Set the scene
Start with context
Fill the frame
2–3 ft for close-ups; keep ladders, cords and workers fully in view.
The hazard control hierarchy — the hierarchy of controls — is NIOSH's classic model for ranking how to protect workers, and OSHA references it throughout its guidance rather than as a single regulation. It has five levels, most protective first: elimination (physically remove the hazard), substitution (replace it with something less dangerous), engineering controls (isolate people from the hazard), administrative controls (change how people work), and PPE (protective equipment as the last line). The point is that PPE is the weakest control, not the first answer. OSHA Scan lets you upload a jobsite photo and get an AI read on the visible hazards — including where a site appears to lean on PPE alone when a stronger control might apply. It is a free, second set of eyes: the AI suggests, your competent person decides.
Free · No account needed to scan · Results in seconds

The hierarchy of controls answers a question every safety decision hides: not just 'how do we protect the worker?' but 'what is the most reliable way?' The model, developed and popularized by NIOSH, ranks five approaches from most to least effective. Elimination removes the hazard entirely — no exposure, no injury. Substitution swaps it for something less dangerous. Engineering controls build a barrier between people and the hazard so protection does not depend on anyone remembering. Administrative controls change how and when people work. PPE, at the bottom, protects the individual only, only while worn correctly, only for what it is rated to handle.
The order is not a preference — it is a statement about failure. The controls at the top keep working when no one is watching; the controls at the bottom fail the moment attention lapses, the strap loosens, or the respirator does not fit. That is why 'give everyone PPE' is the most common and least reliable answer to a hazard, and why an inspector or a competent person is trained to ask, every time, whether a stronger control was ruled out for a real reason or just skipped because PPE was easier.
OSHA references this hierarchy throughout its recommended practices and standard preambles — it is the logic behind why so many standards demand engineering controls first and treat respirators or hearing protection as what you reach for when the better controls are not yet feasible. But it is a model OSHA adopted, not a single citable rule; you will not find '29 CFR the-hierarchy-of-controls.' A photo scan cannot make the ranking decision for you, but it can put the visible facts in front of the person who does: here is a hazard, and here is what protection looks like it is relying on.
Elimination and substitution are strongest because they change the work itself. Elimination might mean prefabricating a roof section at ground level so no one works at height for that step; substitution might mean specifying a water-based sealant in place of a solvent one, or a less-hazardous silica-free abrasive for blasting. These decisions usually belong to design and planning, which is why the hierarchy pays off most when it is applied before the crew ever arrives — a fact no jobsite photo can capture on its own.
Engineering controls are the workhorse of most sites: guardrails at a leading edge, a machine guard over a pinch point, local exhaust ventilation on a cutting station, a trench box in an excavation. They protect everyone in the area without depending on behavior. Administrative controls change the work pattern — rotating crews out of a heat-exposed task, sequencing loud work when fewer people are present, a permit system for hot work, training and signage. PPE — hard hats, harnesses, respirators, hearing protection, cut-resistant gloves — sits last because it does nothing until the right person wears the right item correctly, and it protects only that one person.
The most common real-world failure of the hierarchy is silent: a hazard gets 'controlled' by handing out PPE because that is the fastest, cheapest visible action, while a feasible engineering or administrative control never gets evaluated. A worker in a dust mask cutting masonry dry — when a shroud-and-vacuum or wet-cutting method exists. A crew in harnesses tied to a questionable anchor — when a guardrail or a lift would remove the fall exposure. The PPE is not wrong; relying on it as the whole answer is.
This is exactly the kind of pattern a photo can surface. A single frame often shows the PPE and the hazard together, which lets an AI second look flag it: this looks like PPE carrying the load where a stronger control might apply. The scan does not know whether elimination or engineering was already ruled out as infeasible — only a competent person, who knows the schedule, the budget, and the constraints, can make that call. What the scan does is make sure the question gets asked instead of skipped.
A camera reads a moment of visible conditions. It can show that a guard is missing, that the only visible protection is a respirator, that a barrier is absent where an edge exists. It cannot know whether a stronger control was already evaluated and rejected for a documented reason, whether the substituted product is actually less hazardous in this application, or whether an administrative control like a rotation schedule is in force off-camera. Those are judgment calls the hierarchy leaves to a qualified human.
So use the scan for what it is: the fastest way to get the visible hazards and the apparent controls named and scored, followed by a walk. Photograph the task, read where the report suggests the site is leaning on PPE, and bring that question to the competent person's decision instead of to nobody. Try it on a photo of your own site below — the scan is free and takes about a minute.
Run through these steps before crews start — each one covers a visible gap the AI can help you catch.
Photograph the task and area, and name the specific hazard — a fall exposure, respirable dust, an unguarded moving part. You cannot rank a control until you know exactly what you are protecting against.
For each hazard, ask in order: can it be eliminated, substituted, controlled by engineering, controlled administratively, or does it fall to PPE? Stop at the highest level that is feasible, and combine levels for higher-risk tasks.
Upload the photo to OSHA Scan. The AI flags visible hazards, the OSHA standard each may relate to, and where protection looks like it is relying on PPE alone rather than a stronger control that might apply.
Review each flagged item with a competent person who knows the schedule, budget, and constraints. They decide whether a higher control is feasible or whether PPE is the justified choice, and they document that reasoning.
Confirm the chosen control physically exists and is being used, assign any corrective action with an owner, then re-scan to document the improved state. Export the dated report to PDF or Excel for your program's records.
One frame of the task or area — this is what the AI reads about the level of control in place.
Where a respirator, harness, or dust mask appears to be the sole protection against a hazard a stronger control could address.
Absent guardrails, machine guards, trench protection, or local exhaust where the visible hazard suggests one should be present.
Visible signs of dry cutting, solvent products, or at-height work that hint a less-hazardous method or task removal may have been available.
Each finding notes the OSHA standard it may relate to and a suggested fix framed at the appropriate control level, not just 'wear PPE'.
Scan a photo like the one above and this is the report you get — score, findings, OSHA references, and fixes. It is an illustrative example, clearly marked — not live scan data.

Compliance score
58
Lower means more potential hazards found
6 potential hazards found
1Worker in a dust mask dry-cutting masonry with no dust capture on the tool
HighPossibly related to respirable crystalline silica in construction (29 CFR 1926.1153)
Observed condition: A dust mask is a PPE-level control for a hazard the standard expects engineering controls to lead on — a shroud-and-vacuum or wet-cutting method removes most of the dust at the source, where a mask only filters what reaches one worker's face if it fits and is worn.
Corrective action: Have the competent person confirm whether a tool-integrated dust collection or wet-cutting method is feasible; treat the mask as the backup to that engineering control, not the primary defense.
Medium confidenceNot fully clear from the photo — verify on site.
2Leading edge with fall exposure protected only by workers wearing harnesses
HighPossibly related to fall protection in construction (29 CFR 1926.501)
Observed condition: Personal fall arrest is a lower control than a guardrail: it depends on a rated anchor, correct connection, and clearance, and it stops a fall rather than preventing it. Where a guardrail or removing the edge is feasible, harness-only is a weaker choice on the hierarchy.
Corrective action: Have the competent person evaluate whether guardrails or a different work platform can prevent the exposure; if arrest is the chosen control, verify the anchor rating, connection, and fall clearance.
Medium confidenceNot fully clear from the photo — verify on site.
3Unguarded rotating pulley on a jobsite compressor within reach of the walkway
MediumPossibly related to machine guarding (29 CFR 1926.300(b))
Observed condition: An exposed moving part is a hazard an engineering control — a guard — is meant to isolate. Relying on workers to 'stay clear' is an administrative control substituting for a missing physical barrier, which is a step down the hierarchy.
Corrective action: Install a fixed guard over the rotating part so protection does not depend on anyone remembering to keep their distance; verify the guard cannot be easily removed for the task.
High confidence
Upload a photo like the one above and get a compliance score and hazard count in seconds. No account needed to scan — create a free account to unlock the full report.
Use the real site or facility name. If you save the scan after signup, it becomes the report name.
Three angles, one deeper scan
Only the wide shot is required — every extra angle gives the AI more places to look.
Required: Set the scene — one wide shot lets the AI sweep the whole area at once
Stand at the entry point and capture corner to corner: floors, ladders, scaffolds, and everyone at work
Drop a job-site photo or walkthrough video
Click to upload, drag & drop, or snap a photo on site. Photos scan free in about 15 seconds — no signup, no card. Video walkthroughs (up to 3 min) run on a free account.
Small habits, sharper scans
Set the scene
Start with context
Fill the frame
2–3 ft for close-ups; keep ladders, cords and workers fully in view.
Capture clearly
Make the frame usable
Light it right
Keep the sun or lights behind you — glare and shadows hide hazards.
Tap to focus
Tap the hazard on screen and hold still one second — blur can't be flagged.
Choose the useful view
Give the AI room to understand
Go landscape
Turn your phone sideways — a wider frame catches more of the scene.
Only upload photos you have permission to use, and avoid images showing personal, customer, or confidential information. Demo photos and results are held privately for up to 48 hours so you can save them to a free account; unclaimed photos are deleted automatically. Results are an AI-assisted preliminary review, not an official OSHA determination.
New: Video walkthrough scans
Record up to 3 minutes of your site — the AI extracts frames and flags every hazard with exact timestamps. Free account required.
Get the best results
Wide shot first
Stand at the entrance and photograph the entire work area so AI sees the full context
Hazard areas
Photograph elevated surfaces, equipment, electrical panels, and anywhere workers are active
Close-ups last
Move in close on anything damaged, missing, or that looks risky — the AI catches more detail
Work each hazard down the hierarchy from the top, and stop at the highest control that is feasible. The first few points are free — create a free account to unlock the full checklist and scan your own photos.
Ask elimination first: can the hazard be removed entirely?
Before any control, ask whether the task can be redesigned, prefabricated, or sequenced so the hazard never exists on site. Elimination is the only control that cannot fail because there is nothing left to protect against.
Then substitution: can it be swapped for something less dangerous?
Replace a hazardous material, process, or method with a lower-hazard one — a water-based product, a silica-free abrasive, a quieter tool. Confirm the substitute is genuinely less hazardous in this application, not just different.
Then engineering controls: can a barrier isolate people from the hazard?
Guardrails, machine guards, trench boxes, local exhaust ventilation, interlocks — controls that protect everyone in the area without depending on behavior. This is where most feasible protection lives on a jobsite.
Then administrative controls: can the work pattern reduce exposure?
Rotation schedules, permits, sequencing, procedures, training, and signage change how and when people work. They help, but they depend on people following them every time.
OSHA Scan reads a single photo. That makes it fast and easy for anyone on site — but it also means it has real limits. Here's an honest look at both.
A scan is a fast first look, not the final word. Before treating this kind of area as safe, a competent person should still confirm:
From most to least protective: elimination (remove the hazard), substitution (replace it with something less dangerous), engineering controls (isolate people with a physical barrier), administrative controls (change how people work), and PPE (personal protective equipment). The order reflects how reliably each level protects workers — the top controls keep working when no one is watching, while the bottom ones depend on individual behavior.
No. The hierarchy of controls is a model developed and popularized by NIOSH, and OSHA references it throughout its recommended practices and standard preambles rather than as a single citable rule. It is the logic behind why many OSHA standards require engineering controls first and treat PPE as a last line, but there is no '29 CFR' section titled the hierarchy of controls. OSHA Scan is not affiliated with OSHA.
PPE protects only the individual wearing it, only while it is worn correctly, and only for the hazard it is rated to handle. It does nothing to reduce the hazard itself, and it fails the moment a strap loosens, a respirator does not fit, or someone forgets it. Controls higher in the hierarchy protect everyone in the area without depending on anyone's behavior, which is why PPE is meant to back up stronger controls rather than replace them.
Upload a jobsite photo and the AI reads the visible hazards and the protection in place, then flags where a site appears to rely on PPE alone when a stronger control might apply — for example a dust mask during dry cutting, or harnesses at an edge where a guardrail could fit. It is a second set of eyes that raises the question; the competent person, who knows the site constraints, makes the actual control decision.
Engineering controls isolate people from a hazard with a physical change — a guardrail, machine guard, trench box, or exhaust ventilation — so protection does not depend on behavior. Administrative controls change how and when people work — rotation schedules, permits, procedures, training, signage. Engineering controls rank higher because they keep working automatically, while administrative controls only help when people follow them every time.
Yes, always. The scan is a second set of eyes, never a replacement for a competent person. It cannot know whether a stronger control was already ruled out as infeasible, whether an off-camera administrative control is in force, or what the site's schedule and budget allow. It surfaces the question so a qualified human makes the informed decision — the AI suggests, the competent person decides.
Reviewed by OSHA Scan Editorial
Last updated August 29, 2026
This content is produced by the OSHA Scan Editorial team and reviewed with AI assistance. It is general safety information, not legal or compliance advice. OSHA Scan is an independent tool and is not affiliated with, endorsed by, or certified by OSHA or the U.S. Department of Labor.
Free PDF checklist
33 critical checks across 7 categories — the same visible gaps the AI scanner looks for. Sent to your inbox as a free PDF.
More ways to see what an AI OSHA scan can do for your site.
The overview hub — how the scanner works and every job, site, and hazard it covers.
Spot the last-line control the hierarchy leans on when nothing stronger is in place.
The method where you assign a control level to each step's hazard.
Draft the hazard and control columns of a JHA from a single photo.
The broader site walk where control-level decisions get made and documented.
The photo-first workflow this control review plugs into.
The core photo scan that names hazards and their likely OSHA references.
OSHA's recommended practices for selecting controls, built on the hierarchy the AI helps you apply.
Official resource — osha.govSee a complete labelled example of everything a scan returns.
Start with 5 included AI site scans plus a one-time 10-scan signup bonus — no credit card. Build JHA-ready reports and catch changing conditions sooner.
Start your free trial