1904 on OSHA's website. Partial exemption doesn't mean you skip reporting. Every employer, regardless of size or industry, must report to OSHA within 8 hours any work-related fatality, and within 24 hours any inpatient hospitalization, amputation, or loss of an eye ^[6].

The annual summary (Form 300A) must hang in a visible workplace location from February 1 through April 30 each year. Establishments with 100 or more employees in certain high-hazard industries must submit their 300A data electronically through OSHA's Injury Tracking Application (ITA) by March 2. A second tier, establishments with 20 to 99 employees in high-hazard industries, also has electronic submission requirements ^[6].

Keep records for five years. OSHA can request them during an inspection and ask you to produce logs going back that far. An incident report is the first document you fill out after an injury, and it feeds the formal OSHA 301 form.

What are OSHA penalties for non-compliance in 2024 and 2025?

OSHA raises its civil penalty maximums every year for inflation under the Federal Civil Penalties Inflation Adjustment Act. For 2024, the maximums are:

Violation Type	Maximum Penalty Per Violation
Other-than-Serious	$16,550
Serious	$16,550
Repeat	$165,514
Willful	$165,514
Failure to Abate	$16,550 per day

Those are ceilings, not sticker prices. OSHA runs a penalty calculation that weighs gravity, employer size, good faith, and history. A small employer (under 25 employees) may get a 60% reduction from the maximum, and an employer with a strong safety history and demonstrated good faith can earn more on top of that. The agency spells out its reduction guidance in the Field Operations Manual ^[7].

The number that should scare a small business is the repeat category. Get cited for the same standard within three years and the repeat multiplier kicks in. A $3,000 initial penalty can balloon to $45,000 or more on the second citation. That's where businesses land in real financial trouble.

Criminal penalties are rare but real. A willful violation that causes an employee death can bring fines up to $10,000 and six months imprisonment for a first conviction under the OSH Act itself. Separate criminal statutes, including environmental laws like the Clean Air Act, can pile on in catastrophic incidents.

For a sense of what inspections actually look like, see our guide to osha enforcement.

What OSHA training is required and how often does it need to happen?

OSHA has no single universal training standard. Each standard that requires training sets its own frequency, content, and sometimes delivery method. There's no blanket rule like "train everyone annually."

Here's how the requirements actually vary:

• Hazard Communication (1910.1200): Train employees before initial assignment to hazardous chemicals, and when a new hazard shows up. No fixed retraining interval, but you must retrain if you have reason to believe they don't understand the material.
• Lockout/Tagout (1910.147): Train authorized and affected employees; retrain when performance slips, job assignments change, or energy sources change.
• Powered Industrial Trucks (1910.178): Train before operating; evaluate performance every three years; retrain after an accident, a near miss, or an observed unsafe operation ^[8].
• Bloodborne Pathogens (1910.1030): Train at initial assignment, then annually.
• Emergency Action Plan (1910.38): Train when the plan is first developed, when an employee's responsibilities change, and when the plan changes.

For supervisors and managers who want a structured overview, the OSHA 30 course is the industry standard, covering 29 CFR standards across construction or general industry. It's not a legal requirement for most employers, but it's widely recognized and genuinely useful. For frontline workers, the OSHA training 10-hour course covers the basics.

Document every session: who attended, what you covered, who delivered it, and the date. That paper is what you hand an inspector. Without it, you effectively didn't train.

How do you actually build a workplace safety compliance program from scratch?

Most small business owners don't need a 200-page safety manual. They need a set of documents that address their actual hazards. Here's a practical sequence.

Start with a hazard assessment. Walk your facility and list every task, material, and piece of equipment. For each one, ask: can this hurt someone, and how? This doesn't have to be elaborate. A one-page checklist works. OSHA's free Small Business Handbook gives you a template approach ^[9].

Next, match your hazards to the standards. Line them up against 29 CFR 1910 (or 1926 for construction). Store chemicals? 1910.1200 applies. Run forklifts? forklift certification and 1910.178 apply. Employees maintain equipment? 1910.147 applies. Don't write programs for standards that don't touch your workplace. It wastes time and breeds confusion.

Then write the required programs. Hazard communication first, since it covers almost everyone. Lockout/tagout next if you have equipment. Confined spaces after that if relevant. Each written program should say what you do, who's responsible, and how you document it.

Set up recordkeeping. Pull OSHA Forms 300, 300A, and 301 off OSHA's website (they're free). Decide who fills them out and how fast after an incident.

Train your people and document it. Tie the training to the standards you flagged.

Review annually, or the moment something changes. Add equipment, change a process, or bring in a new chemical, and your programs need an update.

Want to skip the blank-page problem? SafetyFolio's safety program generator builds OSHA-aligned written programs tailored to your industry in about 15 minutes, faster than most consultants' intake calls.

One resource too few owners use: OSHA's On-Site Consultation Program provides free, confidential safety assessments to small businesses. These consultants are walled off from enforcement. They can't issue citations, and their visit isn't shared with OSHA inspectors ^[9]. If you're genuinely unsure about your hazards, call them.

What is the difference between federal OSHA and state OSHA plans?

Federal OSHA directly enforces standards in 28 states and jurisdictions. The other 22 states and two territories (Puerto Rico and the Virgin Islands) run their own state plans, approved by federal OSHA under Section 18 of the OSH Act ^[10]. State plans must be "at least as effective" as the federal program. In practice, many are stricter.

State plans can and do add requirements that don't exist in federal rules. California's Cal/OSHA requires a written Injury and Illness Prevention Program for essentially every employer. Washington's L&I requires a written Accident Prevention Program. Oregon OSHA has its own required written program elements. Operate in a state-plan state and you have to check state-specific requirements, more than 29 CFR.

Some state plans cover state and local government workers, which federal OSHA does not. All state plans cover private-sector employers.

The practical hit: a business operating across multiple states may face different requirements in each location. A hazcom program that clears federal OSHA might fall short of Cal/OSHA's added rules for written procedures and annual review.

In a federal OSHA state, the 29 CFR standards are the floor and the ceiling of your state-level regulatory obligation.

What rights do employees have under OSHA, and how does that affect compliance?

Employee rights matter for compliance because workers can file complaints, and a worker complaint almost always triggers an inspection or at least an informal investigation.

Under Section 11(c) of the OSH Act, workers can report hazards without retaliation, refuse work they reasonably believe poses imminent danger, request an OSHA inspection, and take part in any inspection that happens ^[1]. Retaliating against an employee for exercising these rights is a separate violation from any underlying safety problem, with its own penalties.

Employers must post the OSHA "It's the Law" poster (or the equivalent state-plan poster) in a visible spot ^[11]. The poster explains employee rights. Failing to post it is a citable violation, usually other-than-serious, but still on your record.

OSHA's Section 11(c) anti-retaliation provisions reach discharge, demotion, and pay cuts, plus subtler moves like changing shifts to make a job harder. Whistleblower complaints must be filed within 30 days of the alleged retaliation.

The honest reality: workers who feel heard about safety concerns rarely file complaints. Give employees a way to report hazards without fear, even an informal one, and you cut your regulatory risk. This is more than good management theory. It's why OSHA's Voluntary Protection Programs (VPP) treat worker involvement as a core element ^[12].

What should you do when OSHA shows up for an inspection?

OSHA works inspections in priority order: imminent danger situations, fatalities and catastrophes, complaints and referrals, programmed inspections (planned for high-hazard industries), and follow-up inspections on previously cited violations ^[7].

When an inspector arrives, ask to see their credentials. You have the right to an opening conference where the inspector explains the reason for the visit and the standards to be inspected. You can and should have a company representative walk the whole inspection. An employee representative also has the right to accompany the inspector.

Don't guess or volunteer information beyond what's asked. Answer accurately and directly. If you don't know something, say so and offer to find out. Don't lie. It makes everything worse and can turn a serious violation into a willful one.

After the walkaround comes a closing conference, where the inspector runs through potential violations. This is your chance to add context: corrective actions already taken, what your training records show, whether the hazard came from an employee breaking your own written policy.

Get a citation? You have 15 working days to file a notice of contest. Miss that deadline and the citation and penalty become final. Many employers cut penalties through an informal conference with the OSHA area director before the 15-day window closes. Do this in almost every case.

Keep your records organized and reachable. An inspector asking for your Form 300 log shouldn't set off 45 minutes of searching.

How do workplace injury costs compare to the cost of compliance?

OSHA estimates employers pay roughly $1 billion per week in direct workers' compensation costs ^[13]. That number covers medical expenses and lost-wage payments. It leaves out indirect costs like lost productivity, hiring and training replacements, equipment damage, investigation time, and regulatory penalties.

The Liberty Mutual Workplace Safety Index, which runs on Bureau of Labor Statistics and workers' compensation data, consistently finds the most disabling workplace injuries cost U.S. employers more than $58 billion a year in direct costs alone ^[14]. Overexertion usually tops the list, followed by falls on the same level.

Most safety economists use a rough 4:1 ratio of indirect to direct costs, though the real ratio swings hard by injury type and industry. Nobody has clean data on this across all industries; the estimates trace back to older NIOSH and National Safety Council studies with real methodological limits. The direction isn't in dispute: injuries cost far more than the insurance claim suggests.

For a small business spending a few thousand dollars on written programs and training, the math is simple. One serious back injury with surgery can top $100,000 in direct costs, plus an experience modification rate bump that raises your workers' comp premiums for three years.

Compliance isn't charity. It's cheaper than the alternative.

Frequently asked questions

Does OSHA apply to businesses with fewer than 10 employees?

Yes. OSHA covers private employers with even one employee. The 10-employee threshold only affects injury recordkeeping: businesses with 10 or fewer employees in most industries are exempt from keeping OSHA 300, 300A, and 301 forms. Every employer, regardless of size, still has to follow applicable safety standards and report fatalities and severe injuries within OSHA's deadlines.

What is the General Duty Clause and when does OSHA use it?

Section 5(a)(1) of the OSH Act requires every employer to provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA uses it when no specific standard addresses a hazard. To cite under it, OSHA must show the hazard was recognized by the employer or industry, was causing or likely to cause serious harm, and a feasible means of abatement existed.

How long do you have to correct an OSHA violation after a citation?

The citation sets the abatement date, based on severity. Imminent danger situations require immediate correction. Serious violations typically get 30 days. Need more time? Request an extension in writing before the deadline. Missing the set date triggers a separate failure-to-abate penalty of up to $16,550 per day, which adds up fast on a hazard you can't fix quickly.

Is an OSHA 30-hour card required by law for supervisors?

No federal OSHA standard requires the 30-hour card for supervisors. Some states, cities, and private project owners (especially in construction) require it by contract. New York City's Local Law 196 is a well-known example, requiring site safety training cards for most construction workers. Check your state and any project-specific rules. The card shows training completion but is not itself a legal credential under federal law.

What records does OSHA require you to keep and for how long?

OSHA Form 300 logs and 300A summaries must be kept five years following the calendar year they cover. Form 301 incident reports also run five years. Medical records for employees exposed to toxic substances must be kept 30 years after employment ends (29 CFR 1910.1020). Training records vary by standard: some require three years, others say nothing about retention, but keeping them indefinitely is the safest move.

Can OSHA inspect without advance notice?

Yes. OSHA runs the vast majority of inspections unannounced. Giving an employer advance notice is a criminal offense under the OSH Act, punishable by a fine or up to six months imprisonment, unless OSHA itself authorizes it for a specific reason like scheduling at a remote site. When an inspector arrives you can request a brief delay to get your safety officer on-site, but you can't refuse entry.

What is the difference between a serious violation and a willful violation?

A serious violation is one with substantial probability of injury or illness, where the employer knew or should have known about the hazard. A willful violation is committed intentionally or with plain indifference to the law, meaning the employer knew the requirement and chose to ignore it. Willful violations carry penalties up to $165,514 each and, in fatality cases, possible criminal prosecution.

Do I need a safety program if I only have office workers?

Office-only employers face fewer hazard-specific standards, but you still have obligations. Emergency action plans, hazard communication (if any chemicals including cleaning products are present), electrical safety, and ergonomics all apply. You still have to report fatalities and severe injuries. A simple written program covering your actual hazards is far less work than a manufacturing program and still gives you real protection.

What is OSHA's free consultation program and who qualifies?

OSHA's On-Site Consultation Program provides free, confidential safety consultations to small and medium-sized businesses, prioritizing those with fewer than 250 employees at the site and no more than 500 company-wide. Consultants are separate from enforcement: they can't issue citations, and findings aren't shared with inspectors. Contact your state's program through OSHA.gov. Most states have a waitlist, so plan a few months ahead.

How does a workers' compensation claim relate to OSHA recordkeeping?

They're separate systems. Workers' comp is an insurance system run by states; OSHA recordkeeping is a federal regulatory requirement. One injury can trigger both. Not every workers' comp claim is OSHA recordable, and not every recordable case ends in a claim. A recordable case under 29 CFR 1904 includes work-related injuries or illnesses causing days away from work, restricted duty, medical treatment beyond first aid, or loss of consciousness.

What should a written hazard communication program include?

Under 29 CFR 1910.1200, your written HazCom program must describe how you handle container labeling, safety data sheets, and employee training. It must list the hazardous chemicals at your workplace. It must explain how you handle non-routine tasks involving hazardous chemicals and how you coordinate with contractors. The standard doesn't dictate a format. The program just has to address each element and stay available to employees during their shifts.

Are subcontractors covered under my OSHA compliance obligations?

Each employer is responsible for its own employees. But OSHA can cite multiple employers at a multi-employer worksite under its Multi-Employer Citation Policy. A controlling employer who creates a hazardous condition can be cited even if its own employees aren't exposed. A general contractor can be cited for failing to fix a hazard it knew about even when a subcontractor created it. On shared sites, address the hazards your work creates for everyone present.

Sources

1. OSHA, OSH Act of 1970 coverage overview: OSHA covers private-sector employers with at least one employee; self-employed sole proprietors, certain family farms, and workers covered by other federal agencies are exempt.
2. Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2023: BLS counted 5,283 fatal work injuries and 2.6 million non-fatal workplace injuries and illnesses in 2023.
3. OSHA, Top 10 Most Frequently Cited Standards FY2023: Hazard communication, lockout/tagout, and powered industrial trucks are consistently among the most frequently cited OSHA standards.
4. OSHA, 29 CFR 1910.38 Emergency Action Plans: A written emergency action plan is required for employers with more than 10 employees; smaller employers may communicate the plan orally.
5. OSHA, Recordkeeping Rule 29 CFR Part 1904: Employers with more than 10 employees in non-exempt industries must maintain OSHA Forms 300, 300A, and 301; all employers must report fatalities within 8 hours and inpatient hospitalizations, amputations, or eye losses within 24 hours.
6. OSHA, Field Operations Manual (FOM), CPL 02-00-163: OSHA's penalty calculation considers gravity, employer size, good faith, and history; employers with fewer than 25 employees may receive a 60% reduction from the maximum penalty.
7. OSHA, 29 CFR 1910.178 Powered Industrial Trucks: Forklift operators must be evaluated every three years and retrained after an accident, near miss, or observed unsafe operation under 29 CFR 1910.178.
8. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program serves small and medium-sized businesses; consultants cannot issue citations and findings are not shared with enforcement.
9. OSHA, State Plans overview: Twenty-two states and two territories run OSHA-approved state plans that must be at least as effective as the federal program under Section 18 of the OSH Act.
10. OSHA, OSHA Poster (It's the Law) requirements: All covered employers must post the OSHA Job Safety and Health poster in a conspicuous location; failure to post is a citable violation.
11. OSHA, Voluntary Protection Programs (VPP): OSHA's VPP emphasizes worker involvement as a core element of effective safety management systems.
12. OSHA, Business Case for Safety and Health: OSHA estimates employers pay roughly $1 billion per week in direct workers' compensation costs.
13. Liberty Mutual Workplace Safety Index: The most disabling workplace injuries cost U.S. employers more than $58 billion annually in direct costs, with overexertion the top category.