OSHA compliance software: what the law requires you to record

The short answer

Most United States employers with more than ten people have to keep a running log of work-related injuries and illnesses, post a summary of it on the wall from February through April, keep the paperwork for five years, and phone OSHA within hours when something serious happens. That is the whole of it in one sentence, and the detail underneath is narrower and more mechanical than most people expect: the rules live in 29 CFR Part 1904, they turn on a short list of recording criteria, and the deadlines are fixed calendar dates rather than judgement calls.

Software does not change any of that. What it changes is whether the evidence exists when someone asks for it — the accident record itself, the investigation behind it, the corrective action that closed it, the training record that shows the operator was competent, the current safety data sheet, the written program in its approved version. That is the part that is usually missing, and it is the part this page is really about. The last two sections cover what to look for in a system, and how ours handles it.

The three forms, and what each is for

OSHA recordkeeping is built on three documents, and a great deal of confusion disappears once you separate them.

The distinction that matters operationally is that the 300 and the 301 are created case by case, in the moment, usually by whoever is closest to the event — while the 300A is an annual, executive-certified roll-up. A system that captures the first two well but cannot produce the third leaves you doing the year-end by hand; a system that only stores a finished 300A has not helped with the part that actually takes the time.

Who must keep records — and the two exemptions people misread

There are two separate partial exemptions, they work differently from one another, and the word doing the heavy lifting in both is partial.

The size exemption is company-wide

Section §1904.1 is titled "Partial exemption for employers with 10 or fewer employees", and OSHA's wording is that if your company had ten or fewer employees at all times during the last calendar year, you do not need to keep injury and illness records "unless OSHA or the BLS informs you in writing" that you must. The test is the peak headcount across the entire company during the previous calendar year, not the average, and not the number at any one location. A sixty-person company spread over six sites of ten does not qualify.

The industry exemption is site-by-site

Section §1904.2 exempts establishments classified in certain lower-hazard industries, listed in the appendix to subpart B, regardless of how many people they employ. Unlike the size test, this one applies establishment by establishment — so a single company can have one site that is exempt and another, classified differently, that is not. Check the two tests separately, check the industry list as it stands now rather than as it stood when the business was set up, and check them per site.

Neither exemption touches the duty to report a severe event under §1904.39, and neither touches the standards that require written programs. An exempt employer still calls OSHA within eight hours of a work-related fatality. This is the single most common misunderstanding in the whole of Part 1904.

What counts as recordable

Two questions, in order. First, is it work-related? Section §1904.5 sets a presumption rather than a test to be argued: OSHA's wording is that "work-relatedness is presumed for injuries and illnesses resulting from events or exposures occurring in the work environment, unless an exception in §1904.5(b)(2) specifically applies". Work needs to have caused, contributed to, or significantly aggravated the condition — it does not need to be the only or even the main cause, and a pre-existing condition made significantly worse by work counts.

Second, does the outcome meet the general recording criteria in §1904.7? A case is recordable if it results in any one of the following:

• Death.
• Days away from work.
• Restricted work or transfer to another job.
• Medical treatment beyond first aid. The line between the two is defined in the regulation, and it is a list, not a judgement — worth reading once properly rather than guessing case by case.
• Loss of consciousness.
• A significant injury or illness diagnosed by a physician or other licensed health care professional — recordable even where none of the outcomes above occurred.

That last criterion is the one that surprises people: a diagnosis alone can make a case recordable even when the employee lost no time, needed no treatment beyond first aid and carried on with their normal job. Note also that days away, restricted work and job transfer are not merely triggers — once a case is recordable on one of those grounds, the days themselves are counted and carried on the log, which is why the outcome of a case can change weeks after it was first entered.

The dates that matter

The eight-hour clock is the one worth engineering around, because it is the only obligation here that a normal organisation cannot meet by being diligent at month-end. It needs a known number, a named person, and a route that works at three in the morning on a public holiday. Everything else on this list is a calendar entry.

Electronic submission

Some establishments must send their injury data to OSHA rather than simply keeping it. Section §1904.41 sets the tiers by a combination of headcount and industry classification. An establishment with 100 or more employees in an industry listed in appendix B to subpart E must electronically submit information from both the 300 Log and the 301 incident report. An establishment with 250 or more employees that is required to keep records must submit its 300A summary. A further tier covers smaller establishments in designated industries. Submissions are made through OSHA's Injury Tracking Application, and everything is due by March 2 of the year after the calendar year the forms cover.

Because these tiers turn on both a headcount and a NAICS classification, and because this particular rule has been amended more than once, treat your obligation as something to re-check annually against §1904.41 rather than a fact you established when you set the process up. A site that grows past a threshold acquires the duty quietly.

The written programs behind the log

Recordkeeping is only the part that produces paperwork on a schedule. The standards an inspector is more likely to open with are the ones requiring a written program, and four of them catch almost everybody:

• Hazard Communication — 1910.1200. A written hazard communication program for the workplace, including lists of hazardous chemicals present, container labelling, and safety data sheets made available to employees.
• Respiratory Protection — 1910.134(c). The standard "requires the employer to develop and implement a written respiratory protection program with required worksite-specific procedures", administered by a suitably trained program administrator.
• Lockout/Tagout — 1910.147. Documented energy control procedures, with a narrow exception for certain simple, single-source situations.
• Emergency Action Plan — 1910.38(b). "An emergency action plan must be in writing, kept in the workplace, and available to employees for review" — though an employer with ten or fewer employees may communicate it orally.

Each of these is a controlled document with a review cycle and a training obligation attached, and each is a document an inspector can ask to see in its current version. This is where a document-control system earns its place: not because the regulation mentions software, but because "we have a written program" and "we can produce the current approved version, and show who has acknowledged it" are different claims, and only the second one survives an inspection.

What it costs to get wrong

OSHA publishes its maximum penalties and adjusts them for inflation. The amounts in force for violations assessed after January 15, 2026 are $16,550 per violation for serious, other-than-serious and posting-requirement violations; $16,550 per day beyond the abatement date for failure to abate; and up to $165,514 per violation for willful or repeated violations.

Worth knowing rather than assuming: these figures are unchanged from 2025. OSHA normally adjusts them each January, and its own memorandum of May 21, 2026 explains why the 2026 adjustment did not happen. Check osha.gov/penalties rather than carrying a remembered number, and note that State Plan states set their own penalty levels, which must be at least as effective as the federal ones.

Note that posting-requirement violations sit in the same penalty band as serious ones, and that failure to abate is charged per day. The expensive failures here are rarely the accident itself. They are the corrective action that was agreed and never closed out, and the summary that never went on the wall.

What to look for in a system

If you are evaluating software against the obligations above, these are the questions that separate the products that help from the ones that store documents.

• Does it produce the forms, or hold information about them? Ask to see a 300 Log, a 300A and a 301 generated from real entered data during the demo. "Supports OSHA recordkeeping" is marketing language; a rendered 300A is a product.
• Does it help with the recordable decision, and does it show its working? Classification is where errors get made and where they compound, because a wrong call sits on the log for five years.
• Can it count days? Days away and days restricted accrue after the fact and change the log entry. A system that captures an event but cannot update its outcome will drift out of step with reality.
• Does it work establishment by establishment? Almost every threshold in Part 1904 is an establishment-level test. A system that can only report at company level cannot answer the question OSHA actually asks.
• Does it close the loop? The finding, the corrective action, the owner, the due date, the evidence of closure — in one chain, not in an email thread beside the record.
• Will it still have your data in five years, and can you get it out? Retention is five years and systems get replaced inside that window. Ask about export before you sign, not after.

The sixth question is the one buyers skip and regret. We wrote a vendor-neutral guide to it — how to get your HSEQ data out of any system — because the answer is usually worse than the sales conversation suggests.

How Teammate handles it

Recordkeeping starts with a record, and that is where Teammate begins. An accident is captured on a form you build — not a fixed incident screen somebody else designed for a different jurisdiction. Every field type is available, sub-forms carry the detail, and the whole form works on a phone offline at the scene, syncing when coverage returns. That matters more than it sounds: the accident record written at the time, by the person who was there, is the one that holds up months later.

From the moment it is submitted, the form moves:

• Send it for investigation. Reassign the form to an investigator, who picks it up in their own list of assigned work rather than in an email thread.
• Root-cause analysis in the record itself. Build the analysis your organisation uses into the investigation form, so the finding, the cause and the evidence sit in one object instead of three.
• Reviewed, returned, and co-signed. Nominate approvers and reviewers; they review, return it for more if it is thin, and sign it off. A returned form is the mechanism that stops a one-line investigation becoming the permanent record.
• Assign corrective actions from inside the form. Each action carries an owner, a due date and its evidence of closure, and stays attached to the record that raised it — which is precisely the chain a failure-to-abate citation asks you to produce.
• Generate the report, and send it out. Export or email the finished report straight to a client, an insurer, a head office or a regulator — individually or in bulk from the register — as PDF or Excel.
• Report across everything. Dashboards and reports over every record by site, date range, category and owner, role-aware so a site manager sees their site and the group sees the group. Establishment-level reporting is not a nice-to-have here: almost every threshold in Part 1904 is an establishment test.

Around that core sit the records an inspector asks for after the log, in the same system rather than four:

• Inspections and audits on a schedule, with findings that raise their own corrective actions and an audit that can be reviewed, returned and closed off.
• Controlled documents with approval and version history, and acknowledgement tracked by person — which is how a written program under 1910.38, 134, 147 or 1200 stops being a file on a server and becomes evidence that the right version reached the right people.
• Training and competency records with expiry dates, so "was this person trained for this task, and was the training current on the day" has an answer you can produce.
• A hazardous substances register holding safety data sheet references and their expiry, alongside the hazard communication programme those sheets belong to.
• Reminders and obligations for the dates that otherwise pass quietly — the posting window, the electronic submission deadline, calibrations, licences and consents.

One point of clarity, because it is a fair question to ask any vendor: the 300 Log, the 300A and the 301 are United States statutory sheets with their own prescribed layout. Teammate is the record and evidence system behind them — the accident reports, the investigations, the sign-offs, the actions and the reporting that the log summarises — rather than a generator of those three specific forms. Ask us that question in a demo and you will get the same answer you have just read.

Questions we get asked