US Regulatory Framework
The United States workplace safety system is built on one federal Act, a large body of detailed standards published in the Code of Federal Regulations, and — for more than half the country — a state-run programme operating in place of the federal one. Understanding which rules apply to you, and who enforces them, helps you use SteadyOn more effectively.
This page is not legal advice. For specific compliance questions, consult a qualified safety professional or attorney.
A note on federal OSHA and State Plans
Section titled “A note on federal OSHA and State Plans”The United States is not a single jurisdiction for workplace safety purposes. The Occupational Safety and Health Act of 1970 created federal OSHA (the Occupational Safety and Health Administration, part of the US Department of Labor), but §18 of the Act also allows any state to run its own programme provided it is “at least as effective as” the federal one.
Around half the states have taken that option. If you operate in California, Michigan, Washington, Oregon, or one of the other State Plan states, your regulator is the state agency, not federal OSHA — and in some cases the rules themselves are stricter. California in particular requires every employer to maintain a written Injury and Illness Prevention Program that federal OSHA does not.
Where this documentation says “report to OSHA”, check whether a State Plan covers you. See State Plans and Cal/OSHA.
A second wrinkle: OSHA generally does not cover public-sector employees under federal jurisdiction. State and local government workers are only covered where a State Plan extends to them — which is why several states run public-sector-only plans.
The legislation at a glance
Section titled “The legislation at a glance”| Legislation | What it covers | Who it applies to |
|---|---|---|
| OSH Act of 1970 | General duty to provide a workplace free of recognised hazards; the duty to comply with standards; anti-retaliation | Nearly all private-sector employers |
| 29 CFR 1910 — General Industry | Hazard communication, lockout/tagout, PPE, confined spaces, walking-working surfaces, and much more | Most workplaces outside construction, maritime, and agriculture |
| 29 CFR 1904 — Recordkeeping | The 300 log, 301 incident reports, the 300A annual summary, and severe-injury reporting | Employers with more than 10 staff, outside exempt low-hazard industries |
| 1910.151 — Medical Services and First Aid | First-aid provision, trained personnel, eyewash and drenching facilities | All general-industry employers |
| 1910.38 & 1910.39 — Emergency Plans | Emergency action plans, fire prevention plans, evacuation, alarms | Employers required to have one by another standard |
| State Plans | State-run programmes, and where they exceed federal requirements | Employers in the 29 State Plan jurisdictions |
| US Privacy | State privacy laws, ADA medical confidentiality, access to exposure and medical records | Most employers handling worker health data |
How the layers fit together
Section titled “How the layers fit together”The OSH Act of 1970 is the foundation. It does two distinct things.
First, it imposes the General Duty Clause at §5(a)(1): every employer must furnish a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.” This is a catch-all. Where no specific standard addresses a hazard, OSHA can still cite an employer under the General Duty Clause — which is how heat illness, workplace violence, and ergonomic hazards have historically been enforced.
Second, at §5(a)(2), it requires employers to comply with the specific standards OSHA publishes. Those standards live in Title 29 of the Code of Federal Regulations and are divided by industry:
- 29 CFR 1910 — General Industry (most workplaces)
- 29 CFR 1926 — Construction
- 29 CFR 1928 — Agriculture
- 29 CFR 1915, 1917, 1918 — Shipyards, marine terminals, and longshoring
Alongside those sit two administrative parts that apply regardless of industry: 29 CFR 1903 (inspections, citations, and penalties) and 29 CFR 1904 (recording and reporting injuries and illnesses).
Unlike the UK’s Approved Codes of Practice, OSHA standards are directly enforceable regulations — there is no intermediate “follow this or show you did something equally good” tier. OSHA does publish extensive non-binding guidance, and NIOSH (the National Institute for Occupational Safety and Health, a research body under the CDC) publishes recommended exposure limits that often exceed OSHA’s enforceable ones.
Two duties that are easy to confuse
Section titled “Two duties that are easy to confuse”US law asks two different questions about a workplace injury, and the answers are frequently different:
| Reportable | Recordable | |
|---|---|---|
| Governed by | 1904.39 | 1904.4 – 1904.7 |
| Means | Telephone or notify OSHA directly | Enter on your 300 log |
| Triggered by | Fatality, in-patient hospitalisation, amputation, loss of an eye | A much wider set — including any medical treatment beyond first aid, days away from work, or restricted duty |
| Deadline | 8 hours (fatality) or 24 hours (the rest) | 7 calendar days |
A sprained wrist that keeps someone on light duties for three days is recordable but not reportable. A fatality is both. Getting these the wrong way round is one of the most common US compliance mistakes — see OSHA Recordkeeping for the full test.
How SteadyOn addresses each area
Section titled “How SteadyOn addresses each area”| Area | SteadyOn module |
|---|---|
| Identifying and managing hazards | Hazards |
| Documenting hazard controls | Hazards — Control measures field |
| Hazard assessment (e.g. the PPE assessment required by 1910.132(d)) | Hazards — risk matrix and review dates |
| Incident recording and investigation | Incidents |
| Severe-injury reporting to OSHA (1904.39) | Incidents — Notifiable flag and the Notify Regulator tab |
| Emergency action plans | Emergency Plans |
| Evacuation drills | Emergency Plans — Drills |
| Worker hazard reporting | Hazards and Incidents (any member can create) |
| Public / contractor incident reporting | The public reporting link |
| Corrective actions and follow-up | Actions |
| Workplace inspections and self-audits | Inspections |
| First-aid and CPR certification records | Training Courses + Enrollments (with a First Aider role and a course requirement) |
| Written programmes and policies | Documents |
| Audit trail | The Log page + per-entity Log tab |
| Management and board visibility | Dashboard and Reports (incl. Board Report) |
What SteadyOn does not yet do
Section titled “What SteadyOn does not yet do”OSHA 300/300A/301 recordkeeping logs are not currently supported. SteadyOn records incidents and supports severe-injury reporting under 1904.39, but it does not yet produce the statutory forms or track the recordability determination that drives them. If you are subject to Part 1904, you will need to maintain those forms separately for now.
Note that employers with 10 or fewer employees at all times during the previous calendar year are partially exempt from routine recordkeeping — as are employers in a list of low-hazard industries. Those employers must still report fatalities and severe injuries, which SteadyOn does support. See OSHA Recordkeeping for whether the exemption applies to you.
A note on terminology
Section titled “A note on terminology”If you are reading SteadyOn documentation written for other markets, some terms will not map:
- There is no PCBU in US law. The duty holder is the employer, and the people owed the duty are employees.
- There is no statutory officer due-diligence duty equivalent to the one in New Zealand and Australia. US executive accountability runs through corporate liability and, in serious cases, criminal referral.
- “Competent person” does exist in US standards, but it is defined per-standard (most prominently in construction) rather than as a general concept.