One PPE certification OSHA requires, and one it stopped requiring in 2011

Safety managers routinely talk about "the two PPE certifications" as though both are mandatory paperwork under the same rule. They are not, and the difference is worth getting right before an inspector asks.

The Occupational Safety and Health Administration's general industry standard for personal protective equipment is 29 CFR 1910.132. Paragraph (d)(2) of that standard requires a written certification of hazard assessment. Paragraph (f) requires PPE training and requires each employee to demonstrate an understanding of it — but it no longer requires a written training certification. OSHA deleted that requirement, formerly paragraph (f)(4), in the Standards Improvement Project–Phase III final rule published June 8, 2011.

So the honest framing is: one document is required by the regulation, the other is a record you keep because it is the only practical way to prove the required training happened. Most employers should still produce both, and a clean training certificate is the easiest way to handle the second one. What follows is what each document actually contains, drawn from the text of the standard rather than from vendor templates.

---

1. The PPE hazard assessment certification

The hazard assessment comes first. Before selecting a hard hat or a face shield for anyone, the employer has to determine whether hazards requiring PPE are present at all.

What the standard requires

29 CFR 1910.132(d)(1) requires the employer to assess the workplace to determine if hazards are present, or are likely to be present, which necessitate the use of PPE. If they are, the employer must select the types of PPE that will protect each affected employee from the hazards identified, communicate those selection decisions to each affected employee, and select PPE that properly fits each affected employee. That fit requirement is part of the rule text, not a nicety.

The four required contents of the certification

1910.132(d)(2) is short and specific. The rule calls for written confirmation that the required workplace hazard assessment has been performed, in a certification that:

• identifies the workplace evaluated
• identifies the person certifying that the evaluation has been performed
• gives the date or dates of the hazard assessment
• identifies the document as a certification of hazard assessment

That is the whole list. The standard does not require the certification to enumerate every hazard found, does not require a signature block, and does not require the assessor to be a "competent person" — that term appears in other OSHA standards, not in 1910.132(d). A one-page document carrying those four elements satisfies the rule. Listing the hazards and the PPE selected is good practice and makes the record far more useful, but it is your addition, not OSHA's.

Which PPE the assessment covers

1910.132(g) limits the reach of paragraphs (d) and (f): they apply only to eye and face protection (1910.133), head protection (1910.135), foot protection (1910.136), hand protection (1910.138), and personal fall protection (1910.140). They do not apply to respiratory protection (1910.134) or electrical protective equipment (1910.137), which carry their own program requirements. Hearing protection sits under the noise standard, 1910.95, which has separate monitoring rules of its own.

When the assessment has to be redone

The standard sets no review interval — no annual deadline appears anywhere in 1910.132. What it does require is that the assessment reflect the hazards actually present, which means it has to be revisited when the workplace changes. Non-mandatory Appendix B to Subpart I puts the same idea in guidance form: reassess the workplace hazard situation as necessary by identifying and evaluating new equipment and processes, reviewing accident records, and re-evaluating whether previously selected PPE is still suitable. Many employers schedule a yearly walk-through simply because it is an easy way to make sure that reassessment happens.

The focus: the environment, not the person

A hazard assessment looks at the space, the machinery, the chemicals and the workflow. It says nothing about whether any particular employee knows how to use the gear.

---

2. PPE training and the training record

Once the assessment is done and the equipment is selected, the people wearing it have to be trained. This is where the older guidance floating around the internet goes wrong.

What 1910.132(f) requires

Paragraph (f)(1) requires the employer to train each employee who is required to use PPE, and each such employee must be trained to know at least five things:

1. When PPE is necessary
2. What PPE is necessary
3. How to properly don, doff, adjust, and wear PPE
4. The limitations of the PPE
5. The proper care, maintenance, useful life and disposal of the PPE

Paragraph (f)(2) adds the part that carries the real weight: each affected employee must demonstrate an understanding of that training, and the ability to use PPE properly, before being allowed to perform work requiring PPE. A video and a sign-in sheet do not meet that bar on their own.

What the standard no longer requires

Until 2011, 1910.132(f)(4) required a written certification containing the name of each employee trained, the date or dates of training, and the subject of the certification. OSHA removed that paragraph in the Standards Improvement Project–Phase III final rule, along with the parallel provisions in the shipyard PPE standard at 1915.152(e)(4) and in the general industry and construction cadmium standards at 1910.1027(n)(4) and 1926.1127(n)(4). The agency's stated reasoning was that the certification records did not themselves produce a safety or health benefit and that the paperwork burden — which OSHA put at over 1.8 million hours annually — was not justified. The same rule was explicit that removing the certification requirement does not change the employer's obligation to provide effective training.

Read the current text of 1910.132 on eCFR and you will find (f)(1), (f)(2) and (f)(3), then paragraph (g). There is no (f)(4).

Why you should still document it

The training obligation and the demonstration-of-understanding obligation both survived. If an inspector or a plaintiff's attorney asks how you know an employee understood the limitations of a face shield, "we trained everyone" is an assertion; a dated record naming the employee, the PPE covered, and the person who evaluated the demonstration is evidence. That record is now a defensive document rather than a regulatory one, which is a reason to keep it, not a reason to skip it. Our guide to what OSHA expects on a training certificate walks through the fields worth including.

Note also that other standards kept their own training-record requirements. If your people wear respirators, work around noise at or above the action level, or handle specific regulated substances, check that standard directly — the 2011 change was narrow.

When retraining is required

Paragraph (f)(3) requires retraining whenever the employer has reason to believe a trained employee lacks the required understanding and skill. It lists three circumstances, not as a closed set:

• Changes in the workplace render previous training obsolete.
• Changes in the types of PPE to be used render previous training obsolete.
• Inadequacies in an employee's knowledge or use of assigned PPE indicate the employee has not retained the requisite understanding or skill.

---

3. Direct comparison

| Feature | PPE hazard assessment certification | PPE training record | | :--- | :--- | :--- | | Written document required? | Yes — 29 CFR 1910.132(d)(2) | No longer required by 1910.132; the training itself is required by (f)(1)–(f)(3) | | Primary focus | The workplace, tasks and environmental hazards | The individual employee's knowledge and demonstrated skill | | Required contents | Workplace evaluated; person certifying; date(s); a statement identifying it as a certification of hazard assessment | Set by you — commonly employee name, date(s), PPE covered, evaluator | | Sequence | First; drives equipment selection | After selection, and before the employee does the work | | Trigger for update | New machinery, processes or layout that change the hazards | Workplace or PPE changes, or evidence the employee has not retained the training |

The cart-before-the-horse mistake

A common small-business pattern is to buy a generic PPE training video, have everyone watch it, print certificates, and never run a hazard assessment. That inverts the standard. You cannot meaningfully train someone on "what PPE is necessary" or "the limitations of the PPE" before you have determined which hazards exist and which equipment was selected for them. The assessment supplies the syllabus.

---

4. Why both documents earn their keep

Regulatory exposure

The hazard assessment certification is a discrete, easily checked document, which makes its absence an easy citation. OSHA's maximum penalties, as adjusted for inflation and applicable after January 15, 2026, are $16,550 per serious, other-than-serious or posting violation, $16,550 per day beyond the abatement date for failure to abate, and $165,514 per willful or repeated violation. State-plan states must adopt maximum penalty levels at least as effective as federal OSHA's.

Liability and workers' compensation defense

If a worker is hurt because they weren't wearing eye protection, the two documents answer two different questions. Without a hazard assessment, the argument is that you never identified the chemical splash hazard that called for a face shield rather than goggles. Without a training record, the argument is that the gear was handed over with no instruction on how to adjust it. Holding both shows you identified the hazard and confirmed the employee could handle the equipment.

Program discipline

The assessment forces management to look hard at the facility. The training record forces the same scrutiny on whether people can actually use what they've been given. Together they turn a pile of gear into a program.

5. How to run a PPE hazard assessment

Appendix B to Subpart I of Part 1910 is non-mandatory, but it is OSHA's own description of procedures that would comply with the hazard assessment requirement, which makes it the best starting point available.

1. Walk the floor. Appendix B opens with a walk-through survey of the areas in question. It cannot be done from a desk.
2. Look for the listed sources. The appendix names them: sources of motion, high temperatures, chemical exposures, harmful dust, light radiation such as welding, falling or dropped objects, sharp objects, rolling or pinching objects, workplace layout and the location of co-workers, and electrical hazards.
3. Sort by hazard category. Appendix B uses seven basic categories — impact, penetration, compression (roll-over), chemical, heat, harmful dust, and light (optical) radiation.
4. Review injury data. The appendix directs you to review injury and accident data to help identify problem areas. Your OSHA 300 form, formally the Log of Work-Related Injuries and Illnesses under 29 CFR 1904.29(a), plus first-aid reports, will point at the areas that keep producing incidents.
5. Organize and analyze. Group hazards by area or job role, then estimate the type, level of risk and seriousness of potential injury from each — including the possibility of exposure to several hazards at once.
6. Select and fit the equipment. Choose protection that exceeds the minimum needed, then fit the user and give instructions on care and use. Fit is a rule requirement under 1910.132(d)(1)(iii), not just guidance.
7. Write the certification. Produce the document with the four elements from 1910.132(d)(2), and label it plainly as a certification of hazard assessment.

6. How to run and document PPE training

1. Build the curriculum from the assessment. The hazards you identified determine what "when," "what" and "limitations" mean for your site.
2. Cover all five required topics. Necessity, selection, don/doff/adjust/wear, limitations, and care/maintenance/useful life/disposal.
3. Demonstrate the equipment. Show inspection, donning, doffing and adjustment on the actual gear the employee will wear.
4. Have the employee demonstrate back. Paragraph (f)(2) requires the employee to show understanding and the ability to use PPE properly before doing the work. This is the step that makes the record meaningful.
5. Evaluate honestly. Someone who cannot adjust a harness has not met (f)(2), whatever the sign-in sheet says.
6. Create the record. Name, date, the specific PPE covered, and who evaluated the demonstration. A certificate of completion format works well here and files cleanly alongside the employee's other certificates.

---

7. Common pitfalls

• The blanket assessment. One vague document covering the whole company. A receptionist and a forklift operator do not face the same hazards, and 1910.132(d)(2) asks you to identify the workplace evaluated.
• Skipping "useful life" in training. Employers often teach how to wear PPE and never teach how to inspect it. A cracked hard hat is decoration.
• Treating noise like a PPE-standard problem. Hearing protection runs on 1910.95, not on 1910.132(d) and (f). Add a louder machine and the noise standard's own monitoring rule applies: monitoring must be repeated whenever a change in production, process, equipment or controls increases exposures enough that additional employees may be exposed at or above the action level — an 8-hour time-weighted average of 85 decibels — or that existing hearing protectors may no longer attenuate adequately.
• Verbal-only training. The written certification requirement is gone, but the burden of showing that training happened and was understood has not moved. An undocumented training session is very hard to prove years later.
• Assuming the 2011 change applies everywhere. It removed specific paragraphs in specific standards. Other standards still require training records with named contents.

---

8. Frequently asked questions

Who is qualified to conduct a PPE hazard assessment?

1910.132 does not name a qualification. The certification has to identify "the person certifying that the evaluation has been performed," and that is the extent of the rule. Appendix B refers to the safety officer exercising common sense and appropriate expertise. In practice the assessment is done by whoever knows the operations and the hazards well enough to match equipment to risk — often a safety manager, an industrial hygienist or an experienced supervisor.

Does the employee have to sign the PPE training record?

There is no signature requirement in 1910.132, because the training certification paragraph that once specified contents was removed in 2011. Since the record now exists for your own protection, a signature from both the employee and the evaluator is worth collecting; it makes "nobody ever trained me" much harder to argue.

Can these documents be electronic?

Nothing in 1910.132(d)(2) requires paper — it requires a written certification. The practical test is whether you can produce it, readable and complete, when it is asked for. OSHA takes a comparable position on injury recordkeeping at 1904.29(b)(5), which allows computer-kept records provided the system can produce equivalent forms when needed.

Do these rules cover voluntarily worn PPE, like a comfort dust mask?

Respirators sit outside this discussion entirely. 1910.132(g) states that paragraphs (d) and (f) do not apply to 1910.134, the respiratory protection standard. Voluntary respirator use has its own requirement: Appendix D to 1910.134 is a mandatory information sheet that must be given to employees using respirators when not required under the standard. Check the standard covering the specific equipment rather than assuming 1910.132 governs it.

How long should a PPE training record be kept?

1910.132 sets no retention period, so there is no federal answer to point to for PPE training records specifically. Retention is a business and legal-defense judgement, and the sensible floor is the length of employment plus whatever your state's limitation period for injury claims runs to — ask your counsel or insurer rather than picking a number. Other standards are explicit where OSHA wanted them to be: 1910.95(m)(3) requires noise exposure measurement records for two years and audiometric test records for the duration of employment, and substance-specific standards such as lead and asbestos impose longer terms.

---

This is general information, not legal advice

Everything above is general guidance, not legal advice, and reading it creates no attorney-client relationship. OSHA amends its standards — the training certification paragraph discussed here is a live example — so confirm the current text of any provision before relying on it. About half the states run their own OSHA-approved plans, and a state plan may impose requirements stricter than the federal standard.

Every state also offers a free On-Site Consultation service for smaller employers, funded by OSHA and kept separate from enforcement. Booking one costs nothing and is a better way to find gaps than an inspection.

Conclusion

The two documents answer two different questions. The hazard assessment certification, required in writing by 1910.132(d)(2) with four specific contents, records that you examined the workplace and determined what protection the work demands. The training record, no longer mandated by 1910.132 but still the only realistic proof that the training required by 1910.132(f) happened and was understood, records that the people wearing the equipment can actually use it.

Write the assessment first, teach from it, watch each employee demonstrate the gear, and keep a dated record of who was trained on what. That sequence is what the standard is describing, and it holds up whether the person asking is an inspector, an insurer or an attorney.