Is a written PPE program required by OSHA?

OSHA does not mandate a single written PPE program document the way it does for respiratory protection, but Subpart I requires a hazard assessment with a written certification, training with proof of understanding, and other obligations. Most employers document the whole thing as a written program because it is the only practical way to prove each requirement was met.

Does the employer have to pay for PPE?

Yes, for PPE required to comply with OSHA standards, under the payment rule at 1910.132(h). The narrow exceptions are non-specialty safety-toe footwear and non-specialty prescription safety eyewear that the employer allows to be worn off the job site, plus ordinary weather gear and everyday clothing. Specialty PPE is the employer's cost.

Why is PPE considered the last line of defense?

Because PPE does not remove the hazard; it places a barrier between the worker and a hazard that still exists, and it only protects when worn correctly every time. The hierarchy of controls ranks elimination, substitution, engineering, and administrative controls above PPE because they reduce the hazard itself rather than relying on the worker.

What training does a PPE program require?

OSHA 1910.132(f) requires training on when PPE is necessary, what type is needed, how to put it on, take it off, adjust, and wear it, its limitations, and its care and useful life. Employees must demonstrate understanding before doing PPE-required work, and be retrained when the workplace conditions or the PPE change.

How is a PPE program different from a PPE hazard assessment?

The hazard assessment is the first step of the program, not the whole thing. The assessment identifies which hazards require PPE and is documented in a written certification. The program is everything built on top of it: selection, fit, training, maintenance, and payment. You cannot build the program without the assessment underneath it.

Building a PPE Program (OSHA 1910.132)

Q: What is a PPE program?

It is the employer's connected system for protecting workers with personal protective equipment under OSHA Subpart I: assessing hazards, selecting appropriate PPE, ensuring it fits, training employees, maintaining and replacing gear, and paying for required PPE. A stock of equipment is not a program; the connected decisions and records are.

The six building blocks OSHA's PPE standards require, the order to build them in, and why the employer pays for required gear.

A PPE program is the employer's complete system, built under OSHA 29 CFR 1910.132 and Subpart I, for protecting workers with personal protective equipment: a hazard assessment, PPE selection, employee training, proper fit, maintenance, and the rule that the employer pays for required gear. PPE is the last line in the hierarchy of controls, not the first.

A pile of hard hats and safety glasses is not a program. A program is the connected set of decisions that says which hazards exist, what defends against them, who is trained, whether it fits, and who paid. OSHA's PPE standards, gathered in Subpart I of the general industry rules, describe all of it. This post lays out the pieces and the order they go in, using the standards as the reference. It is educational, not legal advice.

What is a PPE program under OSHA?

OSHA does not use the words "written PPE program" the way it mandates a written program for respiratory protection or lockout. Instead, Subpart I requires a set of connected obligations: assess hazards, provide and select appropriate PPE, ensure it fits, train employees, and pay for it. Put those obligations together and you have a program, and most plants write it down because a documented program is the only practical way to prove each piece was done. The backbone standard is 1910.132 (general requirements), and it is joined by 1910.133 (eye and face), 1910.135 (head), 1910.136 (foot), 1910.138 (hand), and 1910.134 (respiratory), each covering a body region.

The six connected parts of a PPE program. PPE sits at the bottom of the hierarchy of controls, so the program should always ask whether a hazard can be removed before it is worn against.

Why is PPE the last line of defense?

Because PPE does not remove the hazard; it puts a barrier between the worker and a hazard that is still there, and it only works if the worker wears it correctly every single time. The NIOSH hierarchy of controls ranks protections by effectiveness: elimination, substitution, engineering controls, administrative controls, then PPE. A guard that makes it impossible to reach the pinch point protects everyone automatically; a cut glove protects only the hand that remembered to put it on. A mature PPE program is honest about this. Before it standardizes a glove for a task, it asks whether the sharp edge can be engineered away, the same question that drives machine guarding and a job safety analysis. PPE is what you use for the residual hazard that the higher controls could not reach.

How do you build a PPE program? Step by step

The program is built in an order, because each step depends on the one before it.

Do the hazard assessment first. You cannot select PPE for hazards you have not named. Run the task-by-task PPE hazard assessment and write its certification; everything downstream depends on it.
Select PPE that matches each hazard and meets the standard. Eye protection to the ANSI Z87.1 standard, foot protection to the applicable ASTM standard, and so on. Match the type to the hazard: a chemical-splash goggle is not a substitute for an impact face shield. Document the selection next to the hazard it addresses, so anyone can trace why a given item is on the list. A selection with no hazard behind it is clutter; a hazard with no selection behind it is an exposure that will surface in the next incident.
Get the fit right for each worker. PPE that does not fit does not protect and often does not get worn. Fit matters most for tight-fitting respirators, which need formal fit testing under the respiratory protection program but it matters for gloves, glasses, and harnesses too.
Train every affected employee. OSHA 1910.132(f) requires training on when PPE is necessary, what type, how to put it on and take it off and adjust it, its limitations, and its care and useful life. Employees must show they understand before doing work that requires PPE, and be retrained when the workplace or the PPE changes.
Maintain, inspect, and replace it, and confirm the employer pays for required PPE. Damaged or worn gear gets pulled and replaced; the program keeps the equipment in reliable condition, not just in the building.

Who pays for PPE?

The employer, for PPE required to comply with OSHA standards. The employer-payment rule at 1910.132(h) took effect in 2008 and settled a long argument: with narrow exceptions, if OSHA requires the PPE, the employer pays for it, and the employer also pays for replacements, unless the worker lost or intentionally damaged the item. The exceptions are limited. The employer does not have to pay for non-specialty safety-toe footwear or non-specialty prescription safety eyewear when it allows the worker to wear those items off the job site, and it does not have to pay for ordinary weather gear or everyday clothing. But specialty items, a prescription lens insert for a full-face respirator, metatarsal footwear the employer requires, chemical gloves, welding PPE, are on the employer's tab. "Bring your own gloves" is not a compliant PPE program.

The employer-payment rule in one path: if an OSHA standard requires the PPE, the employer pays, with narrow exceptions for non-specialty footwear, prescription eyewear, and everyday weather gear.

Body region	Common PPE	OSHA standard
Eyes / face	Safety glasses, goggles, face shields	1910.133
Head	Hard hats	1910.135
Feet	Safety-toe footwear, metatarsal guards	1910.136
Hands	Cut, chemical, and heat gloves	1910.138
Lungs	Respirators (own written program)	1910.134
Whole body / general	Assessment, selection, training, payment	1910.132

What does PPE training actually have to cover?

OSHA 1910.132(f) is specific about the training, and it is more than "wear your glasses." Each employee who has to use PPE must be trained to know at least five things: when PPE is necessary, what PPE is necessary, how to put it on and take it off and adjust and wear it properly, the limitations of the PPE, and its proper care, maintenance, useful life, and disposal. The limitations item is the one plants skip, and it matters most. A worker who thinks a dust mask protects against solvent vapor, or that a leather glove stops a chemical, is more dangerous than one wearing nothing, because they will lean into a hazard they believe they are protected from. Training also has to land before the work starts, and each employee must demonstrate they understand it and can use the PPE correctly. Retraining is required when the workplace changes, when the PPE changes, or when a worker shows by their behavior that they did not retain the first round. Keep the training records with the assessment, because in an inspection OSHA reads them together.

How do you keep a PPE program alive?

Tie it to change and to the floor. Reassess PPE when a task, chemical, or machine changes; retrain when the PPE or the hazard changes; and inspect gear on a schedule so worn equipment gets replaced before it fails. Pull single PPE requirements into toolbox talks so the "why" stays fresh, and route any PPE-related near miss a glove that failed, glasses that fogged and got removed, back into the assessment. A periodic safety audit should check not just whether PPE is stocked, but whether the assessment, training records, and payment all line up behind it.

What do the numbers say?

The standards and their reach, from the primary sources:

The general PPE requirements are in OSHA 29 CFR 1910.132 and the employer-payment rule is at paragraph (h); the body-specific standards run from 1910.133 through 1910.138.
The hierarchy of controls that puts PPE last is NIOSH's; see the NIOSH hierarchy of controls.
Eye, hand, and foot protection standards sit among OSHA's more frequently cited PPE rules, most often for missing hazard assessments and untrained or unequipped workers, per OSHA enforcement data at osha.gov.

Every one of those citations is a program with a hole in it: gear but no assessment, or an assessment but no training. The program is what closes the holes.

The recurring failure is fragmentation: the assessment lives in one binder, training sign-offs in another, PPE inventory in a spreadsheet, and nobody can see them as one system, so gaps hide in the seams. Harmony is an AI-native layer that connects machines, software, and paperwork into one operational layer, with no rip-and-replace. The assessment, PPE selections, training records, and inspection logs become structured data, and AI search returns cited answers across them, so "what PPE does this task require, is this worker trained on it, and when was the gear last inspected" is one question instead of three folders. It is the everyday shape of connected worker technology and it is not a safety-compliance product. Harmony's digital workflows move those forms and handoffs into that structure; the CLS case study shows the pattern. Build the program in order, keep it tied to the tasks, and PPE becomes the last line that actually holds.