Safety Program Requirements: What Every Employer Needs to Know

Federal OSHA and state OSHA programs require most employers to maintain written safety and health programs. These are not optional paperwork exercises. They are the documented framework that demonstrates how your company identifies hazards, protects workers, and responds to emergencies. If an OSHA compliance officer walks onto your site and asks for your Hazard Communication Program, you need to hand them a current, site-specific document — not a binder from 2014 gathering dust on a shelf.

The specific programs you need depend on your industry, the hazards your workers are exposed to, and in some cases the state where you operate. Below is a comprehensive breakdown.

Core Written Safety Programs Required by OSHA

While no single OSHA standard mandates a universal "safety program," a combination of standards under 29 CFR 1910 (General Industry) and 29 CFR 1926 (Construction) requires employers to develop, implement, and maintain specific written programs. Here are the programs that apply to the majority of employers:

• Hazard Communication Program (HazCom) — 29 CFR 1910.1200. Required for virtually every employer whose workers may be exposed to hazardous chemicals. This includes safety data sheets (SDS), labeling, and worker training.
• Emergency Action Plan (EAP) — 29 CFR 1910.38. Written plan covering emergency escape procedures, routes, critical operations, employee headcount procedures, rescue and medical duties, and alarm systems.
• Fire Prevention Plan — 29 CFR 1910.39. Covers workplace fire hazards, proper handling and storage of flammable materials, ignition sources, and fire protection equipment maintenance.
• Respiratory Protection Program — 29 CFR 1910.134. Required wherever respirators are necessary or voluntarily used. Includes medical evaluations, fit testing, training, and maintenance procedures.
• Lockout/Tagout (LOTO) Program — 29 CFR 1910.147. Required when workers service or maintain machines and equipment where unexpected energization could cause injury. Covers energy control procedures, training, and periodic inspections.
• Bloodborne Pathogens Exposure Control Plan — 29 CFR 1910.1030. Required when employees have reasonably anticipated occupational exposure to blood or other potentially infectious materials (healthcare, first responders, designated first aid providers).
• Confined Space Entry Program — 29 CFR 1910.146 (General Industry), 29 CFR 1926 Subpart AA (Construction). Written program for identifying permit-required confined spaces, entry procedures, attendant duties, rescue plans, and air monitoring.
• Fall Protection Plan — 29 CFR 1926 Subpart M (Construction), 29 CFR 1910 Subpart D (General Industry). Written plan detailing fall hazards, prevention systems, rescue procedures, and training requirements.
• Personal Protective Equipment (PPE) Assessment — 29 CFR 1910.132. Employers must perform and document a workplace hazard assessment to determine required PPE, then provide training on proper use, maintenance, and limitations.
• Hearing Conservation Program — 29 CFR 1910.95. Required when workers are exposed to noise levels at or above 85 decibels over an 8-hour time-weighted average. Includes audiometric testing, hearing protection, and annual training.

Federal OSHA vs. State Plan States

OSHA operates under two models. About half of the United States falls under direct federal OSHA jurisdiction. The remaining states and territories — approximately 22 states and several territories — operate their own OSHA-approved State Plan programs.

State Plans must be "at least as effective as" federal OSHA standards, but many go further. Some state programs impose requirements that do not exist at the federal level. Examples include:

• California (Cal/OSHA) — Requires a written Injury and Illness Prevention Program (IIPP) for all employers, a Heat Illness Prevention Plan, and an Aerosol Transmissible Diseases standard. These have no federal equivalent.
• Washington (DOSH) — Requires a written Accident Prevention Program (APP) for all employers and has more stringent fall protection trigger heights in some scenarios.
• Oregon (Oregon OSHA) — Mandates heat illness prevention rules and wildfire smoke protections that go beyond federal standards.
• Michigan (MIOSHA) — Operates unique standards for agriculture and construction that diverge from federal requirements.

If you operate in multiple states — or have projects that cross state lines — you need to know which jurisdiction applies to each site. A safety program built exclusively around federal OSHA may leave you non-compliant in a State Plan state.

Key Programs by Industry

While the core programs above apply broadly, certain industries have elevated requirements based on the nature of the work and the hazards present.

Construction employers face especially heavy documentation requirements because of the transient, multi-employer nature of job sites. A general contractor is expected to have not only their own safety programs but also the ability to verify that subcontractors maintain compliant programs covering the same hazards.

What a Compliant Written Safety Program Actually Looks Like

A compliant written safety program is not a downloaded template with your company name dropped into the header. OSHA compliance officers and insurance auditors can recognize a generic template instantly, and it often raises more questions than it answers.

A credible, defensible safety program includes:

• Company-specific hazard identification — based on your actual operations, equipment, materials, and work environments — not boilerplate language.
• Clearly assigned responsibilities — who is responsible for implementation, enforcement, training, recordkeeping, and program review. Names and titles, not vague references.
• Documented training records — proof that employees received training on the program, understood the content, and were evaluated. Training records must include dates, attendees, topics covered, and the trainer's name.
• Inspection and audit procedures — scheduled self-inspections, hazard correction timelines, and follow-up documentation.
• Incident investigation procedures — how your company investigates near-misses and injuries, identifies root causes, and implements corrective actions.
• Version control and review dates — the document should show when it was last reviewed, by whom, and what changes were made. A living program is a dated program.

Consequences of Not Having Required Programs

Operating without required written safety programs exposes your company to multiple categories of risk:

• OSHA Citations — Lack of a required written program is a citable violation. As of 2024, penalties for serious violations can reach $16,131 per violation. Willful or repeated violations can reach $161,323 per violation. These penalties are adjusted annually for inflation.
• Increased OSHA Scrutiny — A missing program during an inspection often triggers a broader review. If you cannot produce one program, the compliance officer will ask for all of them.
• Insurance and Bonding Impact — Carriers evaluate your safety programs during underwriting and audits. Missing or inadequate programs can result in higher premiums, policy non-renewal, or difficulty obtaining bonding.
• Litigation Exposure — In the event of a serious injury or fatality, the absence of a written safety program becomes evidence that your company failed to exercise reasonable care. Plaintiff attorneys routinely request safety program documentation during discovery.
• Loss of Contract Eligibility — Many general contractors, project owners, and government agencies require subcontractors to submit safety programs as a condition of bidding. No program means no bid.

How Often Should Safety Programs Be Reviewed?

OSHA does not prescribe a single universal review schedule, but several specific standards do. At a minimum, best practice and industry consensus recommend the following:

• Annual review — at minimum — for all written safety programs. This is the industry standard and the expectation most OSHA compliance officers will hold you to.
• After any significant change — new processes, new equipment, new chemicals, organizational changes, facility modifications, or expansion into new job sites.
• After any incident or near-miss — the investigation findings should feed back into the relevant program. If your fall protection program did not prevent a fall, the program needs to change.
• When regulations change — OSHA updates standards periodically. State Plan states may adopt changes on different timelines than federal OSHA. You need a process for monitoring regulatory changes that affect your programs.
• Lockout/Tagout specifically — 29 CFR 1910.147 requires periodic inspections of energy control procedures at least annually, conducted by an authorized employee other than the one using the procedure.

Document every review — even if no changes are made. A signed and dated review log demonstrates that the program was actively evaluated, which is itself a compliance requirement under many standards.