US OSHA in 2026: Electronic Recordkeeping, PSM Modernisation and the Software Stack You Need

Quick Facts

• Electronic recordkeeping: Under the 2024 final rule amending 29 CFR 1904.41, establishments with 100+ employees in designated high-hazard industries submit Form 300, 300A and 301 data annually via the Injury Tracking Application (ITA). The 2026 cycle for CY2025 data closed 2 March 2026.
• PSM: 29 CFR 1910.119 remains the legal text. Modernisation has not been finalised, but enforcement direction under the Chemical National Emphasis Program (NEP) is sharper than ever.
• EPA RMP: The 2024 Safer Communities by Chemical Accident Prevention final rule (40 CFR Part 68) is in effect; key compliance deadlines stage through 2026 and 2027.
• State plans: California (Cal/OSHA), Michigan, Oregon, Washington and others continue to push beyond federal minimums, especially on heat illness and workplace violence prevention.

The 2024 electronic recordkeeping rule, in 2026 reality

The expanded ITA submission obligation is the most operationally disruptive recent OSHA change for many EHS teams. In 2026 you must:

1. Maintain Form 300, 300A and 301 in the format defined by 29 CFR Part 1904.
2. Submit 300A annually (all establishments ≥250 employees, plus designated industries 20–249).
3. Submit 300 and 301 annually if you have 100+ employees in industries listed in Appendix B to Subpart E (manufacturing, construction, healthcare, transportation, retail, agriculture and others).
4. Include the establishment's legal company name in the submission (added under the 2024 rule).
5. Recognise that OSHA intends to publish establishment-level data — your incident data is now public-facing.

That last point matters. Public-facing OSHA data feeds into ESG ratings, customer scorecards and CSRD-equivalent disclosures for US subsidiaries of EU groups.

What "good" looks like for incident recordkeeping in 2026

• Single system of record for all OSHA-recordable injuries and illnesses, with the OSHA decision tree built in.
• Automatic 300/300A/301 generation with the right field mappings.
• API or CSV export to ITA in the OSHA-published schema.
• Clear DART, TCIR and severity calculation with definitions in the system.
• Privacy-protected fields for sensitive cases (sexual assault, mental illness, HIV, etc.) per 1904.29(b)(7).

This is exactly the workload that drives many US operators to dedicated incident management software and broader EHS platforms — see our OSHA recordkeeping software guide for vendor-by-vendor capability.

PSM in 2026 — the rule hasn't changed, the enforcement has

OSHA opened modernisation of 1910.119 through SBREFA in 2024. As of 2026 a final rule has not landed. But enforcement under the Chemical NEP is sharper:

• Mechanical integrity (MI) continues to dominate citations.
• Operating procedures that don't match field reality are heavily cited.
• Management of Change (MoC) that misses pre-startup safety review (PSSR) is a frequent finding.
• Process Hazard Analysis (PHA) revalidation at the 5-year mark is non-negotiable.
• Compliance audits every 3 years with documented closure of findings is non-negotiable.

If you operate above PSM threshold quantities, the practical 2026 stack is:

EPA RMP — what changed and what to do

The Safer Communities rule (final 2024, codified at 40 CFR Part 68) tightens RMP duties for Program 2 and Program 3 facilities, especially around:

• Safer Technologies and Alternatives Analysis (STAA) for certain NAICS sectors.
• Third-party compliance audits after a regulated incident.
• Root cause analysis for accidental releases.
• Employee participation broadened.
• Information availability to communities and emergency responders.

Compliance dates stage from May 2025 through May 2027 depending on element. If you have not started a STAA programme, that is the priority for 2026.

Heat illness, workplace violence and other state moves

Federal OSHA's heat illness rulemaking is in process; Cal/OSHA, Oregon OSHA, Washington L&I and others already have enforceable heat standards. Healthcare workplace violence prevention plans are mandatory in California (SB 553 broadened), New York and others.

Practically this means your EHS platform needs:

• Heat exposure module (WBGT logging, acclimatisation tracking).
• Workplace violence reporting with privacy controls.
• Multi-jurisdiction config so a national operator can apply CA rules in CA and OR rules in OR without forking the system.

Connecting US OSHA data to ESG and CSRD-equivalent disclosures

US subsidiaries of EU CSRD-in-scope groups must feed:

• TRIR / DART / fatality counts to ESRS S1 (own workforce).
• Process safety events (Tier 1 / Tier 2) to ESRS E2 / S1.
• Incidents involving contractors to ESRS S2 (workers in the value chain).

The cleanest pattern is a single incident system with categorisation tags that map to OSHA forms, RMP / PSM categories and ESRS data points simultaneously. See our CSRD readiness checklist and the double materiality guide.

Vendor shortlist for US operators

Our editorial team's working shortlist for US operators (alphabetical):

• Cority — strong recordkeeping, OSHA forms, NA enterprise depth.
• Enablon — heritage in oil & gas and chemicals PSM.
• Intelex — broad EHS, strong audit and recordkeeping.
• SafetyCulture — frontline inspections and observations.
• Sphera — operational risk and PHA depth.
• Tekmon — strong field execution, permit-to-work and contractor control.
• VelocityEHS — chemical management and OSHA recordkeeping focus.

Compare any two side-by-side using our comparison engine, or take the Get Matched quiz for a tailored shortlist.

A practical 90-day plan for US operators

Days 0–30 — Diagnose

• Confirm which establishments are in the Appendix B list and their headcounts.
• Pull last 3 years of OSHA 300 logs into one consolidated view.
• Score yourself against the Chemical NEP inspection prompts.
• For RMP-regulated sites, check STAA applicability.

Days 31–60 — Consolidate

• Move OSHA recordkeeping to a system that auto-generates 300/300A/301 and exports to ITA.
• Stand up MoC + PSSR + PHA action tracking in a single platform.
• Move permit-to-work to digital if still on paper.
• Add a heat illness module if you operate in CA, OR, WA, or where federal rule lands.

Days 61–90 — Evidence

• Run a mock OSHA Chemical NEP inspection.
• Pre-publish your TRIR and DART internally with definitions.
• Bake the OSHA + RMP dashboard into monthly management review.
• For multi-national groups, share the dataset with the sustainability team for ESRS work.

What to stop doing in 2026

• Stop maintaining 300 logs in Excel. OSHA's ITA expects clean, structured data — and your auditors expect a system of record.
• Stop separating PSM and EHS. An integrated SMS is now the operating expectation.
• Stop running MoC in email. It is the single most common PSM citation pattern.
• Stop ignoring contractors. US contractor fatalities continue to dominate process industry incident statistics.
• Stop treating ESG data as separate. Your incident dataset feeds it.

Final word

US regulators in 2026 expect digital evidence, public-facing data quality and integration across EHS, PSM and RMP. The fastest way to meet those expectations is consolidating recordkeeping, MoC, PtW, PHA and contractor control onto fewer, better-connected platforms — and exposing the result through dashboards that satisfy OSHA, EPA, your insurers, your investors and your communities at the same time.