OSHA 300 log requirements for businesses under 25 employees

Last updated 2026-07-09

What are the OSHA 300 log requirements for small businesses?

The OSHA 300 log is a running record of every work-related injury and illness at your workplace. The system has three forms: the OSHA 300 (the log itself), the OSHA 300A (the annual summary you post), and the OSHA 301 (the incident report for each case). Whether you need all three, some, or none comes down almost entirely to headcount.

Here is the clean version. If you had 10 or fewer employees at every point during the year, you are fully exempt from routine recordkeeping under 29 CFR 1904.1 ^[1]. You still report fatalities and severe injuries to OSHA directly, but you keep no 300 log at all.

If you have 11 to 24 employees, you keep the 300 log and file 301 incident reports, but you do not have to post the 300A summary each February under 29 CFR 1904.32 ^[2]. That posting exemption is the one difference that actually matters for companies in this size band.

Cross 25 employees and the full rule applies. You maintain the 300 log, complete a 301 for each recordable case, post the 300A from February 1 through April 30 every year, and (if you are in a designated industry) submit your data to OSHA's Injury Tracking Application. Size is measured by your peak headcount at any point during the calendar year, not your average. One busy week can change your obligation for the whole year.

Who is completely exempt from keeping the OSHA 300 log?

Two separate exemptions can get you out of routine recordkeeping, and they work independently. Either one alone is enough.

The first is the small-employer exemption. 29 CFR 1904.1 states: "If your company had 10 or fewer employees at all times during the last calendar year, you do not need to keep OSHA injury and illness records" ^[1]. That is a hard line. Peak at 11 employees for one week and you lose the exemption for that year.

The second is the low-hazard industry exemption. OSHA lists industries classified as low-hazard by their NAICS code, and those businesses are exempt from routine recordkeeping at any size, unless OSHA or the Bureau of Labor Statistics tells them otherwise. The list covers many retail, finance, insurance, real estate, and service industries ^[3]. A dentist's office with 40 employees can still be exempt on industry alone.

To check, look up your NAICS code against OSHA's recordkeeping exemption list at osha.gov ^[3]. The answer comes back immediately. If your industry is not on the exempt list, size is the only question left.

Here is what trips up small employers. Exempt from recordkeeping is not exempt from reporting. Every employer, any size, any industry, must report a work-related fatality to OSHA within 8 hours and any in-patient hospitalization, amputation, or eye loss within 24 hours under 29 CFR 1904.39 ^[4]. Miss that call and you have a serious violation with real money attached.

What counts as a recordable injury or illness on the OSHA 300 log?

This is where owners get tripped up. Not every injury goes on the log. A case is recordable when a work-related injury or illness results in any of these: days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, a significant injury or illness diagnosed by a healthcare professional, or a work-related fatality ^[2].

First aid is out. OSHA defines first aid in 29 CFR 1904.7 as things like cleaning a wound, using non-prescription medication at non-prescription strength, and applying bandages ^[9]. Stitches or a prescription ointment from urgent care? Recordable. Rinse and a Band-Aid? Not recordable.

Here is a real example. An employee cuts their hand on a box cutter. You rinse it, apply a bandage, send them back to work. Not recordable. Same cut, but they go to a clinic and get three stitches. Recordable, even if they are back the next day with no restrictions.

Work-relatedness is the other tricky part. An injury is work-related if an event or exposure in the work environment caused it, contributed to it, or significantly aggravated a pre-existing condition. There are exceptions for purely personal tasks and certain mental health situations, but the default presumption is simple: if it happened at work, it is work-related unless an exception clearly applies ^[2].

For what triggers a full incident report, including the field-by-field OSHA 301 requirements, that article walks through it.

Do businesses with under 25 employees have to submit data to OSHA electronically?

Almost certainly not. The electronic submission rule has its own size and industry thresholds, and they sit well above the basic recordkeeping thresholds. If you have under 25 employees, you are below both electronic filing triggers.

Under the electronic recordkeeping rule that took effect in 2024 (29 CFR 1904.41), establishments with 100 or more employees in designated high-hazard industries must submit their full 300 log data each year ^[5]. Establishments with 20 to 249 employees in those same high-hazard industries submit their 300A summary data. Establishments with 250 or more employees in any Part 1904 industry also submit 300A data ^[5].

So where does that leave you? With no electronic filing obligation, unless OSHA or BLS sends you a specific survey request. They do that sometimes for data collection. If one lands on your desk, you are legally required to respond.

The portal is OSHA's Injury Tracking Application (ITA) at osha.gov/injuryreporting ^[10]. If you ever grow past 100 employees in a high-hazard industry, the annual deadline is March 2 for the prior calendar year's data ^[5].

What is the OSHA 300A summary and does a small business have to post it?

The 300A is a one-page annual summary of your injury and illness totals from the 300 log for the prior calendar year. It shows total cases, days away from work, days of restriction, and the equivalent number of full-time workers so OSHA can calculate rates.

Employers with 25 or more employees who are not in a low-hazard exempt industry must post the completed 300A somewhere visible from February 1 through April 30 every year ^[2]. A company executive signs it, not the safety manager.

If you have 11 to 24 employees, you skip the posting. You still keep the 300 log and 301 forms ready in case OSHA asks. And OSHA can ask at any time. You generally have four business hours to produce records for an inspector, and by the end of the next business day for employees and their representatives ^[2].

Four business hours. That is the whole window. Disorganized or missing logs are exactly where a small employer gets into trouble during an inspection.

Employees have rights here too. Any current or former employee, their personal representative, or a union rep can request copies of the 300 log for an establishment where they work or worked. You can remove names from certain sensitive cases (sexual assaults, mental illness, HIV, and a few others) to protect privacy, but you cannot refuse the request ^[2].

How long do you have to keep OSHA 300 records?

Five years. You keep your 300 log, 300A summary, and 301 incident reports for five years following the end of the calendar year they cover ^[2]. Your 2024 records stay on file through December 31, 2029.

During those five years you also update records when you learn new information. If an injury that looked minor in January turns into surgery in October, you go back and update the 300 log entry for that case. OSHA calls these "updates to previously recorded cases" and requires them for the full retention period ^[2].

Paper is fine. Electronic is fine, as long as you can produce the records within the required window during an inspection. Plenty of small employers run a simple spreadsheet and it works. The one requirement is that your data fields match what OSHA asks for on the official form.

One practical warning. Do not store your only copy somewhere a fire or flood could take it out. An employer who loses five years of records in a disaster and cannot rebuild them is in a genuinely bad spot when OSHA calls.

What happens if a small business does not keep the OSHA 300 log when it should?

It gets expensive, and fast. OSHA treats recordkeeping violations as more than paperwork because the agency uses injury data to decide where to inspect.

OSHA can cite recordkeeping failures as "other-than-serious" violations, which carry penalties up to $16,131 per violation as of 2024 ^[6]. Willful or repeated violations run up to $161,323 per violation ^[6]. Falsify records or fail to record injuries to game your rates, and OSHA can treat each missing entry as its own violation.

Run the math for a 15-employee shop that should have kept records and did not. An inspection that finds 10 unrecorded cases over three years could produce $160,000 or more in proposed penalties. That is not a hypothetical. OSHA publishes its enforcement cases, and recordkeeping citations show up regularly against small and midsize employers.

There is a floor of good news. OSHA offers good-faith credit that can cut penalties, and first-time violations for genuinely small employers sometimes land lower. But doing nothing carries real risk. Getting your recordkeeping right now costs nothing. Fixing it after an inspection costs a lot.

How do you actually fill out the OSHA 300 log correctly?

The 300 log has columns for case number, employee name, job title, date of injury, location, description of the injury, and checkboxes to classify each case as death, days away, restriction or transfer, or other recordable. You also track the number of days away and days restricted ^[2].

Three things trip people up. First, you must enter a case within seven calendar days of learning that a recordable case occurred ^[2]. You do not wait for year-end. If a Monday doctor visit reveals a recordable case, you have until the following Monday to log it.

Second, the musculoskeletal disorder column (column M on the current form). You check it when a healthcare professional diagnoses an MSD. This does not change whether the case is recordable. OSHA just tracks MSD rates separately.

Third, privacy cases. For certain sensitive injuries (sexual assault, HIV/AIDS, mental illness, tuberculosis, and needle-sticks involving blood-borne pathogens, among others), you write "privacy case" in the name column instead of the employee's name. You keep a separate confidential list linking those case numbers to names ^[2].

Download the official forms free from osha.gov/recordkeeping. No fee, no required software. Fill them in on a computer or print and complete by hand.

Does your state's OSHA plan change any of these requirements?

It can. Twenty-two states and two territories run their own OSHA-approved State Plans instead of operating under federal OSHA ^[7]. State plans must be at least as effective as federal OSHA, and some go further.

California's Cal/OSHA is the clearest example. It requires most employers to keep a written Injury and Illness Prevention Program (IIPP), something federal OSHA does not impose on most private employers ^[7]. Washington State's L&I uses its own recording forms. Some state plans set different posting deadlines or define recordable cases a little differently.

The practical move: if you are in a state-plan state, go to that state's occupational safety agency website and confirm whether extra requirements apply. Federal OSHA keeps a map and directory of all state plans at osha.gov/stateplans ^[7]. Checking once a year is enough for most small businesses, because these rules move slowly.

For most employers in state-plan states, the recordkeeping rules are either identical to federal OSHA's or differ only in small details like form numbers. But you want to know that before an inspection, not during one.

What is the fastest way for a small business to set up a compliant recordkeeping system?

Honestly, this system is not complicated once you know the rules. For a business with 11 to 24 employees, you need three things: a blank 300 log ready at the start of each calendar year, a stack of 301 forms to complete within seven days of any recordable case, and a filing system that keeps everything accessible for five years.

Here is the whole workflow. Download the official forms from osha.gov/recordkeeping. Keep the log on a computer so you can update it easily. When an injury happens, complete the 301 within seven calendar days. At year-end, tally your totals on the 300A. If posting applies to you, print it, get an executive signature, and hang it February 1. Store everything for five years. Done.

The real gap for most small businesses is not the forms. It is the written safety program that prevents the injuries in the first place. An employer who records injuries well but has no formal prevention program is still exposed to general duty clause citations. If that foundation is your next step, SafetyFolio's safety program generator can build a customized written program in about 15 minutes instead of the 15 hours it takes to draft one cold.

For the training that supports your written program, the OSHA training article covers what OSHA actually mandates by standard, which is a different question from what is merely good practice.

What are the reporting deadlines when a serious injury occurs?

Recording an injury and reporting an injury are two different obligations, and small business owners mix them up constantly.

Recording is internal. It is what you do on your own paperwork. Reporting is when you call or go online to notify OSHA of a specific severe event. Reporting applies to every employer, with no exception for size or industry.

29 CFR 1904.39 requires you to report any work-related fatality within 8 hours of learning about it ^[4]. Any work-related in-patient hospitalization (even one person), amputation, or eye loss must be reported within 24 hours ^[4]. Report by calling 1-800-321-OSHA or using the online tool at osha.gov.

The eight-hour window for fatalities is tight. If an employee dies at a hospital three days after a work accident, the clock starts when you learn of the death, not when the accident happened.

For injuries that do not involve hospitalization, amputation, or eye loss, there is no immediate reporting requirement. Those go on your 300 log within seven days and that is it, unless OSHA is already on-site.

Set an internal rule: the moment anyone hears about a hospitalization or amputation, someone starts the clock and makes the call. Do not wait to gather more facts. You can give OSHA a preliminary report and follow up with details later.

How does the OSHA 300 log connect to your broader safety program?

The 300 log is more than a compliance chore. It is the best data most small businesses have on what is actually hurting their workers.

Pull your log at the end of year two and notice that four of your six recordable cases came from the same workstation, or the same task, or the same shift. That is something you can fix. Injury data tells you where to aim your prevention effort. Without the log, you are guessing.

The recordkeeping rule is built on that logic. The Bureau of Labor Statistics publishes the Survey of Occupational Injuries and Illnesses (SOII), which draws on 300 log data from hundreds of thousands of employers to produce the national injury and illness rates you see quoted in the news ^[8]. Private industry employers reported 2.8 million nonfatal workplace injuries and illnesses in 2022, according to BLS data ^[8].

For your own shop, tracking your injury rate lets you compare against your industry's average. A rate well above your NAICS average raises your odds of a programmed OSHA inspection. Staying below it is genuinely protective.

Your written incident report process feeds the 300 log. A good investigation feeds your safety improvements. The log is the connective tissue between something going wrong and what you do about it. Treat it that way and it earns back far more than the time it takes to keep.

If you need a written program to formalize any of this, SafetyFolio's generator is worth a look before your next inspection cycle.

Frequently asked questions

Does a business with 10 employees have to keep an OSHA 300 log?

No. Under 29 CFR 1904.1, employers with 10 or fewer employees at all times during the prior calendar year are fully exempt from routine OSHA injury recordkeeping. You still must report fatalities within 8 hours and in-patient hospitalizations, amputations, or eye losses within 24 hours. The exemption is based on your peak headcount during the year, not your average.

Does a business with 15 employees have to keep an OSHA 300 log?

Yes, if your industry is not on OSHA's low-hazard exemption list. Employers with 11 to 249 employees who are not in an exempt industry must keep the 300 log and complete 301 incident reports for each recordable case. You do not post the 300A annual summary, a requirement that kicks in at 25 employees. Your records must be available to OSHA within four business hours of a request.

What industries are exempt from OSHA 300 log requirements?

OSHA exempts certain low-hazard industries from routine recordkeeping by NAICS code. These generally include many retail, finance, insurance, real estate, and personal services businesses. The full list is at osha.gov under the recordkeeping rule. Being on the exempt list means no 300 log at any company size, unless OSHA or BLS specifically notifies you otherwise. Check your exact NAICS code to be sure.

How do you calculate the number of employees for the OSHA recordkeeping exemption?

OSHA uses your peak number of employees at any point during the prior calendar year. Part-time, seasonal, and temporary workers all count if you controlled their work. If you had 10 employees January through November but hired 2 seasonal workers in December, you peaked at 12 and the 10-or-fewer exemption does not apply that year. Independent contractors you did not supervise day-to-day generally do not count.

Can employees request to see the OSHA 300 log?

Yes. Current and former employees, their personal representatives, and union representatives have the right to request copies of the 300 log for any establishment where they work or worked. You must provide access by the end of the next business day after the request. For privacy cases involving sensitive injuries, you can substitute 'privacy case' for the employee's name, but you cannot refuse the overall request.

What is the penalty for not keeping an OSHA 300 log when required?

As of 2024, OSHA other-than-serious violations carry penalties up to $16,131 per violation, and willful or repeated violations can reach $161,323 per violation. Each unrecorded case can be cited separately. An employer missing multiple years of records could face substantial total penalties. Recordkeeping violations are also a red flag that can trigger a broader inspection of your safety program.

Do I have to report every workplace injury to OSHA?

No, not every injury. You report to OSHA directly only when someone dies (within 8 hours) or is hospitalized as an inpatient, loses a limb, or loses an eye from a work-related incident (within 24 hours). Other recordable injuries go on your internal 300 log but are not reported to OSHA unless the agency requests your data or shows up for an inspection.

Is a first aid injury recordable on the OSHA 300 log?

No. OSHA defines first aid specifically in 29 CFR 1904.7 and excludes it from recordability. First aid includes cleaning wounds, applying bandages, using non-prescription medication at non-prescription strength, and similar minor treatments. If treatment goes beyond that definition, for example stitches or a prescription medication, the case becomes recordable even if the worker returns to full duty the next day.

When is the deadline to enter an injury on the OSHA 300 log?

You must record a case within seven calendar days of learning that a recordable case occurred. The clock starts when you have enough information to determine the case is recordable, not necessarily the day the injury happened. If a doctor visit two weeks after an accident reveals the injury is recordable, you have seven days from that determination to enter it on your log.

Do remote workers count for OSHA 300 log recordkeeping?

Remote employees count toward your total headcount for exemption purposes. Injuries to remote workers can be recordable if they are work-related, meaning caused or contributed to by work activities. An injury during a personal activity at home (like making lunch) is generally not work-related. An injury while performing a work task from home may be. Each case requires a work-relationship determination.

Does a business that is exempt from the 300 log still need a written safety program?

Recordkeeping exemptions and written program requirements are separate questions. Being exempt from the 300 log does not exempt you from OSHA standards that require specific written programs, like a Hazard Communication program under 29 CFR 1910.1200 or a Lockout/Tagout program under 29 CFR 1910.147. Those apply to any employer in a covered industry regardless of size. Check which OSHA standards apply to your operations.

What is the difference between the OSHA 300, 300A, and 301 forms?

The 300 is the running log where you record each case as it happens through the year. The 300A is the annual summary you total at year-end and post from February 1 to April 30 (required for employers with 25 or more employees in non-exempt industries). The 301 is the incident report you complete for each recordable case, describing exactly how the injury happened. All three must be kept for five years.

My business is a sole proprietorship with no employees. Do I need an OSHA 300 log?

No. OSHA's recordkeeping rule applies to employers with employees. A sole proprietor with no employees has no one to record injuries for. Once you hire even one employee and your industry is not exempt, you are subject to OSHA standards generally, though the 10-or-fewer exemption means you still would not keep the 300 log until you exceed 10 employees.

Do I need to keep OSHA 300 logs for temporary workers from a staffing agency?

It depends on who controls the day-to-day work. If your business supervises the temporary worker's daily tasks and controls conditions at the worksite, you record their injuries on your 300 log. If the staffing agency keeps that control, the agency records the injury. In practice, many OSHA compliance officers view the host employer as responsible when the injury happens at the host's facility under the host's direction, so document clearly how supervision is divided.

Sources

1. OSHA, 29 CFR 1904.1 - Purpose: Employers with 10 or fewer employees at all times during the prior calendar year are exempt from routine OSHA injury and illness recordkeeping.
2. OSHA, 29 CFR Part 1904 Recordkeeping Rule (full text): Recordable cases must be entered within seven calendar days; records must be retained for five years; employees have access rights; the 300A must be posted February 1 through April 30 for covered employers.
3. OSHA, Recordkeeping Exemptions by Industry Classification: Certain low-hazard industries identified by NAICS code are exempt from routine OSHA recordkeeping requirements regardless of employer size.
4. OSHA, 29 CFR 1904.39 Reporting fatalities, hospitalizations, amputations, and losses of an eye: All employers must report work-related fatalities within 8 hours and in-patient hospitalizations, amputations, or eye losses within 24 hours, regardless of size or industry exemption status.
5. OSHA, 29 CFR 1904.41 Electronic submission of records (2024 rule): Establishments with 100 or more employees in high-hazard industries must submit 300 log data electronically by March 2 each year; smaller employers generally have no electronic filing obligation.
6. OSHA, OSHA Civil Penalties: As of 2024, OSHA other-than-serious violations carry maximum penalties of $16,131 per violation; willful or repeated violations up to $161,323 per violation.
7. OSHA, State Plans: Twenty-two states and two territories operate OSHA-approved State Plans that must be at least as effective as federal OSHA and may impose additional requirements.
8. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2022: Private industry employers reported 2.8 million nonfatal workplace injuries and illnesses in 2022, according to BLS SOII data.
9. OSHA, 29 CFR 1904.7 General recording criteria (first aid definition): OSHA defines first aid specifically in 1904.7 and cases treated only with first aid are not recordable on the OSHA 300 log.
10. OSHA, Injury Tracking Application (ITA): Employers required to submit data electronically use OSHA's Injury Tracking Application; smaller employers below the thresholds have no electronic filing requirement.