State OSHA plan variance from federal standard: how to navigate it

Last updated 2026-07-11

What is a state OSHA plan and how is it different from federal OSHA?

A state OSHA plan is a state-run safety program that replaces federal OSHA enforcement inside that state. Federal OSHA operates under the Occupational Safety and Health Act of 1970 and sets the floor for the whole country ^[1]. Section 18 of that same law lets states apply to run their own programs. Once a state plan gets approved, federal OSHA steps back from enforcement there and the state agency takes over.

As of 2024, there are 29 state and territory plans. Of those, 22 cover both private-sector and public-sector employers, and 7 cover only public-sector (state and local government) workers ^[2]. The 7 public-sector-only states do not touch most private businesses, but they matter the day you sign a contract with a municipality.

Here is the phrase that runs everything: 29 CFR 1902.3 requires that a state plan be "at least as effective" as federal standards ^[3]. It does not say identical. That one word gap is where all the complexity lives. A state can copy the federal standard word for word, or write a stricter version, add training, lower exposure limits, cover workers federal OSHA never reaches, or invent entirely new hazard categories.

Treat the state standard as the operative standard in a state-plan state. Federal OSHA is the fallback when the state has not yet adopted a new federal rule. In practice most state plans adopt federal changes within six months of the federal effective date, and some already run ahead of federal rules in the areas they care about most.

Which states have their own OSHA plans?

Twenty-nine states and territories run their own OSHA plans as of 2024. Twenty-two of them cover private employers too. The full-coverage states are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. Connecticut, Illinois, Maine, New Jersey, New York, and the U.S. Virgin Islands cover public-sector workers only ^[2].

If you are in Texas, Florida, Georgia, Ohio, Pennsylvania, or any of the other remaining states, federal OSHA has direct jurisdiction over private employers and you follow the 29 CFR standards only.

State	Covers private sector?	Notable areas of variance
California (Cal/OSHA)	Yes	Injury and illness prevention program required; stricter heat illness standard; independent PSM rules
Washington (L&I)	Yes	Ergonomics rules; stricter crane operator rules; public works requirements
Michigan (MIOSHA)	Yes	Stricter respiratory protection timelines; construction-specific additions
Oregon (OR-OSHA)	Yes	Chemical exposure limits often stricter than federal PELs
North Carolina (NC DOL)	Yes	Generally tracks federal closely but has independent rulemaking authority
Virginia (VOSH)	Yes	Adopted COVID-19 emergency standard before federal OSHA acted
Minnesota (MNOSHA)	Yes	Stricter lead standard; ergonomics guidance documents

Those are highlights, not the whole picture. Every state plan publishes its full standards, and the only source worth trusting is the state agency's own website.

Where do state OSHA rules actually differ from federal standards?

State rules diverge from federal in a handful of predictable places: exposure limits, injury prevention programs, heat illness, lockout/tagout details, and construction-specific requirements. Those are the areas worth auditing first if you operate across state lines.

Permissible exposure limits (PELs) are the ones that bite hardest. Federal OSHA's PELs under 29 CFR 1910.1000 are old, many of them set in 1971 and never revised since ^[4]. California's Cal/OSHA has updated dozens of its occupational exposure limits past federal levels. Oregon's limits for substances like methylene chloride and styrene run tighter than federal ^[12]. If you do industrial work off the federal PEL table, you may be under-protecting workers in a state-plan state without realizing it.

Injury and illness prevention programs (I2P2 or IIPP) are mandatory in California under 8 CCR 3203 ^[10]. Federal OSHA has never passed a final I2P2 rule for general industry, though it has floated proposals over the years. Cal/OSHA has enforced the IIPP requirement since the early 1990s. This is no small procedural gap. A California employer without a written IIPP is out of compliance no matter how cleanly they follow 29 CFR.

Heat illness protection is the next big one. Federal OSHA issued a proposed heat rule in 2024, but it had not been finalized as of mid-2025. California has run an outdoor heat illness prevention standard (8 CCR 3395) since 2005 and added indoor heat protections in 2024 ^[5]. Washington has its own heat rule too.

Lockout/tagout under 29 CFR 1910.147 is one of the most-cited federal standards year after year. State plans mostly follow the federal structure, but some add documentation requirements or reach operations the federal standard leaves fuzzy. Check your state's version if lockout tagout is part of your program.

Hazard communication is one place state plans have stayed close to federal, thanks to GHS harmonization. Even there, enforcement emphasis and paperwork expectations still vary by state.

Construction rules, crane operator certification timelines, and public works safety requirements also split from federal in Washington and California in ways that change how you actually run a job.

How does the 'at least as effective' requirement actually work in practice?

In practice, "at least as effective" means a state can go stricter than federal but never weaker, and federal OSHA audits each state plan every year to confirm it. The review runs through Annual Monitoring and the Final Approval process under 29 CFR 1902 ^[3]. OSHA measures state programs against benchmarks covering inspection rates, citation rates, and the share of penalties actually collected.

A state plan that adopts a standard more protective than the federal version clears the "at least as effective" test on its own. A state plan cannot adopt a weaker one. If a state let its enforcement rot badly enough, federal OSHA could move to reclaim concurrent jurisdiction. That is rare, and the process drags on for years.

Here is what it means for you. The state standard is the enforceable standard in a state-plan state, even when it runs stricter than the federal rule you know. "But we comply with the federal 29 CFR standard" is not a defense in a California, Oregon, or Washington inspection. The inspector is enforcing state code, full stop.

Federal OSHA does keep concurrent jurisdiction over federal government workplaces even inside state-plan states. That matters if you are a federal contractor working on a federal installation.

What is a variance and how is it different from a state plan difference?

A variance and a state plan difference are two separate things that share one word. The word "variance" gets used two ways in OSHA conversations, and mixing them up creates real confusion.

The first meaning is loose shorthand for a state plan adopting different, usually stricter, rules than the federal standard. That is what most of this article covers.

The second meaning is a formal variance application: an employer's petition to OSHA (federal or state) asking permission to comply with a standard through an alternative method. Federal OSHA's variance procedures sit at 29 CFR 1905 ^[6]. A temporary variance can be granted when you cannot comply with a new standard by its effective date because materials or equipment are unavailable, and you show you are taking every available step to protect workers meanwhile. A permanent variance can be granted when you prove your alternative method is at least as safe as the standard requires.

Formal variances are genuinely rare. Federal OSHA grants very few permanent variances a year. They demand heavy documentation, usually third-party data, and a process that looks a lot like rulemaking. If a consultant tells you to "just apply for a variance" as a shortcut around a rule, be skeptical. The burden of proof is on you, the process takes months to years, and approval is never guaranteed.

State-plan states run their own variance procedures, usually modeled on 29 CFR 1905 but not identical. California's variance process runs through the Occupational Safety and Health Standards Board. Oregon and Washington have parallel administrative procedures.

For most small businesses, the formal variance route is not the answer to a compliance gap. Changing your operation or equipment to meet the standard is almost always faster and cheaper.

How do you find out which state-plan rules apply to your business?

Start at the federal OSHA state plan directory on osha.gov, which lists every approved state plan with a direct link to the state agency ^[2]. From there, go straight to the state agency's standards page. Skip the general web search and the vendor compliance summary. Standards change and summaries go stale.

California's standards live in Title 8 of the California Code of Regulations, searchable on the Cal/OSHA site. Washington's are in the Washington Administrative Code (WAC), the 296 chapters. Oregon's are in OAR chapters 437. Every state uses its own numbering system, which is one reason cross-state compliance is such a slog.

Here is the workflow I would use for a small business:

1. Confirm whether your state is a state-plan state using the OSHA directory. 2. Identify the federal standards that cover your industry and operations (29 CFR 1910 for general industry, 29 CFR 1926 for construction). 3. For each federal standard, look up the state equivalent. Many states publish a crosswalk comparing state and federal rules. 4. Flag every place the state standard is stricter or adds something federal does not have. 5. Build those differences into your written program.

If you are using a tool like SafetyFolio's safety program generator, confirm it accounts for your specific state and more than federal 29 CFR standards. The most common failure in off-the-shelf safety programs is defaulting to federal rules with no flag for state-specific additions.

For OSHA training requirements, states sometimes set different content or frequency than the federal standard. Washington, for one, has training documentation requirements for construction that go past what 29 CFR 1926 asks for.

Can a state OSHA plan citation be challenged differently than a federal citation?

Yes, but the challenge process mostly mirrors the federal one. Federal OSHA citations get contested before the Occupational Safety and Health Review Commission (OSHRC). State-plan states run their own review commissions or administrative law judge systems. California uses the Occupational Safety and Health Appeals Board. Washington routes appeals through the Board of Industrial Insurance Appeals. Oregon uses an independent hearings division.

Timelines matter. The contest window after a federal citation is 15 working days from receipt ^[7]. State plans may use the same window or a different one. California gives 15 working days too. Read your citation paperwork the day it arrives, because missing the contest deadline makes the citation final and unappealable.

Penalty amounts differ, sometimes by a lot. Federal OSHA's maximum serious violation penalty is $16,550 per violation as of 2024, adjusted every year for inflation ^[8]. State-plan states must set maximums at least as high, and some go well past it. California's serious violation maximum is $25,000 per violation. Washington's maximum for a willful or repeat violation reaches $156,709 under its 2024 adjustment ^[11].

The practical takeaway: if you get a citation in a state-plan state and want to fight it, hire an attorney or consultant who knows that state's review process specifically, more than federal OSHA procedure. The procedural rules, burden-of-proof standards, and precedent cases are all different.

What happens if you operate in both federal OSHA and state-plan states?

You have to comply with the applicable standard in each jurisdiction. You cannot pick one ruleset and stamp it everywhere. Multi-state employers carry the heaviest load here.

The reliable approach is to find your highest-standard state, build your base program to that level, then flag every state where requirements sit lower so you know where you have slack. California is so often the strictest that California-compliant programs frequently satisfy other state plans, though not always. Washington and Oregon each have areas where they outrun California.

For training, that can mean delivering different content or documenting different things depending on where a worker stands. An OSHA 30 course completed under the federal OSHA Outreach Training Program is a federally recognized credential, but state-plan states may layer additional or different training requirements on top of it.

For multi-site manufacturers or contractors working across state lines, a separate compliance checklist for each state-plan state is not optional. It is the floor you defend from in an inspection.

How do state OSHA plans handle new federal rules or emergency standards?

State-plan states get six months to respond to a new permanent federal standard. They either adopt an identical or equivalent standard, or they show their existing standard is already at least as effective ^[9]. That six-month clock comes from 29 CFR 1953.

Some states beat the deadline and adopt fast. Others burn the full window. During the gap, the federal standard does not automatically apply in a state-plan state. The state's existing standard stays in force.

For federal Emergency Temporary Standards (ETS), the clock tightens to 30 days. State plans have that long to adopt an equivalent ETS or explain why their existing protections cover it. The COVID-19 ETS in 2021 showed how this plays out. State-plan states like Virginia and Michigan moved quickly to their own COVID standards, while others faced pressure to adopt the federal ETS or defend their existing rules.

The reverse happens too. Virginia enacted a COVID-19 workplace standard in July 2020, months ahead of any federal action. That is a state plan using its independent authority to move first. Virginia employers had enforceable obligations that employers in federal-OSHA states did not carry at the same time.

Hear about a new federal OSHA rule taking effect? Do not assume it applies in your state-plan state yet. Look up whether your state adopted it and when the adoption took hold.

How should your written safety program reflect state plan differences?

Your written program has to cite the applicable standard, and in a state-plan state that means the state code section, more than the federal 29 CFR reference. An inspector in California is checking Title 8 CCR compliance. A program that says "per 29 CFR 1910.147" with no reference to 8 CCR 3314 is citing the wrong authority.

For an incident report and recordkeeping, state-plan states use the OSHA 300, 300A, and 301 forms just like federal OSHA. Some states require records filed with the state agency on top of keeping them on-site. California's recordkeeping requirements largely track 29 CFR 1904, but Cal/OSHA has inspection authority over those records independent of federal OSHA.

For hazard-specific programs, your written program should include:

• The specific state standard number, more than the federal equivalent
• Any state-specific thresholds (lower PELs, different action levels, added PPE requirements)
• State-mandated training content that exceeds the federal minimum
• Any state-specific forms or reporting procedures

If you are building or updating a written program and want a starting point that flags these state-level differences, SafetyFolio's program generator lets you pick your state so the output reflects the applicable standards instead of defaulting to federal-only citations.

Keep the program current. When a state updates a standard, your written program has to catch up. Cal/OSHA in particular has been busy over the past five years, with the indoor heat illness rule and updates to the aerosol transmissible disease standard as recent examples.

What are the most common compliance mistakes businesses make with state OSHA plans?

The number one mistake is assuming federal compliance equals state compliance. It is a reasonable place to start, since states must be "at least as effective" as federal. It fails in exactly the areas where state plans have been most active.

Second: ignoring the IIPP requirement in California. Every California employer with even one employee needs a written Injury and Illness Prevention Program under 8 CCR 3203 ^[10]. Cal/OSHA cites this constantly. It is one of the most frequently cited Cal/OSHA standards for general industry. California operations and no written IIPP means a serious citation risk, no matter how clean your federal-standard compliance looks.

Third: running on outdated PELs. If your industrial hygiene program leans on the federal 29 CFR 1910.1000 tables, you may be over the action level under Oregon or California standards for specific substances. This one hits hazard communication and exposure monitoring programs.

Fourth: not checking whether the state adopted the federal standard you are leaning on. If federal OSHA issued a standard last year and your state has not adopted it yet, citing it as the applicable rule is wrong in both directions. The federal standard does not apply in your state yet, and if the state's existing standard is stricter, that one governs.

Fifth: treating a formal variance application like routine paperwork. It is not. It takes engineering data, worker notification, a public comment period, and long agency review. Very few employers should attempt one without legal counsel.

Frequently asked questions

Do federal OSHA standards apply at all in state-plan states?

Federal OSHA standards do not apply to private employers in state-plan states. The state standard governs. Federal standards can serve as a reference point, but the enforceable rule is the state code. The one exception is federal government workplaces inside state-plan states, which stay under direct federal OSHA jurisdiction. For private businesses, your inspection runs through the state agency under state rules.

How do I find the specific state OSHA standard that applies to my business?

Start at the OSHA.gov state plan directory, which links to each state agency. From the state site, go to the standards or regulations section. California uses Title 8 CCR, Washington uses WAC 296 chapters, Oregon uses OAR 437. Many states publish industry-specific guides and comparison tables. For each federal 29 CFR standard you rely on, look up the state equivalent and check for added requirements.

Can a state OSHA plan be less strict than federal OSHA?

No. The Occupational Safety and Health Act requires state plans to be 'at least as effective' as federal OSHA, per 29 CFR 1902.3. A state cannot legally adopt standards weaker than the federal floor. OSHA's approval and ongoing oversight process is built to catch any drift below that line. In practice, the common issue is states exceeding federal requirements, not falling below them.

What is the deadline for contesting a state OSHA citation?

Federal OSHA gives 15 working days from receipt of the citation. Most state-plan states mirror this timeline, including California. Some states differ slightly. Read your citation paperwork the moment it arrives. Missing the contest deadline makes the citation and penalty final and unappealable. If you want to contest, notify the state agency in writing within that window and consult an attorney familiar with that state's review board.

Are OSHA 10 and OSHA 30 cards accepted in state-plan states?

OSHA 10 and OSHA 30 cards from the federal OSHA Outreach Training Program are generally recognized in state-plan states, but they may not satisfy state-specific training requirements that go past the federal standard. Washington and California in particular tie training documentation requirements to their own standards. The card shows general safety training; it does not guarantee compliance with every state-specific training obligation your workers may have.

How do I apply for a formal variance from an OSHA standard?

Federal variance applications go to OSHA under 29 CFR 1905. You submit a written application describing your workplace, the standard you seek a variance from, the alternative method you propose, and evidence it protects workers as well as the standard does. Workers must be notified and get a chance to participate. Temporary variances require showing you cannot yet comply because materials or equipment are unavailable. The process usually takes months and approval is not guaranteed. State-plan states run parallel procedures through their own agencies.

California is stricter than federal OSHA in many areas. What are the most important differences for small businesses?

The biggest ones for small businesses are the written Injury and Illness Prevention Program (IIPP) under 8 CCR 3203, the outdoor heat illness prevention standard (8 CCR 3395), the indoor heat illness standard added in 2024, and chemical exposure limits stricter than federal PELs. Cal/OSHA also sets its own requirements for things like electrical safety and PPE documentation. California's maximum serious violation penalty is $25,000 per violation versus $16,550 federally.

How long does a state plan have to adopt a new federal OSHA standard?

Six months from the federal effective date, per 29 CFR 1953. During that window, the state's existing standard stays in force. For federal Emergency Temporary Standards, the window shrinks to 30 days. Some states adopt new federal rules faster than the deadline; others use the full period. Do not assume a federal rule you heard about applies in your state-plan state until you confirm adoption. Check the state agency's current standards page.

Does operating in multiple states mean I need multiple separate safety programs?

You need your program to comply with each state where you operate. Many businesses build to the strictest applicable state standard and use that as the base program, then add state-specific sections for jurisdictions with extra requirements. You cannot run a single federal-standard program uniformly across state-plan states. At minimum, your program must cite the correct state code sections and address state-specific requirements like California's IIPP obligation.

What states have the strictest OSHA plans compared to federal standards?

California and Washington consistently show the most divergence from federal standards. Oregon's chemical exposure limits for many substances run stricter than federal PELs. Minnesota has a stricter lead standard. Virginia moved ahead of federal OSHA on COVID-19 workplace rules. No single ranking exists, because strictness depends on the industry and hazard. For chemical exposure, Oregon may be stricter than California in some areas. For heat illness, California and Washington both exceed federal requirements.

If I'm a federal contractor, which OSHA rules apply to me in a state-plan state?

It depends where you work. If you work on a federally owned or controlled facility inside a state-plan state, federal OSHA keeps jurisdiction over that federal workplace. Your work on private or state property in a state-plan state falls under the state plan. Construction contractors working on federal buildings in California, for example, may face layered jurisdictional questions. When in doubt, confirm with the contracting officer and the relevant OSHA office which agency has jurisdiction.

How are state OSHA penalties different from federal OSHA penalties?

State plan maximum penalties must be at least as high as federal maximums. Federal OSHA's maximum serious violation penalty is $16,550 per violation as of 2024, adjusted annually for inflation. California's maximum serious violation penalty is $25,000. Washington's maximum for willful or repeat violations reached $156,709 under its 2024 adjustment. State plans also adjust yearly. In some state-plan states, the financial risk from a citation runs higher than it would under direct federal OSHA enforcement.

Do state OSHA plans cover farm workers and agricultural operations differently?

Federal OSHA has limited coverage of agricultural operations, especially small farms with ten or fewer employees. Some state-plan states extend coverage to agricultural workers more broadly than federal law requires. California's agricultural safety regulations, including those for heat illness and pesticide exposure, apply to operations federal OSHA does not reach. If you run a farm or agricultural business in a state-plan state, check state agricultural safety rules specifically rather than assuming the federal exemptions apply.

What is the difference between a state plan state and a state with a public-sector-only plan?

States with full state plans cover both private and public (state and local government) employers. Seven jurisdictions have public-sector-only plans: Connecticut, Illinois, Maine, New Jersey, New York, and the U.S. Virgin Islands among them. In those states, private employers stay under direct federal OSHA jurisdiction, but state and local government workers fall under the state plan. A private employer in New York follows federal OSHA rules. Work for New York City government and the state plan applies to you.

Sources

1. OSHA, Occupational Safety and Health Act of 1970, Section 18: Section 18 of the OSH Act allows states to apply to run their own occupational safety and health programs
2. OSHA, State Plans directory: As of 2024, there are 29 state and territory plans, 22 covering both private and public sectors and 7 covering public sector only
3. 29 CFR 1902.3, Criteria for state plan approval: 29 CFR 1902.3 requires state plans to be 'at least as effective' as federal OSHA standards
4. OSHA, Annotated Permissible Exposure Limits, 29 CFR 1910.1000: Federal OSHA's PELs are largely based on 1971 consensus standards and have not been broadly updated since
5. Cal/OSHA, Heat Illness Prevention, 8 CCR 3395: California has had an outdoor heat illness prevention standard since 2005 and added indoor heat illness protections in 2024
6. 29 CFR 1905, Variance procedures: Federal OSHA's variance procedures for temporary and permanent variances are codified at 29 CFR 1905
7. 29 CFR 1903.17, Contest of citation: Employers have 15 working days from receipt of a citation to file a notice of contest
8. OSHA, Penalties page: Federal OSHA maximum serious violation penalty is $16,550 per violation as of 2024, adjusted annually for inflation
9. 29 CFR 1953, Changes to state plans: State plan states have six months to adopt or show equivalent effectiveness for a new federal standard after its effective date
10. Cal/OSHA, Injury and Illness Prevention Program, 8 CCR 3203: California requires every employer to have a written Injury and Illness Prevention Program under 8 CCR 3203
11. Washington State Department of Labor and Industries, Safety and Health: Washington's maximum penalty for willful or repeat violations reached $156,709 under its 2024 adjustment
12. Oregon OSHA, Oregon Administrative Rules OAR 437: Oregon's occupational exposure limits for substances like methylene chloride and styrene are stricter than federal PELs