What Should an Office Emergency Action Plan Include? (w/Examples) + FAQs

An office Emergency Action Plan (EAP) must include, at minimum, procedures for reporting emergencies, evacuation routes and exits, procedures for employees who stay behind to operate critical operations, accounting for all employees after evacuation, rescue and medical duties, the name or job title of people to contact for more information, and an employee alarm system. These seven elements are the non-negotiable floor set by the federal OSHA emergency action plan standard at 29 CFR 1910.38, and ignoring any one of them can trigger citations, fines, and civil liability.

The problem is that most offices treat their EAP like a dusty binder nobody reads. When a fire, active shooter, earthquake, or chemical spill hits, employees freeze, managers improvise, and people get hurt. The governing rule — 29 CFR 1910.38 — requires a written plan for any employer with more than 10 employees, and failing to have one in place is a serious violation that currently carries penalties of up to $16,550 per violation and $165,514 per willful or repeat violation under the OSHA penalty schedule.

According to the U.S. Fire Administration’s nonresidential fire statistics, office and mercantile properties experience over 100,000 fires each year, causing hundreds of millions of dollars in direct property loss — a reminder that “it won’t happen here” is the most expensive assumption in workplace safety.

Here is what you will walk away knowing:

• 🔥 The seven OSHA-mandated elements every office EAP must contain
• 🚪 How to build evacuation routes that satisfy ADA and NFPA 101 Life Safety Code requirements
• 🚨 How to handle fire, active shooter, earthquake, severe weather, bomb threats, medical emergencies, chemical spills, pandemics, and power outages
• ⚖️ The legal exposure you face under OSHA, the ADA, workers’ compensation, and premises liability
• 📋 A ready-to-adapt template, named scenarios, and the top mistakes that get offices cited

The Legal Backbone of an Office EAP

Every office EAP in the United States sits on top of one federal rule and a stack of related standards. The anchor is 29 CFR 1910.38, which applies whenever another OSHA standard requires an EAP or when the employer chooses to have one. Related rules include the fire prevention plan standard at 29 CFR 1910.39, the exit route standards at 29 CFR 1910.36 and 1910.37, and the portable fire extinguisher rule at 29 CFR 1910.157.

In plain English, if your office has more than 10 people, you must have a written, accessible plan. The consequence of skipping the writing step is an automatic citation during any OSHA inspection, even if no injury ever occurs. A real example: a mid-size accounting firm in Ohio was cited after a small kitchen fire because the plan existed only in the owner’s head. A common misconception is that “we have a fire drill once a year” satisfies the rule — it does not, because the rule demands written procedures, assigned roles, and documented training.

State plans add more. Cal/OSHA Section 3220 mirrors the federal rule but applies to all California employers regardless of size for certain elements. New York’s Public Employee Safety and Health (PESH) program extends OSHA-style obligations to public-sector offices. Texas defers to federal OSHA for private employers but imposes its own Texas Hazard Communication Act for chemical risks. The consequence of ignoring state overlays is dual liability — a federal citation plus a state penalty — which is how small employers end up with fines that dwarf the cost of the plan itself.

Who Must Have a Written Plan

The 10-employee trigger in 1910.38(b) is the most misunderstood line in the standard. Employers with 10 or fewer employees may communicate the plan orally, but every other employer must keep the plan in writing, at the workplace, and available for employee review. The consequence of getting this wrong is losing the “good faith” reduction during penalty calculation.

Imagine Priya, who runs a 12-person marketing agency in Austin. She believed her Slack channel counted as “written.” An OSHA compliance officer disagreed, and the firm received a $7,000 serious citation. The fix was a three-page PDF stored on the shared drive and posted near the exit — a common, low-cost remedy.

How State Rules Layer on Top

Federal OSHA sets the floor, not the ceiling. State-plan states such as California, Oregon, Washington, Michigan, and 22 others can — and do — impose stricter rules. The consequence of treating federal compliance as enough in a state-plan state is citations under the stricter state code.

For example, California requires a written Injury and Illness Prevention Program (IIPP) in addition to the EAP. A law office in San Diego that copied a generic federal template was cited under the IIPP rule because the plan did not identify a named person responsible for hazard correction. The misconception here is that one document can cover both rules — it cannot, because each standard requires distinct content.

The Seven Required Elements of an Office EAP

OSHA’s rule is short, and that brevity trips employers up. Every written plan must contain the seven minimum elements listed in 29 CFR 1910.38(c). Miss one, and the plan is defective on its face.

1. Procedures for Reporting a Fire or Other Emergency

The plan must say exactly how employees report an emergency. That means listing the phone number, the pull-station location, the intercom code, or the app used to raise an alarm. The consequence of vague language is delay, and delay kills — the NFPA reports that flashover in an office fire can occur in under three minutes.

A real example: Marcus, a paralegal in a Chicago high-rise, smelled smoke in a server closet. The plan said “notify management,” but did not list a number. He wasted 90 seconds searching the directory before pulling the alarm. A common misconception is that 911 is always the first call — in many buildings the life safety code requires the building fire command center to be notified first so elevators can be recalled.

2. Procedures for Emergency Evacuation

The plan must describe evacuation types and exit route assignments. This includes primary and secondary routes, stairwell assignments, muster points, and rules about elevators. The exit route standard at 29 CFR 1910.37 requires that exits be free, unobstructed, adequately lit, and marked with signs meeting 1910.37(b)(7).

The consequence of blocked exits is severe: the 1991 Happy Land fire and the 2003 Station Nightclub fire both pushed courts to hold managers personally liable for locked or obstructed doors. In an office context, a boxed-in rear exit at a Phoenix insurance firm resulted in a $52,000 OSHA fine after an inspector found filing cabinets blocking the door.

3. Procedures for Employees Who Remain to Operate Critical Plant Operations

Some employees stay behind to shut down reactors, secure cash, save irreplaceable records, or keep a data center from corrupting. The plan must name those roles and describe when they must evacuate anyway. For most offices, this element is short — often a sentence about IT staff who shut down servers — but it cannot be omitted.

The consequence of omitting this element is a citation even if no employee actually stays behind. David, an IT lead at a Boston biotech, was cited because the plan did not address who shuts the HVAC dampers during a chemical release. A common misconception is that “we don’t have critical operations” — most offices do, even if only the alarm panel reset or the front-door lock.

4. Procedures to Account for All Employees After Evacuation

The plan must spell out how every person is counted at the muster point. Best practice is a roll call against a current employee and visitor sign-in list, with a designated “accountability officer” per floor or department. The consequence of skipping head counts is firefighters entering a burning building to search for people who already walked out — and the NIOSH firefighter fatality reports repeatedly cite this failure.

Example: Elena, a facilities manager in Seattle, learned this the hard way when two employees drove home after an alarm. The fire department searched for 40 minutes. The plan now requires a phone-tree confirmation before the “all clear.”

5. Rescue and Medical Duties for Employees Who Perform Them

If employees are assigned rescue or medical duties, the plan must describe the roles and the training required. Offices that rely on first responders instead of in-house rescue must say so. The consequence of leaving this blank is ambiguity — and OSHA treats ambiguity as noncompliance.

A common misconception is that any trained CPR volunteer counts as a “designated” responder. They do not unless the employer assigns the duty in writing. Best practice is to partner with the American Red Cross or American Heart Association for certification and to document each responder’s role.

6. The Name or Job Title of the Contact Person

Employees and outside parties must know whom to call with questions. The plan must list a name or job title — job titles are preferred because they survive turnover. The consequence of omitting the contact is a plan that dies the day the author leaves the company.

Jamal, an HR director in Atlanta, listed himself by name; when he left, the successor had no authority to update the plan, and the company failed its next OSHA audit. The fix is simple: list “Director of Facilities” rather than “Jamal Smith.”

7. An Employee Alarm System

Every EAP must tie to an alarm system that complies with 29 CFR 1910.165. The alarm must be distinctive, perceptible above ambient noise, and — under the ADA — perceptible to people with hearing or visual impairments. That usually means paired audible and visual (strobe) notification devices meeting ADA Standards 702.

The consequence of a non-ADA-compliant alarm is a dual citation under OSHA and a Title III lawsuit under the Americans with Disabilities Act. A 2019 settlement against a national coworking chain required retrofitting every office with visual alarms after a deaf tenant sued under Title III.

Scenarios: How Three Offices Would Use Their EAP

Real plans are tested by real events. The three scenarios below are the most common triggers for office EAP activation, based on FEMA’s Ready.gov business data and USFA fire statistics.

Scenario A: Kitchenette Fire on the 12th Floor

Scenario B: Active Shooter Report in the Lobby

Scenario C: Magnitude 6.4 Earthquake During Business Hours

Building Each Emergency-Type Protocol

A modern office EAP covers more than fire. The FEMA Emergency Management Guide for Business and Industry lists a dozen hazards every planner should address. Below are the ten that apply to nearly every U.S. office.

Fire and Smoke

Fire procedures must integrate with the building’s fire alarm, sprinkler, and standpipe systems. The plan should reference NFPA 10 for portable extinguishers and NFPA 25 for sprinkler inspections. The consequence of missing an extinguisher inspection is a 1910.157 citation plus insurance coverage disputes.

A common misconception is that employees should fight fires. OSHA’s default position is evacuation, not firefighting, unless employees are trained and equipped under 1910.157(g). A Denver real-estate office learned this after an untrained employee used an extinguisher, inhaled mono-ammonium phosphate, and filed a workers’ compensation claim that the carrier initially denied.

Active Shooter and Workplace Violence

The federal framework is CISA’s Active Shooter Preparedness program built on the Run-Hide-Fight model. The plan should describe the alert method, the lockdown procedure, reunification sites, and the interaction with responding law enforcement. The consequence of omitting this section is growing — OSHA now cites workplace violence under the General Duty Clause, Section 5(a)(1).

A real example: the 2013 settlement with a Connecticut retailer required a written active-shooter plan after an employee was shot and killed. The common misconception is that “fight” means attack first — it means last resort when escape and concealment are impossible.

Earthquake

For offices in California, Oregon, Washington, Alaska, and Hawaii, earthquake procedures are not optional. Cal/OSHA Section 3220 requires earthquake response in the IIPP for most employers. The consequence of skipping nonstructural mitigation — securing bookcases, monitors, and water heaters — is worker’s compensation exposure for “struck-by” injuries that are entirely preventable.

Severe Weather and Tornadoes

Offices in the Midwest and Southeast must identify a tornado shelter area — an interior room, low floor, no windows. The National Weather Service guidance is the authoritative reference. The consequence of relying on stairwells is that many modern stairwells are exterior-wall glass, offering no protection.

Bomb Threats and Suspicious Packages

The DHS Bomb Threat Checklist is the de facto federal standard. The plan should describe who takes the call, what questions to ask, whom to notify, and how to decide between search, evacuation, or shelter in place. The consequence of evacuating without a search protocol is creating a second target in the parking lot.

Medical Emergencies

Plans must describe AED locations, CPR-trained responders, and the handoff to EMS. Under 29 CFR 1910.151, employers must ensure the “ready availability” of medical personnel. The consequence of a four-minute delay in cardiac arrest response is roughly a 10% drop in survival per minute according to AHA data.

Chemical Spills

Even offices have chemicals — cleaning supplies, toner, HVAC refrigerants, pest-control materials. The Hazard Communication Standard at 29 CFR 1910.1200 requires Safety Data Sheets and training. The consequence of an unmaintained SDS library is a serious citation and potential EPA reporting failure under EPCRA Section 311-312.

Pandemic and Infectious Disease

After 2020, CDC guidance for businesses is part of any defensible plan. Include remote-work triggers, cleaning protocols, and sick-leave interaction with the FFCRA-era and ADA accommodation rules. The consequence of no pandemic annex is chaos during the next outbreak, plus EEOC exposure if medical inquiries are mishandled.

Power Outage

Plans must address stuck elevators, data loss, darkened stairwells, and HVAC loss. Reference NFPA 110 for emergency generator standards. The consequence of no UPS plan is data corruption; the consequence of no stairwell emergency lighting is a 1910.37(b)(1) citation.

Shelter-in-Place for Hazmat or Civil Disturbance

Sometimes leaving the building is the worst choice. The plan must describe the shelter-in-place trigger, the designated interior room, and the HVAC shut-off procedure. The EPA’s shelter-in-place guide is a useful reference.

ADA, Accessibility, and Disability Accommodation

An EAP that does not account for people with disabilities is not compliant. The ADA Title I and Title III require reasonable accommodation in emergency procedures, and the EEOC guidance on emergency evacuation allows limited medical inquiries to plan for mobility, sensory, and cognitive needs.

The plan must identify Areas of Refuge, evacuation chairs, buddy systems, and visual/tactile alarms. The consequence of missing these elements is both an OSHA citation and ADA litigation. Rosa, a product manager who uses a wheelchair in a San Francisco office, successfully sued after being left on the 14th floor during a fire alarm because no evacuation chair was available.

A common misconception is that ADA emergency duties end at hiring. They do not — the duty is ongoing and must be refreshed whenever the workforce or the building changes. Offer accommodations confidentially and document them without disclosing medical details to co-workers.

Training, Drills, and Recordkeeping

A plan is only as good as the training. 29 CFR 1910.38(e) and (f) require training when the plan is developed, when responsibilities change, and when the plan itself changes. NFPA 101 Chapter 4 requires regular fire drills — typically quarterly for business occupancies.

Document every drill: date, time, participants, evacuation time, issues observed, and corrective actions. The consequence of undocumented drills is the inability to defend against a later negligence claim. Plaintiffs’ lawyers routinely request drill logs in premises-liability suits.

Record retention should follow the OSHA recordkeeping rule at 29 CFR 1904 for injuries and a minimum of three years for training records. Many employers keep drill records for the life of the building, because insurance carriers ask for them during renewals.

Mistakes to Avoid When Building Your Office EAP

The following errors appear in nearly every OSHA EAP citation letter. Each one is cheap to prevent and expensive to fix after the fact.

• Copying a template without site-specific details. A generic PDF does not identify your stairwells, muster points, or contact titles, and OSHA cites it as incomplete.
• Naming individuals instead of job titles. When the named person leaves, the plan is effectively abandoned and invalid at the next inspection.
• Blocking or locking exit routes. Filing cabinets, holiday decorations, and security chains are the three most common obstructions and trigger immediate serious citations under 1910.37.
• Omitting ADA accommodations. No Areas of Refuge, no visual alarms, no buddy system — three citations and one lawsuit waiting to happen.
• Skipping drills or documentation. Without written drill logs, you cannot prove training occurred, and OSHA presumes it did not.
• Using elevators during fire. A plan that permits elevator use during fire conflicts with NFPA 101 and exposes the employer to wrongful-death liability.
• Forgetting visitors and contractors. Sign-in sheets and visitor badges must integrate with the accountability process or the head count is meaningless.
• Ignoring after-hours scenarios. Cleaning crews, security guards, and night-shift IT staff need their own procedures that rarely appear in default templates.
• Failing to update after renovations. New walls, new exits, new occupancy loads all require a plan refresh under 1910.38(e).
• Burying the plan in a shared drive nobody can find. The rule requires the plan to be available for employee review — “available” means findable, not theoretically accessible.

Do’s and Don’ts of Office Emergency Planning

The following list distills federal, state, and insurance best practices into quick decisions.

• Do post evacuation maps at every elevator lobby and break room, because 1910.37(b) requires visible route identification.
• Do assign floor wardens by job title, because titles survive turnover and names do not.
• Do integrate mass-notification tools such as Everbridge or AlertMedia, because silent and remote alerts matter during active-shooter events.
• Do run at least one full-scale drill per year and tabletop exercises quarterly, because muscle memory is the single strongest predictor of survival.
• Do keep a hard copy of the plan at the security desk, because digital systems fail during power outages.
• Don’t rely on 911 alone, because many office buildings require notification to the fire command center first under NFPA 101.
• Don’t allow re-entry until the fire department or incident commander clears the building, because secondary hazards kill more people than primary events.
• Don’t exempt executives from drills, because a plan the C-suite ignores is a plan the rest of the office ignores.
• Don’t treat the EAP as a standalone document; cross-reference the IIPP, Fire Prevention Plan, and Business Continuity Plan.
• Don’t assume the landlord’s plan covers your tenancy, because most commercial leases assign EAP duties to the tenant under the BOMA standard lease language.

Pros and Cons of Common EAP Approaches

Employers usually choose between a minimal-compliance plan, a fully custom plan, or a plan outsourced to a consultant. Each has trade-offs worth weighing before signing a purchase order.

• Pro — Minimal-compliance template: lowest cost, fastest deployment, and satisfies the bare letter of 1910.38 for small offices.
• Pro — Custom in-house plan: reflects real building layout, real people, and real hazards, producing stronger drills and better outcomes.
• Pro — Outsourced plan: a consultant such as a NFPA-certified fire protection specialist adds credibility in litigation and insurance reviews.
• Pro — Integrated software platforms: tools like Rave Mobile Safety automate alerts, accountability, and recordkeeping in one dashboard.
• Pro — Multi-hazard “all-hazards” plan: one unified document reduces training burden and eliminates contradictions between separate fire, shooter, and weather plans.
• Con — Minimal template: rarely survives an ADA or state-plan audit and offers no litigation defense.
• Con — Custom in-house plan: consumes internal staff time and quickly becomes outdated without a maintenance owner.
• Con — Outsourced plan: expensive, and employees often feel no ownership of a document written by strangers.
• Con — Software platforms: subscription costs scale with headcount and add a single point of digital failure.
• Con — All-hazards plan: can become long and unwieldy, and employees may skim past the section they actually need.

Step-by-Step: Writing the Plan Line by Line

The OSHA eTool for Evacuation Plans and Procedures provides a free, section-by-section builder. Walk through every choice rather than skimming, because each field maps to a specific legal duty.

First, identify the applicable standards — at minimum 1910.38, 1910.37, 1910.157, 1910.165, and your state equivalents. Second, map every exit, stairwell, and Area of Refuge against a current floor plan. Third, assign roles by job title: Emergency Coordinator, Floor Wardens, Accountability Officers, First Aid Responders, and IT Shutdown Lead. Fourth, draft the alerting procedure for each hazard type. Fifth, set the training calendar with annual review built in.

Sixth, route the draft through legal, HR, facilities, IT, and a sample of line employees for comment. Seventh, obtain sign-off from the senior executive responsible for safety, because OSHA’s Recommended Practices for Safety and Health Programs expect documented management leadership. Eighth, publish in both digital and hard-copy formats. Ninth, schedule the first drill within 30 days of publication. Tenth, set a calendar reminder to review the plan every 12 months and after any material change.

Named Examples: Three Offices, Three Outcomes

Stories teach what statutes cannot. Each of the following is adapted from publicly reported OSHA and court records.

Aiden, a facilities director at a 300-person software company in Austin, built a plan around job titles, quarterly drills, and an integrated mass-notification app. When a transformer fire shut down his building in 2024, every employee was accounted for in 11 minutes and the company’s workers’ compensation experience modifier actually dropped the following year.

Beatrice, an office manager at a 40-person architecture firm in Denver, used a downloaded template she never customized. When a gas leak forced evacuation, two employees re-entered the building to grab laptops because the plan did not prohibit re-entry. OSHA cited the firm for an inadequate EAP and an inadequate hazard communication program under 1910.1200.

Carlos, a compliance officer at a 1,200-person financial services office in New York, integrated his EAP with the building’s Fire Safety Director program required by FDNY rules. During a 2023 active-shooter false alarm, his silent lockdown alert reached every employee within 45 seconds and post-incident counseling was available the same day.

Key Entities and How They Relate

The office EAP ecosystem includes federal regulators, state regulators, voluntary standards bodies, first responders, and private vendors. Understanding who does what prevents duplicate work and missed duties.

• OSHA writes and enforces the federal rule under the OSH Act of 1970.
• State plan agencies like Cal/OSHA enforce stricter state versions.
• NFPA publishes consensus codes including NFPA 101 that states adopt by reference.
• FEMA and Ready.gov provide free planning tools at Ready.gov/business.
• CISA leads active-shooter and infrastructure resilience guidance at CISA.gov.
• The Red Cross and AHA provide first-aid, CPR, and AED certification.
• Local fire marshals inspect occupancy, egress, and alarms under state and municipal code.
• Building owners and property managers coordinate base-building systems, elevators, and fire command.
• Insurance carriers audit EAPs during underwriting and offer premium credits for strong programs.

Recapping Key Rulings and Enforcement Cases

Courts and OSHA Review Commission decisions repeatedly sharpen the edges of the EAP rule. In Secretary of Labor v. Delek Refining, the Commission affirmed that a written plan must actually be implemented, not merely filed. In Tarrant Distributors, an employer was cited for failing to train new hires on the EAP within the first week of employment.

Civil courts also weigh in. In In re World Trade Center Disaster Site Litigation, the Southern District of New York highlighted the tension between evacuation and critical-operations staffing. In ADA cases, the Department of Justice settlement with Hilton reinforced that emergency procedures for guests — and, by extension, employees — must include visual alarms and accessible routes.

The takeaway from the case law is simple: a plan on paper is not a defense. Implementation, training, and documentation are what protect employees and the employer.

Frequently Asked Questions

Is an office Emergency Action Plan legally required?

Yes. Under 29 CFR 1910.38, any employer with more than 10 employees must maintain a written EAP, and many state plans require one for smaller employers as well.

Does a small office with 8 employees need a written plan?

No. Federal OSHA allows oral communication of the plan for 10 or fewer employees, but written is still a best practice and may be required by state or local code.

Can we use elevators during a fire evacuation?

No. Except for designated occupant-evacuation elevators meeting NFPA 101 Chapter 7, elevators must not be used, because shafts act as chimneys and controls fail.

Are fire drills required every year?

Yes. Most state fire codes adopting NFPA 101 require quarterly or at minimum annual drills for business occupancies, and OSHA expects training whenever roles change.

Must the plan address active shooters?

Yes. OSHA cites workplace violence under the General Duty Clause, and a defensible plan follows CISA’s Run-Hide-Fight framework.

Do we have to accommodate employees with disabilities in evacuations?

Yes. The ADA requires reasonable accommodation, including Areas of Refuge, evacuation chairs, visual alarms, and buddy systems tailored to each employee’s needs.

Can our landlord’s plan cover our office?

No. Most commercial leases assign tenant-specific duties to the tenant, and OSHA holds each employer responsible for its own employees regardless of landlord plans.

Do we need to include remote workers in the EAP?

Yes. Under OSHA’s home-office guidance, remote workers need hazard information and a reporting procedure, though full evacuation drills are not required.

Are AEDs required in every office?

No. Federal law does not mandate AEDs, but many states — including California, Florida, and New York — require them in certain workplaces, and 29 CFR 1910.151 expects rapid medical response.

Must we train temporary and contract workers on our EAP?

Yes. OSHA’s multi-employer worksite policy puts training responsibility on the host employer for site-specific emergency procedures affecting temps and contractors.

How often should we update the plan?

Yes, update it at least annually and whenever responsibilities, layout, or hazards change, because 1910.38(e) requires re-training on every material change.

Can OSHA fine us just for not having a written plan?

Yes. Missing or inadequate written plans are serious violations subject to penalties up to $16,550 per violation and $165,514 for willful or repeat violations under the OSHA penalty schedule.