OSHA active shooter requirements come from two places: the General Duty Clause of the Occupational Safety and Health Act, which obligates every covered employer to keep the workplace free of recognized hazards likely to cause death or serious harm, and 29 CFR 1910.38, which sets the minimum contents of an emergency action plan. There is no standalone active shooter standard. That absence does not lower the bar. If workplace violence is foreseeable in your industry or your specific workplace, OSHA expects a written plan, employee training, feasible physical controls, and a way to report and account for incidents. Failing on those points can bring citations of up to $165,514 per willful violation.
Where the Legal Duty Comes From
Section 5(a)(1) of the OSH Act requires each employer to furnish a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.”1Occupational Safety and Health Administration. OSH Act of 1970 – SEC. 5. Duties Because no OSHA regulation names active shooters specifically, this clause is what inspectors use when an employer ignores a credible risk of workplace violence.
A hazard is “recognized” once your industry, your history, or your specific workplace puts you on notice. You do not need to have survived an attack. Prior threats from employees, customers, or outsiders count. So does published industry data showing elevated violence rates in your sector. Late-night retail, healthcare, and social services are longstanding examples, but the analysis is fact-specific to your operation.
What OSHA Must Prove to Cite You
Before issuing a General Duty Clause citation, OSHA has to establish four elements:
- Employees were exposed to a hazard the employer failed to keep out of the workplace.
- The hazard was recognized, by the employer or by the industry generally.
- The hazard was causing or was likely to cause death or serious physical harm.
- A feasible and useful method existed to correct it.
Most fights happen on the fourth element.2Occupational Safety and Health Administration. Elements Necessary for a Violation of the General Duty Clause OSHA does not expect a bulletproof workplace. It expects the measures that are practical and widely used in your industry: a written emergency action plan, basic training, access controls, and a system for reporting threats. Doing none of that when those tools are available is what turns a risk into a citation.
What Your Emergency Action Plan Must Contain
29 CFR 1910.38 sets the floor for every emergency action plan. The regulation was drafted broadly to cover fires and other emergencies, and OSHA expects active shooter procedures folded into the same framework. A plan that addresses fire but is silent on workplace violence is the kind of gap inspectors look for.
The plan has to include:
- How employees report a fire, active threat, or other emergency.
- The type of evacuation and specific exit route assignments for each area.
- Procedures for anyone who must stay briefly to shut down critical operations before evacuating.
- A method to account for every employee after evacuation.
- Procedures for anyone assigned to rescue or first-aid duties.
- The name or job title of a person employees can contact with questions about the plan.
The plan must be written, kept at the workplace, and available for employees to review. Employers with ten or fewer employees may communicate it orally.3Occupational Safety and Health Administration. 29 CFR 1910.38 – Emergency Action Plans A distinctive alarm signal is also required so employees can immediately tell an active threat notification apart from a fire alarm.
Training Employees on Run, Hide, Fight
The FBI developed Run, Hide, Fight, in partnership with other federal agencies, as the national civilian response model. OSHA guidance treats training on it as a recognized method of hazard abatement, which means it is one of the concrete steps that helps satisfy your General Duty Clause obligations.
The framework is tiered:
- Run when a safe escape path exists. Evacuate immediately, leave belongings, keep hands visible, and know alternate exits.
- Hide when no safe route is available. Find a room that can be locked and barricaded, silence phones, stay out of sight.
- Fight only as a last resort when life is in immediate danger. Improvise weapons, work as a team, commit fully.
The FBI’s training also covers bleeding control and how to help injured people until EMS arrives.4Federal Bureau of Investigation. Active Shooter Attack Prevention and Preparedness (ASAPP) Building basic hemorrhage control into your program is a reasonable addition for many workplaces.
1910.38 requires reviewing the plan with each covered employee when the plan is first developed, when the employee is initially assigned to a job, when their responsibilities under the plan change, and whenever the plan is updated.3Occupational Safety and Health Administration. 29 CFR 1910.38 – Emergency Action Plans Those are minimums. Effective preparedness usually adds tabletop exercises and physical walk-throughs, because people under stress revert to routes they have actually practiced.
Physical and Engineering Controls
A response plan tells employees what to do during an attack. Engineering controls reduce the likelihood and severity of one occurring. OSHA treats them as a key category of feasible abatement, and inspectors have cited employers who lacked them.
Controls OSHA has recognized as feasible include:
- Alarm and communication systems, including panic buttons, hand-held alarms, public address systems, and a defined response protocol when alarms activate.
- Access controls such as installed metal detectors or hand-held wands, badge-entry doors, and visitor screening.
- Surveillance measures: closed-circuit cameras, curved mirrors at hallway intersections, and effective lighting.
- Layout choices that support escape, including two exits per work area where possible, furniture arranged to prevent entrapment, and designated safe rooms.
Not every workplace needs every item.5Occupational Safety and Health Administration. Citation 314683558/01001 The standard is feasibility given your layout, industry, and risk profile. A late-night convenience store faces different threats than a corporate office. What matters is that you assessed the risk and put in place the controls that are practical for your setting.
Accommodating Employees With Disabilities
An emergency plan that assumes every employee can run down a stairwell leaves people behind. The ADA requires emergency planning to account for employees with physical, sensory, and cognitive disabilities. Wheelchair users may need designated assistance and evacuation chairs. Deaf and hard-of-hearing employees need visual alarm signals, not just audible ones. Blind and low-vision employees may need guided evacuation rather than posted exit signs.6ADA.gov. Emergency Planning Build these accommodations in from the start and test them during drills.
Reporting and Recordkeeping After an Incident
A workplace shooting that results in a fatality must be reported to OSHA within eight hours. An in-patient hospitalization, amputation, or loss of an eye must be reported within twenty-four hours. Reports can be made by phone to the nearest OSHA area office, by calling 1-800-321-OSHA, or through OSHA’s online portal.7Occupational Safety and Health Administration. 29 CFR 1904.39 – Reporting Fatalities, Hospitalizations, Amputations, and Losses of an Eye If you do not immediately recognize the event as work-related, the clock starts when you learn the connection.
Injuries from a violent incident also have to be recorded on the OSHA Form 300 Log if they result in death, loss of consciousness, days away from work, restricted duty or job transfer, or medical treatment beyond first aid. A gunshot wound will almost certainly cross one of those thresholds.
OSHA guidance also recommends providing psychological support after an incident. Trauma counseling, critical incident stress debriefing, and employee assistance programs are recognized post-incident responses, and OSHA has noted that prompt debriefing reduces both acute trauma and longer-term stress.8Occupational Safety and Health Administration. Recommendations for Workplace Violence Prevention Programs in Late-Night Retail Establishments
Employee Protections Against Retaliation
Employees who raise safety concerns internally or file complaints with OSHA are protected under Section 11(c) of the OSH Act. Firing, demoting, transferring, or otherwise punishing a worker for reporting a hazard, participating in an inspection, or exercising any right under the Act is prohibited.9United States Department of Labor. Occupational Safety and Health Act (OSH Act), Section 11(c) A retaliation complaint must be filed with OSHA within 30 days. Remedies include reinstatement and back pay.
Employees also have a narrow right to refuse dangerous work when they genuinely believe an imminent danger of death or serious injury exists, a reasonable person would agree, there is not enough time to correct the problem through an inspection, and they have asked the employer to fix it and been refused.10Occupational Safety and Health Administration. Workers’ Right to Refuse Dangerous Work
Penalties for Noncompliance
OSHA adjusts its civil penalty maximums annually for inflation. As of the January 15, 2025 adjustment:
- Serious violation: up to $16,550 per violation.
- Willful or repeated violation: up to $165,514 per violation.
- Failure to abate: up to $16,550 per day past the deadline, generally capped at 30 days.
These are ceilings.11Occupational Safety and Health Administration. OSHA Penalties Actual amounts depend on severity, employer size, good-faith efforts, and violation history. A “serious” classification means the hazard could cause death or serious harm and the employer knew or should have known. “Willful” means intentional disregard or plain indifference. An employer that received credible threats, did nothing, and then experienced an attack is the textbook willful case.
Failure-to-abate penalties deserve attention. At $16,550 per day for up to 30 days, an uncorrected citation approaches half a million dollars.12Occupational Safety and Health Administration. 2025 Annual Adjustments to OSHA Civil Penalties
Where the Rules May Be Tightening
OSHA has been developing a dedicated workplace violence prevention standard for healthcare and social assistance since 2016. A request for information was published in December 2016, a small-business review panel completed its work in 2023, and a Notice of Proposed Rulemaking was anticipated in mid-2025.13Reginfo.gov. View Rule – RIN 1218-AD08 If finalized, it would be the first OSHA standard specifically addressing workplace violence, with enforceable requirements for written plans, training, and incident investigations for covered employers.
Several states have moved ahead of federal OSHA. California enacted broad workplace violence prevention requirements covering nearly all employers. Other states have focused on healthcare, retail, or public-facing workplaces. If your state operates its own occupational safety plan, check whether it imposes obligations beyond the federal floor.