OSHA for small business

OSHA Requirements for Small Businesses

OSHA has no exemption for small businesses: any employer with one or more employees is covered (29 CFR 1975.4(a)). Injury and illness records start above 10 employees in the entire company over the last calendar year (1904.1), emergency and fire prevention plans may be oral at 10 or fewer (1910.38(b), 1910.39(b)), and every employer reports deaths and serious injuries (1904.39).

Verified vs OSHA sources · Oct 21, 2026

29 CFR 1975.4(a), 29 CFR 1904.1(a), 29 CFR 1910.38(b), 29 CFR 1910.39(b), 29 CFR 1904.39(a)

What applies to my business

Give your industry code, the size of the company and two yes or no answers. The list that comes back names the paragraph behind each line. Nothing you type leaves your browser.

The checklist, by situation

Find the lines that describe your business. Each one gives the paragraph, so you can read the rule itself on the eCFR.

Your situation	What the paragraphs ask
You have one or more employees	Any employer employing one or more employees is covered by the Act. A person who has no employees is not an employer. State and local governments are not employers under the Act, and a State Plan can cover their employees.29 CFR 1975.4(a), 29 CFR 1975.3(d)(5), 29 CFR 1975.5(a)(5)
Every employer, whatever its size	Each employer posts and keeps posted the OSHA notice in a conspicuous place in each establishment. A work-related death is reported to OSHA within eight hours, and an in-patient hospitalization, an amputation or the loss of an eye within twenty-four hours.29 CFR 1903.2(a)(1), 29 CFR 1904.39(a)(1), 29 CFR 1904.39(a)(2)
You use hazardous chemicals	Employers develop, implement and maintain at each workplace a written hazard communication program with a list of the hazardous chemicals. Each container is labeled, safety data sheets are readily accessible during each work shift, and employees get information and training at their initial assignment. These paragraphs name no employee count, and construction employers follow the same text through 1926.59.29 CFR 1910.1200(e)(1), 29 CFR 1910.1200(f)(6), 29 CFR 1910.1200(g)(8), 29 CFR 1910.1200(h)(1), 29 CFR 1926.59
A standard that applies to you calls for an emergency action plan or a fire prevention plan	The plan is in writing, kept in the workplace and available to employees for review, except that an employer with 10 or fewer employees may communicate it orally. In construction the emergency action plan has the same oral option, and the employer is responsible for a fire protection and prevention program at the job site through all phases of the work.29 CFR 1910.38(b), 29 CFR 1910.39(b), 29 CFR 1926.35(e)(3), 29 CFR 1926.24
Your company had more than 10 employees at any time last calendar year	You keep the OSHA 300 Log, the 301 and the 300A unless your establishment is classified as a partially exempt industry. The size is counted for the entire company over the last calendar year. A company that had 10 or fewer employees at all times during that year does not need to keep records unless OSHA or the Bureau of Labor Statistics informs it in writing.29 CFR 1904.1(a), 29 CFR 1904.1(b)
Your establishment is in a partially exempt industry	An establishment classified in a NAICS code of Appendix A to subpart B keeps no injury and illness records unless OSHA, the Bureau of Labor Statistics or a state agency asks in writing. Construction is not on that list. Every employer still reports deaths and serious injuries.29 CFR 1904.2(a)(1), 29 CFR 1904.2 Appendix A (to subpart B)
Sending records to OSHA online	This is decided for each establishment by its headcount in the previous calendar year. With 250 or more employees and records to keep, the 300A is submitted. With 20 to 249 employees in an industry on appendix A to subpart E, the 300A is submitted. With 100 or more employees in an industry on appendix B, the 300 and 301 are submitted too.29 CFR 1904.41(a)(1)(i), 29 CFR 1904.41(a)(1)(ii), 29 CFR 1904.41(a)(2)
You do construction work	The employer initiates and maintains the programs needed to comply with part 1926. Those programs provide for frequent and regular inspections of the job sites, materials and equipment by competent persons designated by the employer, and the employer instructs each employee in the recognition and avoidance of unsafe conditions.29 CFR 1926.20(b)(1), 29 CFR 1926.20(b)(2), 29 CFR 1926.21(b)(2)
You run a farm	An agricultural employer with one or more employees is covered, and members of the immediate family of the farm employer are not regarded as employees. OSHA's directive on the Appropriations Act exempts from enforcement a farming operation with 10 or fewer employees currently and at all times in the last 12 months that has had no active temporary labor camp in the preceding 12 months. That limit is set year by year.29 CFR 1975.4(b)(2), OSHA interpretation 1998-05-28

Free help for a small business

OSHA's On-Site Consultation Program gives small and medium-sized businesses free and confidential advice, delivered by the states. Consultation is independent of enforcement, and the discovery of hazards does not mandate citation or penalties. The employer remains under a statutory obligation to protect employees, and correcting the hazards the consultant finds can lead to an exemption from certain enforcement activities.

29 CFR 1908.1(b)

Start on OSHA's consultation page to find the office in your state.

Penalty reductions for small employers

The size of the employer is one of the factors OSHA looks at when it adjusts a penalty. Our article on the July 2025 small business penalty reductions explains the current adjustments, and the 2026 penalty amounts page lists the maximums. Read the penalty reductions article.

Questions small employers ask

Does OSHA apply to small businesses?

Yes. Any employer employing one or more employees is covered by the Act. There is no minimum size, and a person who has no employees is not an employer. Size changes a few paragraphs, for example who keeps injury and illness records and who may keep an emergency plan oral.

29 CFR 1975.4(a) and 29 CFR 1975.3(d)(5)

Are small businesses exempt from OSHA recordkeeping?

Partly. A company that had 10 or fewer employees at all times during the last calendar year, counting the entire company, does not need to keep injury and illness records unless OSHA or the Bureau of Labor Statistics informs it in writing. Establishments in the partially exempt industries are also excused. Every employer still reports a death, an in-patient hospitalization, an amputation or the loss of an eye.

29 CFR 1904.1(a), 29 CFR 1904.2(a)(1) and 29 CFR 1904.39

Does a business with 10 employees need a written emergency action plan?

Only when an OSHA standard that applies to it calls for a plan. Then an employer with 10 or fewer employees may communicate the plan orally to employees. Above 10 employees the plan is in writing, kept in the workplace and available to employees for review.

29 CFR 1910.38(a), 29 CFR 1910.38(b) and 29 CFR 1910.39(b)

Do small farms have to follow OSHA?

An agricultural employer with one or more employees is covered, and family members of the farm employer are not regarded as employees. Under OSHA's directive on the Appropriations Act, a farming operation with 10 or fewer employees at all times in the last 12 months and no active temporary labor camp in the preceding 12 months is exempt from enforcement. The Appropriations Act sets its limits year by year, so confirm the current year with OSHA.

29 CFR 1975.4(b)(2) and OSHA interpretation 1998-05-28

Is there free help for a small business?

Yes. OSHA's On-Site Consultation Program, run with the states, offers free and confidential advice for small and medium-sized businesses with fewer than 250 employees at a site and no more than 500 nationwide. It is separate from enforcement and does not result in penalties or citations, though the employer remains under a statutory obligation to protect employees.

OSHA interpretation 2016-02-01 and 29 CFR 1908.1(b)

Does a self-employed person with no employees follow OSHA?

The term employer means any person engaged in a business affecting commerce who has employees. A self-employed person with no employees is not an employer under the Act. Hiring one employee makes the person an employer.

29 CFR 1975.3(d)(5) and 29 CFR 1975.4(a)

Run your OSHA records in HazComFast

The 300 Log, the 301 forms, the 300A and the ITA filing live in one place, and each step follows the paragraph of Part 1904 it comes from. This is what the module does, from the first question to the inspector's visit.

Start with the right questions

Do you have to keep the logs?

The app works it out from the company's peak employment last year and each establishment's NAICS code (29 CFR 1904.1 and 1904.2), and keeps the answer with its date. Construction is not on the exempt list, and the app says so.

Is the case recordable?

The assistant asks OSHA's own questions in order: work-relatedness and its exceptions, new case or continuation, then whether treatment went past the 14 first-aid treatments of 1904.7(b)(5)(ii). A person makes the call, and the signed, dated reasoning stays with the case, including the cases that stay off the Log.

Severe injuries, with the clock running

Log a death and an 8-hour countdown starts from the moment you learned of it. An in-patient hospitalization, an amputation or the loss of an eye gets 24 hours, and 8 hours in California. The eight facts OSHA asks for are pre-filled, and the case can't be closed until the report is logged (1904.39).

Record each case once, correctly

A 301 that loses nothing

The 301 keeps a draft as you type, survives a tab switch, and never creates a duplicate case when a phone resyncs after a dead zone. It walks through the form section by section, and the narrative fields the 301 asks for can't be left empty.

Dictate it on site

A supervisor can dictate what happened, in English or Spanish, through the browser's own speech recognition. The app fills only the empty fields, asks about what is missing, never sets the classification, and does not store the transcript.

Everyone who belongs on the log

Temporary and agency workers, subcontractor crews you supervise day to day, and former employees can all be picked on the 301. The app asks the supervision question, so a case is recorded once, by the right employer (1904.31).

The 7-day clock

The 7-day clock starts the day you learn about a case, and the badge turns red two days before it runs out.

Day counts that add up

The count stops at the 180-day cap on days away and restricted days combined. Cases still open on December 31 get an estimate before the 300A is generated, and open cases come back with a monthly reminder. No case lands in “All other illnesses” by default.

Privacy cases

A privacy case prints as “Privacy Case” in the PDF, the spreadsheet and the search, with neutral description templates for the six categories. A contaminated needlestick is locked as a privacy case. The confidential list exports with a watermark in the exporter's name, and the log shows who opened it and when.

No case dropped

Two foremen syncing injury reports at the same second get two case numbers, in order. No case is ever dropped from the Log.

Certify and post the 300A

A 300A that can't change once signed

Only one of the four company executives listed in 29 CFR 1904.32(b)(4) can certify, and only after the log has been reviewed. The certified summary is frozen with a fingerprint. If the log changes afterward, the summary says so and quotes 1904.33(b)(2).

A 300A that adds up

The summary won't generate without the average number of employees, the hours worked and a 6-digit NAICS code, and it checks that the case totals add up the way OSHA's ITA checks them. The EIN and the legal name are stored once.

Posting, February 1 to April 30

The app tracks the posting at each establishment: a timestamped photo of the board, where it hangs and who confirmed. The photo is your own proof. What 1904.32(b)(5) and (b)(6) ask for is the paper copy on the wall, and the app says so.

One log per establishment

Each establishment keeps its own 300 Log and 300A (1904.30). For construction that is the office, not each jobsite (1904.46), and short jobs roll up. Central storage is allowed by 1904.30(b)(2), and the app tracks the seven days each site has to report in.

File with the ITA

Do you have to file?

Two answers decide it: the establishment's peak headcount last year and its NAICS code against Appendices A and B of subpart E (1904.41(a)). The answer is kept, a reminder comes before March 2, and a late filing is tracked through December 31.

Three ways to file, always from a certified 300A

HazComFast sends the data through OSHA's ITA API once an admin has seen exactly what goes, and keeps OSHA's response as the receipt. Or it builds the CSV for you to upload, checked the way the portal checks it. Or you record a filing made elsewhere, with its date and proof.

Protect the records

Records that can't be destroyed

Nothing deletes a 301, a 300A or the history during the retention period or under a legal hold. Removing a case from the log takes a written reason and keeps the record readable, and the five-year clock runs to December 31 of the year it covers, plus five. Removed cases wait in an admin trash that can restore them.

A history nobody can edit

Every change to a 301 is recorded with the old value, the new one, who made it and when, and nobody can edit that history. A reclassification strikes through the original entry instead of overwriting it. The history is there for your defense, not because OSHA asks for it.

A defense package

The signed not-recordable decisions, the amendments with their reasons and the log of 1904.39 reports go into one defense package that you can hand to an inspector.

Employees and their records

A worker signs in on a phone and opens My records: their own 301 in full and the establishment's 300 Log with privacy cases masked, never a coworker's 301. Requests from employees, former employees and representatives go on a register with a countdown to the end of the next business day (1904.35).

Show it and measure it

Inspection Day

Prepare the binder PDF, then issue a read-only guest link that lasts 4, 8, 24 or 72 hours. The readiness check looks at the last five closed years: a certified 300A and a 301 for every case, year by year.

Safety Performance

TRIR and DART for each establishment and jobsite, over the year and the last twelve months, from the cases on the log and the hours you enter. The BLS 2024 national rate for your NAICS code sits beside them, and a lost-time frequency is labeled as neither an OSHA nor a BLS rate.

A calendar of your deadlines

Each deadline shows its CFR paragraph and who is in charge: the 300A posting, the March 2 ITA filing, a copy request to answer, the HazCom dates. Mark one done, or mark it not applicable.

Forms in OSHA's layout, in English or Spanish

The 300, 301 and 300A print in OSHA's structure: lettered columns A to M6 on the 300, questions 1 to 18 on the 301, and a certification block that is never split across pages. The 300 also exports as a real Excel file with privacy cases masked. They are equivalent forms under 1904.29(a), and OSHA does not approve or certify any software.

Investigations that hold up

Five Whys, fishbone, Swiss cheese or your own method: the investigation can't be closed until the method is filled in. It goes to a second person for review, and a completed one is signed and locked. The PDF carries the photos, the signatures and the change history.

The OSHA 300 Log as HazComFast prints it, in OSHA's column layout: lettered columns A to M6, seven cases of a 2026 log with job title, description, classification and day counts, a privacy case printed as Privacy Case, and the page and year totals — The 300 Log as the app prints it, in OSHA's column layout. A privacy case shows as Privacy Case, and the page and year totals are worked out for you.

Free recordability decision tree Log in

The rest of the small employer's paper, in one place

The chemical list, the safety data sheets, the written programs, the permits and the emergency plans each have their own module in HazComFast.

Your chemical list, from a spreadsheet

The inventory is where the hazard communication program and the labels start, and it takes the list you already have.

Import keeps the pictograms

Import your chemical list from a spreadsheet, using hazard words or GHS codes, and each product lands with its pictograms, in the jobsite's flammables total and in the hazard filters. An export from the app can be imported again.

Names exactly as typed

Product names print exactly as you typed them on the label, the inventory PDF and the QR scan. Spanish signal words like Peligro import correctly.

Your SDS library, read and checked

Every sheet in the library is tied to a product on a jobsite, read by HazComFast and checked by a person before it counts.

The AI reads, a person confirms

Drop in the supplier's PDF, scanned or not, in English or Spanish. HazComFast reads every page, fills in the hazards, the H and P statements, first aid and PPE, and shows where each value came from. Anything it isn't sure about waits for a person to confirm it.

Spanish sheets

A Spanish SDS that says PELIGRO is recorded as DANGER, and the original file stays attached as you received it.

A viewer that lasts the shift

An SDS left open for a whole shift still opens. Search "eye contact" and the viewer jumps to Section 4.

What it shouldn't sit next to

Open a product and see which other products stored on the same jobsite it should not sit next to.

Products you stopped using

Scan the QR on a product you stopped using and the page says it was removed from inventory, with the archived SDS one tap away.

Proof of reading, without chasing

Nobody has to remember to ask. Add a hazardous product to a site and every worker there gets one notice with a 7-day due date, a reminder at day 3, and an escalation at day 7.

What you hand an inspector

One click gives you the jobsite's SDS binder as a ZIP with a CSV index, and a dated CSV or PDF of who confirmed reading what.

Your written program, kept true

The program is built from what is actually on your jobsites, and it tells you when it stops matching.

A chemical list from the inventory

The chemical list in your program is built from each jobsite's inventory, under the product name on its SDS. Remove a product and the program tells you the list is out of date, with a button to rebuild it.

The pipes half of (e)(1)(ii)

The unlabeled-pipes half of 1910.1200(e)(1)(ii) has its own section, and the program won't publish while it's empty.

The version of the standard

Your program states which version of the standard it follows: HCS 2024, 89 FR 44144, GHS Rev. 7, with the date. Construction companies get 29 CFR 1926.59 printed too.

English and Spanish, same revision

Write the program in English and Spanish. Each section shows whether its translation is current, and the PDF prints both languages from the same revision.

Signed versions

Each new version records what changed and who signed off, with the signature and time printed on the PDF. Open any past version, see exactly what changed, and roll back by creating a new version.

Onboarding by itself

Assign a worker to a jobsite and the HazCom onboarding starts by itself: they're notified, their core HazCom training is assigned, and they're asked to confirm they've read the SDS for every hazardous product on that site.

Permits that follow the rule, from issue to close

Confined-space permits carry the entries the standard names, hot-work permits carry the fire-prevention checks of 1926.352 for the sites that use one, and each refuses to move on when a check is missing.

No reading, no "Safe"

A reading with only oxygen never shows "Safe": the screen says the space was not tested and must not be entered, and the permit can't be issued. An out-of-limits reading on an active permit suspends it and alerts the supervisor and the attendant.

Real end times

Permits expire at their real end time, in the jobsite's time zone, and the supervisor gets a notice that opens the permit. An expired permit stays expired.

Revisions you can follow

Change a live permit and you get Revision #1, with the reason, the old and new value, who and when. The original never disappears.

The PDF in the rule's order

Close a permit and its PDF is archived as it is: every 1910.146(f) item in order, or the 16 items of 1926.1206, the supervisor's name and signature, each reading with who took it, and a QR code back to the live permit.

Flammables on site

Before a hot-work permit is issued, it checks the jobsite's chemical list and warns you about flammables declared on site.

Competent persons in date

A confined-space permit can't be issued under a competent person whose designation has lapsed. The system refuses and says since when.

Emergency and fire plans that say which rule they follow

The plans are written from the part of the CFR that applies to the work, and the people they cover read them and confirm.

Do you need a written plan

Three questions about your extinguishers and your evacuation policy, and the app tells you whether a written emergency plan is needed, citing the exact paragraph of 1910.157. Cross from 10 to 11 employees and it flags the written plan the same day.

The right part of the CFR

A construction company's emergency plan cites 29 CFR 1926.35, not the general-industry rule, and its fire program cites 1926.24. If you do both kinds of work, you get two plans, never a hybrid.

Employees read and confirm

Publish a new version and each worker reads it on a phone and confirms. Your screen shows 34 of 37 reviewed version 4, the review of 1910.38(f)(3) in a number you can show an inspector.

No blanks left in the plan

Your plan won't export with a blank left in it. Every [NAME] or [PHONE] still to fill is listed for you.

One plan per jobsite

Write the company plan once. Each jobsite gets its own copy with its own exits, muster points and wardens, and when you update the company plan, every site sees what changed without losing its local details.

Counting the extinguishers

Enter the building area and floors, and the app tells you how many 2A extinguishers 1926.150(c)(1) calls for. A 55-gallon drum with two buckets counts where the rule says it does. A site can't go active without its fire protection program.

Free chemical inventory template Log in OSHA recordkeeping software SDS management software HazCom compliance Safety permits

Sources and verification

Paragraphs verified against the eCFR on Oct 21, 2026 (title 29 current to Oct 19, 2026); the partially exempt industries are read from Appendix A to subpart B of part 1904 on the same date. Federal OSHA only: a State Plan state can write its own rules, so read your state's as well on the State Plans page. Not legal advice. See also OSHA requirements explained and free OSHA checklists and templates.