US OSHA 2026: Electronic Recordkeeping and PSM Changes

Quick Facts

• Electronic recordkeeping: Under the final rule published on 21 July 2023 and effective 1 January 2024 (88 FR 47254), which amended 29 CFR 1904.41, establishments with 100+ employees in the industries listed in Appendix B to Subpart E submit Form 300 and 301 data annually via OSHA's Injury Tracking Application (ITA). The deadline for calendar-year 2025 data was 2 March 2026; OSHA lists 2 March 2027 for calendar-year 2026 data.
• PSM: 29 CFR 1910.119 remains the legal text. OSHA's modernisation rulemaking has no scheduled next step: the latest Unified Agenda (the 2026 Regulatory Plan, publication 202510) lists it as a long-term action with the next action undetermined, and a search of OSHA's Federal Register documents from June 2025 to 4 October 2026 found no proposed or final rule amending 1910.119 or 1904.41 (RIN 1218-AC82). OSHA's PSM Covered Chemical Facilities National Emphasis Program (CPL 03-00-021, January 2017) remains a current directive.
• EPA RMP: The 2024 Safer Communities by Chemical Accident Prevention final rule (89 FR 17622, 40 CFR Part 68) took effect on 10 May 2024, with most new compliance dates in 2027 and 2028. EPA proposed on 24 February 2026 to revise many of its provisions, and no final rule had been published by 4 October 2026 (91 FR 8970).
• State plans: Cal/OSHA, Oregon OSHA and Washington L&I, among other states, already enforce heat rules that federal OSHA has only proposed (its supplemental proposal is listed for December 2026), and California requires workplace violence prevention plans (details below).

The electronic recordkeeping rule, in 2026 reality

The 2023 rule expanded the ITA submission obligation. In 2026 you must:

1. Maintain Form 300, 300A and 301 (the glossary explains the OSHA 300 log) in the format defined by 29 CFR Part 1904.
2. Submit 300A annually if the establishment has 250+ employees and must keep OSHA records, or has 20–249 employees and is in an industry listed in Appendix A to Subpart E (1904.41(a)(1)).
3. Submit 300 and 301 annually if you have 100+ employees in industries listed in Appendix B to Subpart E (selected industries in agriculture, forestry and fishing, utilities, manufacturing, wholesale, retail, transportation and warehousing, consumer goods rental, waste, healthcare and social assistance, arts and recreation, accommodation and special food services; the only construction code listed is NAICS 2381, foundation, structure and building exterior contractors).
4. Include the establishment's legal company name in the submission (added under the 2023 rule; 1904.41(b)(10)).
5. Recognise that OSHA intends to post some of the submitted data on a public website after removing information that could identify individuals (88 FR 47254), so your incident data becomes public-facing.

That last point matters: once posted, the data can be read by customers, investors and rating providers, not only by OSHA.

Worked example: which establishments submit what?

The company below is invented. The test is applied per establishment, using the highest number of people employed at any time in the previous calendar year; 1904.41(b)(2) counts full-time, part-time, seasonal and temporary workers.

Two traps follow. A company with 10 or fewer employees all year is partially exempt, but the size test counts the whole company, so a small site of a large employer is not exempt on its own. And a headcount that rises above 250 in one busy month moves the establishment into the 300A group for that year. Check the industry code of each establishment against the appendices in 29 CFR Part 1904 Subpart E, or OSHA's coverage tool, before the 2 March deadline.

The Part 1904 basics behind the 300, 300A and 301

Electronic submission sits on top of the ordinary recordkeeping duties in 29 CFR Part 1904. The ones software has to get right:

• Who keeps records. A company with 10 or fewer employees at all times during the last calendar year is partially exempt, and so are establishments in the industries listed in Appendix A to Subpart B (1904.1, 1904.2). The size test counts the whole company, not the establishment. Partially exempt employers must still report fatalities and severe injuries to OSHA under 1904.39.
• What is recordable. A work-related new case that results in death, days away from work, restricted work or job transfer, medical treatment beyond first aid, or loss of consciousness, or a significant injury or illness diagnosed by a physician or other licensed health care professional (1904.7). The first-aid list in 1904.7(b)(5)(ii) is closed: treatment not on it is medical treatment.
• How fast. Each recordable case goes on the 300 Log and a 301 Incident Report within seven calendar days of receiving information that it occurred (1904.29(b)(3)).
• Privacy concern cases. For an injury or illness to an intimate body part or the reproductive system, from a sexual assault, mental illness, HIV infection, hepatitis or tuberculosis, a needlestick or sharps cut contaminated with another person's blood or other potentially infectious material, or another illness where the employee voluntarily asks, enter "privacy case" instead of the name and keep a separate confidential list of case numbers and names. The list is complete; no other case types qualify (1904.29(b)(6)–(8)).
• One log per establishment expected to operate for a year or longer; short-term establishments can share one log (1904.30).
• The annual summary. A company executive certifies the 300A (1904.32(b)(3)), and it is posted no later than 1 February of the following year and kept up until 30 April (1904.32(b)(6)).
• Retention and updating. Keep the 300 Log, the privacy case list, the 300A and the 301 forms for five years after the end of the year they cover, and update the stored 300 Logs for newly discovered cases and changes in classification during that period (1904.33).
• Severe-injury reports. Report a work-related fatality to OSHA within eight hours, and an in-patient hospitalisation, amputation or loss of an eye within 24 hours (1904.39).
• ITA deadline. Required submissions are due by 2 March of the year after the year the forms cover (1904.41).
• State plans. State-plan states must use the federal rules on which cases are recordable and how they are recorded; on other Part 1904 provisions, such as exemptions, severe-injury reporting and retention, their requirements can be stricter or supplemental (1904.37).

What "good" looks like for incident recordkeeping in 2026

• Single system of record for all OSHA-recordable injuries and illnesses, with the OSHA decision tree built in.
• Automatic 300/300A/301 generation with the right field mappings.
• API or CSV export to ITA in the OSHA-published schema (the ITA accepts web-form entry, CSV upload and API submission; OSHA).
• Clear DART, TCIR and severity calculation with definitions in the system.
• Privacy-protected fields for sensitive cases (sexual assault, mental illness, HIV, etc.) per 1904.29(b)(7).

This is exactly the workload that drives many US operators to dedicated incident management software and broader EHS platforms — see the vendor shortlist below for what our research documents about each product.

PSM in 2026: the rule hasn't changed

OSHA's modernisation of 1910.119 is still at the pre-rule stage. It completed a SBREFA panel report in 2016 and held a stakeholder meeting in October 2022, and the 2026 Unified Agenda lists it as a long-term action with no scheduled next step (RIN 1218-AC82). The current standard already sets specific triggers and intervals for these elements:

• Mechanical integrity (MI): written procedures, inspection and testing of process equipment, and correction of equipment deficiencies (1910.119(j)).
• Operating procedures must reflect current operating practice, and the employer must certify annually that they are current and accurate (1910.119(f)(3)).
• Management of Change (MoC) needs written procedures (1910.119(l)), and a modification significant enough to change process safety information needs a pre-startup safety review (PSSR) (1910.119(i)).
• Process Hazard Analysis (PHA) revalidation at least every five years (1910.119(e)(6)).
• Compliance audits at least every three years, with a documented response to each finding and documented correction of deficiencies (1910.119(o)).

If you operate above PSM threshold quantities, the practical 2026 stack is:

EPA RMP — what changed and what to do

The Safer Communities rule (final 2024, codified at 40 CFR Part 68) tightens RMP duties for Program 2 and Program 3 facilities, especially around:

• Safer Technologies and Alternatives Analysis (STAA) for Program 3 processes in NAICS 324 (petroleum and coal products) and 325 (chemical manufacturing) (40 CFR 68.67).
• Third-party compliance audits after an RMP-reportable accidental release (40 CFR 68.58(f)).
• Root cause analysis in incident investigations.
• Employee participation broadened.
• Information availability to communities and emergency responders.

Compliance dates stage from 15 March 2027 (emergency response field exercises) through 10 May 2027 (STAA, third-party audits, root cause analysis, employee participation, information availability) to 10 May 2028 (updated risk management plans) (40 CFR 68.10(g)–(i)). EPA's February 2026 proposal would change many of these provisions, including STAA, third-party audits and employee participation (the proposal also states EPA would rescind the stop work authority provision at 40 CFR 68.83(d); see the stop work authority guide) (91 FR 8970). Its comment period closed on 11 May 2026 (91 FR 16621), and no final rule had been published when this post was corrected.

Heat illness, workplace violence and other state moves

Federal OSHA proposed a heat injury and illness prevention standard on 30 August 2024, OSHA held informal hearings from 16 June to 2 July 2025 and extended the post-hearing comment period to 30 October 2025, and the Unified Agenda lists a supplemental proposal for December 2026 and final action for October 2027 (RIN 1218-AD39). See also the heat stress programme guide and heat stress management software. Cal/OSHA (outdoor, 8 CCR 3395; indoor, 8 CCR 3396), Oregon OSHA and Washington L&I (WAC 296-62-095) already have enforceable heat rules. In California, health care employers must keep a workplace violence prevention plan under 8 CCR 3342, and SB 553 extended a plan requirement to most other employers from 1 July 2024 (Labor Code 6401.9).

Practically this means your EHS platform needs:

• Heat exposure module (WBGT logging, acclimatisation tracking).
• Workplace violence reporting with privacy controls.
• Multi-jurisdiction config so a national operator can apply CA rules in CA and OR rules in OR without forking the system.

Connecting US OSHA data to ESG and CSRD-equivalent disclosures

US subsidiaries of EU CSRD-in-scope groups may be asked to supply the group's ESRS health and safety metrics (disclosure requirement S1-14 in Delegated Regulation (EU) 2023/2772; S1-13 in the revised ESRS adopted as Delegated Regulation (EU) 2026/1563, which applies to financial years beginning on or after 1 January 2027). Which groups report is set by the CSRD as amended by Directive (EU) 2026/470. Under S1-13 of the revised text, the undertaking discloses:

• the share of its own workforce covered by an occupational safety and health management system;
• fatalities from recordable work-related accidents among its own workforce and workers on its sites, and fatalities from recordable work-related ill health among employees;
• the number and rate of recordable work-related accidents for its own workforce, and for employees the cases of recordable ill health and days lost, with non-employees added where the workforce topic is assessed as material.

Two differences from US practice matter for the data model. The rate is cases per 1,000,000 hours worked (application requirement AR 25), not per the 200,000 hours behind OSHA-style TRIR and DART figures. And the ESRS glossary calls an accident recordable if it results in death or more than three days of absence from work, which is a different test from the OSHA recording criteria; the revised text lets an undertaking use a national definition if it discloses that fact. A US site therefore needs both counts, with the definition stored beside each. The TRIR guide and the TRIR and LTIFR calculator cover the OSHA-style rate, and the glossary defines TRIR and LTIFR.

The cleanest pattern is a single incident system with categorisation tags that map to OSHA forms, RMP / PSM categories and ESRS data points simultaneously. See our ESRS implementation guide and the double materiality guide.

Questions to ask a vendor about recordkeeping and PSM evidence

The site does not rank products. The product records show what each vendor documents on its pages, which is not proof of how a feature behaves with your data. Put the same questions to every vendor:

1. Does the product generate the 300 Log, 300A and 301 from one case record, and can you see the recordability decision and the first aid or medical treatment finding behind each entry?
2. Does it hold the privacy case list separately, with restricted access?
3. How does it submit to the ITA: CSV file, API, or manual web form, and does it map the legal company name and establishment codes?
4. What happens when a case is reclassified in year three of the five-year retention period: is the old version kept?
5. Can establishment headcount and peak employment be tracked, so coverage under 1904.41 can be tested each year?
6. For PSM, can a single MoC record link to the PHA recommendation, the pre-startup review and the revised operating procedure?
7. Can the same incident carry both an OSHA recordable flag and an ESRS recordable flag, with each definition stored?

See the capability map for what the researched profiles document, the demo checklist for a live-session script, and the glossary entries for PSM and management of change for the terms.

Evaluate US recordkeeping and PSM workflows

Use the incident management comparison to test establishment-level record permissions, an amended case and the corresponding export. For a PSM process, evaluate process safety management and management of change separately; a recordkeeping module does not establish coverage of every PSM element.

Demonstrate one scenario with the exact modules, mobile access and interfaces included in the quote. Use the linked comparison’s published inclusion rule and the same evidence checks for every qualifying product. Sponsored placements are additional and labelled; commercial status does not determine organic eligibility.

Correction, 27 September 2026: this section previously said commercial partners were never listed. Organic eligibility follows the same evidence rule for all products. The authored shortlist has been replaced with evaluation tasks.

A practical 90-day plan for US operators

Days 0–30 — Diagnose

• Confirm which establishments are in the Appendix B list and their headcounts.
• Pull last 3 years of OSHA 300 logs into one consolidated view.
• Score yourself against the Chemical NEP inspection prompts (see the OSHA NEP glossary entry).
• For RMP-regulated sites, check STAA applicability.

Days 31–60 — Consolidate

• Move OSHA recordkeeping to a system that auto-generates 300/300A/301 and exports to ITA.
• Stand up MoC + PSSR + PHA action tracking in a single platform.
• Move permit-to-work to digital if still on paper.
• Add a heat illness module if you operate in CA, OR, WA, or where federal rule lands.

Days 61–90 — Evidence

• Run a mock OSHA Chemical NEP inspection.
• Pre-publish your TRIR and DART internally with definitions.
• Bake the OSHA + RMP dashboard into monthly management review.
• For multi-national groups, share the dataset with the sustainability team for ESRS work.

What to avoid in 2026

• Reconsider maintaining 300 logs in spreadsheets. Part 1904 allows computer records, and the ITA accepts web forms, CSV upload and API submission, so a spreadsheet can work; the risk is inconsistent classification and version control across establishments, which a single system of record reduces.
• Avoid separating PSM and EHS. Incident investigation, contractors and MoC are PSM elements (1910.119(m), (h) and (l)) and everyday EHS processes at the same time.
• Avoid running MoC in email. 1910.119(l) requires written procedures that address the technical basis, safety and health impact, procedure changes, time period and authorisation for each change.
• Do not overlook contractors. 1910.119(h) requires you to evaluate a contractor's safety performance and programs when selecting it and to inform contract employers of the process hazards.
• Avoid treating ESG data as separate. Your incident dataset can feed it.

Final word

For the wider software picture in the United States, see our US QHSE software guide, and for the standards OSHA cites most often, the OSHA Top 10 citations playbook.

In 2026 US operators submit injury data electronically, can expect OSHA to post some of it publicly, and answer to OSHA, EPA and state rules at the same time. The fastest way to meet those expectations is consolidating recordkeeping, MoC, PtW, PHA and contractor control onto fewer, better-connected platforms — and exposing the result through dashboards that satisfy OSHA, EPA, your insurers, your investors and your communities at the same time.

Frequently asked questions

Is the 2 March ITA deadline the same every year?

Yes, 1904.41(c) sets 2 March of the year after the calendar year covered by the forms. OSHA lists 2 March 2027 for calendar-year 2026 data. OSHA also says establishments that miss the deadline must still submit, and its page states that late submissions are accepted through 31 December.

Is the PSM standard being rewritten in 2026?

Not as of 4 October 2026. The modernisation item (RIN 1218-AC82) is a long-term action with no next step set, and 29 CFR 1910.119 is unchanged.

Do the EPA's 2024 RMP requirements still apply?

The 2024 rule is in the Code of Federal Regulations with compliance dates in 2027 and 2028 (40 CFR 68.10). EPA proposed on 24 February 2026 to revise many provisions; no final rule had been published by 4 October 2026. Re-check the Federal Register before you plan to a date.

Sources

• Federal Register, Improve Tracking of Workplace Injuries and Illnesses, final rule, 88 FR 47254 (21 July 2023)
• eCFR, 29 CFR Part 1904, including 1904.29, 1904.41 and Subpart E appendices
• OSHA, Injury Tracking Application (ITA)
• eCFR, 29 CFR 1910.119, process safety management
• Reginfo.gov, 2026 Unified Agenda entries for RIN 1218-AC82 (process safety management) and RIN 1218-AD39 (heat injury and illness prevention)
• OSHA, PSM Covered Chemical Facilities National Emphasis Program, CPL 03-00-021
• Federal Register, Safer Communities by Chemical Accident Prevention, final rule, 89 FR 17622 (11 March 2024), Common Sense Approach to Chemical Accident Prevention, proposed rule, 91 FR 8970 (24 February 2026) and comment period extension, 91 FR 16621
• eCFR, 40 CFR Part 68, including 68.10, 68.58 and 68.67
• California Code of Regulations, Title 8, section 3342, section 3395 and section 3396; California Labor Code section 6401.9
• Oregon OSHA, Heat illness prevention; Washington State, WAC 296-62-095, outdoor heat exposure
• EUR-Lex, Delegated Regulation (EU) 2023/2772 (ESRS) and Delegated Regulation (EU) 2026/1563 (revised ESRS)

Revised 4 October 2026: the ITA coverage rules (1904.41 and Appendix B), the recording criteria, the 1904.29, 1904.32, 1904.33 and 1904.39 duties, the PSM agenda entry, the RMP compliance dates in 68.10, the proposed 68.83(d) rescission and the heat rulemaking status were re-checked against eCFR, the Federal Register, reginfo.gov and osha.gov. The ESRS paragraph references for the original standard could not be re-verified and were replaced with the revised ESRS S1-13 text, which was; the excerpt no longer calls the RMP rules "tightened"; absolute "stop doing" advice was softened; and a coverage example, vendor questions and an FAQ were added.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts.

Updated 24 September 2026: merged the sourced sections of OSHA Recordkeeping Software: 300, 300A, 301 Forms Made Simple.