Multi-Employer Worksite Citations: When Your Contractor's HazCom Gap Becomes Yours

A sanitation contractor’s employee gets a chemical splash at your facility. Your safety manager says, truthfully, that every iSi-trained host employee in that area knows the SDS, the labels, and the precautionary measures cold. Two weeks later, the OSHA citation packet arrives — addressed to your facility. The contractor is cited as the exposing employer. You are cited as the controlling employer, and depending on whose process generated the chemical, possibly as the creating employer too. The fact that your own employees were trained is, for purposes of this citation, irrelevant.

This is the scenario OSHA’s Multi-Employer Citation Policy, CPL 02-00-124, is built around. The directive has been in effect since December 10, 1999, and its core sentence is the one most host employers either don’t know or actively misread: “On multi-employer worksites (in all industry sectors), more than one employer may be citable for a hazardous condition that violates an OSHA standard.” More than one. Not “the contractor or the host depending on facts.” Both. Often three or four employers on the same project, all cited for the same underlying violation.

Hazard Communication is the most common ground where this plays out. HazCom has been the most-cited general industry standard for three years running, and the 29 CFR 1910.1200 requirements that govern host-to-contractor information transfer are written into paragraph (e)(2). Most plants we audit have a written HazCom program for their own employees that is reasonably current. The (e)(2) multi-employer language — and the supporting documentation that proves the host actually transmitted hazard information to its contractors — is the gap. With HazCom 2024 retraining deadlines now active and contractor inspections widening under CPL 02-00-124, that gap is about to get tested at thousands of facilities.

This post walks through how the multi-employer policy actually works, where contractor chemical training documentation breaks down, and what host employers should have in place before the next inspection.

What Is OSHA’s Multi-Employer Citation Policy?

How does CPL 02-00-124 decide which employers get cited at a multi-employer worksite?

The directive uses a two-step analysis applied to every employer present at the worksite. Step one is to categorize each employer into one of four roles. Step two is to determine whether that employer’s actions met the obligations attached to its role. An employer that fits no category bears no responsibility for the violation. An employer that fits a category and failed its obligations gets cited.

The four employer categories under CPL 02-00-124 are:

Creating employer. The employer that caused the hazardous condition. In a chemical-exposure case, this is usually the operator whose process generated the substance the worker was exposed to.
Exposing employer. An employer whose own employees are exposed to the hazard. The contractor whose technician inhaled the vapor is always at minimum the exposing employer.
Correcting employer. An employer engaged in a common undertaking on the same worksite who is responsible for correcting the hazard. Often a safety contractor or general contractor with explicit corrective authority.
Controlling employer. An employer with general supervisory authority over the worksite — including the power to correct violations directly or to require others to correct them. The host facility almost always meets this definition for work performed inside its operations.

Two facts about this framework matter more than the category names themselves. First, an employer can occupy more than one category for the same violation. A manufacturing host whose process emitted the chemical, who controls site access, and who has authority to halt contractor work is simultaneously creating and controlling — and gets cited under both. Second, OSHA’s penalty calculation under the multi-employer policy uses the sum of exposed employees across all employers for probability assessment. A 12-person manufacturing crew plus a 6-person contractor crew is treated as 18 exposed employees, not 6. That elevates the gravity of the citation and the proposed penalty above what either employer would face alone.

The Step 2 obligation for a controlling employer is “reasonable care to prevent and detect violations on the site.” OSHA explicitly notes that the controlling employer’s reasonable-care duty is less than what a primary employer owes its own employees — but it is not zero. Per the OSHA standard interpretation on controlling employer authority, a controlling employer is expected to:

Conduct periodic inspections at appropriate frequency given the work
Implement a system for promptly correcting hazards
Enforce other employers’ compliance with safety requirements through a graduated, documented system

A passive “we hired qualified contractors” defense does not satisfy this standard when known hazards go uncorrected. Recent enforcement under CPL 02-00-124 has reinforced that controlling employers must actively enforce safety on site, not delegate compliance to subcontractors and walk away.

What Does 1910.1200(e)(2) Require From Host Employers?

What chemical information must a host employer give to contractors working on site?

The Hazard Communication Standard contains a specific multi-employer paragraph at 29 CFR 1910.1200(e)(2). It requires the host’s written HazCom program to describe the methods the host will use to:

Provide other employers on-site access to safety data sheets for each hazardous chemical the other employer’s employees may be exposed to while working
Inform other employers of any precautionary measures needed to protect their employees during normal operating conditions and in foreseeable emergencies
Inform other employers of the labeling system used in the workplace

Three things stand out about how this paragraph is written. The obligation is on the host, not the contractor. The required content is methods — meaning the program must describe how the transfer will happen, not just promise that it will. And the trigger is exposure potential, not actual exposure: if the contractor’s employees may be exposed to the host’s chemicals while working, the obligation kicks in.

Training under 1910.1200(h)(1) is required before a worker begins work in the area and again whenever a new chemical hazard is introduced. The standard does not allow the host to assume the contractor has already trained its people on the host’s specific chemicals. Generic HazCom training the contractor delivered at home base — covering the contractor’s own chemicals on the contractor’s own jobs — does not cover the host facility’s specific inventory, labeling system, or emergency procedures. The host’s written program must specify how those site-specific hazards are communicated, and a documented site-specific orientation closes the gap.

This is where most multi-employer citations originate. The host has a HazCom program. The host has trained its own employees. The host’s program either does not address (e)(2) or addresses it generically, and there is no documented record of what was actually transferred to which contractor on which date. When the inspector asks, “Show me the SDS access method you used for the contractor working in this area on the day of the exposure,” the absence of a documented answer is the citation.

Why Does “We Trained Our Employees” Not Shield the Host?

Can a manufacturer be cited for a contractor employee’s chemical exposure even if all host employees are properly trained?

Yes, and the reasoning is built into the structure of CPL 02-00-124. The host’s training of host employees addresses the host’s obligations to its own employees. It does not address the host’s obligations as creating, controlling, or exposing employer with respect to contractor employees. Those are different obligations attached to different roles, evaluated separately under the two-step analysis.

Consider how the categories actually apply at a typical manufacturing site:

Host as creating employer. If the host’s process generates the chemical exposure, the host is the creating employer regardless of who is exposed. A coating line emitting solvent vapors is the creating employer for any worker — host or contractor — exposed to those vapors.
Host as controlling employer. The host owns the site, controls access, and has authority to halt or modify any work being performed. The host is the controlling employer with respect to all work done on its property.
Contractor as exposing employer. The contractor’s employees were exposed to the hazard. The contractor is the exposing employer.

OSHA’s two-step process under CPL 02-00-124 evaluates each employer separately. The host’s compliance with its obligations to host employees does not defeat a citation issued for the host’s failure to meet its obligations as a controlling or creating employer toward contractor employees. They are different duties.

The argument host employers reach for is “the contractor was responsible for training its own people” — and that argument is partially correct. The contractor is responsible for training its own people. But under 1910.1200(e)(2), the host is responsible for transmitting site-specific hazard information so the contractor can complete that training. A contractor cannot train against the host’s chemical inventory without receiving information about the host’s chemical inventory. When that transfer is undocumented or absent, the host’s controlling-employer duty fails and a citation follows.

How Does HazCom 2024 Change the Multi-Employer Picture?

What deadlines under the HazCom 2024 final rule affect contractor training obligations?

OSHA’s HazCom 2024 final rule, with extended compliance dates published in Federal Register 2026-00653 on January 15, 2026, introduces three new hazard categories under GHS Revision 7 (desensitized explosives, chemicals under pressure, and unstable gases) and revises classification, SDS, and labeling requirements across most existing hazard classes. The compliance cascade matters for multi-employer obligations:

Compliance Group	Deadline	Multi-Employer Implication
Manufacturers and importers	May 19, 2026	Updated SDS begin reaching host facilities; host must update internal SDS library and re-communicate to active contractors
Distributors	November 20, 2026	GHS-compliant SDS reach end-user host facilities; multi-employer information transfer must reflect new classifications
Employers (training and program updates)	November 19, 2027	Host’s HazCom program update under (e)(2) must include re-communication of updated hazard information to all on-site contractors
Full transition complete	May 19, 2028	Legacy labeling and SDS no longer accepted; any uncommunicated reclassification creates citation exposure

The November 19, 2027 employer deadline is the inflection point most host employers have not planned for in their contractor program. Updating internal HazCom training without simultaneously updating the multi-employer information transfer leaves the controlling-employer obligation unfulfilled. Any chemical that reclassifies under GHS Revision 7 — and OSHA estimates 94% of safety data sheets need at least some updating — generates a fresh information-transfer obligation under 1910.1200(e)(2). New SDS to share. New labels to explain. New precautionary measures to communicate. For host facilities with active contractor populations, the update is not a one-time refresh; it is a re-communication to every contractor working on site between now and 2028.

What Are the Penalty Stakes for Multi-Employer HazCom Citations?

How much does a multi-employer worksite citation actually cost?

Per OSHA’s 2025 annual penalty adjustments, effective January 15, 2025, the maximum penalty per serious violation is $16,550. Maximum penalty per willful or repeat violation is $165,514, with a statutory minimum of $11,823 for willful violations. These are per-violation figures. HazCom citations stack across products, training gaps, and program deficiencies — and on multi-employer sites, citations stack across employers as well.

A representative multi-employer HazCom inspection might generate:

One citation against the contractor as exposing employer for failure to train ($16,550 base)
One citation against the host as controlling employer for failure to transfer hazard information under (e)(2) ($16,550 base)
One citation against the host as creating employer if the host’s process generated the chemical exposure ($16,550 base)
Penalty calculation across all three using sum of exposed employees, raising probability and gravity

The arithmetic on a single inspection: a $50,000 baseline scenario is realistic before any willful finding. If documentation gaps suggest the host knew about the obligation and ignored it — and willfulness is a fact-specific determination — the per-citation ceiling jumps to $165,514.

Two penalty reductions documented in OSHA’s July 2025 policy update can soften the impact, but only for employers who have actually built compliance discipline into their program:

20% reduction for employers never previously inspected (or with no serious/willful/failure-to-abate history in the prior five years)
15% reduction for documented immediate corrective action upon discovering the violation

The 15% corrective-action reduction is meaningful for the controlling employer who responds to a contractor’s HazCom gap by halting work, transferring SDS, and documenting the corrective action in real time. Reasonable care under CPL 02-00-124 looks like that response in motion — which is also the documentation OSHA looks for at Step 2.

What Should a Host Employer Have Documented Before the Next Inspection?

What contractor chemical training documentation does an OSHA inspector look for at a multi-employer site?

The documentation set is shorter than most plants assume, but it has to actually exist. The minimum:

1. A written HazCom program with explicit (e)(2) language. The program must describe how the host provides on-site SDS access to other employers, communicates precautionary measures, and explains the labeling system. Generic “we provide information to contractors as needed” language does not satisfy the methods requirement. Specify the method: which document is provided, by whom, at what point in the contractor onboarding, and where the record is kept.

2. Per-engagement contractor handoff records. A log noting the contractor name, scope of work, areas of the facility involved, host chemicals the contractor’s employees may encounter, SDS provided, precautionary measures communicated, and emergency procedures explained. Date and signature of the host representative who completed the handoff. Acknowledgment from the contractor’s site supervisor.

3. Verification of contractor HazCom training. A copy of the contractor’s HazCom training certification (general HazCom training the contractor’s employees received from their employer), recorded in the host’s contractor file before site access. This is part of the host’s reasonable-care documentation as controlling employer — proof that the host did not ignore the contractor’s general training status.

4. Site-specific orientation records. Sign-in sheets, attendance records, or completion certificates for the host’s site-specific HazCom briefing covering the host’s chemical inventory, labeling system, SDS access procedure, and emergency response. This closes the gap between the contractor’s generic HazCom training and the host facility’s specific hazards.

5. Contractor agreement language. Contracts should require contractors to provide their HazCom program, training records, SDS for any chemicals they bring on site, and acknowledgment of the host’s site-specific hazards. This protects the host as the controlling employer by demonstrating reasonable care in selecting and overseeing contractors at Step 2 of the CPL analysis.

6. HazCom 2024 update communications. As host SDS and labels update under GHS Revision 7, documented re-communication to active contractors of the changes — same documentation methods as initial onboarding, repeated for each material reclassification. This is the November 2027 obligation that compounds with the host’s own program update.

If those six items are in place and dated for every contractor engagement, the host has substantially closed its controlling-employer exposure under CPL 02-00-124. The absence of any one item is the citation lever — and the inspectors know exactly which lever to pull.

What This Means in Federal OSHA States

Do Kansas, Missouri, Oklahoma, and Texas have their own multi-employer policies?

No. Per OSHA’s State Plans page, Kansas, Missouri, Oklahoma, and Texas are all under direct federal OSHA jurisdiction for private-sector employment. Federal CPL 02-00-124 applies as written, with no state-level filter. Inspectors are federal Compliance Safety and Health Officers, penalty amounts are the federal figures, and the four-employer two-step analysis is applied identically to a manufacturer in Wichita, Kansas City, Tulsa, or Oklahoma City.

For multi-state operators, this is operationally simpler than a state-plan environment but does not reduce the underlying obligation. A facility in California (state plan) and a facility in Kansas (federal) will see different procedural mechanics during an inspection, but the substantive multi-employer test is structurally similar. Building a single multi-employer documentation system that satisfies federal CPL 02-00-124 plus state-plan overlays where they exist is the durable approach for any host employer with a national footprint.

For iSi clients in the four-state region, the practical implication is straightforward: federal OSHA inspectors operating from regional offices will arrive applying CPL 02-00-124 unchanged. The contractor handoff documentation either exists or it does not.

Closing the Gap

Most plants we walk through have a HazCom program written to satisfy the host’s obligations to host employees. Most have not built the (e)(2) multi-employer documentation into the contractor onboarding sequence. The November 19, 2027 employer deadline under HazCom 2024 forces the question — every host with active contractors will need to update its program for new GHS Revision 7 classifications, and the same update is the moment to build the multi-employer language and the per-engagement documentation that the controlling-employer test requires.

A documented contractor handoff process takes a few weeks to build and integrates into existing contractor onboarding without disrupting operations. The alternative is improvising during an OSHA inspection opening conference — which, for the controlling-employer obligation under CPL 02-00-124, is the wrong moment to start.

iSi’s EHS COOP retainer covers exactly this kind of program work — auditing the host’s written HazCom program against (e)(2), building the contractor handoff documentation, integrating the HazCom 2024 reclassification updates into the multi-employer transfer, and providing the documented site-specific orientation for contractors. For host facilities that bring contractors into chemical-handling areas, closing the multi-employer documentation gap before the next inspection is the practical first step. Talk to us about a contractor program audit.