Workplace safety laws: what every employer must know

Last updated 2026-07-09

What is the main federal workplace safety law?

The Occupational Safety and Health Act of 1970, signed December 29, 1970, is the foundation of workplace safety law in the United States ^[1]. It created three things at once: OSHA (the enforcement agency), NIOSH (the research arm), and the Occupational Safety and Health Review Commission (the independent tribunal for contested citations).

The Act applies to most private-sector employers and their workers in all 50 states, the District of Columbia, Puerto Rico, and other U.S. territories ^[1]. Federal government workers are covered separately under Section 19, which requires federal agencies to run their own safety programs. State and local government employees are covered only if their state operates an OSHA-approved State Plan.

The law's core obligation on employers is one sentence. Section 5(a)(1) says employers must furnish "employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[1]. That sentence, called the General Duty Clause, is OSHA's fallback authority for every hazard that doesn't have its own specific standard.

For a plain-language breakdown of what OSHA is and how it's structured, read that alongside this article.

Which employers and workers does OSHA cover?

If you run a private business with at least one employee, OSHA almost certainly covers you ^[2]. The agency has jurisdiction over 8.1 million worksites employing roughly 130 million workers ^[2]. The exceptions are narrow: self-employed individuals with no employees, family farms that employ only immediate family members, and workplaces already regulated by another federal agency for safety (mines under MSHA, certain aviation operations under FAA).

Temporary workers are covered too, and OSHA has treated this as a priority enforcement area since 2013 ^[2]. Both the staffing agency and the host employer share responsibility for a temp worker's safety. The host controls the worksite hazards. The staffing agency carries the training and recordkeeping obligations.

Independent contractors are not your employees. But if your workplace creates hazards for them, the General Duty Clause can still reach you, and courts have read that reach broadly.

State Plan states add a layer. Twenty-two states and 7 territories operate OSHA-approved State Plans that cover private and public sector workers ^[3]. If you're in California (Cal/OSHA), Michigan (MIOSHA), or Washington (WISHA), your regulator is the state agency, not federal OSHA, though the state plan must be "at least as effective" as the federal standard ^[3].

What specific OSHA standards do employers have to follow?

OSHA standards live in Title 29 of the Code of Federal Regulations. Three main parts carry most of the weight:

Part	Scope	Examples
29 CFR 1910	General Industry	Hazard communication, lockout/tagout, PPE, electrical, fire exits
29 CFR 1926	Construction	Fall protection, scaffolding, trenching, cranes
29 CFR 1915	Maritime	Shipyard employment, longshoring

General industry (1910) covers manufacturers, warehouses, retail, offices, healthcare, restaurants, and most other businesses that don't fit the construction or maritime buckets. Construction (1926) kicks in any time you're doing building, alteration, repair, or demolition work, even if that isn't your main line.

A handful of standards come up over and over for small businesses.

29 CFR 1910.1200 is the hazard communication standard. It requires Safety Data Sheets, container labels, and training for any workplace that has chemicals ^[4]. If your shop uses cleaning products, lubricants, paints, or solvents, this one applies to you.

29 CFR 1910.147 is the control of hazardous energy standard, better known as lockout tagout. Any time a worker services or maintains equipment that could unexpectedly energize, this rule requires documented energy control procedures for each machine ^[9].

29 CFR 1910.132 through 1910.140 covers personal protective equipment: the hazard assessment that determines what PPE is needed, then eye, face, head, foot, and hand protection, up through respiratory protection under 29 CFR 1910.134.

29 CFR 1910.178 covers powered industrial trucks. If someone drives a forklift at your facility, forklift certification training is a legal requirement, not a nice-to-have.

For construction, 29 CFR 1926.501 on fall protection is the most-cited standard in the entire OSHA universe, year after year ^[8]. Any walking or working surface six feet or more above a lower level in construction requires fall protection.

What are employer rights and responsibilities under OSHA?

Employers carry clear obligations. They also have real rights that many small business owners never learn about.

On the obligations side, the law requires you to ^[2]:

• Keep the workplace free from recognized serious hazards (General Duty Clause)
• Comply with all applicable OSHA standards
• Make sure employees have and use required PPE
• Post the OSHA "Job Safety and Health: It's the Law" poster (free from OSHA) somewhere prominent
• Report fatalities to OSHA within 8 hours, and in-patient hospitalizations, amputations, or eye losses within 24 hours
• Maintain injury and illness records on OSHA Forms 300, 300A, and 301 if you have 11 or more employees and are not in a partially exempt industry
• Not retaliate against workers who report hazards or exercise their safety rights

On the rights side, you can ^[2]:

• Ask for credentials from any OSHA compliance officer who shows up for an inspection
• Accompany the inspector on the walkaround
• Explain context and hand over documentation during the inspection
• Contest any citation within 15 working days of receiving it
• Request an informal conference with the OSHA Area Director before the contest deadline

The 15-working-day contest window is hard. Miss it and the citation becomes a final order by operation of law, valid or not, and you lose the right to argue about it.

What are worker rights under workplace safety laws?

Section 11(c) of the OSH Act protects workers from retaliation for raising safety concerns, filing complaints, taking part in inspections, or refusing work they reasonably believe poses imminent danger ^[1]. OSHA enforces this, and workers have 30 days from the retaliatory act to file a complaint.

Beyond anti-retaliation, workers have the right to ^[2]:

• Request an OSHA inspection if they believe hazards exist
• Take part in inspections and speak privately with the OSHA inspector
• See copies of their employer's OSHA 300 log
• Access their own medical and exposure records under 29 CFR 1910.1020
• Get information and training about hazards in a language they understand

OSHA's anti-retaliation reach goes well past the OSH Act. The agency enforces whistleblower provisions in more than 20 federal statutes, covering industries from trucking (Surface Transportation Assistance Act) to finance (Dodd-Frank).

Workers can refuse work they genuinely believe poses imminent danger of death or serious injury. That right is narrower than most people assume. OSHA's guidance says the danger must be immediate, more than theoretical, and the worker must have no reasonable alternative other than to refuse ^[2]. Courts have sided with employers when the refusal rested on speculative risk.

How much do OSHA violations cost?

OSHA raises its maximum penalties every year for inflation. As of January 2024, the structure is ^[5]:

Violation Type	Maximum Penalty (2024)
Serious	$16,550 per violation
Other-than-Serious	$16,550 per violation
Willful or Repeated	$165,514 per violation
Failure to Abate	$16,550 per day past abatement date

Those are maximums. OSHA's Field Operations Manual allows reductions for size (employers with 1 to 25 workers get up to 60% off), good faith, and history ^[12]. In practice, a small employer with a clean record getting a first serious citation for something like a missing machine guard often lands between $4,000 and $6,000 after reductions. Willful is a different animal: inspectors reserve it for cases where the employer knew about the hazard and made a conscious choice not to fix it.

Criminal penalties exist too, though they're rare. A willful violation that kills a worker is a misdemeanor under the OSH Act, with a maximum $10,000 fine and up to six months in prison. State prosecutors have sometimes brought manslaughter charges under state criminal codes, which carry far heavier consequences.

The Bureau of Labor Statistics counted 5,283 fatal work injuries in 2023 ^[6]. The cost of workplace injuries and illnesses to employers runs into the hundreds of billions a year once you add lost productivity, workers' comp, and litigation.

Do small businesses have to follow the same OSHA rules as large companies?

Mostly yes, with a few exceptions worth knowing.

Recordkeeping is the biggest carve-out. Employers with 10 or fewer employees are exempt from routine OSHA injury and illness recordkeeping under 29 CFR 1904.1, though they still have to report fatalities and severe injuries to OSHA within the required windows ^[7]. Employers in certain low-hazard industries (retail, finance, insurance, real estate) are partially exempt from the 300 log regardless of size, under Appendix A to Subpart B of 29 CFR 1904.

Penalty reductions are real for small shops. OSHA's gravity-based system gives a 60% reduction for employers with 1 to 25 workers and 40% for those with 26 to 100 ^[12]. OSHA also runs a free On-Site Consultation Program for small and medium businesses, separate from enforcement ^[10].

That consultation program is worth understanding. A consultant visits, finds your hazards, and gives you time to fix them. What they find cannot be used against you in an enforcement inspection ^[10]. If you're a small manufacturer or contractor who has never had a formal safety review, this is genuinely useful, and it costs nothing.

On the substance of the standards, though, size buys you no relief. A five-person machine shop must comply with 29 CFR 1910.147 (lockout tagout) the same as a 5,000-person plant. Hazard communication, fall protection, PPE hazard assessments: all apply regardless of headcount.

How do state workplace safety plans differ from federal OSHA?

Twenty-nine states and territories operate OSHA-approved State Plans ^[3]. Of those, 22 cover both private and state and local government workers. The other seven (Connecticut, Illinois, Maine, New Jersey, New York, the U.S. Virgin Islands, and the District of Columbia) cover only public-sector workers, so private employers in those states answer to federal OSHA.

State Plans must be "at least as effective" as federal OSHA, and they're free to go further. Cal/OSHA is the clearest example. California's Injury and Illness Prevention Program (IIPP) requirement under California Labor Code Section 6401.7 has no direct federal equivalent, and it requires every California employer to keep a written safety program regardless of size or industry ^[3]. California also has heat illness prevention standards that predate and exceed anything federal.

Here's the practical rule for a small business: find out who your regulator is before you assume you know the rules. If you're in a State Plan state, go to that state agency's website, not OSHA.gov, for your standards. The state regulator is who shows up for inspections, and the state's standards, penalties, and procedures can differ from the federal versions.

States also move faster than federal OSHA on new hazards. Several State Plan states adopted workplace violence prevention standards for healthcare years before federal OSHA finished its rulemaking.

What written safety programs does OSHA require?

OSHA requires written programs for specific standards, not one catch-all safety manual. The standards that spell out a written plan include ^[4][7][9]:

• Hazard Communication (29 CFR 1910.1200): written hazard communication program
• Lockout/Tagout (29 CFR 1910.147): written energy control procedures for each piece of equipment
• Respiratory Protection (29 CFR 1910.134): written respiratory protection program
• Emergency Action Plan (29 CFR 1910.38): required for employers with more than 10 employees, covering evacuation routes and procedures
• Fire Prevention Plan (29 CFR 1910.39): similar written requirement
• Bloodborne Pathogens (29 CFR 1910.1030): written Exposure Control Plan for employers with occupational exposure
• Hearing Conservation (29 CFR 1910.95): written program when a hearing conservation program is required
• Personal Protective Equipment (29 CFR 1910.132): written hazard assessment certification

Beyond OSHA's explicit list, Cal/OSHA and several other State Plan states require a written Injury and Illness Prevention Program (IIPP) that ties everything together. Even in a federal OSHA state, one written safety program that documents your hazards, your procedures, and your training earns its keep. It's your evidence of good faith in an inspection, and it's how new employees learn the rules.

Building all of these from scratch eats days. SafetyFolio's safety program generator walks you through the questions specific to your industry and produces the required written programs in about 15 minutes.

For the OSHA training that pairs with these written programs, each standard names its own required training content and timing.

What recordkeeping and reporting does the law require?

OSHA's recordkeeping rule (29 CFR 1904) applies to employers with 11 or more employees who are not in a partially exempt industry ^[7]. If you're covered, you keep three forms:

• OSHA Form 300: the Log of Work-Related Injuries and Illnesses, maintained through the year
• OSHA Form 300A: the Summary, posted from February 1 through April 30 each year even if nobody got hurt
• OSHA Form 301: the Injury and Illness Incident Report (or an equivalent), completed within 7 calendar days of each recordable case

A recordable case is any work-related injury or illness that results in days away from work, restricted duty, transfer to another job, medical treatment beyond first aid, loss of consciousness, or diagnosis of a significant injury by a healthcare professional ^[7].

Separate from the 300 log, every employer reports severe incidents directly to OSHA regardless of size or industry ^[2]:

• Fatalities: within 8 hours
• In-patient hospitalization: within 24 hours
• Amputation: within 24 hours
• Loss of an eye: within 24 hours

You can report by calling 1-800-321-OSHA, calling your local OSHA Area Office, or using OSHA's online reporting form.

Electronic submission has grown. Under the Improve Tracking of Workplace Injuries and Illnesses rule, employers with 100 or more employees in designated high-hazard industries must submit their 300 log data electronically each year ^[7]. Employers with 20 to 99 employees in high-hazard industries submit their 300A summary data. The deadline is March 2 for the prior year's data.

For a walk through the forms, the incident report article covers what counts as recordable and how to fill out the 301.

What happens during an OSHA inspection?

OSHA inspections start four ways: a reported fatality or severe injury, a worker complaint, a targeted programmed inspection (OSHA runs national and regional emphasis programs aimed at high-hazard industries like logging, confined spaces, and fall hazards), or a follow-up to a prior citation.

The inspection has three phases. The opening conference is where the compliance officer presents credentials, explains why they're there, and describes the process. The walkaround is the physical inspection of the site. The closing conference is where the inspector sums up what they found.

You have the right to walk with the inspector the whole time. Most experienced safety managers do, taking their own notes and photos next to the inspector's. Don't try to hide hazards. That turns a bad day into a much worse one. Do give context: if you already ordered a machine guard that arrives next week, say so, with the purchase order in hand.

After the inspection, OSHA usually issues citations within 6 months. Each citation names the violated standard, describes the alleged violation, states the proposed penalty, and sets an abatement date. You have 15 working days to contest.

The OSHA 30 course, which the OSHA 30 training article covers in detail, is built to give managers and supervisors the knowledge to spot and fix hazards before an inspector ever finds them.

How do I build a safety program that actually meets these legal requirements?

Start with a hazard inventory. Walk every square foot of your operation and list every real hazard: chemical exposures, machines with moving parts, work at heights, electrical panels, heavy lifting, forklifts, whatever you've got. This isn't box-checking. It's the foundation that tells you which specific OSHA standards apply to your workplace.

Once you know your hazards, pull the matching CFR sections. Each standard tells you exactly what's required: what the written program must contain, what training must cover, what records you keep. Treat the standards as your checklist.

For a small business with no safety staff, the fastest legitimate path is OSHA's free On-Site Consultation Program, available in every state and territory ^[10]. These consultants are separate from enforcement, they don't share findings with inspectors, and they'll tell you precisely what your operation needs.

If you need the written programs fast, a tool like SafetyFolio's safety program generator builds them for your industry in a fraction of the time it takes to draft from scratch. That helps an owner who has no safety director but needs to be inspection-ready.

The programs have to stay alive: updated when processes change, reviewed after incidents, and used in actual training. An outdated program gathering dust is almost worse than none in an inspection, because it proves you knew what was required and let it slide.

Frequently asked questions

What year was the Occupational Safety and Health Act passed?

Congress passed the Occupational Safety and Health Act in 1970, and President Nixon signed it on December 29, 1970. The law took effect in April 1971. It created OSHA as the enforcement agency, NIOSH as the research agency, and the Occupational Safety and Health Review Commission to hear contested citations. The Act remains the primary federal workplace safety law more than 50 years later.

Are employers with fewer than 10 employees exempt from OSHA?

No. OSHA's safety standards apply to nearly all private employers regardless of size. The main exception for small employers is recordkeeping: businesses with 10 or fewer employees are exempt from maintaining the OSHA 300 injury and illness log under 29 CFR 1904.1. But every employer, including one with a single worker, must still report fatalities within 8 hours and severe injuries within 24 hours, and must follow every applicable safety standard.

What is the General Duty Clause and when does OSHA use it?

The General Duty Clause is Section 5(a)(1) of the OSH Act, requiring employers to keep a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA uses it when a hazard exists but no specific standard covers it. To issue a General Duty Clause citation, OSHA must show the hazard was recognized by the industry, was causing or likely to cause serious harm, and a feasible means of abatement existed.

What is the difference between a serious violation and a willful violation?

A serious violation exists when the hazard could cause death or serious physical harm and the employer knew or should have known about it. The maximum penalty is $16,550. A willful violation means the employer knew the condition violated a standard and chose not to correct it. Maximum penalty is $165,514 per violation. Willful citations get named in OSHA press releases and can support criminal referrals in fatality cases.

How long does an employer have to fix an OSHA citation?

Each OSHA citation carries an abatement date set by the compliance officer based on the hazard's severity and how long a fix reasonably takes. Imminent dangers may require immediate action. Serious violations typically get 30 to 90 days. You can petition OSHA for an extension if you're making good-faith progress but need more time. Missing the deadline adds a penalty of up to $16,550 per day past the abatement date.

Can a worker refuse to do dangerous work without being fired?

Workers are protected from retaliation for refusing work they reasonably believe poses imminent danger of death or serious injury, under Section 11(c) of the OSH Act. The protection is not absolute. The danger must be immediate, the worker must have asked the employer to fix it without success, and there must be no reasonable alternative. Courts have not protected refusals based on speculative concerns. A worker fired for a protected refusal has 30 days to file a retaliation complaint with OSHA.

Which states have their own workplace safety laws?

Twenty-nine states and territories operate OSHA-approved State Plans. The 22 that cover both private and public employees include California, Michigan, Washington, Oregon, and North Carolina. Seven cover only public employees (Connecticut, Illinois, Maine, New Jersey, New York, the Virgin Islands, and D.C.), leaving private employers in those states under federal OSHA. State Plans must meet or beat federal OSHA standards and can impose stricter rules, as California does with its IIPP mandate.

What injuries and illnesses must be recorded on the OSHA 300 log?

A work-related case is recordable if it results in days away from work, restricted duty or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury diagnosed by a healthcare professional. Employers with 11 or more employees in non-exempt industries must log these cases within 7 calendar days on OSHA Form 300, complete a Form 301, and post the annual summary (Form 300A) from February 1 through April 30.

Does OSHA cover remote workers or employees who work from home?

OSHA's position, stated in a 2000 letter of interpretation, is that it will not inspect home offices and holds employers to a limited standard for home-based workers. Employers don't have to inspect employees' home offices, but they're responsible for equipment and materials they provide. For workers at client sites or in the field rather than a fixed office, normal OSHA coverage applies. This area of law is still developing, and State Plan states may differ.

What training does OSHA require for new employees?

OSHA has no single universal new-hire training standard. Training requirements sit inside each specific standard. Hazard communication (29 CFR 1910.1200) requires training before workers touch hazardous chemicals. Lockout/tagout requires training before workers service equipment. The training must cover the specific hazards the employee will face, in a language they understand. The OSHA 10-hour course for workers and 30-hour course for supervisors cover general principles but don't replace standard-specific training.

How does OSHA decide which businesses to inspect?

OSHA prioritizes inspections in this order: imminent danger situations, fatality and severe injury investigations, formal worker complaints, referrals from other agencies, and programmed inspections targeting high-hazard industries. National Emphasis Programs and Local Emphasis Programs drive the programmed inspections, aiming resources at industries with high injury rates. A business with no fatalities or complaints can still get inspected if it's in a targeted industry like logging, trenching, fall-hazard work, or heat-intensive environments.

What does OSHA's free consultation program actually offer?

OSHA's On-Site Consultation Program, funded by OSHA but run separately by state agencies, sends safety professionals to your workplace at no charge to find hazards, review your written programs, and recommend fixes. Consultants cannot share findings with OSHA enforcement, and participation cannot trigger an inspection. Employers who take part and fix identified hazards can apply for OSHA's Safety and Health Achievement Recognition Program (SHARP), which brings an exemption from programmed inspections.

What are the most commonly cited OSHA standards?

In fiscal year 2023, OSHA's top five most cited standards were fall protection in construction (29 CFR 1926.501), hazard communication (29 CFR 1910.1200), ladders in construction (29 CFR 1926.1053), respiratory protection (29 CFR 1910.134), and powered industrial trucks (29 CFR 1910.178). Fall protection has topped the list for over a decade, running thousands of citations a year.

What is an OSHA letter of interpretation and is it legally binding?

OSHA letters of interpretation are official agency responses to specific questions about how a standard applies to a particular situation. They aren't binding regulations, but courts and the Occupational Safety and Health Review Commission give them significant weight as evidence of how the agency reads its own rules. They're posted publicly on OSHA.gov and help you figure out how a standard applies to an unusual piece of equipment or work practice.

Sources

1. U.S. Department of Labor, Occupational Safety and Health Act of 1970: The OSH Act was signed December 29, 1970; Section 5(a)(1) requires employers to furnish a workplace free from recognized hazards; Section 11(c) protects workers from retaliation
2. OSHA, Worker Rights and Employer Responsibilities: OSHA covers 8.1 million worksites and 130 million workers; employers must post the OSHA poster; fatalities must be reported within 8 hours, severe injuries within 24 hours
3. OSHA, State Plans: 29 states and territories operate OSHA-approved State Plans; 22 cover private and public sector workers; state plans must be at least as effective as federal OSHA
4. OSHA, Hazard Communication Standard (29 CFR 1910.1200): 29 CFR 1910.1200 requires a written hazard communication program, Safety Data Sheets, container labels, and training for workplaces with hazardous chemicals
5. OSHA, OSHA Penalties: As of 2024, serious violations carry a maximum penalty of $16,550; willful or repeated violations carry a maximum of $165,514
6. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries in 2023: 5,283 fatal occupational injuries occurred in the United States in 2023
7. OSHA, Recordkeeping Rule (29 CFR 1904): Employers with 10 or fewer employees are exempt from routine 300 log recordkeeping under 29 CFR 1904.1; the 300A summary must be posted February 1 through April 30; electronic submission required for employers with 100+ employees in high-hazard industries by March 2
8. OSHA, Commonly Used Statistics (Top 10 Most Cited Standards FY2023): Fall protection (29 CFR 1926.501) was the most cited OSHA standard in FY2023; hazard communication (29 CFR 1910.1200) and respiratory protection (29 CFR 1910.134) were also in the top five
9. OSHA, Lockout/Tagout (29 CFR 1910.147): 29 CFR 1910.147 requires written energy control procedures for each piece of equipment where workers service or maintain machinery that could unexpectedly energize
10. OSHA, On-Site Consultation Program: OSHA's On-Site Consultation Program is free, confidential, and separate from enforcement; consultants cannot share findings with OSHA inspectors; available in every state and territory
11. OSHA, Field Operations Manual (FOM): OSHA's Field Operations Manual governs penalty reductions for size, good faith, and history; employers with 1-25 workers receive a 60% size reduction