The OSH Act applies from your first hire, in every industry, with no small-business exemption. This is the map we drew before building a compliance platform for it — the duties that fall on everyone, the deadlines employers miss most often, and what changes when the hazard assessment happens on a phone on the floor instead of in a binder at a desk.
By Denis Zysman — 2026-10-20
The Occupational Safety and Health Act of 1970 covers most private-sector employers in the United States from their first employee, in any industry — either directly through federal OSHA or through a state plan, which must be at least as protective. There is no small-business exemption from the law itself. Size softens a few duties, such as routine injury recordkeeping for employers with ten or fewer employees, but never the duty to provide a safe workplace. We set out the full list in our guide to what OSHA requires of every employer.
Two sentences carry most of the weight. Section 5(a)(1) — the General Duty Clause — requires every employer to furnish a workplace free from recognized hazards likely to cause death or serious physical harm. Section 5(a)(2) adds the duty to comply with every applicable standard. Together they mean: follow the specific rules where they exist, and where none exists you are still answerable for a hazard you knew about.
No single standard says “run an annual hazard assessment” in those words, but the requirement runs through the whole framework — and for personal protective equipment it is explicit: 29 CFR 1910.132(d) calls for a written, certified assessment. Everything downstream depends on it, which is why a step-by-step walkthrough of how to run a workplace hazard assessment was the first guide we wrote. Where the question is one task rather than a whole facility, the sharper instrument is the job hazard analysis, and we published fully worked JHA examples — a bakery fryer, a warehouse forklift — rather than a blank form.
Federal standards are organised by part: 29 CFR 1910 for general industry — the default for offices, retail, restaurants, healthcare, warehousing — and 1926 for construction, with further parts for maritime and agriculture. One employer can sit under both: a maintenance crew doing renovation work falls under 1926 for that job and returns to 1910 back in the shop. Our map of which OSHA standards apply to your industry sets out the rules that dominate inspections in each sector.
There is no universal OSHA safety manual. The logic is hazard-driven: when a standard applies to your workplace and that standard contains a written-program element, the document becomes mandatory — hazard communication, lockout/tagout, emergency action, respiratory protection, and so on down the list. Templates are a legitimate starting point and a poor finish: an unedited template carrying someone else’s company name is worse than nothing during an inspection. Our page on the written safety programs OSHA requires covers which ones most employers genuinely need and what each must contain.
Part 1904 asks for three forms: the 300 log, one 301 report per case, and the 300A annual summary, posted every year from 1 February to 30 April. Records are kept per establishment and retained for five years, and many employers also submit them electronically each year. Severe injuries run on their own clock, and it is the one employers miss: a fatality must be reported within eight hours, and a hospitalisation, amputation or loss of an eye within twenty-four. Our walkthrough of OSHA 300 log recordkeeping explains each form, who is partially exempt from the routine ones, and who is exempt from nothing.
Every duty above is a process, not a document. That is the single thing we got wrong in our first design: we modelled the deliverable — the file an inspector asks for — when we should have modelled the loop that keeps it true.
Compliance work fails in the gap between the floor and the filing cabinet. The hazard is seen by someone in a hi-vis vest at seven in the morning; the record is written by someone at a desk at five in the afternoon, from memory, and the photograph that would have made it legible was never taken. So we put the assessment where the hazard is. OSHAid is an iOS and Android app for capturing a hazard on site — with photo, video and audio — backed by a web console for the office and an AI layer that proposes hazards and corrective actions for the trade you are actually in.
None of that is required by OSHA, and we say so on our own page about OSHA compliance software: spreadsheets and paper are entirely legal. What a dedicated tool buys is traceability — an assessment that carries its own history, a corrective action with an owner and a date, and records that are audit-ready because they were generated rather than retyped. Against the penalty OSHAid quotes on its home page, up to $16,550 for a serious violation, the arithmetic is not subtle.
The free plan exists for the same reason: an employer who has never written a hazard assessment should be able to start one this afternoon without a purchase order, and the paid tiers and their industry accelerators are laid out on the OSHAid pricing page. Organisations running several establishments have a different problem — consolidation, per-site indicators, roles and an audit log — and that is what the enterprise edition for multi-site organisations is for.
We built this platform twice. The same engine ships in France as iDuerp, against the Document Unique rather than the OSH Act — different forms, different thresholds, different inspectorate, and an almost identical shape underneath: assess, plan, act, record, prove. Doing it twice is what taught us where the regulatory specifics really live, and how much of a compliance product can be built once if you are disciplined about which layer the law goes in.
That is the engineering lesson we carry into client work. A regulation is not a feature list; it is a set of obligations with deadlines attached, and the software that serves it well is the software that makes the next obligation visible before it becomes late.
