Can OSHA Cite You for Your Contractor's Violation? Usually, Yes

If a contractor’s employee gets hurt on your site, OSHA does not need your own employees to have been exposed to the same hazard before it can cite your company. Under the Multi-Employer Citation Policy (CPL 02-00-124), a controlling or exposing employer can be cited for a hazard that only affected a contractor’s own workers. This is the single most misunderstood rule in facilities-level OSHA compliance. It is also different from the General Duty Clause, which is the rule most people assume covers this situation.

This guide covers what OSHA actually requires when contractors work on your site. That includes the four employer categories that determine who gets cited, who logs an injury on which OSHA 300 form, and what you are required to share with contractors under the Hazard Communication Standard. It also covers current 2026 penalty amounts and closes with a practical checklist for facilities and EHS teams. This is a compliance overview, not legal advice. Confirm specifics with your EHS team or counsel for your own site.

The Rule Most Host Employers Get Wrong

Most facilities teams assume OSHA can only cite them if their own employees were exposed to a hazard. That assumption comes from the General Duty Clause, Section 5(a)(1) of the OSH Act. For that specific clause, the assumption is correct: an employer’s obligations under the General Duty Clause extend only to its own employees. OSHA cannot issue a 5(a)(1) citation if the employer’s own employees were not exposed to the hazard.

The Multi-Employer Citation Policy is a separate, broader standard, and it does not have that same limit. Under CPL 02-00-124, OSHA sorts employers at a shared worksite into four roles. More than one employer can be cited for the same violation:

• Creating employer: caused the hazardous condition. Citable even if the only employees exposed are those of other employers on site.
• Exposing employer: has employees exposed to a hazard someone else created. Citable if it knew, or should have known through reasonable diligence, about the hazard, and failed to take steps within its authority to protect its own employees.
• Correcting employer: engaged in a common undertaking on the same site. Responsible for actually correcting the hazard.
• Controlling employer: has general supervisory authority over the worksite. That includes the power to correct violations itself or require others to. Control can come from a contract, or simply from how authority is exercised in practice. A controlling employer must exercise reasonable care to prevent and detect violations, and can be cited even without any of its own employees present (OSHA, CPL 02-00-124).

Most host facilities hire a contractor and keep general supervisory authority over the site by default. That makes them a controlling employer under this policy far more often than they realize. That status alone creates citation exposure for a hazard that never touched a single one of the host’s own employees.

A concrete example. A property management company hires an electrical contractor to rewire a floor. The contractor’s own crew fails to lock out a live circuit, and one of the contractor’s electricians is shocked. No employee of the property management company was anywhere near the hazard. Under the General Duty Clause alone, the property manager would not be citable, since its own employees were never exposed. Under the Multi-Employer Citation Policy, the property manager can still be cited as the controlling employer, if it had the contractual authority to enforce lockout procedures on site and failed to exercise reasonable care in doing so. The hazard never touched their payroll. The citation exposure did not care.

Employer Categories at a Glance

An employer can hold more than one of these roles at once. A facilities team that both directs contractor work and controls the site can be a controlling employer and a correcting employer for the same job.

Recordkeeping: Whose OSHA 300 Log Does an Injury Go On?

This gets confused constantly. The actual test is narrow: day-to-day supervision. Under 29 CFR 1904.31, you must record a recordable injury or illness for a worker who is not on your payroll, if you supervise that worker’s day-to-day activities. If the contractor’s own supervisor directs the daily work instead, the contractor’s employer records it. That happens on their own OSHA 300 log at that employee’s home establishment, even though the injury happened at your facility.

There cannot be joint day-to-day supervision for recordkeeping purposes. A job involving a prime contractor and subcontractors needs one clear answer, not a shared one. The companies involved need to agree in advance, and document, exactly who is supervising which workers day to day. Do that before the job starts, so an injury is not double-recorded or missed entirely (OSHA standard interpretation, 1904.31).

Why this matters beyond the paperwork. Your OSHA 300 log feeds your Total Recordable Incident Rate (TRIR), the number insurers, clients, and bid reviewers actually check. Getting the day-to-day supervision question wrong does not just misfile one injury. It can understate or overstate your real safety record for anyone evaluating your facility from the outside.

Hazard Communication: What You’re Required to Share

OSHA’s Hazard Communication Standard requires a written program that specifically addresses multi-employer worksites. Under 1910.1200(e)(2), a host employer must:

• Make safety data sheets available to other employers on site whose workers may be exposed to hazards the host did not bring onto the site
• Communicate precautionary measures needed during normal operations and foreseeable emergencies
• Explain the labeling system used at the facility, so a contractor’s crew can correctly interpret hazard labels they encounter

This cuts both ways. A contractor bringing hazardous materials or processes onto your site has the same obligation to inform you and other employers present. Treat this exchange as a standing item in your contractor onboarding, not a one-time document dump nobody reads.

What this looks like in practice. Before a contractor’s crew starts work, hand over (or point them to) the SDS binder or digital equivalent for any chemicals stored or used near their work area. Walk through your labeling conventions if they differ from what the contractor’s own crew is used to. Ask the contractor the same question in return: what are they bringing on site, and what do your own employees need to know about it? A five-minute exchange at kickoff is the whole requirement. Skipping it is what turns a routine job into a citation when an inspector asks a contractor’s employee what they were told about the chemicals in the room they were working in, and the honest answer is nothing.

OSHA Doesn’t Require Prequalification by Name, But It Rewards It Anyway

There is no OSHA regulation that says “you must run a contractor prequalification program.” What the Multi-Employer Citation Policy does require, for an exposing or controlling employer, is reasonable diligence and reasonable care in preventing and detecting hazards. A documented prequalification process is exactly the evidence that demonstrates reasonable diligence if OSHA ever investigates an incident: verified insurance, licenses, a reviewed safety record, a checked risk assessment. Skipping it does not remove your citation exposure. It just removes your evidence that you tried.

What “reasonable diligence” practically means for a facilities team. The standard is about what you actually did, not what your policy says you should do. Checking a contractor’s safety record before hiring them, actually communicating site-specific hazards, and having a real way for a worker to report a hazard or stop work all count as diligence. A prequalification checklist that exists on paper but was never followed on a specific job does not meet that bar any better than having no checklist at all, since the standard looks at conduct, not documentation for its own sake.

What Non-Compliance Actually Costs in 2026

These figures are unchanged from 2025. OSHA’s civil penalties are normally adjusted every year for inflation. The required October 2025 CPI-U data was not published because of a government shutdown, and the statute governing the adjustment provides no substitute calculation. So the January 2025 amounts carried forward instead (OSHA, 2026 Annual Adjustments to Civil Penalties). Confirm current figures directly with OSHA before budgeting around them, since this is exactly the kind of number that changes on its own schedule.

Why the multiplier matters more than any single number. A single Willful violation at $165,514 already dwarfs most facilities budgets set aside for compliance. But OSHA issues citations per instance in many cases, not per inspection. A site with the same hazard present at five separate work areas can see that per-violation number multiply five times over, which is how a routine-sounding inspection turns into a six-figure exposure from what looked, on paper, like one recurring issue.

A Practical Compliance Checklist for Facilities Teams

1. Establish and document who is the controlling employer for each job. Put it in the contract if possible. Ambiguity here is what gets sorted out expensively during an OSHA investigation instead of cheaply beforehand.
2. Run prequalification as your reasonable-diligence record, not paperwork. Verify insurance, licenses, a real safety record check, and a reviewed risk assessment or method statement before work starts.
3. Agree on day-to-day supervision in writing before the job starts. That settles recordkeeping responsibility under 1904.31 before an injury happens, not after, when both sides have an incentive to disagree about who was really in charge.
4. Exchange hazard information in both directions. Give the contractor safety data sheets, precautions, and your labeling system. Get the same information back from them about what they are bringing on site. Make it a standing part of onboarding, not a one-off.
5. Keep the operational record tight. Arrival, induction acknowledgment, authorized zones, and sign-out need to be complete enough to reconstruct who was on site and what they were doing if OSHA asks. Our contractor check-in checklist covers that operational side in detail: the four-stage process and the two moments it has to survive, an audit and an evacuation.
6. Review and correct hazards you have authority over on an ongoing basis. A controlling employer’s duty does not end once a job starts. Walking the site while work is underway, not just approving it beforehand, is part of what “reasonable care” actually means.
7. Train whoever manages contractor relationships on these four employer categories specifically. Most facilities and procurement staff have never heard of the Multi-Employer Citation Policy by name, which means they are making contract and supervision decisions without knowing which of those decisions creates citation exposure.

Where Vizitor Fits

None of this replaces legal or EHS judgment. But the operational half of OSHA contractor compliance, proving who was on site, what they were cleared to do, and whether their documents were current when they arrived, is exactly what a contractor management system is built to hold. Vizitor gates check-in on document expiry (insurance, permits, inductions), so an expired certificate blocks entry instead of quietly slipping past a busy front desk. It records a timestamped arrival and sign-out for every contractor, and keeps that record in an encrypted, auditable log rather than a paper book or an email thread. That is the difference between having evidence of reasonable diligence and just believing you did.

Book a demo to see how contractor documentation, zone limits, and sign-out tie together in one record.