Which OSHA standards require a written safety program?

Last updated 2026-07-11

Why does OSHA require written programs at all?

OSHA has no master rule that says "every employer must have a written safety program." Specific standards each carry their own written-program requirement, and those requirements vary a lot in scope. Some demand a full site-specific document with named procedures and employee signatures. Others just ask you to document a policy decision or a list of authorized employees.

The reason for the paper trail is simple. A written program proves a hazard control system existed before an injury, not after. During an inspection, a compliance officer asks to see your written programs early in the walkaround. If you can't produce them, OSHA can cite you for the documentation failure alone, separate from any physical hazard it finds ^[1].

For small businesses, this is often a surprise. Owners believe that because they train workers by hand and things run safely, they're covered. They're not. The standard says "written," and OSHA has upheld citations for missing written programs even when nobody got hurt.

What is the complete list of OSHA standards that require a written program?

The table below covers the standards that explicitly require a written program, plan, or procedure under General Industry (29 CFR 1910) and Construction (29 CFR 1926). "Explicitly" means the standard uses the words "written program," "written plan," "written procedure," or "document" in a mandatory way ^[1][2].

Standard	Topic	Written Document Required
29 CFR 1910.119	Process Safety Management (PSM)	Written process safety information, procedures, and emergency response plan
29 CFR 1910.120	Hazardous Waste Operations (HAZWOPER)	Written safety and health program, emergency response plan
29 CFR 1910.132	PPE (General)	Written hazard assessment certification
29 CFR 1910.134	Respiratory Protection	Written respiratory protection program
29 CFR 1910.138	Hand Protection	Written program when hazard assessment finds a need
29 CFR 1910.146	Permit-Required Confined Spaces	Written permit-required confined space program
29 CFR 1910.147	Lockout/Tagout (LOTO)	Written energy control program and machine-specific procedures
29 CFR 1910.157	Portable Fire Extinguishers	Written fire prevention plan (if employees must fight fires)
29 CFR 1910.165	Employee Alarm Systems	Written emergency action plan (EAP)
29 CFR 1910.269	Electric Power Generation	Written safety program
29 CFR 1910.272	Grain Handling	Written emergency action plan, grain bin entry procedures
29 CFR 1910.1000-1450	Z-series chemicals	Written medical surveillance, exposure monitoring (substance-specific)
29 CFR 1910.1020	Access to Medical/Exposure Records	Written records-access procedure
29 CFR 1910.1030	Bloodborne Pathogens	Written Exposure Control Plan
29 CFR 1910.1047	Ethylene Oxide	Written compliance program
29 CFR 1910.1048	Formaldehyde	Written compliance program
29 CFR 1910.1200	Hazard Communication (HazCom/GHS)	Written hazard communication program
29 CFR 1910.1450	Lab Standard (Chemical Hygiene)	Written Chemical Hygiene Plan
29 CFR 1926.20	Construction Safety (general)	Written program for repetitive, high-hazard operations
29 CFR 1926.502	Fall Protection (construction)	Written fall protection plan for certain operations
29 CFR 1926.503	Fall Protection Training	Written certification of training
29 CFR 1926.1153	Silica (construction)	Written exposure control plan
29 CFR 1910.1053	Beryllium	Written exposure control plan
29 CFR 1910.1044	1,2-Dibromo-3-chloropropane	Written compliance program
29 CFR 1910.1051	1,3-Butadiene	Written compliance program
29 CFR 1910.1096	Ionizing Radiation	Written program for overexposure situations

This list is not exhaustive. Several state-plan states (California, Michigan, Washington, and others) add written-program requirements beyond federal OSHA ^[3]. If you operate in a state-plan state, check your state agency's rules directly.

The single most common written-program citation in general industry is 29 CFR 1910.1200 (hazard communication), which is also one of the easiest programs to build. Our hazard communication guide covers what it must contain.

Which written programs are required most often, regardless of industry?

Four written programs show up in almost every general industry workplace, no matter what you make or sell: Hazard Communication, the Emergency Action Plan, Lockout/Tagout, and Respiratory Protection. Start there.

The Hazard Communication program (29 CFR 1910.1200) is required any time employees may be exposed to hazardous chemicals. That covers most workplaces. The program lists the chemicals present, identifies your Safety Data Sheets, and describes how you label containers and train employees ^[2].

The Emergency Action Plan (29 CFR 1910.38) is required if any OSHA standard covering your workplace mandates one, which pulls in most businesses with more than 10 employees. The plan covers evacuation routes, employee accountability, and who calls emergency services. Employers with 10 or fewer employees may communicate their plan orally instead of in writing, per 1910.38(b) ^[1].

The Lockout/Tagout energy control program (29 CFR 1910.147) is required wherever workers service or maintain equipment that could start unexpectedly. This is one of the more demanding written programs because you need both a program document and individual written procedures for each machine. OSHA estimates that compliance with the LOTO standard prevents roughly 120 fatalities and 50,000 injuries per year ^[4]. Our lockout tagout article walks through what each machine-specific procedure must contain.

The Respiratory Protection program (29 CFR 1910.134) is required any time respirators are used, whether OSHA mandates them or an employee chooses to wear one. Even a courtesy respirator triggers 29 CFR 1910.134(c)(2), which requires at minimum a written statement making the respirator available and spelling out its limitations.

Beyond those four: permit-required confined spaces need a written program under 29 CFR 1910.146, and a PSM-covered process (chemicals above the threshold quantities listed in Appendix A to 1910.119) needs a full written PSM program. Those two take far more work to build than the rest.

What must each written program actually contain?

Every standard sets its own minimum content, and there is no universal template. Most written programs share a common skeleton, though: who's covered, who's responsible, what controls you use, and when you review it.

Almost all of them require a scope statement (which operations and employees are covered), an assignment of responsibilities (who owns what), the specific procedures or controls you use, and a review schedule. Many also require documentation that training happened.

Here's what the five most common programs must cover.

Hazard Communication (1910.1200): List of hazardous chemicals in each work area, location of Safety Data Sheets, labeling procedures, and a description of employee training ^[2]. OSHA's standard says the written program must be "available, upon request, to employees, their designated representatives, the Assistant Secretary and the Director."

Emergency Action Plan (1910.38): Evacuation procedures and routes, procedures for employees who must remain to run critical operations, headcount procedures, preferred means of alerting employees, and rescue or medical duties if you assign them ^[1].

Lockout/Tagout (1910.147): Purpose and scope, rules for employee compliance, means to enforce compliance, steps for shutting down and isolating energy, and machine-specific procedures for each covered piece of equipment. Procedures must be documented unless a single energy source can be locked in one step with zero residual energy.

Respiratory Protection (1910.134): Procedures for selecting respirators, medical evaluations, fit testing, use, maintenance, and training. You must name a program administrator.

Permit-Required Confined Spaces (1910.146): How you identify permit spaces, how you prevent unauthorized entry, and how you coordinate with contractors who enter the same space.

How do you know which written programs your specific business needs?

Start with a hazard inventory. Walk your facility and list the categories of hazard present: chemicals, energized equipment, confined spaces, fall exposures, blood or bodily fluids, respiratory hazards. Each category maps to one or more OSHA standards, and you check each standard for a written-program requirement.

OSHA's compliance assistance resources at osha.gov help match your industry NAICS code to the standards most likely to apply ^[5]. The agency also publishes industry-specific small business pages.

For most small businesses under 25 employees, the real list is 3 to 6 written programs. A retail shop might need only an Emergency Action Plan and a Hazard Communication program. A machine shop adds Lockout/Tagout and likely Respiratory Protection. A healthcare clinic adds a Bloodborne Pathogens Exposure Control Plan.

If you want to skip the guesswork, SafetyFolio's safety program generator walks you through a hazard questionnaire and produces OSHA-formatted program documents in about 15 minutes. It does not replace a legal review for high-hazard situations, but it gets you from nothing to a working draft fast.

One thing worth knowing. OSHA's General Duty Clause (Section 5(a)(1) of the OSH Act) allows citations for recognized hazards even when no specific standard applies. The Occupational Safety and Health Review Commission has upheld General Duty Clause citations that pointed to the absence of a written program as evidence a hazard wasn't controlled ^[6]. So even where no specific written-program standard exists, documenting your controls is smart.

What happens if OSHA finds you're missing a required written program?

A missing written program is a standalone citation. OSHA classifies it as Serious if a related physical hazard also exists, or Other-Than-Serious if the only problem is the missing paperwork. That distinction drives the penalty.

As of January 2025, the maximum penalty for a Serious violation is $16,550 per violation. Repeat or willful violations can reach $165,514 per violation ^[7]. OSHA adjusts these figures every year for inflation under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015.

Inspectors often cite missing written programs alongside physical hazards found during the walkaround. An employer with no written Lockout/Tagout program and improperly guarded equipment faces multiple citations at once. The written-program citation adds to the penalty total and can push the classification of other citations higher.

Small employers (fewer than 25 employees) can request an informal conference with the OSHA Area Director after citations, where penalties are sometimes cut. First-time violations with no injury history may also qualify for a reduction. But the citation stays in OSHA's inspection history and can be used as evidence of prior knowledge in a future inspection ^[8].

If you get cited and want to understand what comes next, our incident report guide covers the process after an OSHA event.

Do written programs need to be updated, and how often?

Most standards require you to review and update your written program whenever a change in the workplace makes the current program inaccurate or inadequate. That language shows up in nearly identical form across 1910.134, 1910.146, 1910.147, 1910.1200, and others.

Some standards also set a fixed interval. The Bloodborne Pathogens standard (1910.1030) requires an annual review and update of the Exposure Control Plan to reflect changes in technology and procedures. The PSM standard (1910.119) requires revalidation of Process Hazard Analyses every five years.

OSHA does not require a blanket annual review of every program. Still, the practical move is to review each program once a year, document that you did it, and note any changes. Inspectors look favorably on programs that show a review date and a reviewer's signature. An undated program with no evidence of updates looks dead.

Keep your old versions. If an injury happened under a since-replaced procedure, OSHA may want to see exactly what the program said at the time.

Are construction employers subject to the same written program requirements as general industry?

Not exactly. Construction rules live in 29 CFR 1926, and while many parallel general industry, there are real differences.

The construction silica standard (29 CFR 1926.1153) requires a written exposure control plan when workers perform tasks with exposures above the action level and don't use Table 1 controls exclusively. The fall protection standards (1926.502 and 1926.503) require written fall protection plans for certain leading edge and precast concrete work, plus written certifications of training ^[9].

Construction also has 29 CFR 1926.20, which requires written programs for safety and health efforts covering repetitive hazardous operations. The language is broad, and OSHA has used it to require written programs on construction sites where no more specific standard fits.

One area worth flagging: the construction hazard communication standard (29 CFR 1926.59) mirrors general industry 1910.1200 almost completely and requires the same written HazCom program. A construction contractor using hazardous chemicals needs a written HazCom program just like a factory does.

If your crews run forklifts on a construction site, the written evaluation and training certification requirements under 29 CFR 1910.178 (which applies in construction by cross-reference) matter too. Our forklift certification article covers what operators and employers need to document.

Do written programs need to be physically on paper, or can they be digital?

Digital is fine. OSHA's long-standing position is that electronic storage of required records and programs is acceptable as long as they can be promptly accessed, retrieved, and printed for employees or inspectors on request ^[10].

The key word is "promptly." If a compliance officer walks in and asks for your written Lockout/Tagout program, pulling it up on a tablet or printing it from a shared drive works. Having it locked behind a login held by someone who's off site does not.

Programs employees reference during work (machine-specific LOTO procedures, say) have to be accessible at or near the equipment. Digital kiosks, laminated QR codes linking to a document, and tablets mounted near machines have all been used in practice. Whether a specific setup satisfies "accessible" can come down to how a compliance officer reads it in context.

Some programs, like the LOTO energy control program, are also training documents. Employees need to understand them, more than theoretically reach them. A document buried five clicks deep in a shared drive is technically accessible and practically invisible. Store your programs where workers actually look.

What does OSHA say about small employers and written programs?

There is no blanket small-business exemption from written-program requirements. Each standard applies based on the hazard, not the size of the payroll.

One explicit size-based exception exists: the Emergency Action Plan standard (1910.38) lets employers with 10 or fewer employees communicate their plan orally instead of in writing. That's the only federal OSHA standard with a written-program carve-out based on headcount.

OSHA does help small employers. The agency's On-Site Consultation Program, funded by OSHA but run separately from enforcement, gives free confidential visits to help small and medium businesses find hazards and set up programs. A consultation visit does not trigger an enforcement inspection ^[5]. The program runs roughly 25,000 visits a year nationwide.

For businesses under 25 employees, OSHA also offers penalty reductions of up to 70 percent for first-time violations. That lowers the financial stakes. It does not erase the obligation to have the required programs in place.

To see how OSHA's broader compliance structure fits together, our osha overview is a good starting point.

How long does it take to write all required safety programs?

It depends on how many you need and how much site-specific detail you put in. A focused small business can knock out first drafts in a day. A mid-size manufacturer can burn a full work week or more.

A one-location small business needing 4 to 5 programs (HazCom, EAP, Lockout/Tagout, Respiratory Protection, and Bloodborne Pathogens) can realistically draft them in a full workday if someone sits down and focuses. The longest single program from scratch is usually Lockout/Tagout, because every machine needs its own procedure.

A mid-size manufacturer with 50-plus employees, multiple chemical hazards, permit-required confined spaces, and PSM coverage could spend 40 to 80 hours or more building complete programs, especially with contractor coordination or engineering detail involved.

OSHA posts model programs for some standards on its website, including a model respiratory protection program and a model hazard communication program ^[5]. They're generic and need site-specific fill-in, but they give you a correct structure to work from.

SafetyFolio's generator cuts the time on common programs by automating the required structure and prompting you for only the site-specific inputs. The result still needs a review by someone who knows your workplace. What it kills is the blank page.

Once the programs are written, employees have to understand them. Our osha training article covers the training requirements that sit alongside most written programs.

Frequently asked questions

Is a written safety program required by OSHA for all employers?

No. OSHA requires written programs under specific standards, not as a blanket rule. Whether you need one depends on the hazards in your workplace. But because nearly every workplace has some chemical hazards, almost all employers need a written Hazard Communication program under 29 CFR 1910.1200. Start there and add others based on your hazard inventory.

What is the difference between a written program, a written plan, and a written procedure?

OSHA uses all three terms and they are not interchangeable. A written program is the broadest document, covering scope, responsibilities, and all related procedures. A written plan (like an Emergency Action Plan) focuses on what employees do in a specific event. A written procedure is a step-by-step work instruction, like a lockout/tagout energy control procedure for one machine. Many standards require all three at different levels.

Does the hazard communication standard require a written program for every employer?

Yes, for virtually any employer whose workers may be exposed to hazardous chemicals during normal operations or foreseeable emergencies. 29 CFR 1910.1200(e) requires a written hazard communication program describing how you meet the labeling, SDS, and training requirements, available to employees on request. It consistently ranks among OSHA's top five most-cited standards.

Do I need a written safety program for just one employee?

The standards set no employee-count minimum, except the Emergency Action Plan's oral-only option for 10 or fewer employees. If the hazard covered by a specific standard is present, the written program is required regardless of workforce size. A sole proprietor with one part-time worker who uses hazardous chemicals still needs a written HazCom program.

Can I use a generic template for my written safety programs?

You can use a template as a starting point, including OSHA's own model programs at osha.gov. But templates must be customized to your workplace. Compliance officers can spot a template that was never adapted, and a generic program that doesn't match your operations gives little legal protection and almost no safety benefit. Fill in the site-specific sections thoroughly.

What is the penalty for not having a written lockout/tagout program?

A missing or inadequate written lockout/tagout program under 29 CFR 1910.147 is usually cited as Serious, with penalties up to $16,550 per instance as of January 2025. Willful or repeat violations reach $165,514. LOTO is one of OSHA's most-cited standards year after year, and inspectors specifically ask for the written program during any inspection involving machinery.

Does the emergency action plan need to be a written document?

Under 29 CFR 1910.38, employers with more than 10 employees must have a written Emergency Action Plan. Employers with 10 or fewer may communicate it orally. The written plan must cover evacuation routes and procedures, employee accountability after evacuation, procedures for critical-operations employees, and preferred alarm methods. Keep it at the workplace and make it available for employee review.

What OSHA standards require written programs in healthcare settings?

Healthcare employers commonly need written programs under 29 CFR 1910.1030 (Bloodborne Pathogens Exposure Control Plan, reviewed annually), 29 CFR 1910.134 (Respiratory Protection if respirators are used), 29 CFR 1910.1200 (Hazard Communication for cleaning chemicals and drugs), and 29 CFR 1910.38 (Emergency Action Plan). Some also need programs under the formaldehyde standard (1910.1048) or ethylene oxide standard (1910.1047) depending on procedures performed.

How often does OSHA require written programs to be reviewed and updated?

Most standards require review and update whenever workplace conditions change enough to make the current program inadequate. The Bloodborne Pathogens standard requires at least an annual review. PSM requires revalidation of process hazard analyses every five years. Best practice is a documented annual review of all programs, even when nothing changed, to show the program is active and more than filed and forgotten.

Does OSHA require a written safety program for construction contractors?

Yes. Construction employers fall under 29 CFR 1926, which includes written program requirements for hazard communication (1926.59), fall protection plans (1926.502), silica exposure control plans (1926.1153), and general safety programs for repetitive hazardous operations (1926.20). Federal OSHA's construction standards parallel many general industry requirements, and several general industry standards are incorporated by reference into 1926.

What is required in a written respiratory protection program under OSHA?

Under 29 CFR 1910.134, the written program must cover procedures for selecting respirators, medical evaluation of employees, fit testing, use in routine and emergency situations, maintenance and storage, training content, and how you evaluate program effectiveness. It must name an administrator responsible for the program. Even voluntary respirator use requires a written statement under 1910.134(c)(2).

Are written programs required under OSHA state plans, and are they different from federal requirements?

State-plan states must have standards at least as effective as federal OSHA, and they often require more. California's Cal/OSHA, for example, requires an Injury and Illness Prevention Program (IIPP) from nearly every employer, a written safety program requirement with no direct federal equivalent. If you operate in a state-plan state, check with your state agency for written program obligations beyond the federal minimums.

What is the bloodborne pathogens exposure control plan and who needs it?

The Exposure Control Plan under 29 CFR 1910.1030 is required for any employer whose workers have occupational exposure to blood or other potentially infectious materials. That includes healthcare, first responders, school nurses, and tattoo parlors. The plan must identify all job classifications with exposure, describe the control methods, and be updated at least annually. OSHA estimates 5.6 million workers face occupational bloodborne pathogen exposure.

Does OSHA require a written program for PPE selection and use?

Yes, partially. 29 CFR 1910.132(d) requires employers to conduct and certify a written hazard assessment for PPE. The certification must identify the workplace evaluated, the person who did the evaluation, and the date. Beyond that, some PPE categories carry their own written program requirements: respiratory protection (1910.134) requires a full written program, and hand protection (1910.138) requires one when a hazard assessment shows it's needed.

Sources

1. OSHA, 29 CFR 1910.38 Emergency Action Plans: Employers with 10 or fewer employees may communicate their emergency action plan orally; others must have a written plan
2. OSHA, 29 CFR 1910.1200 Hazard Communication: Requires a written hazard communication program describing labeling, SDS, and training procedures, available to employees upon request
3. OSHA, State Plans overview: State-plan states may have written program requirements beyond federal OSHA minimums
4. OSHA, Control of Hazardous Energy (Lockout/Tagout) topic page: OSHA estimates LOTO compliance prevents approximately 120 fatalities and 50,000 injuries per year
5. OSHA, On-Site Consultation Program: OSHA's free consultation program covers roughly 25,000 visits per year and does not trigger enforcement inspections
6. OSH Act of 1970, Section 5 Duties (General Duty Clause): The General Duty Clause allows OSHA citations for recognized hazards not covered by a specific standard, including the absence of documented controls
7. OSHA, Penalties page: As of January 2025, the maximum penalty for a Serious violation is $16,550 and for willful or repeat violations is $165,514
8. OSHA, Establishment Search and inspection data: Citations remain in OSHA's inspection history and can be used as evidence of prior knowledge in future inspections
9. OSHA, 29 CFR 1926.1153 Respirable Crystalline Silica (construction): Requires a written exposure control plan for construction employers when workers have exposures above the action level without exclusive Table 1 controls
10. OSHA, Recordkeeping page: OSHA accepts electronic storage of required records and programs as long as they can be promptly accessed and printed upon request
11. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Requires a written energy control program and machine-specific written procedures for each piece of covered equipment
12. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens: Requires an annual review and update of the written Exposure Control Plan; OSHA estimates 5.6 million workers face occupational bloodborne pathogen exposure
13. OSHA, Commonly Used Statistics / Top 10 Cited Standards: Hazard Communication (1910.1200) and Lockout/Tagout (1910.147) consistently rank among OSHA's most-cited standards each fiscal year