OSHA compliance: what employers must do and how to manage the risks

OSHA compliance is often treated as a binder of forms and a poster on the wall. The law asks for more than that — and the businesses that get cited are usually not the ones that missed a form, but the ones where a known hazard was left in place. This guide covers what OSHA requires of employers, recordkeeping and electronic reporting, inspections and current penalties, and a practical way to assess workplace hazards and keep them in a risk register.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 13 min read

What OSHA is and who it covers

OSHA, the Occupational Safety and Health Administration, is the agency within the US Department of Labor that sets and enforces workplace safety and health standards under the Occupational Safety and Health Act of 1970 (the OSH Act). It covers most private-sector employers and their workers in all states and territories, either directly (federal OSHA) or through an OSHA-approved State Plan.

• State Plans. According to OSHA, 22 State Plans (21 states and Puerto Rico) cover both private-sector and state and local government workers, and a further seven cover public-sector workers only. State Plans must be at least as effective as federal OSHA and can set stricter rules — California’s Cal/OSHA is the best-known example.
• Not covered by the OSH Act: the self-employed, immediate family members of farm employers, and workplaces regulated by another federal agency for the same hazards (for example, mining under MSHA). Federal agencies have their own OSHA programme.

What OSHA requires of employers

The duties fall into two groups: the broad obligations in the Act itself, and the detailed standards in Title 29 of the Code of Federal Regulations.

The general duty clause

Section 5(a)(1) of the OSH Act — the general duty clause — requires each employer to provide a workplace “free from recognized hazards” likely to cause death or serious physical harm. It fills the gaps between standards. OSHA has used it for hazards such as excessive heat, workplace violence and some ergonomic and combustible dust hazards. To cite it, OSHA generally has to show that a hazard existed, that it was recognised (by the employer or the industry), that it was likely to cause death or serious harm, and that a feasible way to reduce it existed.

The practical point: “there is no standard for that” is not a defence. If your industry knows a hazard is serious and there is a reasonable fix, you are expected to deal with it.

The standards

Section 5(a)(2) requires compliance with OSHA standards. The main sets are:

Duties that apply almost everywhere

• Display the OSHA poster (“Job Safety and Health — It’s the Law”) where workers can see it.
• Hazard communication for hazardous chemicals: a written programme, labels, safety data sheets and training.
• Training in a language and vocabulary workers understand, as required by the applicable standards.
• Personal protective equipment assessed, provided and, in most cases, paid for by the employer.
• Emergency action and fire prevention arrangements where the standards require them.
• Medical and exposure records kept and made available to workers where standards require monitoring.
• No retaliation. Section 11(c) protects workers who report injuries, raise safety concerns or file complaints.

Recordkeeping: OSHA Forms 300, 300A and 301

Under 29 CFR part 1904, covered employers record work-related injuries and illnesses that meet the recording criteria — for example, those involving days away from work, restricted work, medical treatment beyond first aid, or loss of consciousness.

Records must be kept for five years after the end of the year they cover.

Exemptions. Employers with 10 or fewer employees at all times during the previous calendar year, and establishments in certain lower-hazard industries listed by OSHA, do not need to keep these records routinely unless OSHA or the Bureau of Labor Statistics asks them to in writing. The exemption covers recordkeeping only — not the reporting duty below or any other standard.

Reporting severe injuries

Every employer covered by the OSH Act, including those exempt from recordkeeping, must report to OSHA:

• a work-related fatality within 8 hours;
• a work-related in-patient hospitalisation, amputation or loss of an eye within 24 hours.

Electronic submission

Some establishments must also submit their data each year through OSHA’s Injury Tracking Application (ITA). The deadline is 2 March for the previous calendar year’s data. Under the current rule:

• establishments with 250 or more employees in industries that must keep records submit Form 300A data;
• establishments with 20 to 249 employees in designated higher-hazard industries submit Form 300A data;
• establishments with 100 or more employees in a further list of designated industries also submit Form 300 and 301 data — a requirement that took effect in January 2024.

Electronic reporting rules have been expanded and cut back more than once since 2016. Check OSHA’s ITA pages and the industry lists for your NAICS code each year rather than relying on last year’s answer.

OSHA inspections: what triggers them and what happens

OSHA cannot inspect every workplace, so it prioritises. In broad order:

1. Imminent danger situations.
2. Severe injuries and fatalities reported by employers.
3. Worker complaints about hazards or violations.
4. Referrals from other agencies, organisations or the media.
5. Targeted inspections in high-hazard industries or under national and local emphasis programmes.
6. Follow-up inspections to check that cited hazards were fixed.

An inspection usually starts with an opening conference, followed by a walkaround of the workplace, interviews with workers and a review of records, and ends with a closing conference. If violations are found, OSHA issues citations — legally within six months of the violation — setting out the standard breached, the proposed penalty and an abatement date. The employer then has 15 working days to comply, request an informal conference or contest the citation before the independent Occupational Safety and Health Review Commission.

The most frequently cited standards

OSHA publishes its most frequently cited standards each fiscal year. For FY 2025 (October 2024 to September 2025), fall protection — general requirements (29 CFR 1926.501) topped the list for the fifteenth year running. Other standards on the FY 2025 list include hazard communication (1910.1200), ladders (1926.1053), lockout/tagout (1910.147), scaffolding (1926.451) and machine guarding (1910.212); respiratory protection and powered industrial trucks are also regular entries. If your work involves any of these, they are the obvious place to start a self-inspection.

OSHA penalties in 2025 and 2026

OSHA’s maximum civil penalties are normally adjusted for inflation each January. The 2025 amounts took effect on 15 January 2025. In May 2026 OSHA confirmed that there would be no 2026 adjustment, because the inflation data needed for the calculation was not available, so the 2025 amounts remain in force.

Penalties are per violation, so one inspection can produce several. OSHA may reduce proposed penalties for small employers, good faith and a clean history, but not for willful violations in the same way. State Plans set their own amounts. A willful violation that causes a worker’s death can also be prosecuted as a crime.

The fine is rarely the largest cost. Injuries bring workers’ compensation claims, lost time, replacement staff, damaged equipment, higher insurance premiums and, for contractors, a safety record that clients check before awarding work.

A workplace risk assessment approach

OSHA does not prescribe one risk assessment method for all employers, but its Recommended Practices for Safety and Health Programs set out a structure that works for organisations of any size. Its core elements are management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, programme evaluation and improvement, and communication and coordination between host employers, contractors and staffing agencies. Here is a practical version of the hazard steps.

1. Identify hazards

Walk the workplace with the people who do the work. Review injury records, near-miss reports, equipment manuals, safety data sheets and OSHA standards for your industry. Look at non-routine tasks too — maintenance, cleaning, start-up and shutdown are where many serious injuries happen. Do not forget health hazards such as noise, heat, dust and chemicals, and work-related stress and violence.

2. Assess the risk

For each hazard, judge how likely harm is and how severe it could be, using the same risk matrix you use elsewhere in the business. A fall from height or contact with unguarded machinery belongs at the top of the impact scale even if it has never happened to you.

3. Control the hazard using the hierarchy of controls

Work from the most to the least effective control:

1. Elimination — remove the hazard (do the work at ground level).
2. Substitution — replace it with something less hazardous (a safer chemical).
3. Engineering controls — isolate people from the hazard (guards, guardrails, ventilation).
4. Administrative controls — change the way people work (procedures, permits, rotation, training).
5. Personal protective equipment — the last line of defence, not the first.

4. Record, assign and review

Write down what you found, what you will do, who owns each action and by when. Review after any incident or near miss, when processes or equipment change, and at least annually. The difference between the inherent and residual risk shows what your controls are actually doing — and what would happen if a guard were removed or a procedure ignored.

Health and safety risks in a risk register

Your OSHA logs record what has already happened. A risk register records what could happen, how serious it would be, what you are doing about it and who is responsible. Keeping health and safety risks in the same register as financial, operational and compliance risks means the board sees a fatal-accident risk next to a cyber or supplier risk — which is where it belongs.

Scores are illustrative residual scores on a 5×5 matrix. Useful key risk indicators include near misses reported per month (a rising number often means a healthier reporting culture), overdue corrective actions, overdue training, and recordable incident and days-away rates against your own trend. For sector-specific hazards, see our risk profiles for construction and manufacturing.

UK and Australian equivalents

If you also operate outside the US, the principles are similar but the law is different — and in some ways broader.

• United Kingdom. The Health and Safety at Work etc. Act 1974 is enforced by the Health and Safety Executive (HSE) and local authorities. The Management of Health and Safety at Work Regulations 1999 require a “suitable and sufficient” risk assessment, recorded in writing where you have five or more employees. Serious incidents are reported under RIDDOR 2013.
• Australia. Most states and territories have adopted the model Work Health and Safety (WHS) laws developed by Safe Work Australia, which place a primary duty of care on the “person conducting a business or undertaking” (PCBU) to ensure health and safety so far as is reasonably practicable. Victoria has its own Occupational Health and Safety Act 2004. Each jurisdiction has its own regulator, and several have introduced industrial manslaughter offences.

The common thread with OSHA is risk-based: identify hazards, control them in proportion to the risk, involve workers and keep records. One register can hold risks for all your sites, with the applicable law noted against each.

Common mistakes

• Paperwork without hazard control. Perfect logs do not stop falls. Inspectors look at the workplace first.
• Assuming small means exempt. The recordkeeping exemption is narrow; the standards and reporting duties still apply.
• Relying on PPE. It is the last control, not the first.
• Ignoring contractors and temporary workers. Host employers and staffing agencies share responsibility.
• Discouraging reporting. Incentives tied to “zero injuries” can suppress reports and may breach anti-retaliation rules.
• Treating citations as closed when paid. Abatement is what matters; failure to abate is penalised daily.
• No review after change. New equipment, layouts and processes bring new hazards.