OSHA Top 10 Citations 2026: A Prevention Playbook

Every year OSHA publishes the standards it cited most often during workplace inspections. The list barely changes — and that is the point. The same handful of standards recur at the top of the list because the same handful of failure modes repeat from one employer to the next: missing written programs, expired training, absent inspections, no documented controls.

This playbook walks the preliminary FY2026 list one standard at a time. For each entry you get the citation drivers, the controls that actually move the needle and the EHS software workflows that produce audit-ready evidence without rebuilding spreadsheets every quarter.

The FY2026 OSHA Top 10 — at a glance

OSHA presented its preliminary FY2026 list, covering inspection data from 1 October 2025 to 31 August 2026, at the NSC Safety Congress & Expo on 15 September 2026, where Fall Protection — General Requirements led for the 16th consecutive fiscal year (Safety+Health, National Safety Council; OSHA presentation slides). The same ten standards made up OSHA's full-year FY2025 list (OSHA). OSHA's own Top 10 page, last updated on 15 April 2026 and checked on 4 October 2026, still shows the full-year FY2025 list; FY2026 closed on 30 September 2026, so the final list is not yet published and the order below can change. The preliminary FY2026 order (construction and general industry combined):

1. Fall Protection — General Requirements (29 CFR 1926.501)
2. Hazard Communication (29 CFR 1910.1200)
3. Lockout/Tagout (29 CFR 1910.147)
4. Scaffolding — General Requirements (29 CFR 1926.451)
5. Ladders (29 CFR 1926.1053)
6. Respiratory Protection (29 CFR 1910.134)
7. Powered Industrial Trucks (29 CFR 1910.178)
8. Fall Protection — Training Requirements (29 CFR 1926.503)
9. Personal Protective and Lifesaving Equipment — Eye and Face (29 CFR 1926.102)
10. Machine Guarding (29 CFR 1910.212)

The counts come from OSHA's presentation slides and cover eleven months, so compare ranks between years, not counts. The list gives the number of violations for each standard as a whole, not by paragraph or cause, so the "where programs fall short" notes below are this guide's reading of what each standard requires, not an analysis of OSHA's citation data.

Reading the counts (the site's arithmetic on the preliminary figures). The ten counts add up to 17,701 violations. The two fall protection standards (1926.501 and 1926.503) account for 5,314 of them, about 30%. Adding scaffolding and ladders, the four construction fall-related standards total 8,698, about 49%. That concentration is why a construction employer can reasonably start with a fall-prevention programme, while a general-industry employer's top lines are hazard communication, lockout/tagout, respiratory protection, powered industrial trucks and machine guarding.

For 2026, OSHA's maximum penalties are USD 16,550 per serious violation and USD 165,514 per willful or repeated violation, unchanged from 2025 (OSHA memo, 21 May 2026). The financial case for closing these gaps is no longer in question — the operational question is how to deliver and prove the controls at scale.

1. Fall Protection — General Requirements (1926.501)

Where programs fall short. The standard's trigger is an unprotected side or edge 6 feet or more above a lower level, which must be protected by guardrail, safety net or personal fall arrest unless the standard allows an alternative for the work. Gaps to look for are unprotected edges and holes, roof work without a plan, and reliance on workers to self-deploy personal fall arrest rather than engineering the hazard out.

Prevention controls.

• Site-specific fall protection plan signed before mobilisation, not retrofitted after the first incident.
• Hierarchy-of-controls discipline: eliminate (delete the work-at-height), substitute (prefab on the ground), engineer (permanent guardrail), then PPE.
• Daily site walks with photographic close-out of any guardrail or hole-cover defect.
• Anchor-point register with annual recertification.

Software workflow.

• Site-specific RAMS issued from a template library and pushed to crew tablets.
• Daily checklist drives a guardrail / hole-cover register with overdue alerts.
• Permits-to-work for any work above 6 ft auto-include the fall plan and a competent person sign-off; the permit to work template holds a hot work permit and a confined space entry permit as examples of the layout.

2. Hazard Communication (1910.1200)

Where programs fall short. Missing or outdated written HazCom programs, SDSs not accessible to workers, container labelling gaps and inadequate training on GHS pictograms.

Prevention controls.

• One source-of-truth SDS library with automatic vendor update ingestion.
• Container labelling standard (primary + secondary) with QR codes that open the SDS on phones.
• Annual GHS refresher logged per worker with competency check.
• Pre-purchase chemical approval — no SDS, no purchase order.

Software workflow.

• Chemical Inventory Management (CIM) tied to an SDS library with version control (see chemical management software).
• Auto-generated secondary container labels printed at the workstation.
• Training matrix flags GHS overdue per role and per site.

3. Lockout/Tagout (1910.147)

Where programs fall short. No machine-specific energy control procedures (ECPs), inadequate periodic inspections (every 12 months), authorised vs affected vs other employee training gaps, group LOTO without proper accountability.

Prevention controls.

• ECP per machine, validated, posted at the point of work, and linked to the LOTO permit.
• Annual ECP audit by a different authorised employee with documented findings.
• Group LOTO board with primary authorised employee in writing.

Software workflow.

• Digital ECP library with QR codes on the machine that open the ECP and a LOTO checklist.
• Annual ECP audit scheduled and tracked per asset.
• Training matrix split by authorised / affected / other with auto-renewal.

4. Scaffolding — General Requirements (1926.451)

Where programs fall short. Improper access (no internal ladder or stair tower), missing toe-boards and mid-rails, scaffold not inspected by a competent person each shift, overloaded planks.

Prevention controls.

• Scaffold tag system — green / yellow / red — controlled by a competent person.
• Pre-shift inspection logged before any worker mounts the scaffold.
• Load rating posted at access point.

Software workflow.

• Scaffold register with tag status and inspector identity per scaffold.
• Pre-shift inspection drives a hard-stop on access if the tag is not green.

5. Ladders (1926.1053)

Where programs fall short. Damaged ladders left in service, incorrect angle (4:1 rule), use of step-ladders as straight ladders, missing three-points-of-contact rule.

Prevention controls.

• Coloured monthly inspection tag system with hard-stop removal of any failed ladder.
• Ladder asset register with unique IDs and inspection history.
• Workers trained and ticketed for ladder use, not just toolbox-talked.

Software workflow.

• QR-tagged ladder register with monthly inspection checklist on mobile.
• Defect reporting triggers immediate quarantine and replacement ticket.

6. Respiratory Protection (1910.134)

Where programs fall short. No written respiratory protection program, missing medical evaluations, no fit testing before first use or annually, employees using respirators voluntarily without Appendix D notification.

Prevention controls.

• Written program reviewed annually with site-specific hazard assessment per task.
• Medical clearance — fit test — training stacked as a mandatory sequence before issue.
• Cartridge change-out schedule based on contaminant, work rate and humidity, not vibes.

Software workflow.

• Per-worker respiratory record (medical, fit test, training) with expiry workflow.
• Task-based hazard assessment library aligned to NIOSH selection logic.
• Permits requiring respirators block issuance when any record is expired.

7. Powered Industrial Trucks (1910.178)

Where programs fall short. Operators not certified or evaluated every three years, pre-shift inspections not performed, modifications not approved by manufacturer, untrained pedestrians in traffic zones.

Prevention controls.

• Operator licence with theory, practical and site-specific evaluation, refreshed triennially.
• Pre-shift inspection enforced via key-control or telematics interlock.
• Pedestrian segregation engineered, not painted.

Software workflow.

• Operator competency record with expiry and refresher booking.
• Tablet-based pre-shift inspection that unlocks the truck on completion.
• Incident reporting captures near-misses and feeds traffic-management redesigns.

8. Fall Protection — Training Requirements (1926.503)

Where programs fall short. Workers trained on PFAS but no documented competency, training language not matched to workforce, no retraining after a change in equipment or a fall incident.

Prevention controls.

• Per-worker fall-protection competency with practical demonstration logged.
• Retraining trigger on equipment change, near-miss or incident.
• Multilingual content matching workforce demographics.

Software workflow.

• Training matrix with competency vs awareness distinction, evidence upload, multilingual content tags.
• Auto-trigger of retraining ticket on relevant incident category.

9. PPE — Eye and Face Protection (1926.102)

Where programs fall short. No documented eye-hazard assessment per task, wrong PPE class issued (e.g. Z87 vs Z87+), no enforcement at the work face, contractor crews not aligned to host site PPE matrix.

Prevention controls.

• Task-based PPE matrix published and enforced at site access.
• Eye-wash station inspection schedule with site map.
• Contractor inductions explicitly cover host site PPE matrix.

Software workflow.

• PPE matrix attached to each job hazard analysis, visible to contractors before mobilisation.
• Eye-wash inspection on a recurring checklist.

10. Machine Guarding (1910.212)

Where programs fall short. Guards removed for maintenance and not replaced, point-of-operation guards inadequate for the work, interlocks bypassed.

Prevention controls.

• Guard register per machine with photo of compliant state.
• Bypassed interlocks treated as a recordable near-miss with mandatory RCA.
• Maintenance work order auto-creates a post-maintenance guard verification step.

Software workflow.

• Guard register tied to CMMS/EAM with verification step on every relevant work order.
• Audit checklist for machine-shop walkthroughs feeds CAPA tracking.

Building an OSHA Top 10 prevention program

Stop treating each standard as an isolated project. The same five EHS software capabilities cover much of the prevention work for every entry on the list:

1. A training matrix with role-based requirements, evidence upload and expiry workflow.
2. An inspection library with mobile execution, photo capture and corrective-action routing.
3. A permit-to-work engine that hard-stops when a worker is not competent, inducted or medically cleared.
4. A contractor management platform so host-site standards apply to every crew on site (see our contractor management software 2026 guide).
5. Incident and observation reporting with root-cause analysis feeding back into the matrix.

Audit-ready evidence checklist

For each standard, this guide's own test is whether you can produce the following quickly during an OSHA visit (OSHA sets no ten-minute rule; pick a period you can meet):

• Written program with version history and review date
• Per-worker training records with competency demonstration
• Inspection records with photos and signed-off corrective actions
• Permit history with competency and medical verification
• Incident and near-miss records linked to standards and CAPAs

If any of these still lives in loose files that nobody reviews against the standard, an inspector will find the gap.

Questions to ask a vendor about Top 10 evidence

These apply to any product, and the answers are vendor claims until you see them in a demonstration on your own records. The site's pages on lockout/tagout software, SDS management software, PPE management software and fall protection software describe what the reviewed profiles document, without ranking them.

The capability map and the audit-trail and document-control study show how thinly some of these capabilities are documented across the reviewed profiles.

Frequently asked questions

Is the OSHA Top 10 a list of the most dangerous hazards? No. It counts violations cited after federal OSHA inspections, so it depends on which workplaces OSHA inspects as well as on how common each hazard is. OSHA publishes it so employers can find and fix hazards before an inspection.

Does OSHA publish the list by industry? OSHA's page points to a separate tool for the most cited standards by NAICS code. Use it to see whether your own industry's top standards differ from the all-industry list.

Is this list the same as the construction Focus Four? No. See the Focus Four guide, which also covers how the construction fall standards fit in.

Where do the glossary entries help? The entries for lockout/tagout, safety data sheets, PPE, the hierarchy of controls and CAPA give the terms used above, and the lockout/tagout guide goes into one of the ten in depth.

Do these figures cover state-plan states? No. The list and the penalty maximums above are federal OSHA's. State-plan states run their own programmes, so check yours.

Where to go next

• Best Safety Management Software — execution layer
• Permit-to-Work Software — high-risk work control
• Training Management Software — competency and refreshers
• Incident Management Software — leading and lagging indicators
• ISO 45001 Software — management-system alignment

The FY2026 list rewards the same employers the earlier lists did: those who industrialise the controls instead of relying on individual diligence.

Updated 4 October 2026: OSHA's own Top 10 page (full-year FY2025, updated 15 April 2026), the preliminary FY2026 slides, the Safety+Health report and OSHA's 2026 penalty memo were re-opened. The post now states that OSHA's own page still shows FY2025 and that the FY2026 list is preliminary, adds the preliminary counts and ranks, and replaces the "why it tops the list" paragraphs, which claimed citation drivers that the list does not provide, with notes labelled as this guide's reading of the standards. A vendor-question table and an FAQ were added.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Corrected 23 September 2026: the Top 10 list and section order now follow OSHA's preliminary FY2026 list as reported by the National Safety Council instead of a forecast, the penalty sentence gives OSHA's 2026 maximum penalties instead of an unsourced median, and an unsourced 80 percent figure was removed. The 16-year lead is now attributed to its source, OSHA's presentation slides are linked for the preliminary list, and an unsourced claim that these standards drive most citations was removed.