Almost every small business that uses chemicals is required to have a written Hazard Communication program. Not a binder of Safety Data Sheets — those are separate. Not a training video — also separate. A specific written document that describes how your business handles labeling, SDSs, chemical inventory, and employee training. OSHA requires it under 29 CFR 1910.1200(e), and the absence of one is consistently among the most-cited HazCom violations year after year.
Here's the problem with how most small businesses handle this. They search "written hazard communication program template," download a generic Word document or state agency PDF, fill in the company name, sign it, and file it. That document then sits in a drawer describing a program the business doesn't actually run. And when an OSHA inspector shows up, the gap between what the document says and what the business actually does is exactly what generates the citation.
A written program isn't a form you complete once. It's a description of what your business actually does, and it only protects you if the description is accurate. This post walks through each section a compliant program needs, what a real small-business version looks like, and the specific mistakes that lead to citations.
What the Regulation Actually Requires
The core requirement is short. Under 1910.1200(e)(1), employers must "develop, implement, and maintain at each workplace, a written hazard communication program" that describes how the business will meet the standard's requirements for labels, safety data sheets, and employee training. Beyond that, the program must specifically include two things: a list of the hazardous chemicals known to be present, and the methods the employer will use to inform employees about the hazards of non-routine tasks and of chemicals in unlabeled pipes.
Two words in that requirement do a lot of work: "implement" and "maintain." It's not enough to develop a program. You have to actually run it, and you have to keep it current. A program that describes practices you've abandoned, or that was written for a facility you've since outgrown, fails the "maintain" requirement even if it was perfect the day it was signed.
The other thing worth understanding up front is that the program must be site-specific. This isn't a stylistic preference — it's OSHA's longstanding interpretation. In a 1989 letter of interpretation, OSHA wrote that each workplace contains its own unique exposure potentials, and that the chemical inventory and resulting program are "unique to the worksite, not to the industry sector," and "must be developed for each specific workplace." A template built for "machine shops generally" or "construction companies generally" is a starting point, not a compliant program. The customization is the compliance.
OSHA publishes a free sample written program in Publication 3695, the Small Entity Compliance Guide for Employers That Use Hazardous Chemicals. Several state consultation programs (Michigan, Missouri, Oregon, Washington, South Carolina) publish their own fill-in templates too. These are excellent skeletons. But note that most of them, including OSHA 3695, were written for the 2012 version of the standard and haven't been republished for the 2024 revision yet. Use them for structure, but update the regulatory references and make sure the content reflects what you actually do.
The Sections a Compliant Program Needs
A complete written program has seven or eight working sections. Here's each one.
1. Company Policy and Responsibility
What OSHA wants: A statement that the program exists to comply with 1910.1200, identification of who is responsible for the program, and where the program is kept and how employees access it.
What good looks like: Name an actual person by job title — "the Operations Manager" or "the owner" — not "management." State a physical or electronic location where the program lives and confirm it's accessible during every shift. Note that the program covers all work areas at the site.
The citation trap: Boilerplate that says "we will comply with all applicable regulations" with no named responsible person and no stated location. If an inspector asks an employee "who's in charge of chemical safety here and where's the written program?" and gets a blank stare, the policy section has failed regardless of how it reads.
2. Container Labeling
What OSHA wants: Your procedures for keeping manufacturer labels intact on incoming containers, and your system for labeling workplace (secondary) containers.
What good looks like: Name who checks incoming containers for intact labels. Describe your workplace labeling system — whether you use full GHS labels, an alternative like HMIS or NFPA, or a product-identifier-plus-hazard-information approach. Commit to never removing or defacing manufacturer labels. Explicitly address the containers you actually use: spray bottles, transfer jugs, parts-washer reservoirs.
The citation trap: Saying nothing about secondary containers, or assuming the "immediate use" exemption covers more than it does. That exemption is narrow — it only applies to a container filled and used by the same person within a single shift, kept in that person's continuous control. A spray bottle left at a workstation overnight, or a solvent reservoir shared across operators, is not exempt and needs a label.
3. Safety Data Sheets
What OSHA wants: Who maintains your SDSs, where they're kept, how employees access them during every shift, and how you handle a missing SDS.
What good looks like: Name the responsible person. Describe both your primary access method and a backup — if your SDSs are electronic, what happens when the power or internet is down? Describe what you do when a new chemical arrives without an SDS (you request it from the supplier; federal law requires them to provide it). Note that you retain SDSs in line with the 30-year exposure-record requirement.
The citation trap: SDSs locked in a manager's office, an electronic system with no offline backup, or employees who don't know the login. OSHA's standard for SDS access is that they're "readily accessible" to employees in their work area throughout each shift — not retrievable by asking a supervisor to unlock something.
4. Chemical Inventory List
What OSHA wants: A list of the hazardous chemicals known to be present, identified by the same product identifier that appears on the SDS. This is explicitly required by 1910.1200(e)(1)(i).
What good looks like: A list that cross-references cleanly to your SDS library, gets updated when chemicals come and go, and uses identifiers that match both the label and the SDS. Including location and approximate quantity is smart — it makes the list more useful and feeds directly into Tier II reporting if you ever cross those thresholds.
The citation trap: Vague entries like "assorted cleaners, maintenance closet," or a list that's missing chemicals an inspector can physically see on your shelves. The fastest way an inspector tests your inventory is to pick five containers at random and check whether they're on the list with a matching SDS. If they're not, the inventory is incomplete.
5. Employee Information and Training
What OSHA wants: How you train employees — at initial assignment and whenever a new hazard is introduced — covering the standard itself, the chemicals in their work areas, where to find the program and SDSs, how to detect chemical presence, the physical and health hazards, and protective measures.
What good looks like: Describe who delivers training, in what format, how often, and in what language(s) your workforce needs. Critically, describe how training is documented and how a new chemical or newly-introduced hazard triggers a refresher. The documentation piece is where many programs quietly fail — training happens, but there's no record an inspector can review. If you're tracking training completion across HazCom and your other OSHA training obligations, a dedicated records system like LogStead handles the documentation and proof-on-demand that a binder of sign-in sheets struggles with.
The citation trap: A generic "employees will watch a video" line with no site-specific content, no documentation, and no mechanism for retraining when something changes. We covered the training-frequency rules in detail in our post on how often HazCom training is required — the short version is that the trigger is a new hazard, not the calendar, and the 2024 standard revision is itself a retraining trigger.
6. Hazards of Non-Routine Tasks
What OSHA wants: The methods you'll use to inform employees about the hazards of non-routine tasks, and about chemicals in unlabeled pipes. This is the section almost everyone leaves blank, and it's explicitly required.
What good looks like: List the specific non-routine tasks that actually happen at your site. For a small business these are concrete things: the annual deep-clean of a parts washer or solvent tank, cleaning out an HVAC condensate line with biocide, a coolant sump cleanout, confined-space entry into a pit or tank, stripping and repainting equipment, descaling a water heater with acid, or disposing of a chemical you no longer use. For each, note the chemical hazards, the protective measures, and any special procedures (ventilation, a second person present, emergency steps). For unlabeled pipes, either label them or describe how you identify the contents before anyone works on them.
The citation trap: Leaving the section as the generic "we will inform employees of non-routine task hazards" with no examples, or having pipes carrying chemicals with no identification system. The OSHA template's classic example is "cleaning of reactor vessels," which means nothing to a five-person shop — but every shop has its own version of a once-a-year dirty job, and that's what belongs here.
7. Multi-Employer Worksites
What OSHA wants: If employees of other employers might be exposed to chemicals at your site, the program must describe how you give those other employers access to your SDSs, how you inform them of precautionary measures, and how you tell them about your labeling system. This is 1910.1200(e)(2).
What good looks like: This matters more for small businesses than most realize, and it runs in both directions. If you're a subcontractor — a plumber, electrician, painter, HVAC tech — working at a client's site, you still need your own written program, your own inventory of the chemicals you bring, and your own SDSs accessible to your crew during the shift. You can't rely solely on the general contractor's program. The cleanest approach is to formally exchange chemical and SDS information at the start of a job and keep the record. The same logic applies to any service business that works at customer locations.
The citation trap: Assuming the host site's program covers you, or having no documentation that you exchanged chemical information with other employers on a shared site.
8. Contractors Coming Onto Your Site
Many programs add a short companion section for the reverse situation: when a contractor brings chemicals onto your site. The host needs to obtain information about what those chemicals are. A brief paragraph describing how you collect that information from visiting contractors closes the loop.
The Mistake That Underlies Most Citations
If there's one theme that connects the citation traps above, it's this: the written program describes a business that doesn't exist. The document says SDSs are kept in a binder by the time clock; they're actually in the manager's desk. The document names a HazCom coordinator who left two years ago. The inventory lists chemicals you stopped using and omits three you started using last spring.
OSHA inspectors are specifically looking for this gap. They read your program, then they walk your facility and talk to your employees, and they note every place where reality and the document diverge. A beautifully written program that doesn't match your operation is arguably worse than a rough one that does, because it demonstrates the program isn't being maintained.
The fix is simple to state and easy to neglect: write the program to describe what you actually do, then update it whenever what you do changes. New chemical? Update the inventory. New building or work area? Update the scope. Switched from a paper binder to a digital SDS system? Update the SDS access section. Set a recurring calendar reminder — quarterly is reasonable for most small businesses — to walk the facility and reconcile the document against reality.
What the 2024 Revision Changes for Your Program
The structure of the written program doesn't change under the HCS 2024 revision. What changes is some of the content it has to describe. The revision added and reorganized several hazard classes — desensitized explosives, a non-flammable aerosol category, a split in the flammable gas categories, chemicals under pressure — and updated SDS content and small-container labeling rules. As suppliers issue updated SDSs and you start seeing new pictograms and hazard categories on incoming containers, your program's labeling and training sections need to reflect them.
For employers, the deadline to have workplace labels, the written program, and training updated for substances is November 20, 2026. For mixtures, it's May 19, 2028. During the transition you're allowed to work under the 2012 standard, the 2024 standard, or both — so you're not out of compliance today if your program still references the older version. But the substances deadline is about six months out, and updating the program is part of what's due. We laid out the full employer to-do list in our November 2026 deadline post.
Practically, the program update is small for most small businesses: refresh the regulatory references to point at the current standard, confirm your SDS library is being refreshed as updated sheets arrive, and make sure your training section reflects the "what changed" training you'll deliver before the deadline.
A Realistic Way to Get This Done
If you don't have a written program, or you have one you suspect is the drawer-template variety, here's a sane sequence:
Start with a free skeleton — OSHA Publication 3695's sample, or your state consultation program's template. Then go section by section through the seven or eight sections above and replace every generic line with a true statement about your business. Name real people. State real locations. List your real chemicals. Describe your real SDS system. Enumerate your real non-routine tasks. Where the template has a blank table, fill it in or delete it.
When you're done, do the inspector's test on yourself. Walk your facility with the program in hand. Pick five chemicals at random and confirm they're on your inventory with accessible SDSs. Ask an employee to find an SDS and tell you who's responsible for chemical safety. Every place the document and the walk-around disagree is a place to fix the document — or the practice.
That's a few hours of work, not a project. And it converts the written program from a liability sitting in a drawer into what it's supposed to be: an accurate description of a business that actually communicates chemical hazards to the people working with them.
SafeSheet maintains your chemical inventory and SDS library so the sections of your written program that describe them stay accurate as chemicals come and go. Start a free 14-day trial — no credit card required.