SDS Management for Labs: How to Define Your Requirements

When an EHS director asks me how to do SDS management well, I usually answer with a question: what does your organization actually need it to do?

I'm not dodging. Safety data sheet requirements depend on where your buildings are, whether you're a public or private employer, how much of each chemical you store, and what your own Chemical Hygiene Plan promises. A private biotech in Massachusetts and a public university in Texas answer to different regulators, even if their labs look the same.

I've spent more than ten years helping research institutions and biotech companies with chemical inventory and lab safety, and I now lead solutions consulting at SciSure. The organizations I see get SDS management right define their requirements first and choose tools second.

I've written this guide for the people who run safety programs across many labs: EHS, lab operations, chemical hygiene officers, and research administration. Researchers need SDSs, and they should always know where to find them. The program, and the budget for it, belong to the organization. Here's how I'd work through it.

1. What SDS requirements apply to your labs, and how do you find out?

Start with the federal baseline

‍For most US research labs, two OSHA standards set the floor:

• The Hazard Communication Standard (HazCom, 29 CFR 1910.1200) requires employers to keep an SDS for each hazardous chemical they use and make it readily accessible to employees in their work areas during every shift. Electronic access is allowed, as long as it doesn't create barriers to immediate access.
  

• The Laboratory Standard (29 CFR 1910.1450) requires employers to keep the SDSs that arrive with incoming hazardous chemicals, keep them readily accessible to lab employees, and tell those employees where to find them. It also requires a written Chemical Hygiene Plan.

Check who regulates each site

‍OSHA-approved state plans run their own programs: 22 cover both private and public workers, and seven cover only state and local government workers. They must be at least as effective as federal OSHA, and some go further. If you're a public university in a state without a plan, federal OSHA doesn't cover your state and local government employees, so your state's own rules are where to look.

Look for a state right-to-know law

‍Some states add their own layer. New Jersey, for example, requires public employers to keep a Right to Know Central File at each facility, including SDSs and state Hazardous Substance Fact Sheets.

Check community reporting thresholds

Under the Emergency Planning and Community Right-to-Know Act (EPCRA) sections 311 and 312, facilities holding hazardous chemicals at or above threshold quantities (10,000 pounds for most chemicals, 500 pounds or less for extremely hazardous substances) must send SDSs or a chemical list to their state emergency response commission, local emergency planning committee and fire department. They also file an annual Tier II inventory by March 1. Most single labs won't reach those totals, but a building or campus might. Our guide toHazardous Chemical Management for Labs: A Loss Control Guidecovers this in more detail.

Plan for retention

‍OSHA treats SDSs as employee exposure records. You don't have to keep every old sheet forever, but you do need to keep either the SDS or a record of the chemical identity, where it was used and when, for at least 30 years.

Watch the HazCom update

‍OSHA updated HazCom in 2024 and later adjusted the compliance dates. Employers now have until November 20, 2026 for substances and May 19, 2028 for mixtures to update their hazard communication programs and train people on newly identified hazards. Manufacturers are revising SDSs on their own timeline, so an SDS library that never refreshes will fall behind.

Before you look at any software, answer these for each site:

1. Is this site covered by federal OSHA or a state plan?

2. Does the state have its own right-to-know law?

3. Could any building cross EPCRA reporting thresholds?

4. What does our Chemical Hygiene Plan say about where SDSs live and who maintains them?

5. Do our fire marshal, insurer or landlord expect anything specific?

6. How will we keep chemical records for 30 years, including containers we no longer have?

Your answers are your requirements. Everything else in this post builds on them.

2. Can everyone in your lab (or labs) find the SDS they need?

OSHA's test is access: can the person working with the chemical reach its SDS during their shift, with nothing in the way? Having the sheet somewhere on file doesn't pass that test.

Picture a postdoc at 7pm who splashes a solvent on their glove and wants the first-aid section. The binder is in the lab manager's office, which is locked. The shared drive needs a VPN connection. The SDS in the old database is from 2014, for a different manufacturer's product. Every one of those is a barrier, and every one occurs pretty commonly.

Here's a simple check I suggest to every EHS team:

1. Pick five containers from different labs, including one bought in the last month.

2. Ask someone outside EHS to find the SDS for each, using only their phone.

3. Time it, and write down every login, VPN prompt, locked door or dead end.

If anyone has to call a colleague for help, you've found a gap. Run the same check on a weekend or evening shift if your labs operate then.

Plan for outages too. Electronic access is fine under HazCom, but decide what happens when the network or the system is down. Some teams keep printed sheets for their highest-hazard chemicals as a backup.

Good access changes behavior. Pamela Fatland, Director of Occupational and Environmental Health and Safety at Tulane University, put it this way:

‍

"ChemTracker created a much safer place; people can look up chemicals quickly and discover PPE needs from SDSs."

‍

At Carnegie Mellon University, the EHS office tells researchers they can meet the access requirement with paper SDSs in the work area or through SciSure's SDS search. Giving people both options, and telling them clearly, is what accessible looks like in practice.

3. Do your SDS records match your chemical inventory?

Most SDS problems I see turn out to be inventory problems. A folder of 3,000 PDFs tells you what someone once downloaded. It can't tell you what's in your lab today.

HazCom expects your written program to include a list of the hazardous chemicals present, using a product identifier that matches the SDS. In practice, your inventory and your SDS library should point at each other. When they don't, four gaps show up:

• Missing SDSs.  
  Containers with no sheet on file, often gifts, samples, or a box of reagents that moved with a researcher from another institution.

• Wrong SDSs.  
  The right chemical name but a different manufacturer or grade, which can mean different hazards and composition.

• Old SDSs.  
  Manufacturers must add significant new hazard information to an SDS within three months and send the updated sheet with the next shipment, under HazCom. If your library doesn't pick that up, people read outdated guidance.

• Leftover SDSs.  
  Sheets for chemicals used up years ago. Keep them as records, but keep them out of what people search day to day.

The fix is to manage SDSs at the container level. With SciSure Health & Safety, each container in ChemTracker is its own record, and SDS Auto-Match attempts to attach a current SDS using the chemical name and synonyms, CAS number, product number, manufacturer and document date. Eligible containers are checked again over time, so newer sheets can replace older ones. The reconciliation tool lets your team scan the containers in a room and confirm, move or remove them, so your inventory and your SDS coverage stay honest.

If you're weighing how to label and scan containers, our guide to chemical inventory tracking tools compares barcodes, RFID and photo capture.

4. Who owns SDS management across your labs?

The organization does. OSHA's language is "the employer shall," and the Laboratory Standard asks employers to name the people responsible for the Chemical Hygiene Plan, including a Chemical Hygiene Officer.

I say this plainly because I've watched programs stall when SDS management gets pushed down to individual lab groups. Researchers are focused on their science, which is exactly where their attention belongs. Most of them think about SDSs at the moment they need one. Lab managers juggle ordering, equipment, and onboarding. Neither group owns safety for the institution, and neither should be asked to fund it from a grant or a lab budget.

When the program sits with the organization, the work splits cleanly:

The budget follows the same logic. When SDS software is bought lab by lab, coverage ends up patchy and nobody can answer for the whole organization. If you're building the business case, here's a comparison of lab EHS software vendors.

5. How do you move from binders and shared drives to a maintained process?

Binders and shared drives aren't wrong. They just depend on someone remembering to update them, and that person eventually changes jobs. A maintained process builds the updates into work that already happens. Here's the order I'd follow:

1. Pick one system of record.  
   Decide where the authoritative SDS lives. Binders can stay as a backup in high-hazard areas, but they shouldn't be a second source of truth.

2. Start from your inventory, not your SDS folder.  
   Build or clean the container inventory first, then match SDSs to it. Importing an old folder brings its old problems along.

3. Capture SDSs at intake.  
   The easiest moment to get an SDS right is when the chemical arrives. Make receiving, or procurement, part of the process.

4. Archive, don't delete.  
   When a container is empty, keep its record so you still know what it was, where it was used and when. That's what OSHA's 30-year rule asks for. ChemTracker archives emptied containers rather than deleting them.

5. Schedule reconciliation. Pick a rhythm for physical checks, such as once a year, or each semester in teaching labs.

6. Train people on where SDSs live.  
   Both HazCom and the Laboratory Standard require it. Keep it short: where to look, and what to do when a sheet is missing.

7. Write down your outage plan.  
   Who prints what, and where the backup copies are kept.

None of this needs a big-bang rollout. Most teams I work with start with one building or one department, prove the process, then expand.

6. How should you evaluate SDS management software against your requirements?

Bring your answers from section 1 to every vendor conversation. Then ask questions that test the software against your own labs:

• Coverage of your chemicals.  
  Send each vendor an export of the products you buy most (name, CAS number, manufacturer, product number) and ask for their match rate.

• Where the SDS attaches.  
  Is it linked to each container, or only to a chemical name?

• Revisions.  
  How are newer SDS versions found, and what happens to sheets you attached yourself?

• Gaps.  
  How do you add products the database doesn't cover?

• Access.  
  Can a researcher open an SDS from a phone in the lab, through your single sign-on, without a VPN?

• Your structure.  
  Does it handle multiple buildings, departments and lab groups, with permissions that follow people when they move or leave?

• Reporting.  
  Can you run Tier II, right-to-know and fire code reports from the same inventory?

• Records.  
  What happens to the record when a container is emptied, and can you export your data?

• Implementation.  
  Who cleans and moves your existing spreadsheets and binders, and what support is there after go-live?

SciSure Health & Safety covers container-level chemical inventory, SDS Auto-Match and manual SDS attachment, barcode and RFID scanning, reconciliation, and reporting that includes Tier II, right-to-know and fire code reports where configured. Those reports support your review with regulators and your local fire authority; they don't replace it.

If you want to see what's included without add-ons, our guide to 5 lab problems ChemTracker solves out of the box walks through it.

Start with your requirements

If you take one thing into your next planning meeting, make it the list from section 1. Once you know which rules apply to each site, who owns the program and what "accessible" means for your people, choosing how to manage SDSs gets much simpler.

If you're working through this for your organization, I'd be glad to help you map your requirements, even before you look at software.

Keep reading

• How Can We Automate Lab Safety Inspection Workflows Across Multiple Labs?
• Lab Safety Training: Requirements & Cost of Neglect
• Understanding SciShield: How SciSure Health & Safety Keeps Up With Lab Safety Data
• How to Manage Reactive Chemicals in the Lab: Warning Signs & More
• Lab Compliance Training: How a Lab LMS Keeps Safety Training Current
• Best Practices for Chemical Storage in Research Labs
• How to Identify a Quality Chemical Inventory Database: 6 Things to Check
• Hazardous Chemical Management for Labs: A Loss Control Guide
• Chemical Compliance Management Software: A Buyer's Guide
• Automated Lab Compliance Solutions For Your Next Lab Audit
• Chemical Inventory Best Practices for Multi-Site Labs