Guide · Regulatory Requirements

Emergency Action Plan (OSHA 1910.38): What It Actually Requires

By Mandy-Lynn Aitken — 30 years on both sides of the supply-chain auditUpdated October 16, 2026

Most emergency action plans on file were written once, by one person, for one headcount, and never touched again. That passes a desk audit right up until the day a shift lead can't find the plan, or the plan still lists a department that was reorganized two years ago. Here is exactly what 29 CFR 1910.38 requires, what it does not cover, and how to build a plan that survives the day you actually need it.

What is an emergency action plan?

Under 29 CFR 1910.38, an emergency action plan (EAP) governs what your organization does during an emergency — a fire, a chemical release, a structural failure, an earthquake, or anything else that forces an evacuation or a shutdown of normal operations. That is a narrower job than people assume: it responds to the emergency already underway. Stopping one from starting in the first place is a separate standard, covered below.

Employers must keep the plan in writing and make it available to employees for review. The one exception: employers with 10 or fewer employees may communicate the plan orally. The six required elements still have to exist either way — the exception is about the medium, not the substance.

The six elements OSHA actually requires — 1910.38(c)

This is the part most templates get wrong by paraphrasing it. The regulation lists exactly six elements. A plan missing any one of them is not compliant, regardless of length or polish:

1. Procedures for reporting a fire or other emergency. Who gets called, how, and in what order — the first sixty seconds of the plan.
2. Procedures for emergency evacuation, including the type of evacuation and exit route assignments. “Leave the building” on its own assigns no exit, no zone, and no rule for when a partial evacuation applies instead of a full one.
3. Procedures for employees who remain to operate critical plant operations before they evacuate. Someone has to shut down a line, close a valve, or secure a system before they leave — name who, and what they do.
4. Procedures to account for all employees after an evacuation. A muster point with no roster is not an accounting procedure.
5. Procedures for employees performing rescue or medical duties. Who is trained, what they are allowed to do, and where the first-aid or AED equipment actually is.
6. The name or job title of every employee who may be contacted for more information about the plan, or an explanation of their duties under it. Name the title. A person leaves; the title stays staffed.

If your current plan reads as one paragraph of general reassurance instead of six distinct, assignable procedures, it will not hold up to either an OSHA inspection or a customs validation interview that asks you to walk through it.

What “written” actually means, and what an inspector checks first

A written plan is only written if it is available for employee review — a file on a server nobody can reach during a power outage does not satisfy 1910.38. In practice, an inspector (or a customs validator asking the same question in different language) checks three things before reading a single page: can a random employee, not the person who wrote the plan, tell you where it is; does that employee know which of the six elements applies to their own role; and does the plan match the building as it actually exists today — current exits, current departments, current names or titles. A plan that fails any one of those three is treated as not having passed, regardless of how complete the document itself looks.

Do this one thing before you read any further

Pull up your current plan and find the name of one specific person in it — a department head, a floor supervisor, whoever is listed as the contact under element six. Now check: does that person still work there, in that role, on that shift? In twenty-plus years of sitting across the table from both auditors and the companies being audited, that single check is the fastest way to find out whether a plan is a living document or a filed one. If the name is wrong, the rest of the plan is worth re-checking too.

A requirements checklist — what has to exist before you call the plan done

• All six elements of 1910.38(c) are present as distinct, assignable procedures — not one paragraph of general reassurance.
• The plan is in writing, unless the organization has 10 or fewer employees and has chosen the oral-communication exception.
• Enough employees are designated and trained to assist in a safe, orderly evacuation — a real number per shift and per zone, not an assumption.
• Every employee has had the plan reviewed with them: at initial assignment, whenever their responsibilities under it change, and whenever the plan itself changes.
• The plan names roles by job title. Writing a person's name instead is the single most common reason a plan goes stale within a year.
• Exit route assignments match the building as it is built today, not as it was built when the plan was last written.
• A fire prevention plan exists separately, if your operations are covered by 1910.39 — see the comparison below.

Emergency action plan vs. fire prevention plan — they are not the same document

1910.38 (emergency action plan) and 1910.39 (fire prevention plan) get merged into one document constantly, and that is itself a finding. They answer different questions:

• Fire prevention plan (1910.39) stops the fire starting: a list of major fire hazards and how they're handled and stored, control of ignition sources, housekeeping procedures for combustible and flammable waste, a maintenance schedule for heat-producing equipment, and the name or job title of whoever is responsible for maintaining that equipment and for controlling fuel-source hazards.
• Emergency action plan (1910.38) governs what happens once something is already underway: report, evacuate, account for people, hand off critical operations, perform rescue or medical response.

Most facilities need both. Neither one substitutes for the other, and an auditor who sees them fused into a single generic “safety plan” will usually ask you to separate them — because the six elements of 1910.38 and the five elements of 1910.39 don't map cleanly onto each other.

Training, designation, and review — the parts that expire

Two requirements keep a plan alive after it's written:

• Designation and training (1910.38(e)).The employer must designate and train enough employees to assist in a safe and orderly evacuation of everyone else. “Enough” is a real number per shift, per floor, per zone — not a blanket assumption that someone will know what to do.
• Review (1910.38(f)).The plan must be reviewed with each covered employee: when the plan is first put in place or the employee is first assigned, whenever that employee's responsibilities under the plan change, and whenever the plan itself changes. A plan that still names a department head who left eighteen months ago has failed this requirement, even if nobody has noticed yet.

What a genuinely thorough plan adds beyond OSHA's floor

1910.38 sets the minimum. A plan built to actually be used in the moment — not just filed — adds a small set of physical artifacts that the regulation never requires but that make the difference between a document and a capability:

• A wall-poster drill card at each muster point and exit, showing the evacuation route and the accounting procedure in a form that works when nobody can open a laptop.
• An accountability roster that updates in real time with who is on-site, not a printout from the morning shift change.
• A one-page drill log recording every practice evacuation — date, duration, who was accounted for, what went wrong.
• A damage assessment log for the period immediately after an event, before the full continuity plan activates.
• An after-action form that turns every real event or drill into a named correction with an owner and a deadline — the same discipline a corrective action plan uses in a supplier assessment.
• An annual review sign-off — a dated signature confirming the plan was reviewed, not an assumption that it still matches reality.

None of these are optional add-ons for their own sake. Each one answers a specific question an auditor, a validator, or your own incident commander will actually ask: where is it, who is accounted for, what happened last time, and when was this last checked.

A worked example: shipping and receiving, department by department

A plan written for “all employees” fails the moment two departments need to do different things at the same minute. Here is how the six elements actually land across a typical import or manufacturing site when something happens on the floor:

• Receiving: stops intake, secures open trailers and seals in progress, reports the location and nature of the emergency to the designated contact, moves to the primary muster point.
• Shipping: halts outbound loading, secures already-sealed trailers (seal integrity matters here even mid-emergency — a compromised seal is its own incident), accounts for drivers currently on-site.
• Operations / plant floor: executes the critical-operations shutdown sequence named in element three — the specific valves, lines, or systems that cannot simply be abandoned — before evacuating.
• IT: if the emergency is a system or cyber event rather than physical, triggers the data and access-control procedures; if physical, secures or evacuates with equipment left running per the shutdown sequence, never attempting a shutdown that isn't pre-authorized.
• HR: owns the accounting procedure — the actual roster check against who was on-site, not just a headcount at the muster point.
• Security / executive: owns external reporting (fire department, police, customs where cargo security is implicated) and is the named contact under element six.
• Customer service: handles outbound communication to customers and carriers whose shipments are affected — not part of 1910.38 itself, but the function that keeps a life-safety event from also becoming an unmanaged customer crisis.

Write the plan this way — department by department, stage by stage — and the same document holds up whether an OSHA compliance officer asks for it or a customs validator asks you to walk through it out loud.

Where the emergency action plan meets your supply chain obligations

OSHA 1910.38 is scoped to life safety inside the four walls of one workplace. It was never meant to cover what happens to the rest of your supply chain when that workplace goes down — and that gap is exactly where C-TPAT and PIP pick up. CBP's C-TPAT minimum security criteria expect written procedures that address crisis management, business continuity, security recovery plans, and business resumption— a broader, trade-facing continuity layer. CBSA's PIP folds the same expectation into its Corporate Security category, under risk assessment and planning.

A compliant emergency action plan is the life-safety floor. It is not a business continuity plan, and neither CBP nor CBSA treats it as one.

If your emergency action plan is solid but nothing says how you keep shipping, keep paying suppliers, or keep a customs-sensitive shipment secure after the people are safely out of the building, that is the next document to build — see our business continuity plan template guide.

Hazard-specific, department-by-department versions

This guide covers what 1910.38 requires in general. We also build the same stage-by-stage before/during/after/resume structure out for a named hazard — an earthquake, a severe-weather event, a prolonged power or IT outage — applied department by department. See the Business Emergency Preparedness hub for what is live now.

Frequently asked questions