Lockout/Tagout Program: OSHA Requirements and Penalties

A compliant lockout/tagout program under OSHA requirements has five moving parts: machine-specific written energy control procedures, standardized locks and tags, tiered employee training with documentation, annual inspections by an independent observer, and defined rules for group work, shift changes, contractor coordination, and lock removal. The governing standard is 29 CFR 1910.147, and it is the fifth most frequently cited OSHA regulation, which tells you how often employers get one of those elements wrong.¹ Serious violations carry penalties up to $16,550 each as of January 15, 2025; willful or repeated violations reach $165,514.²

Who the Standard Covers

Section 1910.147 applies to general industry employers whose workers service or maintain machines where unexpected startup or the release of stored energy could cause injury.³ Servicing and maintenance is defined broadly, covering cleaning, lubricating, unjamming, and adjusting. The energy types in scope include electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational.

Several categories fall outside the standard and follow different rules:

Construction and agriculture
Maritime employment (shipyards, marine terminals, longshoring)
Electric utility power generation, transmission, and distribution under exclusive utility control
Electrical work on or near energized conductors in general industry, which is covered by OSHA’s Subpart S
Oil and gas well drilling and servicing
Cord-and-plug equipment where the employee doing the work unplugs it and keeps the plug under exclusive control
Hot tap operations on pressurized pipelines, if shutdown is impractical, service continuity is essential, and documented procedures with proven protective equipment are used

Falling outside 1910.147 is not the same as being free from energy control obligations. If your operation fits one of the carve-outs, you need to work from the applicable standard, not the assumption that no rule applies.³

Written Energy Control Procedures for Each Machine

Every piece of equipment in scope needs its own written procedure. A single company-wide document does not meet the requirement. Each procedure must identify the specific machine, describe every energy source (including type and magnitude, such as voltage or PSI), and pinpoint the location of every energy-isolating device, whether that is a circuit breaker, valve, slide gate, or disconnect switch.³

Writing these procedures requires walking the equipment and tracing every energy path. Miss a pneumatic line or a gravity-fed component and the procedure has a gap that can injure a worker. The finished document should function as a step-by-step instruction set that any trained, authorized employee can follow to bring the machine to a zero-energy state and verify it. Many facilities include diagrams. The document also needs to be accessible at or near the workstation; a binder locked in a supervisor’s office does not help the technician standing in front of the machine.

Lock and Tag Hardware Requirements

Locks, tags, chains, and other devices must withstand the environment they are used in for the maximum expected duration of exposure. Tags must remain legible and intact despite weather, moisture, and corrosive conditions such as areas storing acids or alkali chemicals.³

All lockout and tagout devices within a facility must be standardized by at least one of the following: color, shape, or size. Tags must also be standardized in print and format. Anyone in the facility should be able to look at a device and recognize it instantly as part of an energy control procedure.³

The Isolation and Verification Sequence

The order matters. Before touching an isolation device, the authorized employee notifies all affected employees that the machine is being shut down. The machine is then stopped using its normal controls. The employee operates each energy-isolating device to physically disconnect the equipment from its energy sources and attaches locks and tags to every isolation point.

Stored energy is the step that trips people up. Shutting off the power source does not eliminate energy already in the system. Springs under tension, elevated machine components, residual hydraulic or pneumatic pressure, spinning flywheels, and capacitors holding charge all have to be dissipated or restrained before work begins.

Verification is the final safety gate. The employee attempts to start the machine using its normal controls. If nothing happens, isolation is confirmed. This physical test is mandatory and is the single most important step because it catches anything the earlier steps missed.

When Tagout Alone Is Allowed

Lockout is the default. Tags are warning devices; they do not physically prevent someone from flipping a switch or opening a valve. When an energy-isolating device can accept a lock, a lock must be used.

Tagout alone is permitted only when the isolation device is physically incapable of accepting a lock, and even then the employer must show that the tagout program provides safety equivalent to a lock. That equivalence requires additional measures such as removing a circuit element, blocking a controlling switch, opening an extra disconnecting device, or removing a valve handle. Training for tagout systems must cover the specific limitations of tags: they are warnings only, they must never be bypassed or removed without authorization, they can create a false sense of security, and they must be attached securely enough that they cannot be accidentally detached.⁴

The Minor Servicing Exception

Not every adjustment during production requires a full lockout. The standard exempts minor servicing activities during normal production operations if the activity is routine, repetitive, and integral to the production use of the equipment. All three conditions must be met. A one-off repair does not qualify, even if it is quick.⁴ Even when the conditions are satisfied, the employee must still be protected by alternative measures that provide effective protection. OSHA scrutinizes this exception closely during inspections, and it is narrower than many employers assume.

Training the Three Employee Categories

The standard divides workers into three groups, each with different training obligations:

Authorized employees apply locks and tags and perform maintenance. Training must cover every type of hazardous energy present, the methods for isolating and controlling it, and the specific procedures for each machine they work on.
Affected employees operate the locked-out equipment or work in the immediate area. They must understand the purpose of lockout/tagout and why they must never attempt to restart equipment that has been locked or tagged out.
Other employees whose work brings them through the area must be instructed to recognize locks and tags and leave them alone.

The boundaries matter. An affected employee who begins performing maintenance becomes an authorized employee for that task and needs the corresponding training.³

Retraining Triggers

Retraining is required when an authorized or affected employee changes job assignments, when machines or processes change in a way that introduces new hazards, or when energy control procedures themselves are revised. A periodic inspection revealing employees deviating from established procedures also triggers retraining.³

Certification Records

Employers must certify that training has been completed and kept current. The record must include each employee’s name and the dates of training.⁴ These records are among the first documents an OSHA inspector will ask to see, and missing or incomplete documentation is one of the easier citations to issue.

Group Lockout, Shift Changes, and Contractors

When a crew or multiple departments service the same equipment, the employer must designate an authorized employee with primary responsibility for the group lockout. That person must be able to account for the exposure status of every individual working under the group’s protection at any time.⁴ Each authorized employee in the group still attaches a personal lock or tag to a group device or lockbox when starting work and removes it when stopping. Individual accountability is preserved.

Shift changes create a dangerous window. If the outgoing shift removes its locks before the incoming shift applies theirs, the machine sits unprotected. The standard requires specific procedures for the orderly transfer of lockout protection between shifts so that the equipment is never unprotected.⁴

Outside contractors bring a two-way obligation. The host employer and the contractor must each inform the other of their respective lockout/tagout procedures. The host is then responsible for making sure its own employees understand and follow the restrictions in the contractor’s energy control program.⁴ Handing a contractor a badge and pointing them toward the equipment is not compliance. Miscommunication between a host’s operators and a contractor’s maintenance crew is exactly the scenario where someone re-energizes a machine that someone else is inside of.

Removing Another Employee’s Lock

The general rule is absolute: only the employee who applied a lock may remove it. The exception for situations where that employee is unavailable is narrow and requires a specific procedure written into the energy control program. Three steps are mandatory:

Verify that the authorized employee who applied the lock is not at the facility.
Make all reasonable efforts to contact the absent employee and inform them that their lock has been removed.
Ensure the employee knows their lock was removed before they resume work at the facility.

All three steps are required.⁴ A supervisor who cuts a lock off because the shift ended and the employee went home, without following the procedure, has committed a violation. More importantly, that is how people get killed.

Annual Inspections and Certification

Every energy control procedure must be inspected at least once a year. The inspection must be performed by an authorized employee who is not the one currently using the procedure being reviewed. The independent-observer rule exists because people who run the same procedure daily develop blind spots.³

The inspector watches the lockout process as it is actually performed and talks with employees to verify understanding. Reviews of lockout procedures include a discussion between the inspector and the authorized and affected employees; reviews of tagout-only procedures must also cover the limitations of tags. The employer must certify that each inspection was completed, and the certification must identify the machine, the date, the employees included, and the person who performed the review.³ When an accident occurs, the inspection log is evidence of whether the program was being maintained or allowed to atrophy.

Penalties and the Most Common Citations

Penalties are adjusted annually for inflation. As of January 15, 2025, a serious violation carries a maximum penalty of $16,550 per instance. Willful or repeated violations can reach $165,514 per violation.² These amounts are per violation, not per inspection. A single facility visit that turns up missing procedures for ten machines, thin training records, and no annual inspections can produce a citation package well into six figures.

The most common lockout/tagout citations involve missing or incomplete written procedures, failure to conduct annual inspections, and gaps in training documentation.¹ All three are paperwork failures that are entirely preventable. If the documentation is not in order, the inspector has no reason to believe the actual practice is any better.

1
Occupational Safety and Health Administration. Top 10 Most Frequently Cited Standards
2
Occupational Safety and Health Administration. OSHA Penalties
3
eCFR. 29 CFR 1910.147 – The Control of Hazardous Energy (Lockout/Tagout)
4
Occupational Safety and Health Administration. 29 CFR 1910.147 – The Control of Hazardous Energy (Lockout/Tagout)