Emergency action plan requirements for a business with 10 employees

Last updated 2026-07-09

Does OSHA actually require an emergency action plan for a small business?

Yes. There's no small-employer exemption. OSHA's emergency action plan standard at 29 CFR 1910.38 applies to most general industry workplaces regardless of size, and several industry-specific standards (maritime, construction, and certain fire safety rules) pull it in by reference or carry parallel requirements. ^[1]

What changes for small businesses is the format, not the requirement. If your business has 10 or fewer employees at the time of the inspection, OSHA lets the plan exist entirely in oral form. You still need a plan. You just don't have to put it on paper. Cross 11 employees and the plan must be written, kept at the workplace, and handed to any employee who asks for it. ^[1]

Plenty of owners near that line write the plan anyway. That's the right call. An oral plan stored in the manager's head disappears the moment that person is sick, on vacation, or the one who got hurt. Write it down no matter your headcount.

What must an emergency action plan include under 29 CFR 1910.38?

The standard lists the minimum elements, and there aren't many. Your plan has to contain these six things at a minimum: ^[1]

Required Element	What it means in practice
Emergency escape procedures and routes	Specific exit paths for each area of the building, posted or referenced
Procedures for employees who stay to operate critical equipment	Shutdown sequences before evacuation for things like ovens, presses, or chemical processes
A way to account for all employees after evacuation	A headcount process at the designated assembly area
Rescue and medical duties	Who calls 911, who has first aid training, where the AED is
Means for reporting fires and other emergencies	How employees signal an emergency (pull station, verbal alarm, phone system)
Names and job titles of people who can give more information	A contact list employees can consult about the plan

That last point trips people up. OSHA doesn't force you to name one "emergency coordinator" by name, though that's good practice. It does require you to list either a name or a job title so any employee knows exactly who to ask.

The plan also has to address how employees who can't self-evacuate (workers with mobility limitations, for instance) get help. OSHA folds this into the broader employee accounting requirement, and inspectors look for it specifically in workplaces with known accommodation needs.

Does the 10-employee rule mean you only need an oral plan, or no plan at all?

An oral plan is still a real plan. The 10-employee threshold only decides whether OSHA can require you to produce a written document. The substance (escape routes, alarm methods, employee accounting, designated contacts) applies to every employer, paper or not.

Here's the practical trap with leaning on the oral exemption. OSHA compliance officers can and do ask your employees to describe the emergency procedures. If your workers give inconsistent or blank answers, that's evidence the plan doesn't actually exist in any working form. You can be cited under 1910.38(a) even with a headcount of eight.

The math on writing it down is easy. A basic one-page EAP for a small office or shop takes maybe two hours to draft. Two hours against a citation is not a hard trade.

Who is responsible for the emergency action plan in a small business?

OSHA puts the responsibility on the employer, period. You can name an employee as the plan coordinator or "emergency action plan administrator," but legal accountability stays with the business owner or the controlling entity. ^[1]

For day-to-day work, most businesses with 10 to 30 employees hand EAP duties to the office manager, facilities lead, or operations manager. List at least two people by name or title, a primary and a backup, who own these jobs: sounding the alarm, accounting for everyone at the assembly point, coordinating with responders, and authorizing re-entry.

A single point of failure is the most common gap I see in small business plans. If your only designated emergency contact is also the person likely to be calling 911 from inside the building, fix that before an inspector does it for you.

What training do employees need for an emergency action plan?

29 CFR 1910.38(e) requires employers to train enough employees that the plan can actually be carried out. The standard's exact words: employers must "designate and train a sufficient number of persons to assist in the safe and orderly evacuation of employees." ^[1]

Training has to happen at three moments:

1. When the plan is first developed and put in place. 2. When a new employee is hired into a covered workplace. 3. When the plan changes, or when an employee's responsibilities under the plan change.

The standard sets no minimum training hours and no required format. A 20-minute walkthrough covering the exit routes, the assembly area, the alarm system, and who's in charge is legally enough, as long as you document it. The documentation doesn't need to be fancy. A sign-in sheet with the date, the trainer's name, and the topic is enough to show OSHA you did it.

Practice drills aren't explicitly required by 1910.38 for general industry. They are required in some sectors (fire brigades under 1910.156, certain covered chemical processes under the process safety management standard at 1910.119). For most small businesses, OSHA recommends drills but names no frequency. One drill a year is a reasonable baseline, and it's the kind of thing an OSHA area office views well during an inspection.

If your crew needs broader safety training beyond the EAP, OSHA training resources and the OSHA 30 program cover supervisor-level emergency response in more depth.

How does the alarm system requirement work for a small workplace?

29 CFR 1910.165 sets the alarm rules that plug directly into your EAP. Your alarm system, whether a horn, bell, strobe, intercom, or voice announcement, has to be perceivable above the ambient noise and light in the facility. ^[3]

For a quiet office with 10 people, a verbal announcement or a single horn near the front door may be fully compliant. For a small shop with loud equipment, you almost certainly need a louder device, a visual strobe, or both.

The EAP itself must describe the alarm signal that starts an evacuation, and that description has to set it apart from any other alarms at the facility. If the same horn signals both a fire and a shift change, employees need to tell them apart. That clarity belongs in the written plan.

Store flammable liquids, run a spray booth, or have other fire hazards on site? Check whether 29 CFR 1910.157 (portable fire extinguishers) or 1910.159 (sprinkler systems) also apply. Those standards carry their own alarm and notification provisions that stack on top of 1910.38. ^[4]

What does an emergency action plan need to say about evacuation routes?

The plan must spell out the escape procedures and routes. In practice that's a floor plan or clear written description showing the primary exit from each work area, at least one alternate route per area in case the primary is blocked, the assembly location outside the building, and the headcount method used once people gather. ^[1]

OSHA doesn't want an architect's drawing. A hand-drawn diagram works, even a rough one. It just has to be accurate, legible, and posted where employees can see it.

A few things inspectors look for that are easy to miss:

• Exit routes can't run through high-hazard areas. 29 CFR 1910.36 governs exit route design and specifically bars routing employees through areas that expose them to added hazards during evacuation. ^[5]
• Exit doors must be side-hinged and swing toward exit travel (outward) once a room's occupancy passes the threshold. That's a building code issue as much as OSHA, but inspectors flag it.
• Evacuation maps must be updated when the floor plan changes. A map showing walls that no longer exist is worse than no map.

If you keep hazardous materials on site, the plan should note where the safety data sheets live so responders can grab them fast. That ties back to your hazard communication obligations under 29 CFR 1910.1200.

What happens if OSHA finds your business doesn't have an emergency action plan?

A missing or weak EAP is usually cited as Other-Than-Serious, which carries a maximum penalty of $16,550 per violation as of 2024. ^[6] That ceiling moves every year under the Federal Civil Penalties Inflation Adjustment Act. Repeat or willful violations, where OSHA can show you knew and did nothing, reach $165,514 per violation.

In practice, a first-time citation for a missing written EAP at a small business with no injury history usually shrinks after the informal conference, sometimes to a few hundred dollars with quick abatement. But the citation lands on your OSHA inspection history, which is public through the OSHA Information System.

The fine isn't the real risk. The real risk is liability after an actual emergency. If workers are hurt during an evacuation and the business had no documented plan, no training records, and no assembly point, a plaintiff's attorney will use that OSHA violation as evidence of negligence in a way a $1,500 penalty never captures.

EAP citations also show up as collateral findings during inspections triggered by something else. An inspector arrives on a forklift complaint (see forklift certification requirements), walks the floor, and notices the exits aren't marked and nobody can name the assembly point. That's a separate citation, even though it wasn't why they came.

Does your EAP need to cover natural disasters, active threats, or just fires?

OSHA wrote 1910.38 for all emergencies, not only fires. The regulation says "fires or other emergencies" throughout. Your plan should cover the emergencies that are plausible at your specific location. ^[1]

For most small businesses, that means at least:

• Fire (the most common scenario and the one inspectors focus on)
• Severe weather (tornado, hurricane, or winter storm, depending on geography)
• Medical emergencies
• Utility failures (gas leak, power outage)

Active shooter and workplace violence protocols aren't currently mandated by 1910.38, though OSHA has published guidance recommending them and has cited employers under the General Duty Clause (Section 5(a)(1) of the OSH Act) for ignoring known violence hazards. ^[7] If your workplace has had prior incidents or runs in a higher-risk setting like late-night retail, add a shelter-in-place protocol.

FEMA's free "Ready Business" resources and OSHA's own emergency preparedness pages have scenario templates you can adapt. Neither costs money or requires a login.

How do you actually write the plan? What does a compliant EAP look like?

A compliant EAP for a 10-person business is short. A single laminated page, or two pages, covers every required element for most workplaces. Here's the structure that satisfies 1910.38:

1. Purpose and scope (one sentence) 2. Reporting emergencies (how to call 911, how to sound the alarm, who calls the fire department) 3. Evacuation procedures (routes by area, assembly location, accountability method) 4. Employees who stay behind (who shuts down equipment, in what sequence, when they leave) 5. Accounting for employees (name the supervisor responsible for the headcount) 6. Rescue and medical duties (who has first aid training, where the kit and AED are) 7. Contacts for more information (names and titles, with phone numbers)

Include a floor diagram showing exit routes. Date it. Sign it. Keep a copy somewhere known and tell employees where.

If the writing is the obstacle, the SafetyFolio program generator can produce a custom EAP in about 15 minutes by walking you through your facility type, hazards, and headcount. That's faster than most people spend staring at a blank page trying to figure out where to start.

Update the plan when you move to new space, renovate, add major equipment, or when the designated contact leaves. OSHA sets no review cycle in 1910.38, but an annual review is standard practice and easy to document.

Are there state plan states where the rules are stricter than federal OSHA?

Yes. Twenty-two states and two territories run their own OSHA-approved state plans that must be "at least as effective" as federal OSHA and can go further. ^[8] Several impose stricter or more specific EAP requirements:

• California (Cal/OSHA) requires an Injury and Illness Prevention Program (IIPP) under 8 CCR 3203, which builds in emergency response planning as a mandatory component. The IIPP must be written regardless of employer size. ^[9]
• Oregon OSHA carries specific requirements for emergency eyewash stations and emergency response that go past the federal baseline.
• Michigan (MIOSHA) publishes additional small-employer guidance clarifying EAP expectations above the federal standard.

In a state plan state, check your state occupational safety agency's website alongside federal 29 CFR 1910.38. The requirements are usually free online and written in plain language.

Federal OSHA directly covers the other 28 states and the District of Columbia. Not sure which applies to you? OSHA's website has a tool to pin down your jurisdiction.

How does an EAP connect to other required written safety programs?

The EAP rarely stands alone. Several other OSHA standards reference it or sit right beside it on the compliance checklist:

• 29 CFR 1910.157 (portable fire extinguishers) requires a written fire prevention plan if employees will fight incipient-stage fires instead of evacuating. If your policy is evacuate-only, which is the safe call for most small businesses, you skip the fire prevention plan but you do have to document the evacuate-only policy in your EAP. ^[4]
• 29 CFR 1910.1200 (hazard communication) requires that responders reach SDS information. Your EAP should say where the SDS binder or electronic system lives and how first responders get to it. ^[10]
• 29 CFR 1910.147 (lockout/tagout) requires written shutdown procedures for certain employees who operate equipment before evacuation or during emergencies. Reference those procedures in your EAP. See lockout tagout for the standalone requirements.
• 29 CFR 1910.151 (medical services and first aid) requires trained first aid personnel unless a clinic or hospital is in near proximity. That person, and that proximity call, belong in your EAP's medical duties section. ^[11]

If your business ever has an injury that becomes an OSHA recordable or a 300 log entry, the incident report process ties back to how well your EAP held up during the event. A written plan makes the post-incident paperwork much cleaner.

For businesses building a full stack of written programs from scratch, SafetyFolio's generator produces an EAP alongside hazcom, lockout/tagout, and the rest in one session, so the cross-references line up from the start.

Frequently asked questions

Does a business with exactly 10 employees need a written emergency action plan?

No, not technically. 29 CFR 1910.38 requires a written EAP only when the employer has more than 10 employees. A business with exactly 10 can keep an oral plan. That said, writing it down is strongly recommended. An oral plan employees can't accurately describe during an inspection gets treated as no plan at all, and the duty to have a functional plan applies at any headcount.

How often does an emergency action plan need to be reviewed or updated?

29 CFR 1910.38 sets no fixed review interval. It does require review with each covered employee when the plan changes or when their responsibilities change. Best practice is an annual review. Any time you renovate, move locations, change your alarm system, or the designated emergency contact leaves, the plan needs an immediate update.

Can one document serve as both the emergency action plan and the fire prevention plan?

Yes. OSHA allows an employer to combine the EAP and fire prevention plan into one document. 29 CFR 1910.38 and 1910.39 are separate standards, but nothing prohibits meeting both in a single written program. Most small businesses find one combined document, organized into clear sections, easier to maintain than two separate files. ^[12]

What counts as an emergency for purposes of the OSHA EAP standard?

The standard covers fires and 'other emergencies' without listing them exhaustively. In practice, your plan should address any emergency reasonably foreseeable at your workplace, which usually means fires, severe weather, gas leaks, medical emergencies, and power outages. Chemical spills apply if you store or use hazardous materials. Active threat protocols are recommended but not currently mandated by 1910.38.

Do part-time employees count toward the 10-employee threshold?

OSHA hasn't published an interpretation letter that settles this for 1910.38 specifically, but the agency's general practice is to count all employees who may be present at the workplace, including part-time workers. If you have six full-time and six part-time workers who overlap on one shift, most compliance officers would treat that as a 12-person workplace that needs a written plan.

Does the emergency action plan need to be posted on the wall?

No. 29 CFR 1910.38 requires the written plan to be kept at the workplace and made available to employees on request, but it doesn't require posting it. Evacuation route maps, though, are commonly posted near exits. Many businesses post a one-page EAP summary in the break room or by the main exit as a practical matter, even though OSHA doesn't require it.

What is the OSHA penalty for not having a written emergency action plan?

A first violation is usually Other-Than-Serious, with a maximum penalty of $16,550 per violation as of 2024. Actual penalties for small businesses with no injury history often drop through the informal settlement process. Repeat or willful violations can hit $165,514 per violation. The bigger exposure is civil liability if an injury happens and no documented plan exists.

Does OSHA require emergency drills for businesses with 10 employees?

Not in general industry. 29 CFR 1910.38 requires training on the plan but doesn't mandate drills for most employers. Specific sectors like healthcare carry additional drill requirements. OSHA strongly recommends at least one drill a year in its guidance, and running an annual drill noticeably improves your inspection posture if a compliance officer shows up.

What should the assembly area look like and how far from the building should it be?

OSHA sets no minimum distance. The assembly area must be outside the building, clear of emergency vehicle routes, and somewhere a headcount can actually happen. Common practice is at least 50 feet from the structure. The specific spot must be named in your EAP so employees know exactly where to go without waiting for direction during an emergency.

Do remote or home-based employees need to be covered by the EAP?

OSHA's EAP standard applies to the physical workplace the employer controls. For employees working permanently from their own home space, 1910.38 doesn't typically extend there. If remote workers regularly work in a company-controlled facility, they must be trained on that facility's EAP. Hybrid workers should be trained on the office plan for the days they come in.

Is a fire extinguisher required as part of the emergency action plan?

Not necessarily. Under 29 CFR 1910.157, if your policy is that all employees evacuate immediately upon discovering a fire rather than fighting it, you aren't required to provide portable fire extinguishers. You do have to document that evacuation-only policy. If you provide extinguishers and let employees use them, a separate fire prevention plan and extinguisher training are required.

How do I train employees on the emergency action plan if they speak different languages?

OSHA requires training that employees actually understand, which makes language your responsibility, not the worker's. For a multilingual crew, translate the plan into each language spoken by workers with limited English, and deliver training in a language they understand. OSHA has cited employers for running safety training only in English when the workforce was mostly Spanish-speaking.

Can a small business use a free EAP template instead of hiring a consultant?

Yes. OSHA provides free EAP resources and a template at osha.gov. The standard isn't complicated for a 10-employee business in a low-hazard setting, and many owners write a compliant plan from a template in an hour or two. A consultant earns their fee if your facility has complex chemical hazards, multiple floors, or specialized equipment. For a basic office or retail space, it's rarely worth the cost.

Sources

1. OSHA, 29 CFR 1910.38 Emergency Action Plans: Requires written EAP for employers with more than 10 employees; oral plan permitted at or below 10; minimum plan elements specified
2. OSHA, 29 CFR 1910.165 Employee Alarm Systems: Alarm systems must be perceivable above ambient noise and light levels throughout the facility
3. OSHA, 29 CFR 1910.157 Portable Fire Extinguishers: Employers who adopt an evacuation-only fire policy are not required to provide portable fire extinguishers; written policy required
4. OSHA, 29 CFR 1910.36 Design and Construction Requirements for Exit Routes: Exit routes must not pass through areas that expose evacuating employees to additional hazards
5. OSHA, Civil Penalty Amounts (2024 adjustments): Maximum penalty for Other-Than-Serious violations is $16,550 per violation; willful or repeat violations up to $165,514 per violation as of 2024
6. OSHA, Workplace Violence overview and General Duty Clause guidance: OSHA has cited employers for failing to address known workplace violence hazards under Section 5(a)(1) General Duty Clause
7. OSHA, State Plans overview page: 22 states and 2 territories operate OSHA-approved state plans that must be at least as effective as federal OSHA
8. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: Requires that safety data sheets be accessible to employees and emergency responders
9. OSHA, 29 CFR 1910.151 Medical Services and First Aid: Requires trained first aid personnel at the workplace unless a clinic or hospital is in near proximity
10. OSHA, 29 CFR 1910.39 Fire Prevention Plans: EAP and fire prevention plan may be combined into one document