OSHA compliance for small businesses: what you actually need in 2026

Most small business owners hear "OSHA compliance" and picture a fat binder full of paperwork they'll never read. That's fair. But OSHA doesn't actually care about binders. They care about seven specific documents, and whether you can produce them within 30 seconds of being asked.

Here's what those documents are, which ones apply to your business, and what happens if you're missing them.

Does OSHA apply to your business?

Short answer: almost certainly yes.

OSHA covers every private-sector employer in the United States with one or more employees. Restaurants, construction companies, salons, medical clinics, retail stores, offices. The only full exemptions are solo operators with zero employees, farms that employ only immediate family members, and workplaces regulated by other federal agencies (mining, nuclear energy).

A few partial exemptions are worth knowing about:

• 10 or fewer employees: You're exempt from OSHA 300 recordkeeping (injury and illness logs) and can communicate some required plans verbally rather than in writing.
• Low-hazard industries: You may be exempt from routine programmed inspections, though complaints and referrals can still trigger one.
• None of these exemptions override the General Duty Clause (Section 5(a)(1) of the OSH Act), which requires every employer to keep the workplace "free from recognized hazards."

The seven documents OSHA inspectors look for

You don't need a 200-page safety program. Most small businesses need seven things in a folder, physical or digital, that they can hand to an inspector without scrambling.

1. Hazard Communication Program (29 CFR 1910.1200)

Required if your workplace uses or stores any chemicals. That includes cleaning products, so this one applies to nearly every business.

Your written program must describe:

• How you label chemical containers
• Where employees can access Safety Data Sheets (SDS)
• How you train employees on chemical hazards
• A list of every hazardous chemical in the workplace

This is the most-cited OSHA standard. Getting it wrong is expensive.

2. Emergency Action Plan (29 CFR 1910.38)

Required for any workplace with more than 10 employees. Smaller employers can communicate the plan verbally, though writing it down is still the safer bet.

Your EAP must cover:

• Evacuation procedures and routes
• How you account for everyone after an evacuation
• Who handles rescue and medical duties
• How employees report emergencies
• Contact information for responsible personnel

3. Fire Prevention Plan (29 CFR 1910.39)

Required whenever an Emergency Action Plan is required, so effectively any business with more than 10 employees. It must document:

• Major fire hazards in the workplace
• Procedures for handling and storing hazardous materials
• Potential ignition sources and how they're controlled
• Fire protection equipment and its maintenance schedule
• Employee responsibilities for fire prevention

4. OSHA 300 Injury and Illness Log (29 CFR 1904)

Required for employers with 11 or more employees. You record every work-related injury and illness throughout the year, then post the 300A summary from February 1 through April 30.

Regardless of size, every employer must report:

• Any workplace fatality within 8 hours
• Any inpatient hospitalization, amputation, or loss of an eye within 24 hours

5. Bloodborne Pathogens Exposure Control Plan (29 CFR 1910.1030)

Required if any employee has occupational exposure to blood or other potentially infectious materials. That covers healthcare workers, but also designated first-aid responders, janitorial staff who clean up blood spills, and anyone performing CPR duties.

The plan must include an exposure determination, procedures for minimizing exposure, post-exposure evaluation protocols, and hepatitis B vaccination provisions.

6. Personal Protective Equipment Hazard Assessment (29 CFR 1910.132)

Every employer must assess the workplace for hazards that require PPE: eye protection, gloves, hearing protection, respiratory equipment. The assessment has to be documented in writing, and employees must be trained on proper PPE use.

7. Safety Training Records

There's no single "training records" standard, but multiple standards require documented training: Hazard Communication (1910.1200), Bloodborne Pathogens (1910.1030), PPE (1910.132), and others depending on your industry. Keep records of what training was given, when, by whom, and who attended.

What this looks like by industry

The seven documents above apply broadly. The specifics change depending on what your business actually does day to day.

Restaurants and food service

A commercial kitchen is full of OSHA-relevant hazards: cleaning chemicals under the sink, grease fires, wet floors, sharp knives. On top of OSHA, restaurants also answer to the FDA Food Code and state health departments, often on separate inspection schedules.

The areas that get cited most often: Hazard Communication (sanitizers, degreasers, oven cleaner), fire evacuation specific to your kitchen layout, injury logs for cuts, burns, and slips, and PPE like cut-resistant gloves and non-slip shoes.

Contractors and construction

Construction gets more OSHA inspections than almost any other industry. It also has its own separate set of requirements under 29 CFR 1926, including the "Focus Four" hazards: falls, struck-by, caught-in/between, and electrocution. These four categories account for more than 60% of construction worker deaths.

If you're in construction, the documents that matter most beyond the general seven are fall protection plans (1926.502), scaffolding procedures (1926.451), trenching and excavation protocols (1926.651), and documented tool and equipment inspections.

Salons and spas

People don't think of salons as hazardous workplaces, but OSHA does. Hair treatments contain formaldehyde. Nail services use acetone and produce acrylic dust. Disinfectants are chemicals. Keratin treatments and nail dust are common citation triggers.

Your Hazard Communication Program needs a full chemical inventory. You'll also want documented ventilation for chemical-intensive services, gloves and eye protection for handling products, and if you do waxing or piercing or any service that could break skin, a Bloodborne Pathogens plan.

Medical and dental clinics

Healthcare workplaces carry some of the heaviest OSHA requirements, layered on top of HIPAA and state health department rules. The Bloodborne Pathogens Exposure Control Plan is the big one here, and OSHA wants to see a plan specific to your practice, not a generic template.

Other focus areas: sharps injury prevention (1910.1030(d)(2)), hazardous drug handling if applicable, TB exposure control in certain settings, and ergonomic assessments for repetitive clinical tasks.

OSHA penalty structure

The penalties are worth knowing because they tell you what to prioritize. Per-violation amounts as of January 2026:

Penalties stack. Three serious violations in one inspection: up to $48,393 before any reductions.

Penalty reductions you can request

OSHA does reduce penalties for small businesses that act in good faith:

• Size reduction: businesses with fewer than 250 employees can get up to 60% off
• Good faith: another 25% off if you had a safety program in place
• History: 10% off if no OSHA violations in the past five years

In practice, most small business citations get reduced by 60-85% when the employer cooperates and corrects issues quickly. Having documentation that shows you were making a genuine effort goes a long way.

OSHA's free help for small businesses

This might be the most useful part of this article. OSHA runs a free, confidential program called the On-Site Consultation Program that most small business owners have never heard of.

Here's how it works: a consultant visits your workplace, identifies hazards, and helps you fix them. It's completely separate from OSHA enforcement. No citations, no penalties. It's available to businesses with 250 or fewer employees, and over 21,000 employers used it last year.

If you fix all the hazards they identify, you may qualify for the SHARP program, which exempts you from routine inspections for one to three years.

Getting your documents in order

If you're starting from scratch, go in this order:

1. Walk through your workplace. Note every chemical, every exit, every hazard you can see. This is your starting point.
2. Write your Hazard Communication Program first. It's the most-cited standard and forces you to inventory your chemicals.
3. Create your Emergency Action Plan and post evacuation routes. Walk your employees through it at least once.
4. Set up your OSHA 300 log if you have 11 or more employees. Start recording from day one.
5. Document every training session: date, topic, attendees, who ran it.
6. Build out industry-specific plans (Bloodborne Pathogens for clinics, fall protection for construction, chemical inventory for salons).
7. Review everything once a year. Regulations change, your workplace changes, your documents should keep up.

The mistake most people make is downloading a 50-page generic template and never customizing it. A short, accurate plan that describes your actual workplace is far more useful when an inspector is standing in front of you.

---

ComplyKing generates OSHA safety plans, emergency action plans, employee handbooks, and other compliance documents specific to your business, state, and industry. Your first document is free.