Do you need a written safety program with fewer than 10 employees?

Last updated 2026-07-09

What does OSHA actually say about small employers and written programs?

There is no OSHA rule that says 'fewer than 10 employees means no written safety program.' None. What exists is a narrow recordkeeping exemption plus a few standards that scale with employer size, and those two things get jammed together in people's heads constantly.

The recordkeeping exemption at 29 CFR 1904.1 says employers with 10 or fewer employees are partially exempt from keeping OSHA injury and illness logs (the 300, 300A, and 301 forms), unless OSHA or BLS specifically requests the records or a fatality or hospitalization triggers mandatory reporting ^[1]. That exemption covers logs. It does not cover written safety programs.

Each OSHA standard carries its own written-program trigger, and those triggers live in the standard's text. If the standard says 'the employer shall establish a written program,' you write the program whether you employ 3 people or 300. The size of your crew never edits the regulation.

Which OSHA standards require a written program no matter how small you are?

Several of OSHA's most-cited standards demand a written program in their regulatory text with zero small-employer carve-out. These are the ones that catch small businesses off guard.

29 CFR 1910.1200, the Hazard Communication Standard, requires a written hazard communication program for any employer whose workers may be exposed to hazardous chemicals ^[2]. A one-person shop with a can of acetone on the shelf technically has a chemical that triggers this. The written program has to spell out how you handle labeling, safety data sheets, and employee training.

29 CFR 1910.147, Control of Hazardous Energy (Lockout/Tagout), requires a written energy control program when workers service or maintain equipment where unexpected startup could hurt them ^[3]. A machine shop with two people servicing a metal lathe needs a written LOTO program. No exemption for being small.

29 CFR 1910.38, the Emergency Action Plan standard, requires a written EAP only for employers with more than 10 employees. Ten or fewer, and you can communicate the plan out loud ^[4]. This is one of the genuinely small-employer-friendly rules in the whole OSHA code, and it actually scales with headcount.

29 CFR 1910.132 and 1910.134 (PPE and Respiratory Protection) require written programs and hazard assessments when respirators are used or when a hazard assessment shows PPE is needed ^[5].

More standards carry written-program duties: 29 CFR 1910.119 (Process Safety Management, which kicks in only for facilities holding covered chemicals above threshold quantities), 29 CFR 1910.146 (Permit-Required Confined Spaces) ^[11], and 29 CFR 1910.1030 (Bloodborne Pathogens, which shows up in any healthcare-adjacent small business).

Here's the pattern worth tattooing on your forehead. OSHA writes standards by hazard, not by headcount. If the hazard is in your building, the standard is on your desk.

Which OSHA rules genuinely give small employers a break?

Real accommodations exist. Knowing them keeps you from over-building a program you never needed.

The 10-employee recordkeeping exemption at 29 CFR 1904.1 is the big one ^[1]. If you had 10 or fewer employees at all times during the prior calendar year, you skip the OSHA 300 Log, the 300A Annual Summary, and the 301 Incident Report as a routine matter. You still report any fatality within 8 hours and any in-patient hospitalization, amputation, or eye loss within 24 hours, no matter your size ^[1].

The Emergency Action Plan at 29 CFR 1910.38 lets employers with 10 or fewer employees deliver the plan orally instead of on paper ^[4].

OSHA's On-Site Consultation Program gives free, confidential safety and health help to small and mid-sized businesses, and it runs completely separate from enforcement. Businesses with 250 or fewer employees at a site get priority access ^[12]. It's genuinely useful and badly underused.

Some state-plan states add their own accommodations on top. California's Cal/OSHA, for one, allows a simplified Injury and Illness Prevention Program for certain low-hazard small employers. If you're in a state-plan state, read your state agency's rules, because they often differ from federal OSHA in ways that matter.

Does the type of industry change what's required for a small business?

Yes, a lot. OSHA files its general industry standards under 29 CFR Part 1910, construction under Part 1926, agriculture under Part 1928, and maritime under Parts 1915 through 1919. Which part governs you depends on what your business does, not how big it is.

Construction is the cleanest example. A two-person roofing crew lives under 29 CFR Part 1926. The fall protection standard at 29 CFR 1926.502 requires written fall protection plans in certain situations, crew size be damned. The owner working next to one employee on a 20-foot roof gets no pass.

High-hazard industries like chemical manufacturing, healthcare, and oil and gas carry process-specific standards that apply based on chemical quantities or activities, not employee counts. A small chemical distributor storing chlorine above OSHA's threshold quantity triggers Process Safety Management under 29 CFR 1910.119 no matter how few people work the floor.

Low-hazard operations get off easy. A two-person accounting firm or a small clothing boutique may have almost nothing to write beyond a bare-bones hazard communication program covering cleaning chemicals. A truly low-hazard office with no chemicals, no heavy equipment, and no confined spaces has very little to put on paper, and that's the honest answer. But most small businesses, once they actually inventory their hazards, find two or three standards staring back at them.

For hazard communication specifically, almost nobody is exempt once you look at what's really on the shelves.

What happens if a small employer doesn't have required written programs?

OSHA cites small employers. It happens. There is no small-employer citation waiver, though the penalty math does bend for size.

Under OSHA's penalty formula, smaller employers get a break on the dollar amount. Employers with 25 or fewer employees get a 60% reduction on proposed penalties. Employers with 26 to 100 employees get 40% ^[7]. The violation still lands on your record and can turn a future citation into a 'repeat,' which runs up to $16,550 per violation as of 2024 ^[7].

The deeper problem is what a missing written program usually signals. If the paperwork isn't there, the underlying hazard controls often aren't either. That's where people get hurt. BLS reported that private-sector employers logged 2.8 million nonfatal workplace injuries and illnesses in 2022, and smaller establishments run higher injury rates per worker in several high-hazard sectors ^[8].

When a worker gets injured and OSHA shows up, the absence of a required written program is almost always on the citation. The document also becomes evidence in workers' comp disputes and liability claims. A small employer with no written lockout/tagout program and a worker hurt by unexpected machine energization is standing on very thin legal ice.

OSHA's incident report rules apply to fatalities and serious injuries at every size of employer.

How do you figure out exactly which written programs your small business needs?

Start with a hazard inventory, not a standards list. Walk the floor and write down every source of harm: chemicals, equipment, electrical systems, heights, confined spaces, biological materials, vehicles. That list drives which standards apply, which tells you which written programs you owe.

Here's a screen that works:

1. Do any employees work with or around hazardous chemicals? Yes = written Hazard Communication Program (29 CFR 1910.1200) ^[2]. 2. Does anyone service, maintain, or clean equipment where unexpected startup could hurt them? Yes = written Lockout/Tagout energy control program (29 CFR 1910.147) ^[3]. 3. Do employees enter spaces big enough to bodily enter, not built for continuous occupancy, with limited entry or exit? Yes = evaluate for permit-required confined spaces (29 CFR 1910.146), which requires a written program ^[11]. 4. Do employees use respirators, even voluntarily? Yes = written Respiratory Protection Program (29 CFR 1910.134) ^[5]. 5. Do you employ more than 10 people? Yes = written Emergency Action Plan (29 CFR 1910.38) ^[4]. Ten or fewer = oral plan is fine. 6. Are employees exposed to blood or other potentially infectious materials? Yes = written Exposure Control Plan (29 CFR 1910.1030).

Those six questions catch most written-program requirements for a typical small business. In construction, add a pass through 29 CFR Part 1926 for fall protection, scaffolding, and excavation.

If your operation is complicated, OSHA's free On-Site Consultation Program helps you find gaps without triggering enforcement. Start at osha.gov ^[12].

What does a minimally compliant written safety program actually look like?

A written safety program is not a 200-page binder. OSHA's standards describe the required content, and for most small businesses that content is specific and short.

Take Hazard Communication. The written program has to cover how you keep a list of hazardous chemicals, how you manage labels, how employees can reach safety data sheets, and how you train people ^[2]. A solid HazCom program for a small business runs four to six pages.

A written Lockout/Tagout energy control program has to describe the program's scope, the energy-control rules, and the isolation techniques, plus carry equipment-specific procedures for each covered machine ^[3]. Those equipment procedures are usually the bulk of the document, and for simple machinery they can live in a plain table.

The content has to be three things: accurate for your actual workplace, reachable by employees (not locked in a desk drawer), and updated when conditions change. It does not need special formatting, special paper, or a signature from anyone beyond what your own process calls for.

For owners who want these built fast, SafetyFolio's safety program generator walks the required elements for each applicable standard and produces a document in about 15 minutes instead of 15 hours.

State-plan states, check your agency. California's IIPP standard, for one, requires elements federal OSHA never mentions.

Do state-plan states have different rules for small employers?

Yes, and this one bites people. Twenty-two states and two territories run their own OSHA-approved state plans covering private-sector employers ^[9]. Each state plan has to be at least as effective as federal OSHA, but it can go stricter, and several do.

California's Cal/OSHA requires every employer, regardless of size, to keep a written Injury and Illness Prevention Program (IIPP) under California Code of Regulations Title 8, Section 3203. No small-employer exemption for the IIPP itself, though Cal/OSHA allows a simplified version for certain low-hazard employers. That's stricter than federal OSHA, full stop.

Washington State's WISHA program similarly requires an Accident Prevention Program from most employers.

Michigan, North Carolina, Virginia, Oregon, and others run state-plan agencies with rules that can diverge from federal OSHA. So the practical move is simple: if you're in a state-plan state, look up your state agency directly ^[9].

Assuming federal rules apply everywhere is how a small employer gets cited under state law for something they were sure was fine.

Is a written safety program worth building even when it's not technically required?

Honest answer: yes, for most small businesses, even where the letter of the law doesn't force it.

Here's the money case. Workers' comp premiums tie directly to your experience modification rate (EMR), which tracks your claims history. One serious injury can spike a small business's EMR and push premiums up by thousands of dollars across three policy years. A documented safety program is evidence you took reasonable precautions, and that can move both the claim outcome and the insurance relationship in your favor.

General liability coverage for contractors increasingly hinges on demonstrated safety practices. Plenty of project owners and general contractors demand proof of a safety program before a subcontractor sets foot on site. A two-person electrical sub with no written program just loses bids.

There's a quieter benefit too. Writing your procedures down forces you to think them through. A small manufacturer who writes a lockout/tagout procedure for each machine has to name every energy source on that machine, and that's the exact mental work that stops injuries before they happen.

One warning. A written program that doesn't match what you actually do can be worse than no program in litigation, because it sets a standard of care you then visibly broke. Write what you do, or change what you do to match what you wrote. The paper and the practice have to line up.

Worth checking what OSHA training your people need alongside any program you build.

How often does OSHA actually inspect small businesses?

OSHA reaches a tiny slice of workplaces each year. In federal fiscal year 2023, the agency ran roughly 33,000 inspections nationwide ^[10]. Against something like 10 million workplaces under its jurisdiction, the odds of a random programmed inspection landing on any single business in a given year are very low.

Most inspections aren't random, though. They come from a fatality or catastrophe (mandatory), an employee complaint (high priority), a referral from another agency, or a local or national emphasis program aimed at a specific industry or hazard. If a worker gets hurt and calls OSHA, an inspection follows, and your headcount doesn't matter.

Small employers in high-hazard industries also draw OSHA's Site-Specific Targeting program, which uses BLS injury and illness data to steer inspections toward establishments with above-average injury rates. If your industry runs hot and you're not keeping records (even when exempt from routine recordkeeping), a national emphasis program can still pull you in.

The real inspection risk for a small employer isn't the surprise visit. It's the triggered inspection after something goes wrong. And that's the exact moment a missing written program costs you the most.

What's the simplest way for a small employer to get into compliance?

Do the hazard inventory first. This step decides everything downstream, and most small employers skip it to grab a generic template online that has nothing to do with their actual operation.

Once you know your hazards, match them to the standards that apply using the six-question screen above, or pull OSHA's free Small Business Compliance Guides from osha.gov. OSHA publishes plain-language guides for many standards that tell a small employer exactly what to do.

For building the document, you've got three routes. Write it yourself using OSHA's compliance guides and the standard text as your outline. Grab a template from a trade association (many industry groups publish standard-specific templates for members). Or use a tool built for this, like SafetyFolio, which structures the required content for each applicable standard and lets you drop in your workplace-specific details.

Whatever route you pick, the document has to name your actual workplace, describe your actual procedures, and list your actual chemicals or equipment. A generic template with your company name slapped on the cover is not a compliant written program. OSHA compliance officers have read every template in circulation and can tell in a glance when the paper doesn't match the room they're standing in.

Then train your people on the content. Written programs that employees have never seen or been trained on don't count as compliant, even if the writing is flawless. Standards like Hazard Communication ^[2] and Lockout/Tagout ^[3] carry explicit training requirements tied to the written program.

For lockout tagout especially, documented employee training matters as much as the written program itself.

Frequently asked questions

Does the 10-employee OSHA exemption mean I don't need any safety programs?

No. The 10-employee exemption at 29 CFR 1904.1 applies only to routine injury and illness recordkeeping logs. It cancels no written-program requirement in OSHA's safety standards. If a standard's text says 'written program required,' you need it regardless of headcount. Common examples: Hazard Communication (29 CFR 1910.1200), Lockout/Tagout (29 CFR 1910.147), and Respiratory Protection (29 CFR 1910.134) all require written programs with no size exemption.

What is the OSHA recordkeeping exemption for small businesses exactly?

Employers with 10 or fewer employees at all times during the previous calendar year are exempt from routinely keeping OSHA 300 Logs, 300A Annual Summaries, and 301 Incident Reports, under 29 CFR 1904.1. The exemption vanishes if OSHA or BLS requests records. It also does not exempt you from the 8-hour fatality reporting rule or the 24-hour rule for in-patient hospitalizations, amputations, or eye losses, which apply to all employers at any size.

If I only have 2 or 3 employees, do I still need a written Hazard Communication program?

Yes, if your employees may be exposed to hazardous chemicals. The Hazard Communication Standard at 29 CFR 1910.1200 covers any OSHA-covered employer whose workers could encounter hazardous chemicals. There is no small-employer headcount exemption in that standard. A two-person auto body shop using paint, solvents, or body filler has hazardous chemicals and needs a written HazCom program, a chemical list, safety data sheets, and documented employee training.

Does a small business in a state-plan state have different written program requirements?

Often yes, and often stricter. California, Washington, Michigan, Oregon, and 18 other states run OSHA-approved state plans that can exceed federal requirements. California's IIPP standard requires every employer, regardless of size, to keep a written Injury and Illness Prevention Program. There is no blanket small-employer exemption in California for the IIPP itself. Always check your state agency's rules directly if you operate in a state-plan state.

What OSHA penalty reduction do small employers get if they're cited?

OSHA's penalty structure includes a size-based reduction. Employers with 25 or fewer employees receive a 60% reduction on proposed penalty amounts. Employers with 26 to 100 employees receive a 40% reduction. These reductions apply to the base penalty before gravity adjustments. A reduced penalty is still a penalty, and repeat violations (same standard cited again within three years) carry much higher maximums, up to $16,550 per violation as of 2024.

Does a small employer need a written Emergency Action Plan?

It depends on headcount. The Emergency Action Plan standard at 29 CFR 1910.38 requires a written EAP for employers with more than 10 employees. Employers with 10 or fewer may communicate the plan orally instead. This is one of the genuine small-employer accommodations in the OSHA code. Even where oral communication is allowed, writing the plan down is good practice and may be required by your state plan.

Can OSHA inspect a business with fewer than 10 employees?

Yes. OSHA has no minimum-size threshold for inspections. Fatalities, catastrophes, and employee complaints trigger inspections at employers of any size. In fiscal year 2023, OSHA ran roughly 33,000 inspections nationally. Most were complaint-driven or fatality-triggered, not random. A small employer whose worker is injured badly enough to require hospitalization should expect an OSHA inspection regardless of payroll size.

What written programs does a small construction company need?

Construction employers fall under 29 CFR Part 1926, not Part 1910. Required written programs depend on the work but commonly include a Hazard Communication program (1926.59), fall protection plans when certain methods are used (1926.502), a written confined-space program if permit-required spaces are present, and scaffolding-related documentation. There is no small-crew exemption from these standards in construction. Even a two-person roofing crew must comply with applicable Part 1926 requirements.

Is there free help for small businesses to figure out OSHA written program requirements?

Yes. OSHA's On-Site Consultation Program offers free, confidential safety and health visits to small and mid-sized businesses, separate from enforcement. Businesses with 250 or fewer employees at a site get priority access. OSHA also publishes free Small Business Compliance Guides on osha.gov for many standards. These guides explain required written-program elements in plain language and are the most underused free resource available to small employers.

Does a home-based business need OSHA written safety programs?

OSHA's general industry standards technically apply to any covered employer. That said, OSHA has stated through Letters of Interpretation that it generally will not inspect home offices or the home portion of home-based work. If you employ workers who come to your home to work, or you run home-based industrial activities, the analysis shifts. The safest move is to identify your actual hazards and check with OSHA or a consultant if you're unsure.

How long does it take to write a basic safety program for a small business?

Realistically, two to eight hours for a business with one or two applicable standards, assuming you know what to write. A Hazard Communication program can be drafted in an hour or two once your chemical list is ready. Lockout/Tagout takes longer because equipment-specific procedures add time. Tools that template the required content and prompt you for workplace-specific details can cut this to 15 to 30 minutes per program. The chemical inventory and hazard assessment usually eat the most time.

What's the difference between a safety program and a safety plan?

OSHA uses both terms without a consistent technical distinction. 'Written program' and 'written plan' appear interchangeably across standards to mean a documented set of procedures, policies, and responsibilities for managing a specific hazard. A Lockout/Tagout energy control program and an Emergency Action Plan are both written documents describing how the employer manages a hazard category. The label matters less than the required content, which comes from the standard's text.

Do I need a full written safety manual or just individual standard-specific programs?

OSHA requires specific written programs tied to specific standards; it does not require a single consolidated safety manual. Many small businesses find it easier to keep individual documents for each applicable standard (a HazCom program, a LOTO program, a respiratory protection program) rather than one combined manual. A combined manual is fine if it holds all required elements. OSHA checks whether the required content is present and reflects the actual workplace, not whether the documents are bound together.

Sources

1. OSHA, 29 CFR 1904.1 - Partial exemption for employers with 10 or fewer employees: Employers with 10 or fewer employees are partially exempt from routine OSHA injury and illness recordkeeping requirements under 29 CFR 1904.1
2. OSHA, 29 CFR 1910.1200 - Hazard Communication Standard: The Hazard Communication Standard requires a written hazard communication program for employers whose workers may be exposed to hazardous chemicals, with no small-employer headcount exemption
3. OSHA, 29 CFR 1910.147 - Control of Hazardous Energy (Lockout/Tagout): The Lockout/Tagout standard requires a written energy control program when workers service or maintain equipment where unexpected energization could cause injury, with no small-employer exemption
4. OSHA, 29 CFR 1910.38 - Emergency Action Plans: Employers with 10 or fewer employees may communicate their Emergency Action Plan orally rather than in writing under 29 CFR 1910.38
5. OSHA, 29 CFR 1910.134 - Respiratory Protection: The Respiratory Protection standard requires a written respiratory protection program when respirators are used or required, with no small-employer exemption
6. OSHA, Penalties page - Penalty Reduction Factors: Employers with 25 or fewer employees receive a 60% penalty reduction; employers with 26-100 employees receive a 40% reduction; repeat violations can reach $16,550 per violation as of 2024
7. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program (2022 data): Private-sector employers reported 2.8 million nonfatal workplace injuries and illnesses in 2022
8. OSHA, State Plans - Overview and List of State Plan States: Twenty-two states and two territories operate OSHA-approved state plans that cover private-sector employers and may have requirements stricter than federal OSHA
9. OSHA, Enforcement Data: OSHA conducted approximately 33,000 inspections in federal fiscal year 2023
10. OSHA, 29 CFR 1910.146 - Permit-Required Confined Spaces: The Permit-Required Confined Spaces standard requires a written confined space program when permit-required confined spaces are present, with no small-employer exemption
11. OSHA, On-Site Consultation Program: OSHA's On-Site Consultation Program offers free, confidential safety and health consultation to small and medium businesses separate from enforcement; businesses with 250 or fewer employees at a site receive priority