OSHA Top 10 Citations 2026: A Prevention Playbook for EHS Leaders

Every year OSHA publishes the standards it cited most often during workplace inspections. The list barely changes — and that is the point. The same handful of standards drive most general-industry and construction citations because the same handful of failure modes repeat across thousands of employers: missing written programs, expired training, absent inspections, no documented controls.

This playbook walks the FY2026 list one standard at a time. For each entry you get the citation drivers, the controls that actually move the needle and the EHS software workflows that produce audit-ready evidence without rebuilding spreadsheets every quarter.

The FY2026 OSHA Top 10 — at a glance

The list has been stable for over a decade. Expect FY2026 to look like this (construction and general industry combined):

1. Fall Protection — General Requirements (29 CFR 1926.501)
2. Hazard Communication (29 CFR 1910.1200)
3. Ladders (29 CFR 1926.1053)
4. Respiratory Protection (29 CFR 1910.134)
5. Scaffolding — General Requirements (29 CFR 1926.451)
6. Lockout/Tagout (29 CFR 1910.147)
7. Powered Industrial Trucks (29 CFR 1910.178)
8. Fall Protection — Training Requirements (29 CFR 1926.503)
9. Personal Protective and Lifesaving Equipment — Eye and Face (29 CFR 1926.102)
10. Machine Guarding (29 CFR 1910.212)

Median proposed penalty per serious citation is now above USD 16,000, with willful and repeat citations exceeding USD 165,000. The financial case for closing these gaps is no longer in question — the operational question is how to deliver and prove the controls at scale.

1. Fall Protection — General Requirements (1926.501)

Why it tops the list. Most citations are for unprotected leading edges, holes and roof work above 6 feet without conventional protection (guardrail, safety net, personal fall arrest). Site supervisors often rely on workers to self-deploy PFAS rather than engineer the hazard out.

Prevention controls.

• Site-specific fall protection plan signed before mobilisation, not retrofitted after the first incident.
• Hierarchy-of-controls discipline: eliminate (delete the work-at-height), substitute (prefab on the ground), engineer (permanent guardrail), then PPE.
• Daily site walks with photographic close-out of any guardrail or hole-cover defect.
• Anchor-point register with annual recertification.

Software workflow.

• Site-specific RAMS issued from a template library and pushed to crew tablets.
• Daily checklist drives a guardrail / hole-cover register with overdue alerts.
• Permits-to-work for any work above 6 ft auto-include the fall plan and a competent person sign-off.

2. Hazard Communication (1910.1200)

Why it tops the list. Missing or outdated written HazCom programs, SDSs not accessible to workers, container labelling gaps and inadequate training on GHS pictograms.

Prevention controls.

• One source-of-truth SDS library with automatic vendor update ingestion.
• Container labelling standard (primary + secondary) with QR codes that open the SDS on phones.
• Annual GHS refresher logged per worker with competency check.
• Pre-purchase chemical approval — no SDS, no purchase order.

Software workflow.

• Chemical Inventory Management (CIM) tied to an SDS library with version control.
• Auto-generated secondary container labels printed at the workstation.
• Training matrix flags GHS overdue per role and per site.

3. Ladders (1926.1053)

Why it tops the list. Damaged ladders left in service, incorrect angle (4:1 rule), use of step-ladders as straight ladders, missing three-points-of-contact rule.

Prevention controls.

• Coloured monthly inspection tag system with hard-stop removal of any failed ladder.
• Ladder asset register with unique IDs and inspection history.
• Workers trained and ticketed for ladder use, not just toolbox-talked.

Software workflow.

• QR-tagged ladder register with monthly inspection checklist on mobile.
• Defect reporting triggers immediate quarantine and replacement ticket.

4. Respiratory Protection (1910.134)

Why it tops the list. No written respiratory protection program, missing medical evaluations, no fit testing before first use or annually, employees using respirators voluntarily without Appendix D notification.

Prevention controls.

• Written program reviewed annually with site-specific hazard assessment per task.
• Medical clearance — fit test — training stacked as a mandatory sequence before issue.
• Cartridge change-out schedule based on contaminant, work rate and humidity, not vibes.

Software workflow.

• Per-worker respiratory record (medical, fit test, training) with expiry workflow.
• Task-based hazard assessment library aligned to NIOSH selection logic.
• Permits requiring respirators block issuance when any record is expired.

5. Scaffolding — General Requirements (1926.451)

Why it tops the list. Improper access (no internal ladder or stair tower), missing toe-boards and mid-rails, scaffold not inspected by a competent person each shift, overloaded planks.

Prevention controls.

• Scaffold tag system — green / yellow / red — controlled by a competent person.
• Pre-shift inspection logged before any worker mounts the scaffold.
• Load rating posted at access point.

Software workflow.

• Scaffold register with tag status and inspector identity per scaffold.
• Pre-shift inspection drives a hard-stop on access if the tag is not green.

6. Lockout/Tagout (1910.147)

Why it tops the list. No machine-specific energy control procedures (ECPs), inadequate periodic inspections (every 12 months), authorised vs affected vs other employee training gaps, group LOTO without proper accountability.

Prevention controls.

• ECP per machine, validated, posted at the point of work, and linked to the LOTO permit.
• Annual ECP audit by a different authorised employee with documented findings.
• Group LOTO board with primary authorised employee in writing.

Software workflow.

• Digital ECP library with QR codes on the machine that open the ECP and a LOTO checklist.
• Annual ECP audit scheduled and tracked per asset.
• Training matrix split by authorised / affected / other with auto-renewal.

7. Powered Industrial Trucks (1910.178)

Why it tops the list. Operators not certified or evaluated every three years, pre-shift inspections not performed, modifications not approved by manufacturer, untrained pedestrians in traffic zones.

Prevention controls.

• Operator licence with theory, practical and site-specific evaluation, refreshed triennially.
• Pre-shift inspection enforced via key-control or telematics interlock.
• Pedestrian segregation engineered, not painted.

Software workflow.

• Operator competency record with expiry and refresher booking.
• Tablet-based pre-shift inspection that unlocks the truck on completion.
• Incident reporting captures near-misses and feeds traffic-management redesigns.

8. Fall Protection — Training Requirements (1926.503)

Why it tops the list. Workers trained on PFAS but no documented competency, training language not matched to workforce, no retraining after a change in equipment or a fall incident.

Prevention controls.

• Per-worker fall-protection competency with practical demonstration logged.
• Retraining trigger on equipment change, near-miss or incident.
• Multilingual content matching workforce demographics.

Software workflow.

• Training matrix with competency vs awareness distinction, evidence upload, multilingual content tags.
• Auto-trigger of retraining ticket on relevant incident category.

9. PPE — Eye and Face Protection (1926.102)

Why it tops the list. No documented eye-hazard assessment per task, wrong PPE class issued (e.g. Z87 vs Z87+), no enforcement at the work face, contractor crews not aligned to host site PPE matrix.

Prevention controls.

• Task-based PPE matrix published and enforced at site access.
• Eye-wash station inspection schedule with site map.
• Contractor inductions explicitly cover host site PPE matrix.

Software workflow.

• PPE matrix attached to each job hazard analysis, visible to contractors before mobilisation.
• Eye-wash inspection on a recurring checklist.

10. Machine Guarding (1910.212)

Why it tops the list. Guards removed for maintenance and not replaced, point-of-operation guards inadequate for the work, interlocks bypassed.

Prevention controls.

• Guard register per machine with photo of compliant state.
• Bypassed interlocks treated as a recordable near-miss with mandatory RCA.
• Maintenance work order auto-creates a post-maintenance guard verification step.

Software workflow.

• Guard register tied to CMMS/EAM with verification step on every relevant work order.
• Audit checklist for machine-shop walkthroughs feeds CAPA tracking.

Building an OSHA Top 10 prevention program

Stop treating each standard as an isolated project. The same five EHS software capabilities cover 80 percent of the prevention work for every entry on the list:

1. A training matrix with role-based requirements, evidence upload and expiry workflow.
2. An inspection library with mobile execution, photo capture and corrective-action routing.
3. A permit-to-work engine that hard-stops when a worker is not competent, inducted or medically cleared.
4. A contractor management platform so host-site standards apply to every crew on site (see our contractor management software 2026 guide).
5. Incident and observation reporting with root-cause analysis feeding back into the matrix.

Audit-ready evidence checklist

For each standard you should be able to produce, within 10 minutes of an OSHA visit:

• Written program with version history and review date
• Per-worker training records with competency demonstration
• Inspection records with photos and signed-off corrective actions
• Permit history with competency and medical verification
• Incident and near-miss records linked to standards and CAPAs

If any of these still lives in a SharePoint folder, an inspector will find the gap.

Where to go next

• Best Safety Management Software — execution layer
• Permit-to-Work Software — high-risk work control
• Training Management Software — competency and refreshers
• Incident Management Software — leading and lagging indicators
• ISO 45001 Software — management-system alignment

The FY2026 list will reward the same employers it has rewarded for a decade: those who industrialise the controls instead of relying on individual diligence.