Nobody wants to keep a federal log with a pen. The first question most employers ask when they take over recordkeeping is whether the OSHA 300 Log can live in a spreadsheet or a piece of software instead of on OSHA's printed form — and the answer is an unambiguous yes. The recordkeeping rule has allowed electronic records since it was rewritten in 2001, and OSHA reaffirmed the position as recently as an April 2025 interpretation letter.
But "you may keep the log on a computer" is the beginning of the rule, not the end of it. The regulation attaches conditions — an equivalence test with three parts, two production deadlines your system must be able to beat, and a posting duty that electronic storage explicitly does not satisfy. Employers who miss those details end up with a log that is convenient all year and non-compliant in the two moments that matter: an inspection and posting season.
This guide walks through exactly what 29 CFR 1904.29 and 1904.32 require, what OSHA's own FAQs and interpretation letters add, and where spreadsheets tend to quietly fail the test.
What the Regulation Actually Says
Two provisions of 29 CFR 1904.29(b) do the work.
First, 1904.29(b)(4) permits substitutes for the official forms and defines the standard: an equivalent form is one that "has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces."
Second, 1904.29(b)(5) answers the computer question directly. May you keep your records on a computer? "Yes, if the computer can produce equivalent forms when they are needed, as described under §§ 1904.35 and 1904.40, you may keep your records using the computer system."
Read together: the medium is free, the output is regulated. OSHA does not care whether your log lives in a database, a spreadsheet, or a filing cabinet. It cares that when someone with a legal right to see the records asks for them, what comes out is equivalent to the official forms — and that it comes out fast enough.
The Three-Part Equivalence Test
Each part of the (b)(4) definition rules out a real failure mode.
Same information
Your electronic 300 Log must capture everything the official form captures: the case number, employee name (or "privacy case"), job title, date, location, description, the G–J classification checkboxes, the K and L day counts, and the M-column injury/illness type. A tracking system that logs incidents but has no field for restricted-duty day counts, or no way to mark a privacy case, is not an equivalent form no matter how good the rest of it is. The same goes for the 301 incident report behind each log line and the 300A summary at year-end — each has its own required content, and each form has its own job.
As readable and understandable
The produced output has to make sense to a reader who knows the OSHA form — an inspector, an employee, an insurance auditor. A raw database export with cryptic column headers fails this part even if every data point is present. In practice this means your system should be able to print or display something laid out recognizably like the 300, 301, and 300A.
Completed using the same instructions
This is the part that actually catches people. The official forms embed rules in their instructions: check only the single most serious outcome column per case, count calendar days rather than scheduled workdays, cap day counts at 180, start counting the day after the injury. An equivalent form must be completed by those same rules. A spreadsheet will happily let you check two outcome columns, count only weekdays, or run a day count to 300 — and every one of those makes your log wrong, not just your format.
The 2025 confirmation
In an interpretation letter dated April 29, 2025, OSHA confirmed to a software vendor that electronically generated forms — including records maintained in formats like Excel or CSV — are acceptable if they meet the equivalency standards of 1904.29 and 1904.32. Two details from that letter are worth knowing: any substitute 300A must carry the certification statements and employee-access language from the official form, and OSHA does not endorse, approve, or certify any vendor's product — no software can truthfully claim to be "OSHA-approved."
The Two Production Clocks
Section 1904.29(b)(5) conditions computer storage on producing equivalent forms "when they are needed, as described under §§ 1904.35 and 1904.40." Those two sections are deadlines:
- Employees: end of the next business day. When a current or former employee, a personal representative, or an authorized employee representative requests copies of the 300 Log, you must provide them by the end of the next business day. Who can ask for what — including the narrower rules for 301 reports — is covered in our guide to employee access rights under 1904.35.
- Government: four business hours. When an authorized representative of OSHA, NIOSH, or a state-plan agency asks for your records during an inspection or investigation, 1904.40 gives you four business hours to produce them. If the records are kept in a different time zone — a corporate office two zones away, or a cloud system administered elsewhere — you may use the business hours of the location where the records are maintained.
The four-hour clock is the practical test of any electronic system. If producing a readable 300 Log requires the one person who knows the spreadsheet, a password nobody else has, or IT support from another office, your storage system can fail an inspection before a single entry is examined.
Run the fire drill
Pick a random morning and have someone other than your recordkeeper produce the current 300 Log, one 301, and last year's 300A within four hours. If they can't, fix the access problem now — 1904.40 does not have an exception for "the person who maintains it is on vacation."
Paper output is the default answer to a records request, but it is not always mandatory: OSHA's 2025 letter confirms you may provide copies in an electronic format if the person requesting the records agrees to receive them that way.
Centralized Electronic Records for Multi-Site Employers
Electronic recordkeeping pairs naturally with centralization, and 1904.30(b)(2) expressly allows it: you may keep the records for all establishments at headquarters or another central location if you meet two conditions. Information about each recordable case must reach the central location within seven calendar days of you learning about it — the same clock as the entry deadline itself — and you must be able to produce and send the records back to the establishment within the 1904.35 and 1904.40 time frames when someone entitled to them asks.
Note what centralization does not change: you still keep a separate log per establishment, no matter where the data physically lives. A single company-wide log covering three warehouses fails the equivalence test at all three of them. The per-location rules — and the traveling-employee wrinkles that come with them — are covered in our multi-establishment recordkeeping guide.
What Electronic Storage Does Not Cover
The clean rule of thumb: electronic recordkeeping changes where the records live, and nothing else. Three duties in particular survive untouched.
The 300A must still be physically posted
OSHA has answered this directly in its recordkeeping FAQ: electronically "posting" the annual summary — on an intranet, by email, on a shared drive — does not satisfy 1904.32(b)(5). A copy of the 300A must be posted in each establishment, in the conspicuous place where employee notices normally go, from February 1 through April 30. The recordkeeping rule's flexibility about computers applies to storage, not to posting. However you keep the log, one sheet of paper ends up on the wall every February — even in a year with zero recordable cases.
Certification can be electronic — but it gets printed
A company executive must certify the 300A after reviewing the log. In a 2009 interpretation letter, OSHA confirmed that an electronic signature is acceptable for that certification — the regulation does not prohibit it — but with a condition that closes the loop: the electronically certified summary must be printed and posted in the workplace for the standard February-through-April window. E-signature workflows are fine; a certification that exists only inside your software is not.
Keeping the log in software is not the same as submitting to OSHA
Electronic recordkeeping under 1904.29 and electronic submission under 1904.41 are separate obligations that happen to share an adjective. Keeping a compliant electronic log does not send anything to OSHA; covered establishments must separately submit their 300A data (and, for the largest establishments in designated industries, 300/301 case data) through the Injury Tracking Application by March 2 each year. The ITA submission walkthrough covers who is covered and how the upload works.
Privacy Cases in an Electronic System
The privacy-concern rules of 1904.29(b)(6)–(9) apply with full force to electronic records, and they are worth designing for rather than bolting on. For the six privacy-case categories, the log must say "privacy case" instead of the employee's name, and you must keep a separate, confidential list linking case numbers to names. In an electronic system, that means the produced 300 Log can never render the name on a privacy-case line, and access to the name linkage should be restricted to the people who genuinely need it. A spreadsheet where the "real name" sits in a hidden column on the same tab is exactly the kind of design that fails the moment someone prints the log for an access request. The full rules — including when to withhold detail from the description column itself — are in our privacy-concern cases guide.
Where Spreadsheets Quietly Fail
A spreadsheet is a legitimate equivalent form on the day you build it — OSHA's 2025 letter says as much about Excel and CSV formats. The compliance risk is not the medium; it is that a spreadsheet enforces nothing afterward:
- Classifications go stale. The most-serious-outcome column must track each case as it evolves, and the update duty of 1904.33(b)(1) keeps the log alive for its full five-year retention window. Nothing in a spreadsheet nags you when a case that started as "other recordable" turns into days away.
- Day counts stop accruing. Columns K and L should grow until a case closes or hits the 180-day cap. A cell typed once and never revisited is the single most common drift.
- Totals stop reconciling. The 300A must equal the sum of the log lines beneath it. Formulas break, rows get inserted outside the sum range, and the mismatch surfaces at the worst possible moment — on a posted, certified summary an inspector is comparing to the log.
- The instructions live in someone's head. "Same instructions" is a property of how the form is completed, not just its layout. When the person who knew the counting rules leaves, the spreadsheet keeps accepting whatever the next person types.
None of these are arguments against electronic recordkeeping — they are arguments for electronic recordkeeping that enforces the rules instead of merely storing the data.
Frequently Asked Questions
Is it legal to keep the OSHA 300 Log in Excel?
Yes. OSHA permits records "on a computer" under 1904.29(b)(5), and a 2025 interpretation letter confirms formats like Excel and CSV are acceptable — provided the output meets the equivalent-form test and the system can produce forms within the 1904.35 and 1904.40 deadlines.
Do I ever have to print anything?
Yes, at least once a year: a copy of the certified 300A must be physically posted in each establishment from February 1 to April 30 — electronic posting does not satisfy the rule. Paper is also the default for access requests, though a requester can agree to receive electronic copies.
Can the 300A be signed electronically?
Yes. OSHA confirmed in 2009 that electronic signatures may satisfy the certification requirement — but the electronically certified summary must then be printed and posted for the February–April window.
Is there OSHA-approved recordkeeping software?
No such thing exists. OSHA does not endorse, approve, or certify any product. Any vendor claiming "OSHA-approved" or "OSHA-certified" status is misstating how the rule works — compliance is a property of your records, not of the software brand.
Does keeping the log electronically satisfy the March 2 submission?
No. Electronic recordkeeping (1904.29) and electronic submission through the ITA (1904.41) are independent duties. Covered establishments must do both.
Choose the Medium, Keep the Discipline
The regulation gives you the medium for free: any system that captures the same information, reads like the official forms, follows the same instructions, and produces equivalent output on the 1904.35 and 1904.40 clocks is compliant. What the regulation never waives is the discipline — the 7-day entries, the evolving classifications, the reconciled totals, the printed 300A on the wall each February.
LogStead is built as an equivalent-form system in exactly this sense: cases are entered against the same 1904 rules the official instructions impose, day counts and most-serious-outcome classifications stay current as cases evolve, privacy-case names live only on the separate confidential list, and the printable 300, 301, and 300A — plus the ITA-ready export — are generated from the same log lines on demand, well inside the four-hour clock. If you are weighing whether a case belongs on the log in the first place, start with the free recordability checker.