OSHA emergency action plan requirements for small office buildings

Last updated 2026-07-11

What does OSHA actually require for an emergency action plan?

The governing rule is 29 CFR 1910.38, titled "Emergency action plans." It applies to any employer covered by OSHA's General Industry standards, which is virtually every office in the country. ^[1]

Six things have to be in the plan. Procedures for reporting a fire or other emergency. Procedures for emergency evacuation, including the type of evacuation and exit route assignments. Procedures for employees who stay behind to run critical operations before they leave. Procedures to account for all employees after evacuation. Procedures for anyone performing rescue or medical duties. And the name or job title of a person employees can contact for more information about the plan. ^[1]

That list looks tidy. Each item has teeth. "Exit route assignments" means a floor map with primary and alternate routes marked, not a verbal wave toward the front door. "Accounting for all employees" means a named assembly point and a specific person doing the head count. "Critical operations" matters even in offices, because someone may need to shut down a server, lock a drug cabinet, or release door locks before leaving.

Here's what the standard does not require: a specific format, a page count, or third-party review. You can write this yourself. What you cannot do is skip it.

Does my small office actually have to have a written plan?

There's one real exception. If your workplace has 10 or fewer employees at any one time, you can communicate the plan orally instead of writing it, as long as employees can review it when needed. ^[1]

That exception is narrower than most people think. It counts everyone present at the same time, not full-time headcount. Eight full-timers plus three part-timers who overlap on Tuesdays puts you past ten on those days, and you need a written document. OSHA counts actual bodies on-site, not FTEs.

Everyone else needs a written plan. The 11-person accounting firm, the 30-person law office, the 200-person corporate campus. There's no revenue threshold, no industry carve-out, no exemption for offices that feel low-risk. ^[1]

Even if you qualify for the oral exception, write it down. Staff changes. You forget what you told people two years ago. The oral version walks out the door the day your office manager quits. The written plan takes an afternoon and protects you indefinitely.

What specific elements must the written plan include?

Here's each required element with the practical detail the standard implies but doesn't spell out.

Procedures for reporting emergencies. Fire alarms, 911 protocols, internal notification chains. Who calls 911? Who tells the building manager? If your building has a fire alarm pull station, employees need to know where it is and how to use it. If you rely on a monitored alarm system, document that too.

Evacuation types and exit routes. Write out which events trigger full evacuation versus shelter-in-place, and include a floor diagram showing primary and alternate exits. Exit routes have to meet 29 CFR 1910.36 and 1910.37, which cover minimum width (28 inches at the narrowest point leading to an exit), height (7 feet 6 inches minimum), and the rule that exits discharge directly to the street or an open space. ^[2]

Critical operations procedures. For most offices this is short: lock the server room, close fire doors, secure patient records. Write it anyway.

Employee accounting procedures. Name the assembly area. Name the person doing the head count. Name the backup for when that person is out sick. This is the step that saves lives in a real emergency, and it's the step small offices skip most.

Rescue and medical duties. If you have first-aid responders or fire wardens, list them and their responsibilities. If you don't have any, say so, and note that those duties default to calling 911.

Key contacts. List the name or job title of whoever answers questions about the plan. A faceless "HR" isn't enough. Attach a real person or title.

What are OSHA's training requirements for the emergency action plan?

You must train employees when the plan is first implemented, whenever an employee's responsibilities under the plan change, and whenever the plan itself changes. ^[1] That's the floor. The standard sets no hours, no written test, no certification.

Training means walking people through the plan, showing them the exit routes, telling them where the assembly point is, and making sure they know who runs the head count. A 15-minute walkthrough qualifies. Emailing someone a PDF does not.

You also have to review the plan with each employee covered by it. ^[1] That review happens at initial employment, so new hires go through it on or before their first day, and again whenever an employee moves to a location covered by a different plan.

Document the training. The standard doesn't require a written EAP training record specifically, but if an inspector asks whether you trained someone, you need proof. A sign-in sheet with date, trainer name, and topics covered is enough. This ties into your broader OSHA training recordkeeping, which you should already have running.

Annual refreshers aren't legally required for small offices, but most safety professionals push for them. People forget. Staff turns over. A quick yearly walkthrough is cheap insurance.

How do exit route requirements connect to the emergency action plan?

Your EAP references exit routes. The physical requirements for those routes live in two companion standards: 29 CFR 1910.36 (design and construction) and 29 CFR 1910.37 (maintenance, safeguards, and operational features). ^[2]

The most common small-office exit violations are burned-out or missing exit signs, doors locked or blocked from the inside during business hours, and access corridors narrowed by stored boxes or equipment. OSHA requires exit routes to stay free and unobstructed at all times. ^[10] No propping the exit door open with a box of paper that's been sitting there since last quarter.

Exit signs have to be visible from a distance, lit by a reliable source, and marked "EXIT" in plainly legible letters at least 6 inches high. ^[10] Battery backup is required if the primary lighting fails.

Your EAP should state how many exit routes exist, which is primary and which is alternate, and what triggers use of the alternate (blocked primary, fire location). A small single-floor office usually needs two exits. Multi-story buildings need a route from every floor.

Do the walk right now. Look at every door on the path. Check every sign. Fix what's broken before you finalize the written plan. Listing a route that doesn't work isn't compliance.

What's the difference between an emergency action plan and an emergency response plan?

This distinction trips up a lot of small business owners, and it matters for compliance.

An emergency action plan (29 CFR 1910.38) covers what employees do to protect themselves when an emergency hits. It's defensive. Evacuate, account for everyone, get out safely. Nearly all employers need one.

An emergency response plan (29 CFR 1910.120, the HAZWOPER standard) covers how employees respond to releases of hazardous substances. It's operational. It applies where employees might actually fight a chemical spill, run a hazmat response, or handle post-emergency cleanup. ^[3] Most standard offices don't need it.

There's a third document people confuse with both: the fire prevention plan under 29 CFR 1910.39. That standard requires employers to identify potential fire hazards, keep them controlled, and train employees in fire prevention. It's separate from the EAP, though OSHA lets you combine both into one document. ^[4]

For a typical small office, you need the EAP under 1910.38 and probably the fire prevention plan under 1910.39. You almost certainly don't need a full HAZWOPER emergency response plan unless your office handles chemicals beyond cleaning supplies and copy toner.

What do OSHA inspectors actually look for in a small office EAP?

Compliance officers inspecting general industry offices follow the Field Operations Manual and will ask for your written EAP if your workforce tops 10 people. ^[5] Nobody expects a 50-page document. They expect that it exists, that it contains all six required elements, and that you can show employees were trained on it.

The deficiencies inspectors find most often at small offices:

1. No written plan at all ("we just tell people to go out the front door") 2. A plan downloaded off the internet and never customized, referencing assembly points, floor wardens, and alarm systems that don't match the actual building 3. No documentation that employees were trained 4. A plan never updated after an office move or renovation 5. Blocked exit routes or dead exit signs

OSHA classifies EAP violations as serious when there's a substantial probability that death or serious physical harm could result. Serious violations carry penalties up to $16,131 per violation as of 2024. ^[6] Willful violations, where OSHA finds you knew about the deficiency and did nothing, reach $161,323 per violation. ^[6]

Inspectors also check whether your alarm system, if you have one, is covered in the plan, and whether employees can tell different alarm signals apart when a building uses them.

How should a small office handle shelter-in-place in the emergency action plan?

Shelter-in-place isn't named as a required element in 1910.38, but OSHA's guidance makes clear that if a shelter-in-place scenario is a realistic threat at your location, you should address it. ^[7]

Three scenarios usually trigger shelter-in-place for offices: severe weather (tornadoes, hurricanes), a nearby hazardous material release, and an active threat. Your local fire department or emergency management office can tell you which hazards are most relevant where you are.

A shelter-in-place procedure should answer four questions. What signal or communication triggers sheltering instead of evacuating? Where do employees go inside (interior rooms away from windows for tornadoes, a sealed room for hazmat)? Who decides to shelter versus evacuate? What happens to visitors and contractors who are on-site?

For severe weather, FEMA recommends identifying interior rooms on the lowest floor for tornado sheltering. ^[8] Name those rooms in your plan. Don't write "go to the safest area."

Many small offices run one shelter-in-place section covering all scenarios, with a note that the specific location depends on the threat. That's reasonable and easy to maintain.

Does the emergency action plan have to cover fire specifically, and what about fire extinguishers?

Yes. Fire is the scenario 1910.38 most clearly contemplates, and it's the one inspectors focus on hardest in office settings.

Fire extinguishers are covered by 29 CFR 1910.157. That standard gives you a choice. You can provide portable extinguishers for employee use, in which case you have to train employees to use them and maintain the extinguishers. Or you can adopt a policy requiring everyone to evacuate immediately on a fire alarm, in which case you skip extinguisher training, but you also can't have employees try to fight any fire. ^[9]

Most small offices take the second route. It's simpler and honestly safer. Untrained people attacking a fire with a portable extinguisher get hurt. If you go evacuation-only, your EAP has to state plainly that all employees evacuate immediately and that nobody is authorized to use a fire extinguisher for anything except personal escape.

If you do provide extinguishers for employee use, they get a monthly visual check and an annual inspection by a licensed professional, and employees need hands-on training at least once a year. ^[9] That training covers the extinguisher type, the PASS technique (pull, aim, squeeze, sweep), and the fire classes each extinguisher is rated for.

Whatever your fire extinguisher policy is, write it into your EAP or your fire prevention plan so there's no ambiguity.

How often does the emergency action plan need to be reviewed and updated?

The standard says the plan must be reviewed with each covered employee whenever responsibilities change or the plan changes. ^[1] It doesn't mandate an annual review in so many words. Several events clearly force an update, though.

You move to a new location. You renovate and exit routes change. The person running the head count leaves. You add a floor or a wing. You install or swap your fire alarm system. You hire past the 10-employee threshold and now need a written plan for the first time.

Most safety professionals review the EAP every 12 months no matter what, because small offices drift. The assembly point that used to be the parking lot is now a construction zone. The floor warden who transferred departments never got updated in the document. The phone tree has three wrong numbers. Annual review catches all of it.

A workable process: assign one person to own the update, set a calendar reminder for the same month each year, walk the physical exit routes during the review instead of just reading the document, and collect signatures confirming employees got the updated version. For a small office the whole thing runs under two hours.

If a blank page is the obstacle, SafetyFolio's safety program generator builds a customized EAP template in about 15 minutes from your specific workplace details. You edit rather than start from nothing.

How do you account for employees with disabilities in the emergency action plan?

This is the gap in most small-office EAPs, and it's the one that matters most in a real emergency.

The standard has no standalone disability accommodation clause, but the ADA and basic duty of care require that your evacuation procedures account for employees who can't use stairs or need help evacuating. OSHA's evacuation guidance recommends designating "areas of rescue assistance" for employees with mobility limitations in multi-story buildings. ^[7]

Areas of rescue assistance are usually stairwell landings or lobbies where a person can wait safely until firefighters or rescue personnel reach them. Your EAP should name these locations by floor and room, name the person responsible for confirming that anyone needing help is accounted for, and describe how that employee signals their location to first responders.

Single-story offices with accessible exits are simpler. Make sure every exit route is actually navigable by someone using a wheelchair or mobility aid. Check door widths (minimum 28 inches, ideally 32 for wheelchair clearance), clear tripping hazards, and confirm the exterior path to the assembly point is accessible.

Never build a personal emergency evacuation plan without the employee who needs it. They know their needs better than you do. Have that conversation during onboarding, not during an emergency.

What's the fastest compliant way to write an EAP for a small office from scratch?

Here's the order that works.

First, walk the space with a notepad. Find every exit, sketch a rough floor plan, note the alarm pull stations and fire extinguishers, and pick an assembly point at least 50 feet from the building and clear of the path emergency vehicles take.

Second, assign roles. You need at least one person on the head count at the assembly point, one backup, and a contact for questions about the plan. In a small office, that can all be one person.

Third, write the six required elements. Each can be a short paragraph or a brief bulleted list. The full document for a 20-person single-floor office might run three to five pages including the floor map.

Fourth, run initial training before the plan goes live. Walk employees through the routes, show them the assembly point, explain their roles. Log it with a sign-in sheet.

Fifth, keep the document accessible. OSHA requires that employees can review the plan on request. ^[1] A shared drive, a binder in the break room, or both works.

If the blank page is the real problem, SafetyFolio's generator walks you through the decisions and outputs a formatted, site-specific plan you can train from directly. Either way, the writing isn't the hard part. The walk-through is.

For a broader written safety program structure, see our guide on hazard communication, which follows a similar build-it-yourself approach.

What are the OSHA penalties for not having an emergency action plan?

OSHA sorts violations into four categories: other-than-serious, serious, willful, and repeat. An EAP violation is almost always serious, because missing evacuation procedures creates a direct risk of death or serious injury in a fire. ^[6]

As of 2024, serious violation penalties run from $0 to $16,131 per violation. ^[6] Inspectors can reduce penalties based on good-faith effort, business size, and citation history. A 10-person office with no prior citations that cooperates fully might see a big reduction. A 50-person office with a prior citation and still no written plan lands at the high end.

OSHA adjusts civil penalty amounts every year under the Federal Civil Penalties Inflation Adjustment Act. The $16,131 figure applies to violations in 2024. Check OSHA's penalties page for the current year. ^[6]

Then there's liability beyond the fine. If an employee is hurt during an emergency and you had no written EAP, no training records, and blocked exit routes, workers' compensation claims and civil litigation both get much more expensive. The EAP is cheap. The alternative isn't.

More on OSHA's enforcement framework is in our overview of OSHA.

Frequently asked questions

Does a one-person office need an emergency action plan?

Technically yes, 29 CFR 1910.38 applies to all employers covered by OSHA's general industry rules. But with 10 or fewer employees on-site at any one time, the plan can be oral rather than written. A sole proprietor with no employees has no one to train but is still covered by the standard. In practice, OSHA enforcement focuses on workplaces with employees at risk.

Can I use a template I found online for my EAP?

Start with a template, then customize it to your actual workplace. A plan that references exit routes, alarm systems, and assembly points that don't match your building isn't compliant, and an inspector will spot it immediately. The floor diagram has to be yours, the roles have to be real people, and the procedures have to reflect how your building works. A generic template is a starting point, not a finished plan.

What's the difference between an emergency action plan and a disaster recovery plan?

An emergency action plan under OSHA 1910.38 protects people during an emergency: evacuation, shelter-in-place, accounting for employees. A disaster recovery plan is a business continuity document about restoring operations after an event. They're completely separate. OSHA doesn't regulate disaster recovery plans. Most small offices need both, but the EAP is the one with legal teeth under OSHA.

How long does it take to write a compliant EAP for a small office?

Realistically, two to four hours for a single-floor office if you already know your building and staff. Most of that is the physical walk-through and the floor diagram, not the writing. The document for a 15 to 20 person office runs three to five pages. A structured tool or template that guides the decisions cuts the time down further.

Does the EAP need to be posted on the wall?

No. OSHA 1910.38 requires only that the plan be available for employee review, not posted prominently. Exit route maps are commonly posted, and that's good practice, but the full EAP can live in a binder or on a shared drive. What matters is that employees know it exists and can get to it when they want to review it.

What happens if my office layout changes after I write the EAP?

Update the plan before employees use the space with the new layout. If a renovation changes an exit route, closes a corridor, or moves the alarm panel, the EAP has to reflect it. Train affected employees on the new routes before the change goes live, and document that training. Keeping an outdated EAP on file while the physical space has changed is a violation.

Is a fire drill required by OSHA for office buildings?

OSHA's 1910.38 doesn't explicitly mandate fire drills for general industry, though it requires training that lets employees execute the plan. Some state fire codes and local ordinances do require periodic drills, especially in multi-tenant buildings. Check your state and local fire code. Even where it's not required, an annual drill is the best way to find gaps before a real emergency does.

Who is responsible for keeping the emergency action plan up to date?

The employer, legally. In practice an owner, operations manager, or designated safety coordinator should own the document and have a calendar reminder to review it annually and after any significant change. Delegating the task is fine; abdicating accountability isn't. Whoever owns it needs authority to make changes and budget for any physical fixes the review turns up.

Do contractors or visitors need to be included in our emergency action plan?

OSHA's standard focuses on employees, but contractors working at your site for extended periods are generally covered by the host employer's EAP. Brief them on exit routes and the assembly point when they arrive. Visitors aren't employees, but accounting for them at the assembly point is basic duty of care, and OSHA compliance officers and civil courts both take it seriously after an incident.

What if our building's property manager says they handle the emergency plan?

Your property manager may handle building-level systems like fire suppression, alarms, and building evacuation maps, but OSHA's requirements sit with the employer, not the landlord. You're responsible for making sure your employees know your portion of any building-wide plan, that you've assigned roles, and that you've done training. Get a copy of the building's procedures, fold them into your plan, and document your own training separately.

Does the emergency action plan need to cover active shooter situations?

OSHA 1910.38 doesn't list active threats by name, but the general duty clause (Section 5(a)(1) of the OSH Act) requires employers to protect workers from recognized hazards. ^[12] DHS publishes guidance recommending employers address active shooter scenarios through the 'Run, Hide, Fight' framework. ^[11] For offices where active threat risk is recognized, including that scenario in your EAP or as an annex is the defensible move.

Can the emergency action plan be combined with other required written programs?

Yes. OSHA permits combining the EAP with the fire prevention plan (1910.39) and other written programs into one safety manual, as long as every required element of each standard is present. Many small offices keep a single Safety and Emergency Procedures Manual covering EAP, fire prevention, and basic first aid. That's efficient and fully compliant, as long as nothing required gets lost in the consolidation.

Sources

1. OSHA, 29 CFR 1910.38 Emergency action plans: Lists the six required elements of an emergency action plan and permits oral plans for workplaces with 10 or fewer employees
2. OSHA, 29 CFR 1910.36 Design and construction requirements for exit routes: Exit routes must meet minimum height and width requirements and discharge to the street or open space
3. OSHA, 29 CFR 1910.120 Hazardous Waste Operations and Emergency Response (HAZWOPER): Emergency response plans are required under HAZWOPER for employers who respond to hazardous substance releases, distinct from the EAP requirement
4. OSHA, 29 CFR 1910.39 Fire prevention plans: Requires employers to identify fire hazards and maintain fire prevention measures; can be combined with the EAP in a single document
5. OSHA, Field Operations Manual (FOM), CPL 02-00-160: Describes inspection procedures compliance officers follow when evaluating employer written programs including emergency action plans
6. OSHA, Penalties page: Serious violations carry penalties up to $16,131 per violation and willful violations up to $161,323 per violation as of 2024
7. OSHA, Emergency preparedness and response guidance: OSHA guidance recommends shelter-in-place procedures and areas of rescue assistance for employees with disabilities
8. FEMA, National preparedness planning guidance: FEMA recommends identifying interior rooms on the lowest floor for tornado sheltering
9. OSHA, 29 CFR 1910.157 Portable fire extinguishers: Employers who provide portable fire extinguishers must train employees annually; employers who adopt an evacuation-only policy are exempt from extinguisher training
10. OSHA, 29 CFR 1910.37 Maintenance, safeguards, and operational features for exit routes: Exit signs must be visible, illuminated, and marked with letters at least 6 inches high; exit routes must remain unobstructed at all times
11. U.S. DHS, Active Shooter Preparedness: DHS recommends employers address active shooter scenarios using the Run, Hide, Fight framework
12. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: Requires employers to furnish a workplace free from recognized hazards likely to cause death or serious physical harm