How to write an OSHA hazard communication program for a 5-person shop

Last updated 2026-07-09

What is an OSHA hazard communication program and who has to have one?

A hazard communication program, sometimes called a HazCom program or the "right-to-know" program, is the written document that explains how your shop identifies chemical hazards, tells employees about them, and trains workers to protect themselves. The legal hook is 29 CFR 1910.1200, OSHA's Hazard Communication Standard. It applies to any employer whose workers may be exposed to hazardous chemicals during normal work or in a foreseeable emergency. ^[1]

That includes you. Even if you have two employees and nothing scarier on the shelf than spray lubricant and aerosol cleaner.

OSHA adopted the Globally Harmonized System (GHS) of classification and labeling in 2012, and the updated standard has been fully in effect since June 1, 2016. ^[1] If your written program still talks about MSDS sheets or leans on the old NFPA diamond as your primary labeling system, it's out of date, and an inspector will write it up.

The standard covers general industry under 29 CFR Part 1910, construction under 29 CFR 1926.59, and maritime separately. ^[9] This article is about general industry: manufacturing, auto repair, fabrication, small production shops. The five required elements are identical across all sectors, so the bones of your program don't change.

Here's what small employers get wrong. They think size matters. OSHA's HazCom standard has no employee-count threshold. A 5-person welding shop and a 500-person auto plant carry the same written-program obligation. The only real difference is length. A small shop's program can run shorter because the chemical list is shorter and the work processes are fewer.

What are the 5 required elements of a written HazCom program?

29 CFR 1910.1200(e) spells out exactly what your written program has to address. Five elements. The standard names each one. ^[1]

1. A statement that the program exists and how it works. A written document that says your shop has a HazCom program, names who runs it, and shows how the pieces connect. One page covers it for a small shop.

2. A list of hazardous chemicals in the workplace. This is your chemical inventory. It has to cover every chemical in the shop, including products employees bring in and gases used in processes like welding. ^[1]

3. Safety Data Sheets (SDS) for every chemical. One SDS per chemical on your list, kept where employees can reach them on every shift (not locked in the office), updated when new products arrive. The SDS is the standardized 16-section document your supplier is legally required to hand you. ^[2]

4. Labels on containers. Every container needs a GHS-compliant label with the product identifier, signal word ("Danger" or "Warning"), hazard statements, precautionary statements, and pictograms. Labels you make for secondary containers (the spray bottle you filled from a drum) need at minimum the product name and the right hazard warnings. ^[1]

5. Employee training. Workers get trained before their first assignment to any area where hazardous chemicals are present. Training has to cover how to read an SDS, what the GHS label elements mean, the specific hazards in their work area, and how to protect themselves. ^[1]

That's the whole list. The regulation is short and readable. Pull up 29 CFR 1910.1200 on OSHA's site and write your program straight from it. Plenty of experienced safety people do exactly that.

How do you build a chemical inventory for a small shop?

Walk your shop with your phone and photograph every chemical product you see. Start with the obvious ones: paints, solvents, cleaners, lubricants, adhesives. Then catch the ones everybody forgets. The can of penetrating oil. The propane cylinders at the welding station. The acid in the forklift batteries. The compressed gas cylinders in the corner.

For each product, write down the name as it appears on the label, the manufacturer, and where it lives in the shop. That's your starting inventory.

A few judgment calls. Chemicals in "consumer quantities," used the same way and as often as a regular consumer would use them, are technically exempt under 29 CFR 1910.1200(b)(6)(ix). ^[1] But inspectors read that exemption narrowly. If your crew uses a cleaning product over and over all day, the consumer exemption won't save you. When in doubt, list it.

Your inventory doesn't need to be a database. A spreadsheet with five columns does the job: chemical name, manufacturer, SDS on file (yes/no), storage location, primary hazard class. A 5-person shop usually lands somewhere around 20 to 60 chemicals. Fabrication shops can top 100, mostly because every paint color and coating counts on its own.

Update the list every time a new product comes in. Hand that job to one person. Make it everyone's job and it becomes nobody's job.

Where do you get Safety Data Sheets and how do you keep them organized?

Your supplier or manufacturer has to give you an SDS with the first shipment of any hazardous chemical, and again after they update the sheet. ^[1] If one doesn't show up, ask for it. Most manufacturers post SDS files on their websites. OSHA also links out to SDS resources from its Hazard Communication page. ^[3]

A three-ring binder works fine for a small shop. Sort the sheets alphabetically or by work area, drop a table of contents in the front, and keep the binder where any employee can grab it without hunting down a supervisor. A second copy in a weather-resistant box near the main exit helps emergency responders.

Electronic storage is allowed under 29 CFR 1910.1200(g)(9). The catch: the system has to be reliable, employees have to know how to use it, and you need a backup for the moment it goes down mid-shift. ^[1] For most 5-person shops, a binder is simpler and harder to break.

Check your SDS files once a year. GHS-format sheets follow a standard 16-section layout. If you still have old MSDS documents in a pre-GHS format, swap them for current versions from the manufacturer. Section 2 ("Hazard Identification") is the one workers use most. Section 8 covers exposure limits and PPE. Section 9 covers physical and chemical properties. When a worker has a question about a chemical, the answer usually sits in one of those three sections.

For practice reading a real sheet, our hcl safety data sheet article goes through one line by line, which is handy training material.

What do GHS labels need to include, and what about secondary containers?

Shipped containers from manufacturers carry six label elements under GHS: product identifier, supplier identification, signal word, hazard statements, precautionary statements, and pictograms. ^[1] There are eight standardized GHS pictograms (flame, skull-and-crossbones, exclamation mark, and the rest), and which ones appear depend on how the chemical is classified.

You don't redesign manufacturer labels. That work is done. Your job is keeping the original labels on and readable. A label soaked in oil until you can't read it? Replace it.

Secondary containers are where small shops get cited. Pour paint thinner from a 5-gallon drum into a spray bottle and that bottle is a secondary container that needs a label. The label has to show the chemical identity ("paint thinner" or the product name) and the right hazard warnings. It doesn't need all six GHS elements if you run a workplace labeling system you've defined in your written program, but it needs enough for a worker to know what's inside and what to watch out for. ^[1]

Writing "FLAMMABLE PAINT THINNER" on masking tape with a marker is technically fine if your program names that as your secondary labeling system. A pre-printed label with the GHS pictograms holds up better in an inspection.

Two exceptions. A portable container one employee fills and uses up during a single shift doesn't need a label. Pipes and piping systems use alternative labeling methods. Both live in 29 CFR 1910.1200(f). ^[1]

What does HazCom training need to cover, and how do you document it?

Train employees before they work in any area where hazardous chemicals are present. Not within 30 days. Before. ^[1] This trips up shops that put new hires on the floor day one and pencil in training for "end of the week."

29 CFR 1910.1200(h) lists what training has to cover: the requirements of the standard itself, the operations in the work area involving hazardous chemicals, where the written program and SDS files are and how to reach them, the methods used to detect a chemical release, the physical and health hazards of the chemicals in the area, and the protective measures workers can take, including PPE, work practices, and emergency procedures. ^[1]

A 5-person shop doesn't need a classroom. A 45-minute walkthrough that hits every topic, backed by a sign-in sheet and a one-page quiz, does the job. The quiz is optional under the standard, but it's smart. It shows OSHA the worker absorbed the content instead of just sitting in the room.

Document all of it. Keep a record showing employee name, date, topics covered, and trainer's name. OSHA sets no specific retention period for HazCom training records, but three years is the common benchmark because it matches the general recordkeeping window under 29 CFR Part 1904. ^[4]

Refresher training is required when a new chemical or new hazard shows up, or when an employee clearly doesn't understand their protections. The standard doesn't require an annual refresher. Many shops run one anyway. That's a fine habit, it just isn't a legal mandate.

For a wider view of what OSHA requires on worker training, the osha training article maps out the full picture.

What does the actual written document need to say?

People overcomplicate this part. Your written HazCom program doesn't need 40 pages. Three to five pages of plain language covers a 5-person shop. Here's what a solid document includes.

Header section. Company name, effective date, the name of the person who maintains the program (your "HazCom coordinator"), and a signature from the owner or top manager.

Purpose statement. One paragraph saying this is your program under 29 CFR 1910.1200 and what it's built to do.

Chemical inventory. Either include it or point to where it lives ("attached as Appendix A" or "kept in the SDS binder at the shop entrance").

SDS procedures. Where the sheets are, how employees reach them, how you get SDS for new chemicals, and how often you review the collection.

Labeling procedures. How you handle incoming containers, how you label secondary containers, and what your secondary labeling system looks like.

Training procedures. When training happens (before first exposure), who runs it, what it covers, and where records live.

Non-routine tasks. If workers ever do jobs outside their normal routine that involve different chemical exposures, cleaning out a storage tank for example, the program has to say how you communicate hazards for those specific tasks. ^[1]

Contractor coordination. If outside contractors work in your shop, you have to tell them about hazardous chemicals they might be exposed to, give them access to your SDS files, and explain your labeling system. Contractors have to tell you about chemicals they bring in. ^[11] This one bites a lot of small businesses during inspections.

That's the whole document. OSHA's model programs and guidance give you sample language to adapt. ^[3] If the blank page is the real obstacle, SafetyFolio's safety program generator builds a compliant written program for your specific shop in about 15 minutes, based on your industry and chemical use.

One honest thing. A program written to pass an inspection isn't the same as a program that protects workers. Write it to be useful. Use words your employees will actually read.

How does OSHA enforce HazCom, and what are the penalties for a small shop?

Hazard communication is one of OSHA's most cited standards, year after year. In federal fiscal year 2023, HazCom ranked as the second most cited standard in general industry, with thousands of violations recorded. ^[5] The usual deficiencies: missing SDS sheets, unlabeled secondary containers, and no written program at all.

Penalties under OSHA's current structure, adjusted for inflation every year, run up to $16,550 per serious violation and up to $165,514 per willful or repeated violation as of 2024. ^[6] OSHA can group HazCom violations, so a shop with 15 unlabeled containers and no written program can pick up several citations in one visit.

Small employers get a break. Businesses with 10 or fewer employees qualify for a penalty reduction, usually in the 60 to 80 percent range, though the violation still lands on your record. ^[6] Fix problems fast and cooperate with the inspector and you can often negotiate further cuts through the informal settlement process.

The real risk for a 5-person shop isn't a random programmed inspection. OSHA's programmed inspections aim at higher-hazard industries. What pulls an inspector into a small shop is an employee complaint, a referral from another agency (a fire marshal, say), or an injury serious enough to require OSHA reporting. If one of your five workers gets hurt and tells the responding inspector nobody ever trained them on chemical hazards, you're looking at citations and penalties stacked on top of whatever workers' comp mess you're already handling.

For how OSHA investigations actually run and what to expect when an inspector shows up, the osha overview covers the process.

Do you need a separate HazCom program if you have a lockout/tagout program or other safety programs?

No. Your HazCom program is a standalone written document, but it doesn't have to be a standalone binder. Plenty of shops keep every required written program in one safety manual, with HazCom as a clearly labeled section. That's allowed.

What you can't do is let another program stand in for HazCom. A lockout/tagout program controls energy during maintenance, not chemical hazards. A PPE program specifies protective equipment but doesn't replace chemical hazard communication. These programs run alongside each other. None of them substitutes for another.

For shops that maintain equipment with chemical hazards in play (cleaning solvents used during a lockout, for instance), the HazCom program and the LOTO program should reference each other. Your LOTO procedure should note the chemicals workers might meet during a maintenance step, and the HazCom program should list those chemicals and point to the right SDS. Our lockout tagout article breaks down that standard.

If you're building a safety program from scratch and trying to figure out which written programs you actually owe OSHA, the hazard communication overview shows where HazCom sits among the other required programs.

What should you do when you add a new chemical to the shop?

This is where most small shops fall behind. They write a solid program, get everything current, then buy a new product six months later and do nothing with it. The program goes stale, and the next inspector finds a jug on the shelf with no SDS on file.

Build a simple routine for new chemicals.

1. Before buying any new chemical product, one person (usually the owner or shop manager in a 5-person operation) approves it. 2. That person requests the SDS from the supplier before or at first delivery. If it doesn't arrive with the shipment, call and ask. 3. Add the product to the chemical inventory. 4. File the SDS in the binder (or upload it to your electronic system). 5. If the chemical carries hazards workers haven't been trained on, train them before anyone uses it.

For most new products that resemble something already in your shop (a different brand of the same solvent), the training is quick: "New cleaner, here's its SDS, here's what's different." You don't need a full session every time.

29 CFR 1910.1200(h)(1) says training happens when new hazards enter the work area, not necessarily for every new product. ^[1] Still, when you're unsure, run a quick training and document it. The cost is 15 minutes and a signature. The cost of skipping it is a citation.

What's the easiest way to get a compliant HazCom program done quickly?

Writing from a blank page is the slow way. The fastest honest path, without paying a consultant, is OSHA's own small-employer material.

OSHA publishes a free "Hazard Communication: Small Entity Compliance Guide" that walks through each requirement with sample language. ^[3] Download it, use its model written program as your template, and fill in your company name, your chemical inventory, your procedures, and your employees' names. If your inventory is already done, that's 2 to 3 hours of work.

To cut it shorter, SafetyFolio's program generator assembles a written HazCom program tailored to your shop type in about 15 minutes, then lets you export a document you can print and sign.

Either way, once you have a draft, do one walkthrough with it in hand. Read the labeling section standing next to your chemical storage. Read the SDS section looking at your binder. If anything on paper doesn't match the physical shop, fix it before you sign. A program that describes one shop while you're standing in another is worse in an inspection than a simpler, honest program, because it tells the inspector the paperwork is just paperwork.

When it's done, put the effective date on it, sign it, and set it somewhere employees can see. Then set a calendar reminder to review it once a year and any time something significant changes: new chemicals, new processes, new employees who need training.

What records do you need to keep and for how long?

OSHA's HazCom standard doesn't set a retention period for most HazCom records. Related rules and plain good practice point toward keeping certain records longer.

Training records (who was trained, when, on what): most safety people hold these at least 3 years, matching OSHA's general injury recordkeeping window under 29 CFR Part 1904. ^[4] Some attorneys recommend keeping them for the length of employment plus 30 years when the chemicals can cause long-latency diseases like certain cancers.

Chemical inventory: keep the current version plus the last two annual versions. If OSHA investigates a chemical exposure from 18 months back, you want to show what was in the shop then.

SDS sheets: keep current sheets for every chemical in the shop. For chemicals you've stopped using, OSHA recommends (doesn't require) holding the SDS 30 years when the chemical could cause long-term health effects, following the spirit of 29 CFR 1910.1020, the medical and exposure records standard. ^[7] For a plain cleaning product with no long-latency risk, a year after you stop using it is reasonable.

The written program itself: keep it, and every prior version, indefinitely. It's a few pages. There's no reason to toss it, and legal reasons to keep it.

For any workplace incident involving chemical exposure, you'll also file an incident report as part of OSHA's injury and illness recordkeeping under 29 CFR Part 1904.

Frequently asked questions

Does a 5-person shop really need a written HazCom program?

Yes. 29 CFR 1910.1200 applies to any employer with workers who may be exposed to hazardous chemicals. There is no employee-count exemption. A 2-person shop using spray lubricant and paint carries the same written-program obligation as a large manufacturer. The only difference is that a small shop's program can be simpler because the chemical inventory is smaller.

What's the difference between an MSDS and an SDS?

MSDS (Material Safety Data Sheet) was the pre-2012 format. SDS (Safety Data Sheet) is the current GHS-compliant format with a standardized 16-section structure. OSHA required employers to transition to GHS-format SDS by June 1, 2016. If your binder still holds old-format MSDS documents, replace them with current GHS SDS sheets from the manufacturer.

Can I store SDS sheets electronically instead of in a binder?

Yes. 29 CFR 1910.1200(g)(9) allows electronic storage. The system has to be reliable, accessible to all employees during every shift without barriers, and backed by an alternate method if it goes down. For a 5-person shop, a physical binder is usually simpler and more dependable. An electronic system makes sense mainly if you have multiple locations or a large chemical inventory.

How often do I need to train employees on hazard communication?

Training is required before first exposure, meaning before an employee works in any area with hazardous chemicals. Additional training is required when new hazards are introduced. Annual refresher training is not mandated by the standard, though it's common practice. Document every session with employee names, date, topics covered, and trainer name.

What happens if an OSHA inspector finds my HazCom program is missing or incomplete?

Expect a serious citation. HazCom is the second most cited OSHA standard in general industry. Serious violation penalties run up to $16,550 per violation as of 2024. Employers with 10 or fewer employees typically get a 60 to 80 percent penalty reduction, but the citation stays on record. The fastest way to lower penalties is to correct deficiencies immediately and cooperate during the inspection.

Do I need to include products like WD-40 or aerosol cans in my chemical inventory?

Generally, yes. The consumer-product exemption under 29 CFR 1910.1200(b)(6)(ix) applies only when employees use a product the same way, in the same amounts, and as often as a normal consumer would. If your crew uses an aerosol product repeatedly through the workday, the exemption almost certainly doesn't apply. Put it on the inventory and get the SDS.

What do I have to tell outside contractors about my chemicals?

Under 29 CFR 1910.1200(e)(2), you must inform contractors working in your facility about hazardous chemicals they may be exposed to, give them access to your SDS files, and explain your labeling system. Contractors must do the same for chemicals they bring in. Document the exchange. Many shops add a contractor safety briefing form for exactly this.

How do I label a secondary container like a spray bottle or small transfer can?

Secondary containers must show the chemical identity and the appropriate hazard warnings at minimum. You can use GHS-compliant labels, the chemical's original label, or a workplace labeling system you define in your written program. A portable container that a single employee fills and uses up in one shift doesn't need a label, but anything that sits around or gets shared does.

Does the HazCom program need to cover welding fumes and gases?

Yes. Welding rods, shielding gases, and base metals are all sources of chemical hazards, and SDS sheets are available from manufacturers for welding consumables. Welding fumes also fall under a specific OSHA permissible exposure limit in 29 CFR 1910.1000. Your program should list welding materials and their SDS sheets, and training should cover fume hazards and ventilation controls.

Can my HazCom program be part of a larger safety manual?

Yes. Many small shops keep all written programs in one document or binder with clearly labeled sections. OSHA requires the program to be in writing and available to employees; it doesn't require a separate binder. Just make sure the HazCom section is complete and easy to find, so an inspector or employee can locate it without searching.

What's the minimum information a written HazCom program must include?

Under 29 CFR 1910.1200(e), the written program must describe how your shop handles container labeling, maintains SDS files, and trains employees. It must list hazardous chemicals by work area (or reference where the list is kept) and address non-routine tasks and multi-employer worksites. For a small shop, this fits comfortably in 3 to 5 pages.

How do I know which GHS pictograms belong on a label?

The manufacturer determines the hazard classification and adds the correct pictograms to their label. You don't assign pictograms yourself for products you buy. For chemicals you produce or mix in-house, you'd classify the hazard and apply the right GHS elements. OSHA's GHS Quick Card lists all eight pictograms and the hazard categories each covers, and it's a free download from OSHA.gov.

Is a HazCom program the same as a chemical hygiene plan?

No. A Chemical Hygiene Plan (CHP) is a separate requirement under 29 CFR 1910.1450, which covers laboratories where chemicals are used for research or analysis. Most small shops (fabrication, auto repair, manufacturing) don't need a CHP. They need a HazCom program. If your 5-person shop runs an actual laboratory function, you may need both.

How long does it take to write a basic HazCom program for a small shop?

Realistically, 2 to 4 hours if you start from a template. The longest part is building the chemical inventory, which needs a physical walkthrough. Writing the document from a model (OSHA's Small Entity Compliance Guide has one) takes 1 to 2 hours. Add time to chase down missing SDS sheets. A 5-person shop with a straightforward inventory can be inspection-ready in a single afternoon.

Sources

1. OSHA, Hazard Communication Standard (29 CFR 1910.1200): Full text and requirements of OSHA's Hazard Communication Standard including the five required program elements, labeling, SDS, and training requirements.
2. OSHA, Safety Data Sheets guidance (Hazard Communication): Suppliers must provide a standardized 16-section Safety Data Sheet for each hazardous chemical.
3. OSHA, Hazard Communication resources and Small Entity Compliance Guide: OSHA free Small Entity Compliance Guide and model program language for hazard communication.
4. OSHA, Recordkeeping Rule (29 CFR Part 1904): OSHA injury and illness recordkeeping requirements; 3-year retention period for injury logs used as common benchmark for safety training records.
5. OSHA, Top 10 Most Frequently Cited Standards FY2023: Hazard Communication was the second most cited OSHA standard in general industry in federal fiscal year 2023.
6. OSHA, Penalties page: Serious violation penalties up to $16,550 per violation; willful or repeated violations up to $165,514 as of 2024; small employer penalty reductions of 60-80%.
7. OSHA, Access to Employee Exposure and Medical Records (29 CFR 1910.1020): 30-year retention recommendation for records related to toxic substance exposures with potential long-latency health effects.
8. OSHA, Hazard Communication in Construction (29 CFR 1926.59): HazCom requirements for construction sector mirror 29 CFR 1910.1200 including the five program elements.
9. Bureau of Labor Statistics, Occupational Injuries and Illnesses Survey: BLS data on nonfatal occupational injuries and illnesses used as context for chemical exposure incidents in small businesses.
10. OSHA, Enforcement directives (Multi-Employer Citation Policy): Host employer obligations to inform contractors about chemical hazards under the multi-employer worksite policy.