OSHA Compliance Guide for Employers (2026): Requirements, Recordkeeping and Penalties

OSHA compliance is not optional — and the cost of getting it wrong has never been higher. In 2026, a single willful violation can carry a penalty of up to $161,323. A pattern of repeat violations can push that figure into the millions. Yet every year, tens of thousands of US employers receive citations for violations that were entirely preventable.

This guide is written for HR leaders, operations managers, and business owners who need to understand exactly what OSHA requires — the forms, the deadlines, the inspection rights, and the penalty tiers — without wading through pages of regulatory language. Whether you run an office of 20 people or a warehouse of 500, OSHA’s rules apply to you, and this guide will tell you what to do about it.

What Is OSHA and Who Must Comply?

The Occupational Safety and Health Administration (OSHA) is a federal agency within the US Department of Labor. Created by the Occupational Safety and Health Act of 1970, OSHA’s mission is straightforward: ensure that American workers have safe and healthful working conditions.

OSHA covers most private-sector employers and their workers in all 50 states, the District of Columbia, and US territories. Federal government employees are covered by a separate OSHA program. State and local government workers are only covered in states that operate their own OSHA-approved programs.

Importantly, OSHA covers virtually every industry — not just construction and manufacturing. Office workers, healthcare staff, retail associates, restaurant employees, and remote workers all fall within OSHA’s jurisdiction.

Federal OSHA vs. State-Plan States: Fast Facts

Feature	Federal OSHA	State-Plan States (29 states)
Coverage	Private sector in non-plan states	Private + public sector workers
Standards	Federal OSHA standards	At least as effective as federal; often stricter
Inspections	Federal compliance officers	State compliance officers
Penalties	Federal penalty schedule	Must be at least equivalent; some states higher
Examples	Texas, Florida, Georgia, New York	California (Cal/OSHA), Michigan, Washington

The 29 states and territories with their own OSHA-approved programs include: Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Virgin Islands, Washington, and Wyoming, among others. If you operate in one of these states, check your state plan’s specific requirements — they can exceed federal minimums.

OSHA’s General Duty Clause: The Baseline Obligation

Section 5(a)(1) of the OSH Act — known as the General Duty Clause — requires every employer to provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm to employees. This is the foundational obligation from which all other OSHA requirements flow.

The General Duty Clause is not limited to industries with specific OSHA standards. OSHA can cite any employer under this clause for a hazard — even one not covered by a specific regulation — if four conditions are met:

• The employer failed to keep the workplace free of a hazard
• The hazard was recognized (either by the employer, the industry, or common sense)
• The hazard was causing or likely to cause death or serious physical harm
• There was a feasible and useful method to correct it

Practical implication: if you know about a hazard in your workplace — even one without a specific OSHA standard attached — you are still legally obligated to address it. Ignorance is not a defense once a hazard is recognized.

OSHA Recordkeeping Requirements: Forms 300, 300A, and 301

One of the most misunderstood areas of OSHA compliance is recordkeeping. Many employers assume they only need to report major accidents, but OSHA’s requirements go much further. If you have 10 or more employees and are not in a partially exempt low-hazard industry, you are required to maintain injury and illness records using three specific forms.

The Three OSHA Recordkeeping Forms

Form	Name	Purpose	Retention Period
OSHA Form 300	Log of Work-Related Injuries and Illnesses	Running log of each recordable case throughout the year	5 years
OSHA Form 300A	Summary of Work-Related Injuries and Illnesses	Annual summary of all cases; must be posted Feb 1 – April 30	5 years
OSHA Form 301	Injury and Illness Incident Report	Detailed account of each individual incident	5 years

Which Employers Are Exempt from Recordkeeping?

Two categories of employers are partially exempt from OSHA recordkeeping requirements (though they still must report fatalities and severe injuries):

• Small employers: Employers with 10 or fewer employees at all times during the previous calendar year
• Low-hazard industries: Employers in specific industries classified as low-hazard by OSHA (including many retail, finance, real estate, and service industries). OSHA publishes an updated list; you can verify your industry’s status using your NAICS code on OSHA’s website.

Important: partial exemption from recordkeeping does NOT exempt these employers from OSHA standards or from reporting severe injuries and fatalities. Every employer, regardless of size or industry, must report fatalities and certain severe injuries.

What Injuries and Illnesses Must Be Recorded?

A case is recordable if it is work-related and involves any of the following:

• Days away from work
• Restricted work or transfer to another job
• Medical treatment beyond first aid
• Loss of consciousness
• Diagnosis of a significant injury or illness by a healthcare professional
• Death
• Hearing loss (when a Standard Threshold Shift is confirmed)
• Needlestick injuries involving contaminated sharps
• Tuberculosis infection after occupational exposure

First aid treatments — including over-the-counter medications, bandaging minor cuts, and non-prescription-strength medications — do not trigger recordkeeping. The line between first aid and recordable medical treatment is critical and often disputed during inspections.

Form 300A Posting Requirements

Every year, covered employers must post the OSHA Form 300A Summary in a visible location in the workplace from February 1 through April 30. The summary must be certified by a company executive (owner, officer, or the highest-ranking company official at the establishment). Failure to post by February 1 is itself a citable violation.

OSHA Injury and Illness Reporting Deadlines

Beyond recordkeeping, OSHA requires employers to actively report certain severe incidents to OSHA directly. These reporting requirements apply to all employers covered by OSHA — including those exempt from routine recordkeeping.

The 8-Hour Rule: Fatalities

If a work-related fatality occurs, you must report it to OSHA within 8 hours of learning about the death. This applies to fatalities that occur within 30 days of a work-related incident. You can report by calling OSHA’s 24-hour hotline at 1-800-321-OSHA (6742) or reporting online at osha.gov.

The 24-Hour Rule: Severe Injuries

Three types of severe injuries must be reported to OSHA within 24 hours of learning about them:

• In-patient hospitalization of one or more workers (not just emergency room visits — must be admitted)
• Amputation of any body part (includes fingertip amputations)
• Loss of an eye

The 24-hour clock starts when the employer first learns about the qualifying event — not when the incident occurred. If an injury happens on a Friday evening and the employer learns on Saturday morning, the 24-hour window starts Saturday morning.

Electronic Reporting: OSHA 300A Online Submission

In addition to maintaining paper records, many employers are required to submit their Form 300A data electronically through OSHA’s Injury Tracking Application (ITA) at injurytracking.osha.gov. Submission is due by March 2 each year for the prior calendar year.

Electronic submission is required for:

• Establishments with 250 or more employees that are required to keep records
• Establishments with 20–249 employees in OSHA-designated high-hazard industries

OSHA uses this data for enforcement targeting, so timely and accurate submission matters. Beginning in 2024, OSHA also began publishing establishment-level injury and illness data publicly — meaning your injury rates can be reviewed by job applicants, insurance carriers, and customers.

OSHA Inspections: What to Expect

OSHA inspections happen without advance notice in the vast majority of cases. Understanding the inspection process — how they are triggered, what rights you have, and what happens after — is one of the most valuable things an employer can learn before they need it.

Types of OSHA Inspections

OSHA prioritizes inspections in this order:

• Imminent danger situations: Conditions where death or serious harm is about to occur
• Severe injury and illness reports: Triggered when employers report fatalities, hospitalizations, amputations, or eye loss
• Worker complaints: Filed by employees (or their representatives) alleging hazardous conditions
• Referrals: From other agencies, media reports, or other OSHA inspections
• Programmed inspections: Scheduled inspections of high-hazard industries, often based on injury rate data from OSHA’s ITA database
• Follow-up inspections: To verify that violations cited in a prior inspection have been corrected

The Inspection Process Step by Step

Step 1 — Opening conference: The OSHA compliance officer (CO) presents credentials, explains the purpose and scope of the inspection, and outlines the process. You have the right to require the CO to obtain a warrant if you do not consent to the inspection, though most employers allow entry voluntarily.

Step 2 — Walkaround: The CO tours the workplace, observing conditions, taking photographs, and making notes. You have the right to have a company representative accompany the CO. Employees also have the right to have a representative accompany the CO during the walkaround.

Step 3 — Employee interviews: The CO may interview workers privately. Employees have the right to speak with the CO in private, and employers cannot discipline employees for participating.

Step 4 — Records review: The CO will typically request injury and illness records (OSHA 300, 300A, 301), written safety programs, training records, and hazard communication documentation.

Step 5 — Closing conference: The CO discusses preliminary findings, identifies any apparent violations, and outlines next steps. This is your opportunity to present evidence, explain abatement measures already taken, or clarify facts.

What Happens After an Inspection

If violations are found, OSHA issues a citation and notice of penalty, typically within six months of the inspection. The citation describes each violation, the specific standard violated, and the proposed penalty. Employers have 15 working days to contest a citation by filing a Notice of Contest with OSHA. If not contested, the citation becomes a final order.

Even if you do not contest the citation, you must abate the hazard by the date specified and document abatement. Failing to abate carries its own daily penalties.

OSHA Penalties in 2026

OSHA penalty amounts are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. The 2026 penalty amounts represent the maximum per-violation amounts. Actual penalties depend on factors including the employer’s size, good faith efforts, violation history, and gravity of the violation.

Violation Type	2026 Maximum Penalty	Description
Serious	$16,131 per violation	Hazard likely to cause death or serious harm that the employer knew about or should have known about
Other-Than-Serious	$16,131 per violation	Violation related to safety/health but unlikely to cause death or serious injury
Willful	$16,131 – $161,323 per violation	Employer intentionally violated OSHA standards or showed plain indifference to requirements
Repeat	Up to $161,323 per violation	Substantially similar violation cited within the previous 5 years
Failure to Abate	$16,131 per day beyond abatement date	Employer did not correct a previously cited violation by the required date
Posting Requirements	Up to $16,131 per violation	Failure to post OSHA poster or Form 300A

For context on the real financial exposure: a multi-day failure to abate a serious violation can quickly generate six-figure penalties even without a willful finding. OSHA inspectors can cite multiple individual violations from a single inspection — a site with 10 serious violations faces up to $161,310 in maximum proposed penalties before any negotiation.

OSHA offers penalty reductions for: good faith (up to 25% reduction), small business size (up to 70% for employers with 25 or fewer workers), and history of compliance. These reductions are applied to the gravity-based penalty before any good faith or size reduction, but willful violations do not qualify for good faith reductions.

Most Cited OSHA Violations: The Annual Top 10

Every year, OSHA publishes its list of the ten most frequently cited standards following federal inspections. This list has remained remarkably consistent for years, which means these are not obscure edge cases — they are foundational compliance failures that OSHA encounters across virtually every industry. If your organization has not audited these specific areas, start here.

Rank	Standard	Topic	Why It Matters
1	29 CFR 1926.501	Fall Protection – Construction	Leading cause of construction fatalities; inadequate guardrails, fall arrest systems
2	29 CFR 1910.1200	Hazard Communication (HazCom)	Chemical labeling, Safety Data Sheets, employee training requirements
3	29 CFR 1926.1053	Ladders – Construction	Improper ladder use, defective equipment, lack of training
4	29 CFR 1910.134	Respiratory Protection	Written program, medical evaluations, fit testing, and training gaps
5	29 CFR 1926.503	Fall Protection Training – Construction	Inadequate or undocumented fall protection training
6	29 CFR 1910.147	Lockout/Tagout (Control of Hazardous Energy)	Energy control procedures for equipment maintenance; a major cause of amputations
7	29 CFR 1926.502	Fall Protection Systems – Construction	Deficiencies in guardrail, safety net, or personal fall arrest systems
8	29 CFR 1910.178	Powered Industrial Trucks (Forklifts)	Operator certification, inspection requirements, and safe operating procedures
9	29 CFR 1910.305	Electrical Wiring Methods	Improper wiring, exposed conductors, and inadequate grounding
10	29 CFR 1910.212	Machine Guarding	Unguarded machinery points of operation; significant amputation risk

General industry employers should pay particular attention to standards 2, 4, 6, 8, 9, and 10. These appear year after year in office environments, warehouses, manufacturing facilities, and healthcare settings alike. Hazard communication violations, for example, are cited at businesses ranging from hair salons to hospitals.

State OSHA Plans: 29 States with Their Own Programs

Twenty-nine states and territories operate their own occupational safety and health programs, approved by federal OSHA. These state plans must meet or exceed federal OSHA requirements — but many go further, imposing stricter standards, lower exposure limits, or additional requirements that federal law does not mandate.

For employers operating in multiple states, this creates a compliance patchwork. A safety program adequate under federal OSHA may fall short of Cal/OSHA requirements, for example. Key state plan considerations:

• California (Cal/OSHA): Requires written Injury and Illness Prevention Programs (IIPP) for all employers. Has stricter heat illness prevention and indoor heat standards, additional requirements for COVID-19 and aerosol transmissible diseases, and higher penalty caps than federal OSHA.
• Washington (L&I / WISHA): Separate agency from federal OSHA; covers both private and public employees. Has unique ergonomics-related requirements and stricter rules around silica exposure.
• Michigan (MIOSHA): Separate standards for construction and general industry, with additional requirements around workplace violence prevention in healthcare settings.
• Oregon (Oregon OSHA): Requires a written safety and health program for all workplaces; has progressive safety culture requirements tied to inspection priority reduction.
• Virginia (VOSH): One of the few state plans to adopt permanent workplace violence prevention standards for healthcare and social assistance industries.

If you operate in a state plan state, you should review that state’s specific standards in addition to — not instead of — federal OSHA requirements. Federal OSHA does not enforce standards in state plan states for industries covered by the state program.

OSHA Compliance for Remote and Hybrid Workplaces

OSHA’s requirements do not disappear when employees work from home. However, the practical application of OSHA to home-based work is more limited than many employers assume. Here is what you need to know:

What OSHA Does and Does Not Require for Remote Workers

OSHA has stated that it will not conduct inspections of home offices and will not hold employers liable for employees’ home office conditions. However, there are important nuances:

• Recordkeeping still applies: If a remote employee is injured while performing work-related tasks at home, that injury can be recordable under OSHA’s rules. The test is whether the injury was work-related — not where it occurred.
• Employer-provided equipment: OSHA standards generally apply to employer-provided tools and equipment even when used at home. If your company ships chemical products to a remote worker’s home for work use, hazard communication requirements still apply.
• Ergonomics guidance: OSHA has no specific ergonomics standard for general industry, but the General Duty Clause could potentially apply to known ergonomic hazards. Most employers address this through voluntary ergonomic assessments.
• Mental health hazards: OSHA’s stance on psychosocial hazards is evolving. The General Duty Clause has been used to address workplace violence; its application to remote-work-related stress is an emerging area.

For hybrid workplaces, the key is consistency: your OSHA recordkeeping obligations do not change based on where the work happens. Incident investigation procedures, reporting chains, and recordkeeping systems need to work across all work locations.

Best HR and Safety Software for OSHA Compliance

Managing OSHA compliance manually — tracking incidents in spreadsheets, setting calendar reminders for Form 300A posting, and maintaining paper training records — is how organizations miss deadlines and accumulate risk. Modern EHS (Environment, Health, and Safety) and HR software platforms automate the most time-sensitive compliance tasks.

Here are the key categories of software relevant to OSHA compliance:

EHS and Safety Management Platforms

Intelex: Enterprise-grade EHS platform with OSHA 300/300A/301 recordkeeping, incident management, audit tools, and regulatory reporting. Strong in manufacturing, oil and gas, and large multi-site organizations.

Cority: Comprehensive EHS suite with configurable incident reporting workflows, injury case management, and automated regulatory submission for electronic OSHA reporting. Used by Fortune 500 companies in high-hazard industries.

Safesite: Mid-market safety management platform with mobile-first incident reporting, inspection checklists, and OSHA recordkeeping automation. Well-suited for construction, field service, and distributed workforces.

iAuditor by SafetyCulture: Mobile inspection and audit platform that helps safety managers conduct regular walkarounds, document hazard observations, and assign corrective actions. Strong for teams that do frequent facility audits.

HR Platforms with Safety and Compliance Modules

BambooHR: While primarily an HR platform, BambooHR includes incident tracking and time-off management features useful for recording restricted work days. Integrates with standalone EHS platforms via API.

Rippling: Offers compliance monitoring, document management, and training delivery that can support OSHA training recordkeeping requirements. Better for tech-forward companies managing compliance documentation across a distributed workforce.

Workday: Enterprise HCM with health and safety case management modules. Suitable for large organizations that want unified HR, benefits, and safety tracking in a single system of record.

Training Management Systems

OSHA requires documented training for a significant number of standards — from hazard communication to lockout/tagout to forklift operation. Learning management systems (LMS) with OSHA course libraries and completion tracking help maintain the training records that compliance officers request during inspections.

Platforms like Convergence Training, Vector Solutions, and Alchemy Systems offer OSHA-specific course libraries with completion certificates and integration into broader HR systems.

OSHA Compliance Checklist for Employers

Use this checklist as a baseline audit tool. It does not replace a full compliance assessment but provides a starting point for identifying gaps.

Recordkeeping and Reporting

• OSHA Form 300 is maintained and updated throughout the year
• OSHA Form 301 is completed within 7 calendar days of each recordable incident
• OSHA Form 300A is completed annually and posted February 1 – April 30
• Form 300A is certified by a company executive before posting
• Electronic submission to OSHA ITA completed by March 2 (if required)
• All OSHA records retained for a minimum of 5 years
• Fatality reporting procedure is documented and understood by management
• Severe injury (hospitalization, amputation, eye loss) reporting procedure is in place

Hazard Communication

• Written Hazard Communication Program is in place
• Safety Data Sheets (SDS) are accessible to all employees for each chemical in the workplace
• All chemical containers are properly labeled with GHS-compliant labels
• Employees have received HazCom training, and training is documented

Emergency Preparedness

• Written Emergency Action Plan (EAP) is in place (required for employers with 10+ employees)
• EAP includes evacuation procedures, emergency contact list, and employee roles
• Fire prevention plan is documented (if required for your industry)
• Emergency exits are clearly marked, unobstructed, and regularly inspected

Training Documentation

• Training records exist for all OSHA-required training (HazCom, PPE, emergency procedures, job-specific standards)
• Training records include employee names, dates, topics covered, and trainer information
• Refresher training is tracked and scheduled

Posting Requirements

• OSHA “Job Safety and Health – It’s the Law” poster is displayed in a conspicuous location
• OSHA citations (if any) are posted at or near the location of the violation until abated or for 3 working days (whichever is longer)
• State-plan equivalent poster is displayed if operating in a state plan state

Frequently Asked Questions About OSHA Compliance

Related US Employer Compliance Guides

This guide is part of the Spotsaas US Employer Compliance series. Each article covers a distinct federal compliance area for US employers:

• FMLA Compliance Guide for Employers — Leave requirements, intermittent leave rules, notice deadlines, and common violations
• ACA Compliance Guide for Employers — Employer mandate, affordability thresholds, 1095-C reporting, and ESRP penalties in 2026
• FLSA Overtime Rules: Employer Guide — Salary thresholds, exempt vs. non-exempt classification, and overtime calculation rules
• I-9 Compliance Guide for Employers — Document verification, remote I-9 rules, E-Verify requirements, and ICE audit preparation
• COBRA Administration Guide for Employers — Qualifying events, notice deadlines, premium calculation, and excise tax penalties