Here is a fact that will ruin your Tuesday morning: there is no single "OSHA" in the United States.
There are, depending on how you count, somewhere between one and twenty-eight OSHAs. Some states run their own programs. Some piggyback on the federal version. Some do both, depending on whether the employer is public or private. And every last one of them has inspectors with badge numbers, clipboards, and the legal authority to shut your operation down before lunch.
If you run a business in one state, you can probably muddle through. If you operate across state lines — and an increasing number of SMBs do, especially with remote workers — you are playing a regulatory board game where the rules change every time you cross a border.
Nobody tells you this when you incorporate. Nobody warns you at the chamber of commerce mixer. You find out when an inspector shows up, cites you under a standard you have never heard of, and hands you a penalty that makes your accountant weep.
Let me walk you through the entire map.
The Three Jurisdiction Types
Every state falls into one of three categories. Understanding which category your state occupies is not optional — it is the first thing you need to know before you spend a single dollar on compliance.
Federal OSHA States (29 States)
These states have no approved state plan for private-sector employers. Federal OSHA runs the show — their inspectors, their standards, their penalties. The federal agency conducts inspections, issues citations, and collects fines directly.
The 29 federal OSHA states: Alabama, Alaska (private sector only), Arkansas, Colorado, Connecticut (private sector only), Delaware, Florida, Georgia, Idaho, Illinois (private sector only), Kansas, Louisiana, Maine (private sector only), Massachusetts, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey (private sector only), New York (private sector only), North Dakota, Ohio, Oklahoma, Pennsylvania, Rhode Island, South Dakota, Texas, West Virginia, and Wisconsin.
If you are in one of these states, you answer to the federal Area Office. Your standards are 29 CFR 1910 (General Industry) and 29 CFR 1926 (Construction). Your maximum penalty for a willful violation is $163,939 per instance, adjusted annually for inflation.
That is the simple version. It gets worse.
State Plan States (22 States + Territories)
These states operate their own OSHA programs that cover both private and public sector employees. To get approved, they had to demonstrate that their standards are "at least as effective as" federal OSHA. In practice, many of them are significantly stricter.
The state plan states: Alaska (public sector), Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming.
California's Cal/OSHA is the poster child. They have standards that go far beyond federal requirements — heat illness prevention, workplace violence prevention (SB 553), aerosol transmissible diseases, indoor heat. Their penalties are often higher. Their inspectors are often more aggressive. And their appeals process is its own special circle of regulatory purgatory.
Oregon OSHA runs its own program with additional agricultural safety standards. Washington's L&I division enforces standards on ergonomics that federal OSHA abandoned years ago. Michigan OSHA has unique construction standards.
The critical point: in a state plan state, you must comply with state standards even when they exceed federal requirements. You cannot cite federal OSHA and argue that you are in compliance when the state standard is stricter. The state wins.
Hybrid States (6 States)
These are the ones that cause the most confusion. Six states and territories operate state plans that cover only public sector employees, while federal OSHA retains jurisdiction over private sector employers.
The hybrid states: Connecticut, Illinois, Maine, New Jersey, New York, and the Virgin Islands.
If you are a private employer in New York, federal OSHA is your regulator. If you are a public employer — a city, a school district, a state agency — New York's Public Employee Safety and Health (PESH) bureau is your regulator. Different inspectors. Different procedures. Sometimes different standards.
This matters enormously for contractors who work on both private and public projects. You might literally be subject to different regulatory frameworks depending on which job site you are standing on today.
The Stricter States: Where Compliance Gets Expensive
Not all OSHA jurisdictions are created equal. Some states have earned reputations for aggressive enforcement, stricter standards, or both. If you operate in these states, your compliance baseline is higher than the national average.
California (Cal/OSHA)
The undisputed heavyweight champion of workplace safety regulation. Cal/OSHA maintains standards in areas where federal OSHA has nothing:
- **SB 553 Workplace Violence Prevention** — Requires a written WVPP, training, violent incident logs, and annual plan review for virtually all employers. Federal OSHA has no equivalent general industry standard.
- **Heat Illness Prevention** — Mandatory shade, water, rest breaks, and emergency response plans when temperatures exceed 80 degrees. Federal OSHA relies on the General Duty Clause.
- **Indoor Heat** — Cal/OSHA finalized indoor heat illness prevention standards that apply to warehouses, kitchens, laundries, and other high-heat indoor environments.
- **Aerosol Transmissible Diseases** — A comprehensive standard that goes far beyond federal bloodborne pathogens requirements.
Cal/OSHA penalties can exceed federal maximums. Their inspectors have a reputation for thoroughness that borders on the forensic.
Washington State (L&I)
Washington's Department of Labor and Industries enforces ergonomic standards that federal OSHA proposed and then abandoned under political pressure in 2001. Washington kept them. If you have workers performing repetitive tasks, heavy lifting, or awkward postures, Washington holds you to a standard that does not exist anywhere else in the country.
Oregon OSHA
Oregon runs a particularly active program with emphasis on agricultural safety, forestry, and heat-related illness. They adopted permanent heat rules before federal OSHA finalized its own proposal.
Minnesota OSHA
Minnesota maintains a well-funded state program with inspection rates that consistently exceed the national average. They inspect more frequently, and they follow up more aggressively.
Virginia (VOSH)
Virginia was one of the first states to adopt an Emergency Temporary Standard for COVID-19, moving months ahead of federal OSHA. Their willingness to act fast on emerging hazards sets them apart.
Enforcement Data: What the Numbers Actually Tell You
Most compliance guides stop at listing the states. That is like handing someone a map without contour lines. You can see where the borders are, but you have no idea where the cliffs are.
Enforcement data tells you where the cliffs are.
Federal OSHA conducts roughly 32,000 inspections per year. State plan states collectively conduct another 42,000 to 50,000. The total inspection volume has been declining for years — fewer inspectors, larger jurisdiction — which means every inspection that does happen is conducted by someone who is not wasting their time on random drive-bys. They are there because a complaint was filed, an injury was reported, or your industry is on the emphasis program list.
**Penalty severity varies wildly by jurisdiction.** The same violation — say, an unguarded floor hole — might generate a $4,000 serious citation in one state and a $16,000 citation in another. Willful violations can range from $11,000 to $163,939 per instance. The variance is not random. It correlates with:
- State funding levels for enforcement agencies
- Political environment and regulatory philosophy
- Industry concentration and historical injury rates
- Whether the state has penalty reduction programs for small employers
**Inspection targeting is increasingly data-driven.** Both federal OSHA and state plan states use Site-Specific Targeting (SST) programs that pull from injury and illness data reported via the OSHA 300A electronic submission system. If your DART rate (Days Away, Restricted, or Transferred) exceeds the national average for your NAICS code, you move up the inspection priority list. You may not know you are on the list until the inspector is in your parking lot.
Protekon's Risk Scoring Engine
Here is where we stop talking about the problem and start talking about the solution.
Protekon does not simply tell you what the rules are. Any template vendor can hand you a poster and a PDF. Protekon tells you how exposed you are — right now, today — using a weighted risk scoring model built on real enforcement data.
The risk score is a composite of six weighted factors:
| Factor | Weight | What It Measures |
|--------|--------|-----------------|
| Willful violations in your area/industry | +30 | Inspectors are actively targeting intentional non-compliance |
| Repeat violations in your area/industry | +20 | Patterns of failure — inspectors look for these specifically |
| Serious violations in your area/industry | +10 | Baseline hazard exposure in your peer group |
| Active emphasis programs | +15 | OSHA is running a targeted campaign in your industry or hazard type |
| Recent inspection activity | +15 | Inspectors are physically present in your geography |
| High penalty density | +10 | Your area or industry has a history of above-average fines |
A business with a risk score of 75 or above is operating in what we call a "red zone" — the combination of enforcement activity, penalty severity, and industry targeting means that an inspection is not a matter of if but when. And when it comes, the inspector will be looking for exactly the kinds of deficiencies that generate the highest penalties.
A business with a risk score below 30 is in a relatively calm zone. That does not mean you can ignore compliance — it means your margin for error is slightly larger. Slightly.
The scoring engine updates continuously. When federal OSHA publishes new emphasis programs, the weights shift. When a cluster of inspections hits your metro area, the recent inspection activity factor spikes. When a company in your NAICS code gets hit with a willful violation, the industry-specific risk goes up for everyone in that code.
This is not a static spreadsheet. It is a living risk map.
Industry Benchmarks by State
Different industries face different enforcement realities depending on where they operate. Here are the patterns we see in the data:
Construction
Construction is the most-inspected industry in nearly every jurisdiction. Federal OSHA's top 10 most-cited standards are dominated by construction hazards — fall protection, scaffolding, ladders, excavations. State plan states with large construction sectors (California, Washington, Oregon) layer additional requirements on top.
If you are a construction contractor operating in California, your compliance burden is roughly 40% higher than the same contractor doing the same work in Texas. That is not an opinion — it is a count of applicable standards.
Manufacturing
Manufacturing enforcement varies dramatically by sub-sector. Machine guarding citations are universal, but states like Michigan and Ohio (with heavy manufacturing histories) have inspection programs specifically targeting metalworking, plastics, and automotive supply chain operations.
Healthcare
Healthcare enforcement has intensified since 2020. States with aerosol transmissible disease standards (California) or those that adopted emergency COVID standards (Virginia, Oregon) maintain higher baselines. Workplace violence is a particular focus in healthcare — and with SB 553 in California, it is now a compliance requirement rather than a recommendation.
Hospitality and Retail
Often overlooked, but increasingly targeted. Heat illness standards affect restaurants and kitchens. Workplace violence prevention affects any establishment open to the public. Ergonomic hazards in warehousing and distribution centers are a growing enforcement priority.
Using Enforcement Data Proactively
Most businesses encounter enforcement data for the first time when they receive a citation. That is like checking your credit score for the first time when the bank denies your mortgage. It is too late to fix anything.
The smart play — the only play that makes financial sense — is to use enforcement data before the inspector arrives.
**Step 1: Know your jurisdiction type.** Federal OSHA, state plan, or hybrid. This determines which standards apply and which agency will be knocking on your door.
**Step 2: Know your NAICS code's enforcement history.** How many inspections have been conducted in your industry code in the last three years? What were the most common citations? What was the average penalty? This is your peer group benchmark.
**Step 3: Know your geographic risk.** Enforcement activity clusters geographically. If three businesses within ten miles of you have been inspected in the last six months, you are in an active enforcement zone.
**Step 4: Monitor emphasis programs.** Federal OSHA and state plan states publish their emphasis programs. These are effectively announcements that say "we are going to inspect more of this industry or this hazard type." If your industry shows up on an emphasis program, your inspection probability just multiplied.
**Step 5: Track regulatory changes.** New standards do not arrive silently. They are proposed, commented on, finalized, and implemented over months or years. But most SMBs do not track the Federal Register or state regulatory gazettes. By the time a new standard is enforceable, they have never heard of it.
Protekon does all five of these steps continuously, automatically, and in real time. The risk score updates. The alerts fire. The documentation generates. You do not need a full-time safety director to stay ahead of enforcement — you need a managed compliance platform that never sleeps, never takes a vacation, and never forgets to check the Federal Register.
The Bottom Line
The national compliance landscape is not one landscape. It is fifty landscapes, each with its own terrain, its own hazards, and its own enforcement army. Operating across state lines without understanding the jurisdictional map is like driving cross-country without knowing which states have speed cameras.
You might get lucky. You might not.
Protekon's enforcement intelligence covers every jurisdiction — federal, state plan, and hybrid. The risk scoring engine weights real enforcement data to give you a single number that tells you how exposed you are. And the managed compliance platform ensures that when the inspector does show up, your documentation is audit-ready, your training is current, and your plans are compliant with whichever version of OSHA happens to govern your particular patch of dirt.
Fifty states. Twenty-eight different OSHA programs. One platform that covers them all.
That is the difference between hoping you are compliant and knowing you are.
