Why OSHA recordkeeping is back under scrutiny in 2026
The Occupational Safety and Health Administration has required employers to log workplace injuries and illnesses for decades, but the rules around who must submit that data electronically, and how completely, changed materially under the 2023 final rule that took full effect in 2024 and continues to apply through the 2026 reporting cycle. Establishments in designated high-hazard industries with 100 or more employees must now submit not just the annual summary, but the full detail from the OSHA Form 300 injury and illness log and Form 301 incident reports through OSHA's Injury Tracking Application (ITA). For document-heavy employers in manufacturing, warehousing, healthcare support, and other Appendix B industries, this turns what used to be an internal paper log into a dataset that regulators, and in some cases the public, can access.
This matters for document management because OSHA recordkeeping is no longer a once-a-year form filled out and filed in a drawer. It is a rolling record that must be accurate, updated, retained for a fixed period, and produced on demand, with real financial exposure if it is not.
The 2026 filing calendar
Covered establishments must post the OSHA Form 300A Annual Summary in a visible workplace location from February 1 through April 30, 2026, covering calendar year 2025 data. Separately, electronic submission of that data through the ITA is due by March 2, 2026. Employers can file using the ITA web form, a CSV upload, or an API connection, but the underlying obligation is the same regardless of method: the numbers submitted electronically must match the records the employer is legally required to keep on file, not a rounded or reconstructed estimate.
Who is actually required to submit electronically
The electronic submission requirement is tiered by employer size and industry:
- Establishments with 250 or more employees, in industries that must routinely keep OSHA injury and illness records, must electronically submit information from Form 300A.
- Establishments with 20 to 249 employees, in a specific list of historically higher-hazard industries (Appendix A of the rule), must also submit Form 300A data annually.
- Establishments with 100 or more employees in designated high-hazard industries (Appendix B) must submit Forms 300, 300A, and 301 electronically, not just the summary. Certain data fields tied to identifying information are excluded from these submissions for privacy reasons.
- Employers with 10 or fewer employees at all times during the year, and establishments in partially exempt low-hazard industries, are generally not required to keep these records at all, though state-plan states may impose additional requirements.
Because the applicable tier depends on both headcount and North American Industry Classification System (NAICS) code, many businesses that assumed they were exempt in prior years are not exempt under the current thresholds, particularly midsize employers in industries added to Appendix A and B during the 2023 rulemaking.
What must be retained, and for how long
Under 29 CFR 1904.33, employers must retain the OSHA 300 Log, the privacy case list (where one exists), the 300A Annual Summary, and all 301 Incident Report forms for five years following the end of the calendar year those records cover. That means an establishment filing 2025 data in March 2026 must be able to produce that same documentation through the end of 2030 at minimum, and in practice organizations often need several years of overlapping logs available simultaneously.
The retention duty is not static for every document type. The OSHA 300 Log carries an active updating requirement: employers must revise stored logs to add newly discovered recordable injuries or illnesses and to reflect any change in how a case was classified, even after the year has closed. The 300A summary and 301 incident reports, by contrast, are not required to be updated once filed, though nothing prevents an employer from correcting them. This distinction matters operationally because a static, unindexed PDF archive makes it easy to miss the fact that a five-year-old log technically still needs a correction entered against it.
The cost of getting it wrong
OSHA's civil penalty amounts are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. For 2026, the maximum penalty for a serious violation, the category recordkeeping failures typically fall under, is $16,550 per violation. Willful or repeat violations carry a maximum of $165,514 per violation. Because recordkeeping citations can be issued on a per-instance basis, such as a separate citation for each missing or inaccurate entry in a log rather than a single citation for the log as a whole, the total exposure for a business with multiple undocumented incidents across a reporting year can climb well past the headline per-violation figures. Penalty amounts are also adjusted by factors including employer size, documented good-faith safety efforts, and prior citation history, so two employers with similar underlying facts can see different assessed totals.
A practical checklist for the 2026 cycle and beyond
- Confirm which tier applies to each establishment separately: headcount and NAICS code should be re-checked annually, not assumed from prior years.
- Verify that Form 300A totals submitted through the ITA reconcile exactly with the underlying 300 Log and 301 reports kept on file.
- Set a recurring review point before the five-year retention window closes on each year's records, rather than relying on staff memory to know what can be discarded.
- Track which entries in older 300 Logs may need retroactive updates for newly classified or newly discovered cases, since the updating duty survives the filing date.
- Keep submission confirmations and CSV or API upload logs from the ITA itself as evidence that the March 2 deadline was met, separate from the underlying injury records.
- Where multiple establishments file under one company, maintain a master index showing which location filed what, and when, to avoid gaps surfacing only during an inspection.
None of this requires new software to be legally compliant, but it does require records that are dated, indexed, retrievable within the five-year window, and demonstrably reconciled between the internal log and what was actually submitted to OSHA. Employers who treat the 300A posting period each spring as the moment to first locate the underlying logs, rather than the moment to confirm records that have been current all year, are the ones most likely to find gaps only after an inspector asks for them.