OSHA 300, 300A and 301: what must be recorded, posted and kept in the United States

This page describes the federal requirements in 29 CFR Part 1904: what each form holds, the deadlines that govern them, what a company executive is actually certifying when they sign, how long the records survive and who is exempt. It describes the regulation. It is not legal advice and does not tell any particular employer what to do.

Why are there three forms and not one?

Because the same event has to answer three different questions, and no single document answers all three well.

29 CFR 1904.29(a) names all three and requires employers to use them, or equivalent forms, for recordable injuries and illnesses. The regulation gives each its full title: the OSHA 300 is the Log of Work-Related Injuries and Illnesses, the 300-A is the Summary of Work-Related Injuries and Illnesses, and the OSHA 301 is the Injury and Illness Incident Report.

The 301 answers what happened to this person. The 300 answers what happened at this establishment this year. The 300A answers how much, in a number a stranger can read from a noticeboard. Each is a compression of the one before it, and compression only runs one way. A 300A can always be rebuilt from a complete set of 301s. A thin 301 cannot be rebuilt from anything at all.

An employer may substitute its own paperwork. Under 1904.29(b)(4) an equivalent form is “one that has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces”, and the same paragraph notes that many employers use an insurance form in place of the OSHA 301. Records may be kept on a computer under 1904.29(b)(5), provided the system can produce the equivalent forms when they are needed.

That substitution clause is the quiet one. It means the OSHA 301 is frequently not a form anybody fills in, but a by-product of whatever the employer already uses to open a claim.

What is the seven day clock actually measuring?

Not how fast somebody types. How fast the event reaches the person who keeps the records.

Under 1904.29(b)(3) an employer must enter each recordable case on the 300 Log and the 301 Incident Report within seven calendar days of receiving information that a recordable injury or illness has occurred. The clock starts on the organisation receiving information, not on a manager sitting down to write.

Seven days is generous for the writing and tight for everything before it. In a business with shift patterns, subcontractors and multiple sites, most of that week is consumed by the event travelling from the person who saw it to the person who is accountable for the log. The recording deadline is therefore a test of internal reporting, not of administration, and an employer who misses it has usually not been slow with the paperwork. They have been slow to find out.

What does a company executive actually certify?

Not the arithmetic. The regulation asks them to vouch for how the numbers were produced.

Under 1904.32(b)(3) a company executive must certify that they have examined the OSHA 300 Log and that they reasonably believe, “based on his or her knowledge of the process by which the information was recorded”, that the annual summary is correct and complete.

Read that clause carefully, because it is doing something unusual. It does not ask the signatory to re-check the cases. It asks what they know about the process. A senior executive at a multi-site business cannot personally verify that a laceration in March was correctly classified, and OSHA has not asked them to. What is being certified is the reliability of the capture, and the totals are merely the visible output of it.

Paragraph (b)(4) then narrows who may sign to exactly four people: an owner of the company, but only where it is a sole proprietorship or partnership; an officer of the corporation; the highest ranking company official working at the establishment; or the immediate supervisor of that highest ranking official. A safety manager cannot sign unless they also hold one of those positions.

Putting the signature that high, and tying it to knowledge of the process rather than to the figures, tells you what the regulation is really regulating. Part 1904 looks like a filing requirement and behaves like a reporting-system requirement.

When must the summary be posted, and where?

Section 1904.32(b)(6) sets a three month window: the 300A must be posted no later than February 1 of the year following the year it covers, and kept in place until April 30.

Where it goes is prescribed too. Under 1904.32(b)(5) a copy must be posted in each establishment, in a conspicuous place or places where notices to employees are customarily posted, and the employer must ensure it is not altered, defaced or covered by other material. A multi-site business therefore posts a separate summary at every establishment rather than one at head office.

This is the only moment in Part 1904 when the year’s recordkeeping becomes visible to the workforce that generated it. Failing to do it carries its own penalty line: Section 1903.15(d)(6) provides that the penalty for a posting violation under section 17(i) of the Act shall not exceed $16,550, for penalties proposed after January 15, 2025.

How long must the records be kept, and what do five years actually preserve?

Section 1904.33(a) requires employers to save the OSHA 300 Log, the privacy case list if one exists, the annual summary and the 301 Incident Reports for five years following the end of the calendar year the records cover.

The clock runs from the end of the year, not from the injury. A case from March 2026 and a case from November 2026 are both held until the end of 2031.

Storage is not passive. Under 1904.33(b)(1) stored 300 Logs must be updated during the five years to include newly discovered recordable cases and any reclassification of an existing one, with the original entry removed or lined out and the new information entered. The 300A and the 301 are treated differently: paragraphs (b)(2) and (b)(3) confirm that neither has to be updated, though an employer may.

That asymmetry is worth noticing. The log is a living document and the incident report is a snapshot. Five years on, the 300 Log reflects everything the employer has since learned, and the 301 reflects only what was known within seven days of the event. The regulation preserves the correction and freezes the account.

Who is exempt, and what does exemption not cover?

There are two partial exemptions, and both are partial in the same way.

Section 1904.1 exempts companies with ten or fewer employees at all times during the last calendar year. The test looks at the whole company rather than a single site, and uses peak employment, so a business that briefly rose to eleven does not qualify.

Section 1904.2 exempts establishments in an industry group listed in appendix A to subpart B, a NAICS-based list of lower hazard sectors. It is applied establishment by establishment, so one company can have some sites keeping records and others not.

Neither exemption switches off the duty to report a serious event. Both sections state that all employers covered by the OSH Act must still report any work-related incident resulting in a fatality, an in-patient hospitalization, an amputation or the loss of an eye, under 1904.39. Both also give way to a written request under 1904.41 or 1904.42, at which point an exempt employer must keep records.

Exemption is therefore from the routine paperwork, never from the serious event. The distinction between recording and reporting is where most of the confusion in this area lives, and it is set out in full on our page on recordable or reportable.

Which employers must also submit the data electronically?

Posting on a noticeboard and filing with OSHA are separate obligations. Section 1904.41 creates three routine categories. Establishments with 20 to 249 employees in an industry listed in appendix A to subpart E, and establishments with 250 or more employees that are required to keep records, submit 300A information. Establishments with 100 or more employees in an industry listed in appendix B to subpart E submit information from Forms 300 and 301 as well.

The deadline is fixed at 1904.41(c): submission by March 2 of the year after the calendar year the forms cover.

Head counts include everyone. Under 1904.41(b)(2) each individual employed at the establishment at any time during the calendar year counts as one, including full-time, part-time, seasonal and temporary workers. Not every field travels: 1904.41(b)(9) strips employee names, and on Form 301 the address and treating clinician details as well. The requirements apply in State Plan states too, under 1904.41(b)(7).

Who else can ask to see the forms?

Employees can, and the response times are short.

Under 1904.35(b)(2)(iii) an employee, former employee, personal representative or authorized employee representative who asks for a copy of the current or stored 300 Log for an establishment the employee worked in must be given it by the end of the next business day.

An employee asking for the 301 describing their own injury must also receive it by the end of the next business day under 1904.35(b)(2)(v)(A), while an authorized employee representative acting under a collective bargaining agreement receives a redacted version within seven calendar days. First copies cannot be charged for, under 1904.35(b)(2)(vi).

Names stay on the log when it is released. Paragraph (b)(2)(iv) requires names to be left on the 300, with privacy protected instead through the privacy concern case mechanism in 1904.29.

The next-business-day standard is the sharpest operational line in Part 1904. A request can arrive at any time, for records going back five years, and the answer is due tomorrow. That is only survivable if the records were complete when they were made.

How this relates to the United Kingdom

There is no British equivalent of the 300 Log. The nearest UK duties are split between RIDDOR, which requires certain injuries to be reported to the regulator and the record kept for three years, and the accident book, which records the event locally. Neither produces an annual posted summary and neither carries a certification requirement.

We cover those separately in RIDDOR explained and the accident book as claim evidence.

Frequently asked questions

Sources

• 29 CFR 1904.29, forms and recording deadline: https://www.ecfr.gov/current/title-29/section-1904.29
• 29 CFR 1904.32, annual summary, posting and certification: https://www.ecfr.gov/current/title-29/section-1904.32
• 29 CFR 1904.33, retention and updating: https://www.ecfr.gov/current/title-29/section-1904.33
• 29 CFR 1904.41, electronic submission: https://www.ecfr.gov/current/title-29/section-1904.41
• 29 CFR Part 1904, exemptions and access provisions: https://www.ecfr.gov/current/title-29/part-1904
• 29 CFR 1903.15, penalty amounts: https://www.ecfr.gov/current/title-29/section-1903.15

Last reviewed: 16 September 2026

About Logincident. Logincident is a data and software company whose configurable platform captures structured evidence at source through a mobile app, forms, photographs, GPS and offline capture, and presents it in dashboards and reports. We are not a law firm or a claims handler, and nothing on this page is legal advice.