Contractor OSHA Compliance in 2026: Training Cards, Top Citations by Trade, and the State-Plan Trap That Catches Out-of-Town Crews

The average OSHA serious-violation fine hit $16,550 per citation in 2026 and willful or repeat violations cap at $165,514 each. A four-citation inspection on a residential roof without fall protection can clear $66,000 before the lawyer shows up. Contractor OSHA compliance is the line between an inspection that closes with a verbal warning and one that takes out a quarter of net income.

Most OSHA inspections start one of two ways: a worker complaint or an injury serious enough to trigger a report. Per OSHA’s penalty schedule, inspectors do not have to find what the complaint alleged. Once they are on your site they can cite anything in plain view, including a missing 300 log, an unlabeled chemical container, or an extension cord run across a doorway.

This is how contractor OSHA compliance actually works in 2026: training cards by role, top citations by trade, the recordkeeping threshold that catches growing shops, where state-plan OSHA diverges from federal, and how the documentation doubles as workers comp savings.

OSHA 10 and OSHA 30 training: who needs what, by when

Federal OSHA does not require OSHA 10 or OSHA 30 cards for most contractors. State law and large-GC contracts do.

OSHA 10 is the entry-level outreach card for field workers. Ten hours of instruction covering fall protection, electrical hazards, struck-by, caught-in-between, PPE, and basic worker rights. Per OSHA.com’s course comparison, every contractor laborer, apprentice, helper, and journeyman should have one inside a week of hire.

OSHA 30 is the supervisor card for foremen, project managers, safety leads, and anyone responsible for the safety of others. Thirty hours covering the OSHA 10 content in more depth plus accident investigation, recordkeeping, multi-employer worksite duties, and management of safety programs.

Per the State OSHA training requirements list, Connecticut, Massachusetts, Missouri, New Hampshire, New York, Rhode Island, and West Virginia all mandate OSHA 10 for construction workers and OSHA 30 for supervisors within 15 days of hire on any public-works job. New York City, Philadelphia, and Miami-Dade County enforce the same through local permit ordinances regardless of statewide law.

Cards never expire federally. Seven states (NY, CT, NV, MA, NH, RI, MO) require renewal every five years.

The contracts catch the rest. Every Turner, Skanska, Whiting-Turner, or Suffolk PQ form asks for OSHA 30 on every foreman and OSHA 10 on every laborer before subs hit the site. A roofing sub on r/Roofing wrote in 2025: “Got dropped from a Suffolk hospital project two days before mobilization because three of my new hires hadn’t finished their OSHA 10 yet. Lost a $340K job over $90 of online classes.”

Online OSHA 10 runs $60-$80 per worker, OSHA 30 $160-$200 per supervisor. A 12-person shop with two foremen is under $1,200 of total training spend.

Top OSHA citations by trade

OSHA publishes the Top 10 most-cited standards every year. The list barely changes.

Fall Protection (1926.501) is the #1 cited OSHA standard and has been for 15+ consecutive years. Per the Top 10 Violations 2026 breakdown, it produces 6,000-7,000 citations a year, roughly 65% of them in construction. The trigger is 6 feet above a lower level in construction (4 feet in general industry, 10 feet on scaffolds). Residential roofing, HVAC roof units, gutter work, and framing are the bullseye trades.

Ladders (1926.1053) runs second in construction. Citations come from using the wrong ladder type, exceeding the load rating, not extending three feet above the landing, or working off the top two steps.

Scaffolding (1926.451) is the GC and masonry tax. Improper guardrails, missing toeboards, no inspection by a competent person before each shift, planking gaps, and missing fall protection at 10+ feet.

Hazard Communication (1910.1200) is the chemical-program standard. Missing SDS binders, unlabeled secondary containers (the gas can that says “GAS” in Sharpie does not count), no written hazcom program. HVAC and plumbing shops get hit on refrigerants, solvents, and sealants.

Electrical Wiring Methods (1910.305) and Lockout-Tagout (1910.147) are the electrician’s standard exposure. Per the Top 10 OSHA Violations in Construction breakdown, wiring-method citations cover overloaded circuits, missing covers, extension cords used as permanent wiring, and bad strain reliefs. LOTO citations almost always follow an injury and run into the willful-violation range fast.

Respiratory Protection (1910.134) catches anyone cutting concrete, doing demo, or spraying foam without fit-tested respirators, written programs, and medical clearance.

The pattern: roofers and framers get fall protection, electricians get LOTO and wiring methods, HVAC and plumbing get hazcom and ladders, GCs get scaffolding and multi-employer-site duties. A clean inspection requires programs and documentation for all of them, not just the one most likely to come up.

Recordkeeping: 300, 300A, 301, and the 11-employee threshold

The OSHA 300 log is the worksheet, the 300A is the annual summary, and the 301 is the per-incident report. All three are mandatory for most contractors above a single headcount line.

Per OSHA’s partial-exemption rule (29 CFR 1904.1), employers with 10 or fewer employees throughout the entire previous calendar year are partially exempt from routine 300/300A/301 recordkeeping. The threshold is peak headcount across all locations, not average and not per-site. Two locations of 8 and 5 trigger the requirement at 13 total.

Per SafetyIQ’s 300/300A/301 guide, the three forms work together:

Form 300 (Log of Work-Related Injuries and Illnesses) stays in the office, updated within 7 days of every recordable incident. Recordable means death, days away from work, restricted duty, transfer, medical treatment beyond first aid, loss of consciousness, or a diagnosed significant injury.

Form 300A (Annual Summary) gets posted in a visible worksite location from February 1 through April 30 every year, even if you had zero recordable incidents. Signed by a company executive (owner, GM, or COO), not the safety officer.

Form 301 (Injury and Illness Incident Report) is the back-of-house detail file for each recordable event. Kept for five years.

Even partially exempt small contractors must report fatalities within 8 hours and hospitalizations, amputations, or eye losses within 24 hours. The OSHA reporting line (1-800-321-OSHA) is open 24/7, and missing the window is its own citation.

Per OSHA’s 2026 reporting threshold update, construction employers with 100+ employees at any establishment now have to submit 300, 300A, and 301 data electronically every year through the ITA portal. Sub-100 establishments in construction still submit 300A annually if they have 20-249 employees.

State-plan OSHA: 21 states with their own rules

OSHA is a federal agency, but per OSHA’s State Plans directory, 21 states plus Puerto Rico run their own OSHA-approved programs covering private employers. Another six cover only state and local government workers. State plans must be at least as protective as federal OSHA. Most are stricter.

California (Cal/OSHA) is the most aggressive. Per the Nelson Mullins state-plan breakdown, Cal/OSHA requires every employer to maintain a written Injury and Illness Prevention Program (IIPP) with a designated person, hazard assessments, employee training records, and a system for investigating injuries. Federal OSHA has no IIPP requirement at all, and IIPP violations are Cal/OSHA’s most-cited standard year after year.

In 2025 Cal/OSHA dropped the residential-roofing fall-protection trigger from 7.5 feet to 6 feet, matching general construction and ending the residential carve-out California previously allowed. Per the FallTech writeup, every residential roofer in California now needs fall protection at the same trigger as commercial work.

Washington (DOSH) requires a written Accident Prevention Program for every employer. Stricter ergonomic and heat-illness rules than federal.

Oregon (Oregon OSHA) matches Washington on documentation, adds rigorous heat and wildfire-smoke standards.

North Carolina (NC OSH) runs a state plan but generally mirrors federal standards. Per the NC State Plan page, the bigger divergence is on enforcement aggression, not on the standard text.

Other state plans for private employers: AK, AZ, HI, IN, IA, KY, MD, MI, MN, NV, NM, PR, SC, TN, UT, VT, VA, WY.

If you cross state lines, the rule is the rule of the state you are working in, not the rule of the state you are headquartered in. A Texas HVAC company doing a multi-site rollout in California needs Cal/OSHA IIPP documentation on every truck and every foreman.

The residential GC “carve-out” that isn’t really a carve-out

Federal OSHA’s residential fall-protection standard at 1926.501(b)(13) requires conventional fall protection (guardrails, safety nets, or personal fall arrest) at 6 feet, the same trigger as commercial construction.

The narrow exception is when the employer can demonstrate that conventional fall protection is infeasible or creates a greater hazard. Per OSHA’s standard text, the burden is on the contractor to write a site-specific fall-protection plan, get it signed by a qualified person, and keep it on the job. There is no automatic small-employer exemption.

The most common residential variance: slide guards on low-slope roof work. They are allowed in some narrow situations under the alternative-procedures plan but not as a blanket substitute for harness systems. Inspectors who see a slide guard with no written fall-protection plan and no harness anchors will cite both the fall-protection standard and the absence of the plan as two separate violations.

A residential GC on ContractorTalk wrote in 2025: “Had an inspector pull up on a re-roof, two guys on a 6/12 with slide guards and no harnesses. Nothing in writing. Three citations totaled $34,500. Now every job folder has a one-page fall plan stapled to it before mobilization.”

The truthful read: there is no federal residential carve-out worth relying on. Write the plan, document the anchors, harness up.

The safety-program-as-workers-comp lever

Documented safety programs do two things that pay back hard: they shrink OSHA exposure and they shrink workers comp premium.

On the workers comp side, our workers comp for contractors breakdown covers the experience modifier math. Carrier schedule credits of 5-15% off base premium go to contractors with formal documented safety programs (written IIPP/APP, monthly toolbox talks logged in writing, post-incident drug testing, return-to-work program). For a roofing shop paying $200K in annual WC premium, a 10% schedule credit is $20K a year before the mod even moves.

On the OSHA side, the same documentation is the inspector’s wish list. Written fall-protection plan, hazcom binder with current SDSs, OSHA 30 card for the foreman, OSHA 10 cards for the crew, toolbox-talk log signed by attendees, equipment inspection records, drug-testing policy, and a competent-person designation for scaffolds and excavations. An inspector who finds all of that signs off and leaves. An inspector who finds none of it stays a long time.

The mechanical move: hire a part-time safety consultant for $1,500-$4,000 a month (or buy a Safesite, KPA, or SafetyCulture subscription at $300-$1,200/month), template every form, train the foremen on enforcement, and audit one job a week. Two renewals later the carrier credits and lower mod cover the cost 3-4x over.

Common OSHA mistakes that growing contractors make

No site-specific safety plan. Inspectors want the plan for this site, not a generic template. JHA per task, fall plan if working at height, hazcom inventory of chemicals brought on site, emergency contacts and hospital map. One page each, in the job folder.

Missing the 8-hour and 24-hour reporting windows. A worker hospitalized overnight has to be reported to OSHA within 24 hours. Most contractors do not know this until they get cited. Put the OSHA reporting line in the foreman’s phone today.

Subs without their own OSHA programs. On a multi-employer worksite, the GC is the controlling employer and inherits liability for sub violations. Collect each sub’s written safety program, OSHA 30 card for their foreman, and COI before they mobilize. Our contractor bonding and insurance guide covers the COI piece.

Skipping post-incident documentation. A near-miss that did not produce an injury still warrants a 301 form, a root-cause write-up, and a toolbox talk the next morning. The contractors with the best mods document near-misses harder than actual incidents.

Running 1099 helpers without their own training records. If the helper functions as your employee (your truck, tools, dispatch), they are W-2 for OSHA purposes regardless of how you pay them. The contractor payroll software guide covers the W-2 mechanics, and the contractor hiring guide covers onboarding documentation.

The honest take

OSHA compliance is not a 200-page binder problem. It is a foreman-discipline problem.

The contractors who never get cited share four habits: every new hire gets an OSHA 10 inside the first week and every foreman has an OSHA 30, every job starts with a one-page hazard analysis in the folder, every fall-protection setup gets a photo for the file before work starts, and the foreman runs a 5-minute toolbox talk every Monday morning with a sign-in sheet.

The contractors who get hit with $50K inspections share four habits in the opposite direction: training is “we’ll get to it,” the JHA is verbal, the harnesses are in the truck but not on the workers, and nobody knows where the 300 log is.

OSHA inspectors are not looking for perfect. They are looking for evidence that you take it seriously. Written plans, signed training cards, photos of anchors, and a foreman who can explain the fall-protection setup in 30 seconds when asked. That same evidence is what the workers comp carrier wants at renewal, what the GC wants at PQ, and what plaintiff’s counsel can’t use against you when something does go wrong.

Print the OSHA 10/30 training list. Photograph the fall-protection setup on every roof job. Post the 300A this February even if it is blank. The downside cost is a weekend; the upside is the difference between staying open and not.

Our contractor license by state guide covers the licensing layer that sits next to OSHA, and the contractor tech incentive programs guide covers the rebates that fund the safety software most shops put off buying.