What a written hazard communication program includes: the complete OSHA guide

Last updated 2026-07-09

What does OSHA actually require a written hazard communication program to include?

Six things. OSHA's Hazard Communication Standard at 29 CFR 1910.1200(e) spells out exactly what your written program covers, and it's more specific than most employers realize.

Here's what the regulation actually says. Per 29 CFR 1910.1200(e)(1): "Employers shall develop, implement, and maintain at each workplace, a written hazard communication program which at least describes how the criteria specified in paragraphs (f), (g), and (h) of this section for labels and other forms of warning, safety data sheets, and employee information and training will be met." ^[1] That's the baseline. The rule then adds three more required elements on top.

Put plainly, every compliant written hazard communication program includes:

1. A list of all hazardous chemicals in the workplace (by work area or facility-wide, your choice) 2. Procedures for labeling containers of hazardous chemicals 3. Procedures for maintaining and accessing Safety Data Sheets (SDSs) 4. How employees will receive information and training on chemical hazards 5. Procedures for non-routine tasks involving hazardous chemicals 6. Procedures for informing contractor employees (multi-employer worksite provisions)

Notice what's missing from that list. A phone directory, an org chart, a mission statement, three paragraphs about your company's commitment to safety. Those add length and zero compliance value. The written program is a working document, not a brochure.

The standard applies to general industry under 29 CFR 1910.1200, construction under 29 CFR 1926.59, and maritime under 29 CFR 1915.99 and 1917.28, all of which pull in the same HazCom requirements by reference. ^[2] So if you're in construction or shipyard work, the required content is identical.

What goes in the chemical inventory list, and who has to see it?

The chemical inventory is the spine of your program. Without it, you can't train employees on specific hazards, you can't verify your SDS file is complete, and an OSHA inspector can't confirm you know what you actually have on-site.

Your inventory has to identify every hazardous chemical present in the workplace. OSHA defines a hazardous chemical as "any chemical which is classified as a physical hazard or a health hazard, a simple asphyxiant, combustible dust, pyrophoric gas, or hazard not otherwise classified." ^[1] That definition is broad. Cleaning products, lubricants, paints, adhesives, welding gases, and battery acid all count.

You can organize the inventory by work area, by product category, or facility-wide. OSHA doesn't mandate a format. A simple spreadsheet with columns for product name, manufacturer, SDS location, and the work area where it's used is fine. Some employers add a column for the SDS revision date so they know when to refresh.

Two things people miss.

First, the inventory is a living document. Every time you bring in a new chemical, it goes on the list before employees start using it, not after. When you stop using a chemical, you can drop it from the active list. Keep the SDS on file, though, since chemicals tied to occupational exposure records require 30-year retention under 29 CFR 1910.1020. ^[3]

Second, the list has to be available to employees on request. OSHA's standard gives employees the right to access the written hazard communication program at any time. Locking it in a manager's desk drawer fails that test. A shared drive folder, a binder in the break room, or a posted QR code all work fine.

How should your written program handle Safety Data Sheets?

Your written program has to describe two things about SDSs: how you'll get them, and how employees will reach them. ^[1]

On the getting side, you need an SDS for each hazardous chemical before employees are exposed to it. In practice, that means requesting SDSs from your suppliers as part of purchasing, not as an afterthought. If a supplier ships product without an SDS, you're required to contact them and ask for one. If they stonewall you, you can contact OSHA.

On the access side, SDSs must be "readily accessible to employees in their work area during each work shift." ^[1] That phrase does real work. "Readily accessible" means employees don't have to ask a supervisor, wait for a key, or dig through a filing cabinet. The practical solutions are a physical binder kept in the work area, an unlocked shared drive, or an SDS management software subscription. Electronic systems are allowed as long as there's a backup for power outages or system failures.

Your written program should name your specific system instead of just saying "SDSs are available." An inspector wants to see exactly where the SDSs live and confirm employees know how to find them. Write the actual location into your program: "SDSs are maintained in the red binder on the shelf next to the chemical storage cabinet in Bay 3, and on the shared company drive at [folder path]."

One note on format. Since OSHA's 2012 alignment with the Globally Harmonized System (GHS), every SDS follows a standardized 16-section format. ^[1] If you still have old Material Safety Data Sheets (MSDSs) in the pre-2012 format, replace them with GHS-compliant SDSs. Suppliers are required to provide the updated format.

For a closer look at how the communication chain between suppliers and employers works, the hazardous communication article walks through the full SDS lifecycle.

What do the labeling requirements say for your written program?

Your written program has to explain how your workplace keeps chemical labels intact, both on containers you receive from suppliers and on any containers you fill or transfer chemicals into.

For shipped containers, manufacturers and importers must provide labels under 29 CFR 1910.1200(f) with six elements: product identifier, signal word ("Danger" or "Warning"), hazard statements, precautionary statements, pictograms, and supplier information. ^[1] Your job on the employer side is keeping those labels on the containers and legible. Your program should spell out what employees do if a label is missing or damaged, who checks labels during receiving, and who has authority to pull a product from use if it arrives unlabeled.

Secondary containers are the harder part for most small businesses. Transfer a chemical from its original container into a spray bottle, bucket, or tank, and that secondary container needs a label too. You don't need a full GHS-formatted label for a secondary container used within a single work shift by the same employee who filled it, as long as it doesn't leave that person's immediate control. For anything else, you need at minimum the product identifier plus the words, pictograms, or hazard statements that convey the hazard. ^[1]

Name who's responsible for labeling secondary containers and what system you use. Blank label stock and a marker works. Pre-printed templates work. A label printer works. What doesn't work is unlabeled bottles sitting around, which is one of the most cited labeling violations OSHA writes.

OSHA issued a letter of interpretation in 2016 clarifying that employers can use "alternative labeling systems" such as color-coding or NFPA/HMIS numbering, but only alongside a training program that teaches employees what the alternative labels mean, never as a replacement for one. ^[4]

What employee training information must the written program cover?

The written program doesn't have to be a full training curriculum, but it has to describe how training happens: when it occurs, who runs it, and what topics it covers.

The standard at 29 CFR 1910.1200(h) requires training at the time of initial assignment and whenever a new chemical hazard enters an employee's work area. ^[1] Your program needs to say exactly that, tailored to your shop. "New employees receive HazCom training during their first-day orientation" and "employees are notified and retrained whenever a new chemical is added to the inventory" are the concrete statements OSHA wants to see.

On content, 29 CFR 1910.1200(h)(3) lists the required training topics:

• Methods employees can use to detect the presence or release of a hazardous chemical
• Physical, health, simple asphyxiation, combustible dust, and pyrophoric gas hazards of chemicals in the work area
• Measures employees can take to protect themselves (engineering controls, work practices, PPE)
• Details of the hazard communication program, including how to read labels and SDSs

Your program doesn't need to replicate all of this, but it should reference it and point to where training records are kept. If you use a third-party training vendor or an online course, name it in the program.

The workplace safety training article covers how to structure and document training records so they hold up under an audit, worth reading alongside this.

One thing employers get wrong: training on where SDSs and the written program live counts as required HazCom content. So during onboarding, when you show a new hire where the SDS binder sits, document it.

What does the program need to say about non-routine tasks?

Non-routine tasks are work activities that don't happen on a regular schedule and that may expose employees to hazards they don't hit day-to-day. Cleaning the inside of a storage tank once a year. Stripping floor coatings. Working in a confined space where solvents have pooled. Using a chemical during an equipment repair that's otherwise locked in the maintenance closet.

OSHA requires your program to describe how you'll inform employees about the hazards of non-routine tasks before they start. ^[1] The standard doesn't prescribe a method. It just requires a procedure.

In practice, a pre-task briefing (a toolbox talk or tailgate meeting) is the common approach. Your program might say: "Before any non-routine task involving hazardous chemicals, the supervisor conducts a pre-task briefing covering the specific chemicals involved, their SDSs, required PPE, and emergency procedures. Attendance is documented."

Specificity is the whole game. An inspector who reads "we address non-routine tasks as they arise" is going to follow up with questions. An inspector who reads a specific procedure is going to check whether you actually follow it, which is a far better problem to have.

For a small shop where the owner is also the supervisor doing the task, a written pre-task checklist that gets filled out and filed does the job. It takes five minutes and creates a record.

How do you handle hazard communication for contractors and other employers on your site?

If employees from more than one employer work at your site at the same time, your program has to describe how you'll share hazard information across employer lines. This is the multi-employer worksite provision under 29 CFR 1910.1200(e)(2). ^[1]

The rule cuts both ways. If you're the host employer, you tell contractors about the hazardous chemicals they may be exposed to at your site and give them access to your SDSs. If you're the contractor, you tell the host employer about the hazardous chemicals your crew is bringing onto the site.

Your program should state who at your company talks to outside employers before work begins, how you'll share SDS access (physically, electronically, or by reference), and how you'll handle chemical introductions mid-project.

Plenty of small businesses skip this section because they don't picture themselves as multi-employer worksites. But if you've ever had an HVAC technician, pest control crew, cleaning service, or general contractor on-site while your employees were present, you have a multi-employer situation. It doesn't take a formal written agreement. It takes a process.

OSHA's multi-employer policy lives in its CPL 02-00-124 directive, which describes how citation responsibility splits between controlling, creating, exposing, and correcting employers on shared worksites. ^[5] Your written HazCom program is one of the documents that marks you as a responsible controlling employer.

What format does the written program need to be in?

OSHA requires no specific format, font, length, or template. What it requires is that the program exists, covers the required elements, and reaches employees.

A two-page document that specifically addresses all six required elements beats a twenty-page boilerplate that was clearly downloaded and never customized. Inspectors are good at spotting programs that don't match the actual workplace. If your program mentions chemicals you don't use, worksites that don't match your facility, or procedures that contradict what employees say during interviews, that creates problems.

Some practical format guidance.

Use your actual company name throughout. "ABC Plumbing, Inc." not "Employer."

Reference your specific chemical inventory by name or location. "The chemical inventory is maintained in the attached Appendix A" beats "a chemical inventory exists."

Name the person responsible for each component. OSHA specifically requires that the program identify who owns the overall program. That can be an owner, operations manager, or safety coordinator, but it has to be a specific role.

Date the document and note when it was last reviewed. Programs have to stay current. OSHA sets no review interval, but annual review is the widely accepted standard, plus a review after any significant change to your chemical inventory or operations.

If you want to build a customized program without grinding through OSHA's regulatory text, SafetyFolio's safety program generator walks you through the required elements and outputs a document tailored to your workplace in about 15 minutes.

For broader context on what makes a well-structured written safety program, a safety and health program should be is worth a look.

How does OSHA enforce hazard communication program requirements, and what are the penalties?

Hazard communication lands near the top of OSHA's most-cited standards every year. In OSHA's fiscal year 2023 data, HazCom (29 CFR 1910.1200) was the fifth most frequently cited standard in general industry, with 2,070 violations issued. ^[6] That count doesn't include construction, which cites the standard separately under 29 CFR 1926.59.

Inspectors check HazCom three ways: document review (asking for the written program and chemical inventory), physical inspection (checking container labels and SDS availability), and employee interviews (asking workers where SDSs are kept and whether they've been trained). Interviews are often the most revealing. An inspector who asks three employees where to find the SDS for a chemical they use daily and gets three different answers is going to look hard at whether your training was real.

Penalty amounts as of 2024: serious violations carry a maximum of $16,131 per violation, and willful or repeated violations carry a maximum of $161,323 per violation. ^[7] OSHA adjusts these figures annually for inflation. Penalties can drop based on employer size, good faith, and history, but the reductions don't apply to willful violations.

For small businesses, the common HazCom citations are: no written program (or one that clearly doesn't match the workplace), missing or outdated SDSs, unlabeled secondary containers, and no documented training records. All four are straightforward to fix before an inspection.

OSHA also runs a free on-site consultation program, separate from enforcement, where a consultant reviews your program and flags gaps without triggering penalties. ^[8] The consultation is confidential and available to small businesses (generally under 250 employees at a site). It's genuinely useful if you've never had your program reviewed.

What's the difference between OSHA's HazCom standard and the old MSDS system?

OSHA revised its Hazard Communication Standard in 2012 to align with the United Nations Globally Harmonized System of Classification and Labelling of Chemicals (GHS). The full revision took effect for general industry in June 2016. ^[1]

The main changes:

Material Safety Data Sheets became Safety Data Sheets, with a mandatory 16-section format replacing the variable format that came before. The 16 sections are: identification, hazard identification, composition/information on ingredients, first-aid measures, fire-fighting measures, accidental release measures, handling and storage, exposure controls/personal protection, physical and chemical properties, stability and reactivity, toxicological information, ecological information, disposal considerations, transport information, regulatory information, and other information.

Labels gained standardized pictograms (the red-bordered diamond symbols), signal words ("Danger" or "Warning"), and required hazard and precautionary statements.

Hazard classification got more standardized, with specific criteria for health hazards, physical hazards, and environmental hazards.

If you're still using old MSDS documents for any chemical, request updated GHS-format SDSs from the manufacturer. Most major suppliers have fully transitioned, but smaller or older product lines sometimes lag. If a supplier genuinely can't provide a GHS-compliant SDS, document your attempts to obtain one.

The practical difference for your program is small but real: any references to "MSDS" in your documents should become "SDS," and any training built on the old MSDS format should move to the 16-section GHS format.

Do small businesses with only a few hazardous chemicals still need a full written program?

Yes. OSHA does not exempt small employers from the written program requirement based on business size or the number of chemicals used. One hazardous chemical and one employee is enough to trigger 29 CFR 1910.1200. ^[1]

There's relief inside the requirement, though. If your workplace has a small number of chemicals and all the required information fits on the label, OSHA allows a simplified written program. The standard at 29 CFR 1910.1200(e)(1) says the written program "does not have to be lengthy or complicated" for workplaces with few hazardous chemicals. ^[1]

In the 2012 preamble to the revised rule, OSHA acknowledged that a straightforward written statement of procedures, a short chemical inventory, and accessible SDSs meets the standard for most small businesses. The written program exists to be a working reference, not a performance.

OSHA's compliance directive for the HazCom standard (CPL 02-02-079) gives inspection guidance, including how inspectors evaluate small employers with limited chemical exposure. ^[9] For a business with three or four chemicals, a one-page written program with clear procedures and an attached one-page inventory is genuinely sufficient if it covers all six required elements.

The businesses that get cited aren't usually the ones with simple programs. They're the ones with no program, or a program that was never shown to employees.

What records do you need to keep for your hazard communication program?

OSHA's HazCom standard itself doesn't set retention periods for the written program, training records, or the chemical inventory the way some other standards do. But overlapping requirements effectively create retention obligations.

First, SDSs. SDSs for chemicals that employees have been exposed to must be kept for 30 years after last use under OSHA's Access to Employee Exposure and Medical Records standard at 29 CFR 1910.1020. ^[3] That applies to SDSs that are part of exposure records. Most employers keep all SDSs indefinitely in digital form, since storage costs nothing.

Second, training records. OSHA sets no specific HazCom training record retention period, but because inspections can happen years after a potential violation, most compliance professionals keep training records (sign-in sheets, quiz results, online completion certificates) for at least three years. Some state OSHA plans have their own requirements.

Third, the written program itself. Keep every version with a date stamp so you can show the program was current during any period covered by an inspection or lawsuit.

For the chemical inventory, keep the historical versions. If a worker later develops an occupational illness and you need to reconstruct their chemical exposure history, a dated inventory from five years ago is worth its weight.

Nobody has clean data on how often HazCom recordkeeping gaps specifically trigger citations versus the substantive violations. The practical value of good records is simpler: they make everything easier, from employee training to workers' comp claims to the inspection itself.

Frequently asked questions

Does a written hazard communication program need to be updated every year?

OSHA sets no annual update requirement, but your program has to reflect current conditions. That means updating it whenever you add new chemicals, change procedures, or hand the program to a new responsible person. Most safety professionals run a formal annual review as a matter of practice. Undated or clearly outdated programs are a common inspection flag.

Can a written hazard communication program be kept electronically?

Yes. OSHA allows electronic written programs and electronic SDS systems under 29 CFR 1910.1200, as long as employees can access them during their work shift without barriers. Electronic systems must have a backup for power outages. A program on a password-protected system that employees have no credentials to access fails the 'readily accessible' standard.

Who is responsible for the written hazard communication program at a small business?

The employer is ultimately responsible. Your program should name a specific individual (by job title rather than name, in case of turnover) who maintains the program, keeps the chemical inventory current, ensures SDS access, and oversees training. At very small businesses, that's usually the owner or operations manager. The point is that the responsibility is written down and known.

What happens if an OSHA inspector visits and you don't have a written hazard communication program?

Expect a citation. Not having a written program is a serious violation under 29 CFR 1910.1200(e)(1), subject to penalties up to $16,131 per violation as of 2024. Inspectors routinely ask for the written program early in an inspection. If you produce one that clearly doesn't match your workplace, that can be treated as a deficient program rather than no program, but the outcome is similar.

Do office workers who use common cleaning products need hazard communication training?

Yes, if those cleaning products meet OSHA's definition of a hazardous chemical. Many common products, including bleach, ammonia-based cleaners, and aerosol sprays, are hazardous chemicals under 29 CFR 1910.1200. Consumer products used in quantities and frequencies comparable to normal consumer use have a partial exemption, but that's a narrow carve-out. When in doubt, put the product in your inventory and provide basic training.

What is the difference between a written hazard communication program and an SDS?

An SDS (Safety Data Sheet) is a document from the chemical manufacturer describing the hazards, handling, and emergency response for a specific chemical. A written hazard communication program is the employer's document describing how they manage chemical hazards in their workplace, including how SDSs get obtained, maintained, and accessed. The SDS is a source of information. The written program is the management system.

How specific does the chemical inventory need to be?

Specific enough to identify every hazardous chemical present. OSHA requires no particular format, but the inventory should include the product name (matching the SDS), the location where it's used or stored, and enough detail to link it to its SDS. Generic descriptions like 'cleaning chemicals' don't cut it. List each product individually. A spreadsheet with product name, manufacturer, and work area columns satisfies the requirement for most workplaces.

Are there industries or workplaces exempt from the written hazard communication program requirement?

Very few. Certain agricultural operations have modified requirements. Retail establishments that use products in quantities consistent with normal consumer use have a partial exemption for those specific products. Laboratories fall under a separate standard at 29 CFR 1910.1450. But for the vast majority of general industry, construction, and maritime workplaces, the written program requirement under 29 CFR 1910.1200 or its parallel standards applies in full.

How does hazard communication training differ from the written program?

The written program is the document describing your system. Training is what you do with employees based on that system. Your program must describe how training happens, but the training itself is a separate activity that has to be conducted and documented. The written program tells OSHA what you've committed to. Training records and employee knowledge tell them whether you followed through.

What should a written hazard communication program say about personal protective equipment?

Your program should point out that chemical-specific PPE requirements live in each chemical's SDS (Section 8 of the 16-section format covers exposure controls and personal protection). The program doesn't need to replicate PPE requirements for every chemical, but it should tell employees where to find that information and confirm PPE is available. A separate written PPE program under 29 CFR 1910.132 handles the broader PPE hazard assessment requirement.

Can an employer use a generic template for their written hazard communication program?

A template is a starting point, not a finished product. Inspectors are experienced at spotting generic programs that don't reflect the workplace. Your final document has to reference your specific chemicals, your actual SDS locations, your named responsible person, and your real training procedures. A template customized with real details from your operation is fine. An unmodified download is not.

What are the most common reasons OSHA cites employers for HazCom violations?

Based on OSHA's consistently high HazCom citation rates, the common violations are: no written program or one that doesn't reflect actual operations, missing or inaccessible SDSs, unlabeled secondary containers, and no documented employee training. Of these, unlabeled secondary containers and missing SDSs are the easiest to catch during a physical walkthrough, which is why inspectors look for them first.

Does the written hazard communication program need to cover hazardous waste?

Hazardous waste is primarily regulated by the EPA under RCRA, not OSHA's HazCom standard. But employees who handle hazardous waste may have exposure to hazardous chemicals, and OSHA's hazardous waste operations standard (29 CFR 1910.120) carries its own training and program requirements. If your operation generates or manages hazardous waste, you likely need both a HazCom program for the chemicals your employees use and HAZWOPER compliance if handling or cleanup is involved.

How do I handle chemicals whose manufacturers have gone out of business and I can't get an updated SDS?

OSHA requires a good-faith effort to obtain a compliant SDS. If the manufacturer is gone, try the distributor, a trade association, or a third-party SDS database. OSHA guidance puts employers who document their efforts to obtain SDSs from defunct manufacturers in a stronger position if the gap turns up during an inspection. Document every attempt in writing with dates.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: Written hazard communication program must include: chemical list, SDS procedures, labeling procedures, training, non-routine tasks, and multi-employer provisions per 29 CFR 1910.1200(e)
2. OSHA, Construction HazCom Standard 29 CFR 1926.59: Construction industry hazard communication requirements under 29 CFR 1926.59 incorporate the same HazCom elements as general industry
3. OSHA, 29 CFR 1910.1020 Access to Employee Exposure and Medical Records: SDSs that are part of employee exposure records must be retained for 30 years after last use
4. OSHA, Letters of Interpretation on Hazard Communication: OSHA guidance confirms alternative labeling systems (color-coding, NFPA/HMIS) are allowed only alongside a training program that explains them, not as a replacement
5. OSHA, CPL 02-00-124 Multi-Employer Citation Policy: OSHA's multi-employer worksite policy describes how citation responsibility is allocated among controlling, creating, exposing, and correcting employers
6. OSHA, Top 10 Most Frequently Cited Standards: In FY2023, Hazard Communication (29 CFR 1910.1200) was the fifth most cited general industry standard with 2,070 violations
7. OSHA, Penalties: As of 2024, serious violations carry a maximum penalty of $16,131 per violation and willful or repeated violations carry a maximum of $161,323 per violation
8. OSHA, On-Site Consultation Program: OSHA's free on-site consultation program is available to small businesses and is confidential and separate from enforcement
9. OSHA, CPL 02-02-079 Inspection Procedures for the HazCom Standard: OSHA's compliance directive CPL 02-02-079 provides inspection guidance for the Hazard Communication Standard including evaluation of small employers
10. OSHA, 29 CFR 1910.1450 Occupational Exposure to Hazardous Chemicals in Laboratories: Laboratory workplaces are covered by a separate standard (29 CFR 1910.1450) rather than the general HazCom standard
11. OSHA, 29 CFR 1910.132 Personal Protective Equipment: Written PPE hazard assessments are required under 29 CFR 1910.132, separate from but complementary to the HazCom written program