Sample hazard communication program: build one that passes OSHA inspection

Last updated 2026-07-09

What is a hazard communication program and who needs one?

Any employer with workers exposed to hazardous chemicals needs a written hazard communication program. That is the plain reading of 29 CFR 1910.1200(e)(1), which applies to general industry, and 29 CFR 1926.59, which extends the same requirements to construction ^[1]. One bottle of bleach in a janitor's closet and an employee who touches it puts you in scope.

The program exists so employers and employees know what hazardous chemicals are present, understand the risks, and know how to protect themselves. OSHA's standard, commonly called HazCom 2012, matches the United Nations Globally Harmonized System of Classification and Labelling of Chemicals (GHS). That matters for a practical reason: a safety data sheet from a German supplier follows the same 16-section format as one from a Texas manufacturer ^[2].

HazCom is consistently one of OSHA's most cited standards. In fiscal year 2023, it ranked second on OSHA's top-10 most-cited list with 3,213 violations ^[3]. The median penalty per violation moves around, but serious HazCom violations currently carry penalties up to $16,131 per instance under OSHA's 2024 penalty schedule ^[4]. Small businesses with 250 or fewer employees may qualify for penalty reductions of 25 to 60 percent, but that reduction only kicks in after you already have a violation. That is not a plan.

Manufacturers, importers, and distributors carry extra duties around classifying chemicals and preparing SDSs. If you are a downstream user, meaning you buy chemicals and use them, your obligations are narrower: maintain the program, keep SDSs, label containers, and train workers.

What are the six required elements of a written HazCom program?

The standard is specific. Under 29 CFR 1910.1200(e)(1), your written program must address at minimum: (1) container labels and other forms of warning, (2) safety data sheets, (3) employee information and training, (4) a list of hazardous chemicals, (5) methods the employer will use to inform employees of non-routine tasks and unlabeled pipes, and (6) how the employer will provide other employers and their workers access to hazard information when multiple employers share a worksite ^[1].

Here is how each element becomes actual documents and procedures.

1. The written program document itself. This is the narrative policy. It tells a reader (or an OSHA compliance officer) how your operation handles chemical hazards. It names who maintains it, how often it gets reviewed, and where the physical or digital files live. Write it in first person for your company. "ABC Plumbing Services maintains a written hazard communication program" beats a generic template that still says "Company Name Here."

2. Chemical inventory list. You need a list of every hazardous chemical in your workplace by product name, cross-referenced to the SDS. This list does not need to be elaborate. A spreadsheet with columns for product name, manufacturer, SDS location, and work area is fine. Update it whenever you bring in a new product.

3. Safety data sheet management. SDSs must be readily accessible to employees during every shift they might be exposed ^[1]. So you cannot lock them in the manager's office. A binder in the break room, a shared drive on a shop tablet, or an online SDS management service all work, as long as workers can actually get to them. OSHA has said in letters of interpretation that electronic access is acceptable provided backup is available if the system goes down ^[5].

4. Container labeling procedures. Every container of hazardous chemicals must be labeled. Shipped containers must display the GHS-required elements: product identifier, signal word, hazard statements, precautionary statements, pictograms, and supplier information ^[2]. For in-plant secondary containers, OSHA allows alternative labeling systems (such as NFPA diamonds or HMIS) as long as employees are trained on the system. Whatever system you use, describe it in writing.

5. Employee training. Workers must be trained before initial assignment and when new hazards are introduced. The content is specific: employees must know where the written program and SDSs are, how to read labels and SDSs, and what protective measures apply to the chemicals they work with. General awareness is not enough. Training has to match the chemicals actually present ^[1].

6. Non-routine tasks and multi-employer worksites. If workers occasionally handle pipes or equipment that could contain unlabeled hazardous chemicals, your program must say how you will communicate that hazard before the task. On construction sites or in facilities where contractors come and go, you must inform the other employer's workers of hazards and give them access to your SDSs.

What does a sample hazard communication program actually look like?

Below is a plain-language template framework. This is not a fill-in-the-blank form that you sign and file. Treat it as an outline you adapt to your specific operation. Every blank must be filled with real information about your company.

---

[YOUR COMPANY NAME] Hazard Communication Program *Effective Date: [Date] | Last Reviewed: [Date] | Program Administrator: [Name/Title]*

Purpose. This written program describes how [Company Name] complies with OSHA's Hazard Communication Standard, 29 CFR 1910.1200. The purpose of this hazard communication program is to ensure that all employees who may be exposed to hazardous chemicals in the course of their work are informed of the hazards associated with those chemicals and know how to protect themselves.

Scope. This program covers all employees at [location(s)] who use, handle, or may be exposed to hazardous chemicals. It applies to all shifts.

Responsibilities. [Name or Title] is responsible for maintaining the chemical inventory list, obtaining and maintaining SDSs, conducting or arranging employee training, and reviewing this program at least annually and whenever a new chemical hazard is introduced.

Chemical Inventory List. A current list of all hazardous chemicals used in this workplace is maintained at [location, e.g., "the maintenance office and shared drive"]. The list is organized by product name and cross-referenced to the SDS file.

Safety Data Sheets. SDSs for all chemicals on the inventory list are kept at [specific location]. Employees on all shifts may access SDSs at any time. [If electronic: A printed backup binder is maintained at [location] in case of system outages.]

Container Labels. All containers of hazardous chemicals are labeled in accordance with 29 CFR 1910.1200(f). [Company Name] uses [GHS manufacturer labels / NFPA / HMIS / other] for secondary containers. Employees are trained on this system. No container is ever left unlabeled.

Employee Training. Training is provided before initial job assignment and whenever a new chemical hazard is introduced. Training covers: the location of this written program and SDSs; how to read and interpret GHS labels and SDSs; the physical and health hazards of chemicals in the work area; and specific protective measures, including PPE, ventilation, and emergency procedures. Training records are kept at [location] and include the date, topics covered, trainer name, and employee signatures.

Non-Routine Tasks. Before any non-routine task involving potential chemical exposure (such as cleaning a reaction vessel or entering a confined space with residual chemicals), [Name/Title] will brief affected employees on the chemical hazards and required controls.

Multi-Employer Worksites. When contractors or other employers work at this facility, [Name/Title] will provide them with a copy of the relevant SDSs and inform them of any chemical hazards in the work area before work begins. We will also obtain information about any chemicals the contractors bring on site.

Program Review. This program is reviewed annually by [Name/Title] or whenever a significant change in chemical inventory, processes, or regulations requires an update.

---

Filled out, that framework runs about two pages. It is not glamorous. OSHA compliance officers are not looking for eloquence. They want specificity and evidence that the program is actually followed.

If you want to skip the blank-staring-at-a-template phase, SafetyFolio's safety program generator builds a company-specific written HazCom program in roughly 15 minutes by asking you targeted questions about your chemicals, workforce, and work areas.

How do you build and manage your chemical inventory list?

Start by walking every square foot of the facility with a clipboard or phone. Open cabinets, check under sinks, look in maintenance rooms, inspect delivery areas. Pull every product you find and check whether it has an SDS. If a product has an SDS, it belongs on your list. If you are not sure, include it.

A workable inventory format:

Product Name	Manufacturer	Work Area	SDS Location	Date Added	Date Updated
Acetone 99%	Spectrum Chemical	Paint booth	Binder, Tab A / Drive: SDS/acetone	2024-01-15	2024-01-15
Muriatic Acid 20%	Klean Strip	Tile room	Binder, Tab B / Drive: SDS/muriatic	2024-03-02	2024-03-02
Bleach (sodium hypochlorite)	Clorox	Janitorial	Binder, Tab C / Drive: SDS/bleach	2024-01-15	2024-06-10

A few practical notes. Assign one person as the gatekeeper. When purchasing orders a new chemical, that person must obtain the SDS before the chemical arrives on site, add it to the inventory, and file the SDS. Make this a written procedure so it does not rely on someone remembering.

Track the date of the last SDS update too. Manufacturers revise SDSs when formulas change or new hazard data emerges. OSHA does not specify a mandatory SDS refresh interval, but you should check for updates whenever a supplier flags a change, and a yearly spot-check on high-hazard chemicals is reasonable practice.

For small shops with 10 or fewer chemicals, a physical binder is perfectly fine. For operations with 50 or more chemicals across multiple locations, a cloud-based SDS library (many run in the $30 to $150 per month range) makes cross-site access and search much faster. Cloud systems are only as good as the person updating them, though.

What do GHS labels need to include and what are your secondary container rules?

Under 29 CFR 1910.1200(f)(1), shipped containers from the manufacturer or distributor must carry six elements: a product identifier, signal word ("Danger" or "Warning"), hazard statement(s), precautionary statement(s), pictogram(s), and the name, address, and phone number of the responsible party ^[1].

The GHS uses nine pictograms. Here is a quick reference for the most common:

Pictogram Name	Hazard Type
Flame	Flammables, self-reactives, pyrophorics
Exclamation mark	Irritants, acute toxicity (lower severity)
Skull and crossbones	Acute toxicity (higher severity), fatal if swallowed
Health hazard	Carcinogens, reproductive toxins, respiratory sensitizers
Corrosion	Skin/eye corrosion, metal corrosion
Gas cylinder	Gases under pressure
Environment	Aquatic toxicity
Flame over circle	Oxidizers
Exploding bomb	Explosives, self-reactives, organic peroxides

For secondary containers (bottles, spray bottles, buckets) that you fill from the original container, you do not need the full manufacturer label. You do need the product identifier and enough hazard information for employees to protect themselves. Many companies use a simplified label with the product name, signal word, and the relevant precautionary statements. Whatever your system is, employees must be trained on it and your written program must describe it.

One common mistake: assuming an NFPA 704 diamond covers your secondary container obligation. OSHA has stated in letters of interpretation that an NFPA diamond alone may not satisfy the full GHS labeling requirement for secondary containers unless your training makes the link explicit and covers health effects the NFPA system does not convey ^[5]. Safer to use a label that also includes the product name and a basic hazard statement.

What does SDS management require, and how do you handle missing or outdated sheets?

Every SDS follows the same 16-section format under GHS. Section 1 is product identification. Section 2 is hazard identification, the most useful part for workers on the floor. Section 8 covers exposure limits and engineering controls. Section 11 gives toxicological information. When you train employees on how to use an SDS, focus their time on sections 1, 2, 7 (handling and storage), 8, and 13 (disposal).

Accessibility is the rule OSHA actually enforces. An SDS in a locked cabinet fails. An SDS on a computer that requires a supervisor's password fails. An SDS posted in a language workers cannot read is legally compliant under OSHA's standard but practically useless, and arguably against the spirit of the law. OSHA has said that when a significant portion of your workforce speaks a language other than English, you should make SDSs and training available in that language ^[6].

If a chemical arrives without an SDS, 29 CFR 1910.1200(g)(7) requires you to contact the manufacturer or distributor to obtain one. Do it in writing so you have a record of the request. You cannot put a chemical into service without the SDS. If reasonable effort still comes up empty, pull the chemical from service.

Outdated SDSs are a common citation trigger. OSHA does not mandate a specific revision schedule for downstream users, but it does require the SDS for the chemical in the formulation you are actually using. If a supplier reformulates a product and never tells you, you could be sitting on the wrong SDS without knowing it. A standing instruction to purchasing to request updated SDSs with every new product order costs nothing and closes that gap.

What HazCom training does OSHA actually require?

Under 29 CFR 1910.1200(h), training must happen at the time of initial assignment and whenever a new physical or health hazard is introduced to the work area. The standard does not require annual refresher training, though many safety professionals recommend it and some state plans may require it ^[1].

Training must cover at minimum:

• The requirements of the HazCom standard and where employees can get more information
• Operations in the work area where hazardous chemicals are present
• The location and availability of the written program, the chemical list, and the SDSs
• Methods to detect the presence or release of hazardous chemicals (monitoring, odor, visual appearance)
• Physical, health, simple asphyxiation, combustible dust, and pyrophoric hazards
• How employees can protect themselves (engineering controls, work practices, PPE)
• The details of the written program, including how to read labels and SDSs

What the standard does not specify: the length of training, whether it must be in person, or whether online training satisfies the requirement. OSHA has generally accepted online training when it covers the required topics and includes a way to verify comprehension, but you should also give employees a way to ask questions, which pure self-paced video does not do well.

Always keep training records. At minimum: employee name, date, topics covered, and signature. OSHA can ask for records going back to current employees' hire dates.

For more on structuring the training component of your program, see our guide on workplace safety training.

How does a multi-employer worksite change your HazCom obligations?

29 CFR 1910.1200(e)(2) requires that when workers from different employers work in the same area, each employer must ensure their own employees are protected. If you are the host employer, you must inform contractors of the chemical hazards they might hit and give them access to your SDSs. If you are the contractor, you owe the same to the host and to other contractors in the area.

In practice, this runs on a chemical exchange form or a pre-work meeting. Before a contractor starts, you hand them a list of chemicals in their work area and copies of (or access to) the relevant SDSs. They give you the same for anything they are bringing in. Someone signs and dates the exchange so there is a record.

Construction sites are the hardest version of this problem because the roster of employers changes constantly. General contractors often handle it through a site-specific SDS binder that all subcontractors contribute to and can access. If you are a sub, know where that binder is and make sure your workers do too.

This is also where unlabeled piping comes in. Under 29 CFR 1910.1200(e)(1)(ii), if workers perform non-routine tasks that could expose them to hazardous chemicals in unlabeled pipes, you must provide hazard information before the work starts. That might be a tailgate meeting, a written job safety analysis, or a pre-task briefing, as long as it happens and gets documented.

What OSHA citations look like for hazard communication violations

HazCom was the second most cited OSHA standard in FY2023 with 3,213 violations ^[3]. The breakdown of where those violations fall tells you where to look first.

The most common specific violations:

Violation Type	Why It Gets Cited
No written program or outdated program	Compliance officers ask for it on arrival
Missing or inaccessible SDSs	Usually caught during walk-around
Unlabeled secondary containers	Visual, easy to spot
No training records	Cannot prove training occurred
Chemical inventory incomplete	Cross-checked against SDSs in the facility

Citations get classified as serious (where a substantial probability of death or serious physical harm exists), other-than-serious, or willful/repeat. Most HazCom first-offense citations land as serious, with penalties in the $1,000 to $5,000 range for small employers after reduction, though larger employers or repeat violations run much higher ^[4].

OSHA's informal conference process lets you contest or reduce penalties, but it requires you to show correction efforts and a good-faith compliance history. The fastest path to a reduced penalty is already having a partially compliant program and showing it has been updated since the inspection.

For a broader look at how inspections unfold and what to expect, see our article on hazardous communication.

Do state OSHA plans have different HazCom requirements?

Twenty-two states and two territories run their own OSHA-approved state plans ^[7]. State plans must be at least as effective as the federal standard, and many are identical. A handful carry real differences.

California's Cal/OSHA operates under Title 8 of the California Code of Regulations and has its own version of the HazCom standard, layered with Proposition 65, which requires warnings for chemicals known to the state to cause cancer or reproductive harm ^[8]. If you operate in California, your program has to handle both Cal/OSHA HazCom and Prop 65 labeling separately.

Washington State's Division of Occupational Safety and Health (DOSH) and Oregon OSHA also have state-specific interpretations. Safest approach in a state-plan state: pull the actual standard from your state agency's website rather than leaning on the federal 29 CFR 1910.1200 text alone.

For construction, the federal standard is 29 CFR 1926.59, which mirrors 1910.1200 almost exactly ^[9]. State-plan construction requirements follow the same pattern: at least as protective, sometimes more so.

How do you update and maintain your HazCom program over time?

A written program that sits in a drawer and never changes is both legally weak and operationally useless. OSHA does not mandate a specific review schedule, but common practice is to review annually and whenever one of these triggers hits: a new chemical enters the workplace, a formulation change affects an existing SDS, a new work process creates a new exposure pathway, a near-miss or incident involves a chemical hazard, or a regulatory change updates the standard.

Name one person as the program owner, and back that up with a written procedure stating what they must do and when. If that person leaves, the responsibility transfers explicitly, not by assumption.

For training, build a simple tracking system. A spreadsheet with employee name, hire date, date of initial HazCom training, and date of any refresher is enough. When a new chemical comes in, note which employees work in that area and document that they got the update.

For SDSs, build a procurement habit: no new chemical comes on site without an SDS in hand. Some organizations run a chemical approval process where new chemicals must be reviewed and signed off by the safety designee before purchasing. That is overkill for a shop with 12 chemicals and may be exactly right for a manufacturing facility with 200.

How HazCom fits into a broader safety and health system is covered in our piece on what a safety and health program should be. Keeping the program current is where most small businesses fall down. The initial build is one-time work. The maintenance never stops. If your program still lists a chemical you stopped buying three years ago, an inspector will notice, and it signals that the whole document may be stale.

SafetyFolio's safety program generator includes reminders and a structured review workflow so the maintenance side is less likely to slip. A well-maintained Word document works just as well if someone actually owns the process.

What are common HazCom program mistakes to avoid?

The mistakes that get businesses cited are almost always process failures, not knowledge failures. The employer knew they were supposed to have SDSs. They just never got around to collecting them.

Generic programs. A program that still says "Company Name" or lists example chemicals your facility does not use tells an inspector you downloaded a template and signed it. Fill every blank with real information.

Training with no records. You could have trained every employee perfectly, but if you cannot show a record, OSHA treats it as if it never happened. Keep records forever for current employees.

SDSs filed but not accessible. A binder in the supervisor's locked office, a shared drive that requires a VPN workers do not have, or SDSs only on one terminal in a facility with three shifts all fail the accessibility standard.

Secondary containers without labels. Spray bottles, buckets, and shop containers are where most labeling violations hide. Walk the floor looking specifically for unlabeled containers.

Outdated inventory. If your list carries chemicals you no longer use and misses new ones, the document is evidence of neglect rather than compliance.

Assuming training done once is done forever. Introduce a new solvent to the degreasing process, and the employees who work that process need updated training. Document it.

Not informing contractors. On construction sites and in facilities where outside workers come in regularly, the multi-employer communication step is easy to skip and regularly cited.

Frequently asked questions

Is a written hazard communication program required for all employers?

Yes. Under 29 CFR 1910.1200(e)(1), any employer whose employees may be exposed to hazardous chemicals must have a written hazard communication program. There is no size exemption. A two-person plumbing shop that uses pipe solvents needs one just as a 500-person chemical plant does. The scale of the program may differ, but the written document is mandatory.

What is the purpose of a hazard communication program?

The purpose of a hazard communication program is to ensure employees know what hazardous chemicals they work with, understand the risks, and have access to safety data sheets and training to protect themselves. OSHA's rule is rooted in workers' right to know. The GHS format means that information is communicated in a standardized way regardless of where a chemical was produced.

How often does a hazard communication program need to be updated?

OSHA does not set a specific review interval in 29 CFR 1910.1200, but the program must reflect current conditions. Best practice is a formal annual review plus an update whenever a new chemical enters the workplace, a process changes, or the standard is revised. Stale programs that still list discontinued chemicals are a common citation trigger during inspections.

Can I use a free template from OSHA's website for my written program?

OSHA does provide model programs and guidance documents, and they are a legitimate starting point. The catch is that a model program is generic by definition. You must customize it with your company name, responsible persons, specific chemicals, SDS locations, and training procedures. An unsigned or partially filled template does not satisfy the standard and may make an inspection worse, not better.

Do SDSs need to be in English, or can they be in other languages?

OSHA's standard requires SDSs to be in English, but OSHA has stated in guidance that when a significant portion of a workforce speaks a different language, employers should provide information and training in that language too. Relying on English-only SDSs when your workforce is primarily Spanish-speaking, for example, satisfies the letter of the law but creates real safety gaps and could support a willful citation if a chemical injury occurs.

What is the difference between HazCom 2012 and the old MSDS system?

HazCom 2012 matched the U.S. standard to the United Nations Globally Harmonized System, replacing the older Material Safety Data Sheet (MSDS) with the standardized 16-section Safety Data Sheet (SDS). The old system had no required format, so MSDS quality varied wildly. The GHS format means every SDS worldwide follows the same section order, making it easier for workers and emergency responders to find critical information fast.

Do I need HazCom training for office workers?

Only if those workers may be exposed to hazardous chemicals. An office worker who never enters the production floor and whose only chemical contact is hand sanitizer probably does not need formal HazCom training. But if office staff sometimes walk through areas where chemicals are used, or if cleaning chemicals are stored in shared spaces, train them. Document your reasoning for any group you exclude in case OSHA asks.

What happens if a supplier does not provide an SDS for a product?

Under 29 CFR 1910.1200(g)(7), you must contact the manufacturer or distributor and request the SDS. Make that request in writing and keep a copy. If you cannot obtain an SDS after reasonable effort, the chemical should not be put into use. You cannot legally place employees at risk from a chemical whose hazards are unknown.

Can electronic SDSs satisfy OSHA's accessibility requirement?

Yes. OSHA has confirmed in letters of interpretation that electronic SDS management systems are acceptable as long as employees can access them during their shifts without supervisor assistance and a backup system (such as a printed binder) is available if the electronic system goes down. A system that requires a password only the manager has does not satisfy the requirement.

Does HazCom apply to construction as well as general industry?

Yes. The parallel construction standard is 29 CFR 1926.59, which incorporates the full text of 1910.1200 by reference. Construction employers face the same written program, SDS, labeling, and training requirements as general industry, plus the added complexity of multi-employer worksites where chemical hazard information must be shared across subcontractors and the general contractor.

How do I handle chemicals that arrive on site without labels or SDSs?

Do not allow them into service. Quarantine the container, contact the supplier immediately, and request both the SDS and a properly labeled replacement container. Document the contact. If the supplier cannot or will not provide the required documentation, that is grounds to stop purchasing from them and potentially to report to OSHA. Workers cannot be expected to protect themselves from hazards they cannot identify.

What penalties does OSHA impose for HazCom violations?

Under OSHA's 2024 penalty schedule, serious violations carry up to $16,131 per instance. Willful or repeat violations can reach $161,323 per instance. Small employers with 25 or fewer employees may receive reductions of up to 60 percent on penalties, and companies with 26 to 250 employees may receive up to 40 percent reductions. Even after reductions, multi-instance citations add up quickly.

Does my HazCom program need to cover consumer products used in the workplace?

Consumer products are partially exempt under 29 CFR 1910.1200(b)(6)(ix) if they are used in the workplace the same way a consumer would use them, meaning the same frequency, duration, and quantity. If a worker uses a consumer-grade cleaner for 8 hours a day rather than the incidental use a household consumer would have, the exemption likely does not apply and the full HazCom requirements kick in.

What records does OSHA expect to see during a HazCom inspection?

Expect an inspector to ask for the written program document, the chemical inventory list, all SDSs for chemicals in the facility, employee training records (with dates and signatures), and labeling documentation for secondary containers. They will also do a physical walk-through to spot unlabeled containers and check that SDSs are actually accessible where chemicals are used, rather than filed somewhere in the office.

Sources

1. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: Written program must cover labels, SDSs, training, chemical list, non-routine tasks, and multi-employer worksites; training required at initial assignment and when new hazards introduced
2. OSHA, GHS Hazard Communication Pictograms: GHS-required label elements and the standardized 16-section SDS format align U.S. labels with the international system
3. OSHA, Top 10 Most Cited Standards FY2023: Hazard Communication was the second most cited OSHA standard in FY2023 with 3,213 violations
4. OSHA, Penalties page (current civil penalty amounts): Serious violations carry penalties up to $16,131 per instance; willful or repeat violations up to $161,323 per instance under the 2024 penalty schedule
5. OSHA, Letters of Interpretation (Hazard Communication): OSHA has stated that electronic SDS access is acceptable with backup, and that an NFPA diamond alone may not satisfy full GHS secondary-container labeling without supporting training
6. OSHA, Hazard Communication guidance: When a significant portion of the workforce speaks a language other than English, employers should provide information and training in that language
7. OSHA, State Plans page: 22 states and 2 territories operate OSHA-approved state plans that must be at least as effective as the federal standard
8. California OSHA (Cal/OSHA), Division of Occupational Safety and Health: California's Cal/OSHA has additional requirements including Proposition 65 warning obligations for chemicals known to cause cancer or reproductive harm
9. OSHA, 29 CFR 1926.59 Hazard Communication (Construction): The construction HazCom standard at 29 CFR 1926.59 incorporates the full requirements of 1910.1200 by reference
10. OSHA, GHS Hazard Communication Pictograms: GHS specifies nine standardized pictograms covering flammables, oxidizers, toxicity, corrosion, health hazards, gas pressure, environmental hazards, explosives, and general hazards
11. OSHA, Penalties page (small employer reduction): Employers with 25 or fewer employees may receive penalty reductions of up to 60 percent; employers with 26 to 250 employees up to 40 percent