The OSHA 300 Log and 300A Forms: A Complete Recordkeeping Guide for 2026 June

Why the OSHA 300 log matters more than most paperwork

If your business has more than ten employees on payroll for any part of the year, federal recordkeeping rules expect a complete file every January 1. The osha 300 log sits at the center of that file. So does the 300A summary you'll post on the breakroom wall by February 1. Skip either form and you're looking at a citation that nobody wants on a clean compliance record.

Here's the part most safety managers learn the hard way. The 300 and 300A aren't interchangeable. One tracks individual cases. The other rolls them up into a single, signed annual summary that hangs visibly through April 30. Both fall under 29 CFR Part 1904, the recordkeeping standard. Both can trigger a knock at the door from an OSHA compliance officer if your numbers look off compared to your industry.

This guide walks through what each form is, who fills them out, when they're due, and how to file electronically through the Injury Tracking Application. We'll also cover privacy cases, exempted industries, and the fillable PDF versions you can grab today. Bookmark this — you'll come back to it every January.

The three forms that make up OSHA recordkeeping

People say "the 300 log" casually, but recordkeeping under 29 CFR 1904 actually uses three separate documents. They work together. Mess up one, and the others go sideways.

The Form 300 — Log of Work-Related Injuries and Illnesses is your running tally for the calendar year. Every recordable case lands here within seven days. A recordable case generally means medical treatment beyond first aid, days away from work, restricted duty, job transfer, loss of consciousness, or a significant diagnosis from a physician. Cuts treated with a bandage don't qualify. Lacerations needing stitches do.

The Form 300A — Annual Summary is what most workers actually see. You take your final 300 numbers from the prior year, total them by case type and outcome, and post the summary. It includes total hours worked and average annual employment so OSHA can calculate your incidence rate against industry benchmarks. A senior company official signs it. That signature isn't ceremonial — it's a legal certification.

The Form 301 — Injury and Illness Incident Report backs up every entry on the 300. Detailed write-up. Time, place, what the employee was doing, what happened, what got hurt, treatment. Many employers use their workers' comp first report of injury instead — that's allowed if it captures the same data. Keep these together with the 300 log. OSHA can ask for them within four business hours during an inspection.

Who actually has to keep these records

Two tests decide whether you're on the hook. First, employee count. If you had ten or fewer employees at all times during the previous calendar year, you're partially exempt — no need for 300, 300A, or 301 forms unless OSHA or the Bureau of Labor Statistics specifically requests them. That ten-employee threshold counts every worker on payroll at any point in the year, not just full-timers. Part-time, seasonal, and temporary workers all count. Independent contractors paid on a 1099 do not.

Second, industry. OSHA maintains a list of partially exempt industries under Appendix A to Subpart B of 1904. Most retail, finance, insurance, real estate, and certain service-sector NAICS codes don't have to keep the logs even with hundreds of employees. The exemption tracks the establishment, not the parent company. A corporate office might be exempt while the manufacturing plant down the road isn't. Look up your NAICS at the four-digit level — same NAICS prefix doesn't always mean same exemption status.

Here's the kicker — even exempt employers must still report any fatality within eight hours and any inpatient hospitalization, amputation, or loss of an eye within 24 hours. Recordkeeping exemption doesn't equal reporting exemption. Confused yet? You're not alone. The action plan for any covered employer should start with a quick check against the exemption list as part of any osha compliance review, then a confirmation of which establishments meet the employee count threshold.

Filling out the 300 log: what counts and what doesn't

An injury or illness goes on the log if it's work-related and meets at least one of the general recording criteria. Work-relatedness is broader than people think. If an event or exposure in the work environment caused or contributed to the condition, or significantly aggravated a pre-existing condition, you record it. Exceptions exist — eating lunch in the breakroom, the common cold, personal grooming — but the default is "record it" when in doubt.

The 300 has columns for case classification: days away from work, job transfer or restriction, other recordable. Pick one. The most serious outcome wins if a case progresses. A sprain that started as restricted duty but turned into three days off home becomes a days-away case.

You'll list the employee's name, job title, date, where the event happened, what the employee was doing, what happened, what part of the body was affected, and what the injury or illness was. Body part and event description matter for trend analysis. Vague entries like "back pain" or "fall" don't help your safety committee spot patterns. Specifics do — "lower back strain lifting 50 lb box from floor" tells the story.

The privacy cases nobody talks about until they have one

Some injuries shouldn't show the employee's name on the public-facing log. The privacy concern case list is short but important: injuries to intimate body parts or reproductive systems, sexual assaults, HIV infection, hepatitis or tuberculosis, needlestick injuries with contaminated sharps, and any case where the employee requests anonymity for an illness involving mental health. The standard at 1904.29(b)(7) spells out the exact list — no employer discretion to expand or shrink it.

For these cases, write "privacy case" on the 300 log in place of the employee's name. Keep a separate confidential list linking the case number to the employee's identity. Lock it up. Don't email it. Only share with people who genuinely need access — usually HR, the safety manager, and counsel. Even if a workers' comp claim is filed publicly with the state, your 300 log entry stays anonymous.

Get this wrong and you've created a HIPAA-adjacent problem on top of an OSHA one. A union grievance has been filed over less. Train whoever maintains the log on which conditions trigger the privacy rule before they have to use it. Many companies add a refresher to existing training programs to keep this current. Reactive learning is expensive learning. Some employers add a calendar reminder each year to re-train the recordkeeper, especially after turnover.

The 300A annual summary: posting rules that haven't changed

By February 1 each year, the 300A summary covering the prior calendar year must be posted in a conspicuous spot where employee notices normally appear. Breakroom bulletin board. Time clock area. Wherever your workforce actually looks. It stays up through April 30 — three full months minimum.

A company executive signs the 300A. Per the standard, that's an owner, an officer of the corporation, the highest-ranking company official at the establishment, or the immediate supervisor of that highest-ranking official. The signature certifies that the person has examined the 300 log and believes the summary is correct and complete. That's a lot of weight on a single line.

If you have multiple establishments, each gets its own 300A based on its own 300 log. Don't roll up corporate totals onto a single posted summary unless the facility is one establishment. OSHA defines establishment by physical location and economic activity, not by tax ID or org chart.

Electronic submission through the Injury Tracking Application

Most establishments with 250 or more employees, and certain high-hazard establishments with 20–249 employees, must also submit their 300A data electronically through the Injury Tracking Application (ITA) every year. The deadline is March 2. Miss it and citations start at Other-Than-Serious but climb fast if the lapse is willful or repeated.

Recent rule changes expanded the requirement. Starting with 2024 data submitted in 2025, employers in designated high-hazard industries with 100 or more employees at an establishment must also submit detailed Form 300 and 301 data — not just the 300A summary. That's case-level detail uploaded to OSHA's servers. The agency is publishing some of this data publicly under the new transparency rule.

To submit, create an account at osha.gov/ita. You'll need your establishment's NAICS code, address, and EIN. Upload a CSV file or enter data manually. The system validates against employee count ranges and flags obvious errors. Print or download a confirmation when you finish — that's your proof of filing if questions come up later.

Fillable PDFs, printable forms, and editable templates

OSHA hosts the official forms as free fillable PDFs at osha.gov/recordkeeping/forms. Form 300, Form 300A, and Form 301 are all available there. The fillable versions let you type directly into the PDF, save your progress, and print when ready. Spanish-language versions exist for both 300 and 300A — Form 300 en español and Form 300A en español — useful for bilingual workplaces.

Some employers prefer an Excel-based template instead. Several insurance carriers, trade associations, and EHS software vendors distribute editable spreadsheet versions that auto-calculate totals for the 300A. These are fine as equivalent records under 1904.29(b)(4) as long as the data captured is identical to the OSHA form. Don't skip required columns to save space.

Electronic recordkeeping systems work too. For employers who want their recordkeepers credentialed on the underlying rules, osha certification resources and free resources cover the recording criteria in detail. Most enterprise EHS platforms — Intelex, Cority, EHS Insight, VelocityEHS — have built-in 300/300A modules that handle case classification, post-injury workflows, and CSV export for ITA submission. Smaller shops often run on the OSHA PDF plus a shared spreadsheet. Both approaches are compliant. Pick what your team will actually maintain.

Common citations and how to avoid them

The most cited recordkeeping violations follow a depressing pattern year after year. Not maintaining the 300 log for the current year. Failing to post the 300A by February 1. Classifying recordable cases as first aid to keep the numbers down. Missing 301 incident reports. Not training employees on how to report injuries without fear of retaliation.

Retaliation matters more than most folks realize. Section 1904.35 protects an employee's right to report injuries. Drug-testing every reporting employee regardless of suspicion can be interpreted as retaliation. So can post-injury safety bonus programs that punish entire crews when one person reports. OSHA has cited employers under 11(c) anti-retaliation provisions for exactly these practices. Review your post-injury program before the next 300 entry.

A good osha compliance calendar helps. Quarterly review of recordable case classifications. December audit of the running 300 before year-end. January 1 reset and start of the new log. February 1 posting of the 300A. March 2 ITA submission. April 30 takedown of the posted summary, but five-year retention of the actual records.

Five-year retention and what to do with old logs

Keep the 300, 300A, and 301 forms — plus any equivalent records — for five years following the calendar year they cover. Logs from 2021 are still on file through end of 2026. Don't shred early. Inspectors and BLS surveys can request prior years during this window.

When an injury becomes worse, gets reclassified, or turns out to be unrelated to work, update the original log entry. Cross out incorrect data with a single line so the original remains legible. Initial the change. Required by 1904.33.

After five years, dispose of the paper or electronic records. Most employers archive digitally anyway. Workers' comp claims, civil litigation, and union grievances sometimes reach back further than OSHA's window. Cheap storage. Easy call.

State-plan states and where the rules differ

Twenty-two states plus Puerto Rico operate their own state plan OSHAs that cover private-sector employers. Six more cover state and local government only. State-plan rules must be at least as effective as federal, but several go further. California's Cal/OSHA, Washington's L&I, Michigan, Oregon — they all have additional reporting requirements, different posting rules, or expanded recordkeeping coverage.

California requires reporting any serious injury, illness, or death within eight hours, including remote work injuries that occur at a teleworking employee's home. Washington requires electronic submission from a broader range of industries than federal OSHA. Michigan has its own electronic system entirely separate from ITA.

If your business operates in a state-plan state, check the state agency's recordkeeping page before assuming federal rules apply uniformly. The 300 and 300A forms are the same, but the deadlines, submission methods, and additional reporting triggers can differ. A multi-state employer should keep a one-page cheat sheet of differences per state.

What inspectors actually look for during a recordkeeping audit

A compliance officer reviewing your records wants three things, fast. The current year's 300 log up to date through the last seven days. The signed prior-year 300A, still posted between February 1 and April 30. The supporting 301 reports for every case on the log.

They'll ask about classification on borderline cases. Why did this go on the log as "other recordable" rather than "days away"? Why is this one off the log entirely? Document classification calls in real time, with reference to General Recording Criteria at 1904.7 and the specific exceptions in 1904.5.

They'll also pull random employee names and ask whether all their work-related medical visits hit the log. That's where employers get caught. An ER visit treated as "first aid" shows up in workers' comp records but not on the 300. Mismatch. Citation. Train supervisors and your clinic to flag every work-related medical event.

Putting it all together: a yearly recordkeeping rhythm

Treat recordkeeping like payroll — predictable, scheduled, never improvised. Calendar reminders for the four critical dates: January 1 (new log opens), February 1 (300A posted), March 2 (ITA submission due), April 30 (300A comes down).

The 300 and 300A aren't compliance theater. The data they generate — incidence rates, body-part patterns, time-of-day clusters — is raw material for a serious safety program. Need to test your team's knowledge? Try a quick osha test.