A manufacturing company's HR manager opens a letter from a lawyer about an incident on the packaging line in 2023, three years earlier. The question in it is narrow: on the day it happened, was the operator trained and current on the equipment he was running?
She knows the answer is yes, because she booked the session herself. What she can't do is prove it. The operator left in 2024, and his training records went with his profile when it was deactivated. The certificate was a PDF emailed to a supervisor who has also left, and the one record she can still pull says "expired", which is true today and says nothing about a Tuesday in March three years ago.
That is why "how long do you have to keep training records?" is harder than it looks. Most people who ask it want a number. The rules that give a number are mostly about other kinds of records, and the rules written for training records mostly don't give one.
This guide sets out what OSHA, the EEOC and ISO 9001 actually say, where the "three years" you keep hearing comes from, and how to set a period that protects you. Most of it applies whatever system you use. CertLister appears only where a system helps, as the worked example.
Chapter 1
Three Bodies of Rules, None of Them Aligned
This chapter shows why the answer depends on which set of rules you ask, so you know where to look for yours.
Training records sit where three sets of rules meet. Each was written by a different body, for a different purpose.
Occupational safety recordkeeping exists so that a regulator can reconstruct exposure and harm. It cares what happened to a person's body over a working life, which is why its periods run for decades.
Employment law recordkeeping exists so that a discrimination or wage claim can be investigated. It cares about the employment decision, so its periods are short and count from that decision, not from the risk.
Quality and accreditation standards exist so that an auditor can confirm your process works. They want proof of competence and mostly leave the retention period to you, as long as you set it in advance and keep to it.
None of the three sets out to answer "how long do I keep a forklift certification?" The training record inherits whichever answer someone applied first, and that is usually the shortest one.
Chapter 2
What Actually Specifies a Period
Here are the four general rules that give a fixed number, and what each one really covers.
None of them covers training records as such. A few training rules do name a period, and they come later in this guide.
Employee medical and exposure records: 30 years. 29 CFR 1910.1020(d) requires that "the medical record for each employee shall be preserved and maintained for at least the duration of employment plus thirty (30) years," and that each employee exposure record "shall be preserved and maintained for at least thirty (30) years." It is the longest retention duty most employers carry. It exists because an occupational disease can appear decades after the exposure that caused it.
Injury and illness logs: 5 years. 29 CFR 1904.33(a) requires you to save the OSHA 300 Log, the annual summary and the 301 Incident Reports "for five (5) years following the end of the calendar year that these records cover." They record injuries and illnesses, and say nothing about who was trained.
Personnel and employment records: 1 year. Under the EEOC's recordkeeping rules, employers keep personnel or employment records for one year. If someone is let go involuntarily, their records are kept for one year from the date of termination. Payroll records under the ADEA (the Age Discrimination in Employment Act) are kept for three years. The one year is not always the end: once a charge of discrimination is filed, the records that relate to it must be kept until the charge, and any lawsuit based on it, is finally resolved.
Whatever a client contract says. It isn't a regulation, but in practice it is often the rule that binds. Prime contractors and healthcare networks often require their vendors to keep training records for the life of the contract plus a set number of years. That clause binds you on top of any legal minimum, because you signed it.
The trap is the third rule. It is easy to file training records as personnel records, apply the one-year period and destroy them on schedule. The decision looks sound, and it throws away the only evidence that could answer the lawyer's letter.
Chapter 3
What the Training Standards Actually Say
This chapter shows what the rules that require training say about keeping the record, which is often very little.
Go to the standards that specifically require training, and look for a retention period. What you find surprises most people.
Fall protection. 29 CFR 1926.503(b) requires a written certification record with "the name or other identity of the employee trained, the date(s) of the training, and the signature of the person who conducted the training or the signature of the employer." On retention, all it says is: "The latest training certification shall be maintained." Nothing requires you to keep the one before it.
Respirator fit testing. 29 CFR 1910.134(m)(2)(ii) says fit test records "shall be retained for respirator users until the next fit test is administered." The rule does more than allow you to discard the old record. It ends the retention period the moment a newer one exists.
Powered industrial trucks (forklifts). 29 CFR 1910.178(l)(6) requires the employer to certify that each operator has been trained and evaluated, with the operator's name, the dates of the training and the evaluation, and who carried them out. It sets no retention period at all.
ISO 9001:2015, clause 7.2(d). Organizations must "retain appropriate documented information as evidence of competence." The word appropriate carries the whole sentence, and that is on purpose: the standard leaves the period to you, because you know your risks and it doesn't.
Read together, these rules are about whether a person is qualified now. They are competence rules, not rules for keeping evidence. You can meet every one of them to the letter and still be unable to prove anything about last year.
Chapter 4
Where "Three Years" Comes From
This chapter answers the questions people ask most: whether "three years" is a rule, and how long to keep records for current and former employees.
One sentence turns up wherever this topic does: "All training records must be kept current and be maintained for a minimum of three years." We could not find it in any federal regulation. It reads like a company or state policy, built on the few training rules that do name three years.
So is it true? Not as a federal rule for every training record. The standards in the previous chapter keep only the latest record or set no period, and the rules below name three years only for their own programs. Your state, your sector or your own company policy may still require it, so check before you rely on a shorter period.
These federal rules name three years:
- Bloodborne pathogens. 29 CFR 1910.1030(h)(2)(ii): "Training records shall be maintained for 3 years from the date on which the training occurred."
- Hazardous materials transport. 49 CFR 172.704(d) requires a record of current training "inclusive of the preceding three years," kept "for as long as that employee is employed by that employer as a hazmat employee and for 90 days thereafter."
- Select agents and toxins. 42 CFR 73.15(d) requires a record of the training given to each person with access, and 42 CFR 73.17 says all records under that part "must be maintained for 3 years."
One rule counts from the person rather than the training. For asbestos, 29 CFR 1910.1001(m)(4) says "The employer shall maintain all employee training records for one (1) year beyond the last date of employment of that employee." The construction standard, 29 CFR 1926.1101, says the same.
That answers the two questions people ask most:
- For current employees, the hazmat rule is the clearest model: keep the last three years of training for as long as the person works for you.
- For former employees, the clocks keep running after someone leaves: three years from the training date for bloodborne pathogens, 90 days after the job ends for hazmat, and one year after employment ends for asbestos. Deleting a leaver's records on their last day breaks all three.
None of the rules in this guide counts from the date a certification expires. Three years is the minimum for the programs above, not a period that fits every record. The rest of this guide explains why the period that protects you is usually longer.
Chapter 5
Currency and History Are Different Questions
This chapter separates the two questions a training record has to answer, and shows how ordinary systems lose the answer to the second.
"Is this person qualified today?" is an operational question. You need the answer often and fast, at a site gate or before a shift is assigned, and it is only useful if it is current. Good tracking systems are built for it, and keeping staff with expired credentials off the schedule is where it matters most.
"Was this person qualified on 14 March 2023?" is a question of evidence. You need the answer rarely, it can take a while, and it is only useful if the record is unchanged. A record that was not written at the time, or has been edited since, is worth very little.
Systems built well for the first question destroy the answer to the second in three ordinary ways:
Status is overwritten in place. One field holds "valid" or "expired" and flips on the expiry date. The field is always right and the history is gone: you can't tell a certification that expired last week from one that expired in 2019, or show that it read valid on a given day.
Renewal replaces instead of adding. Someone recertifies, and the new dates are written over the old row because the old ones are out of date. They are out of date for daily work, but as evidence they are the whole record. Without them you can't show an unbroken chain of qualification across the period in question.
Offboarding deletes. A leaver comes off the active roster and their records go with them, by design or because a data-minimization policy caught them. This one does the most damage, because former employees are the people you are most often asked about. Nobody writes a letter about someone who is still on site and currently certified.
Each of these looks reasonable on its own. Together they mean the only records you can produce are for current employees with current certifications, the one group nobody asks you to prove anything about.
In CertLister, renewing adds a new credential instead of editing the old one. Use Renew on the old credential and it is marked Replaced, with its issue and expiry dates unchanged, while the new one is Active. Search a person's name on the Credentials page and both are listed, each with its own expiry date and status, so the record that covered 2024 is still there to open.
- Search a name: every credential the person holds or held.
- The old forklift credential: Replaced, its Sep 30, 2023 to Sep 30, 2026 dates unchanged.
- The renewal: a new credential, Active until Oct 20, 2029.
Chapter 6
The Period That Actually Governs You
Work out your own retention period from the claims, legal holds and contracts that could need the record.
The legal minimum is not your retention period. Your exposure window is: the length of time a training record could be needed as evidence. It is almost always longer.
Look at it from three directions:
- The claims it would defend. Limitation periods vary by jurisdiction and type of claim, and some start when a problem is discovered rather than when it happened. That can push the window years past the incident. Occupational illness is the extreme case, which is why medical and exposure records are kept for thirty years.
- The charges that freeze the clock. As the EEOC rules say, an open charge stops normal disposal of anything related to it. A retention schedule with no legal-hold step (a way to stop deleting the records tied to a dispute) will delete records you were already required to keep.
- The contracts and accreditations you have signed. Read the clause itself, not your memory of it. The longest number is often here.
Take the longest of the three and round up. Then, and this matters more than the number, write it down as a schedule and apply it the same way every time. A record disposed of under a written policy you follow is a very different conversation from a record that is simply missing. Deletion with no policy behind it can look like destroying evidence, even when it was only carelessness.
One caveat: this is a summary of published rules, not legal advice, and retention duties differ a lot between jurisdictions. Canadian provincial OHS rules, employment law in EU member states and sector regulators all set their own periods, sometimes longer than the US federal ones above. Confirm yours with counsel, and treat this guide as a map of the questions to ask.
Chapter 7
Setting a Rule You Can Actually Follow
Use these five habits to turn your period into a rule that works without anyone having to remember it.
Capture the dates as data when the record is issued. The issue and expiry dates belong in fields, not only as printed text on a PDF. A retention rule is a query over dates. If the dates were never stored as dates, someone has to open documents one by one to apply the rule, so it won't be applied.
Keep records by type, not by person. The instinct is to organize retention around employment status: active, left, purge after a set time. That instinct is what deletes the useful records. The duty attaches to the record and what it covers, whether or not the person still works for you.
Make leaving an archive step, never a delete step. Taking someone off the active roster and destroying their history are two different actions, and the second should be hard to do by accident. Old records should stay searchable by name long after the person has gone. If your HR system removes them, Can your HR system track employee certifications? lists what to ask it, and the employee certification tracking guide covers what to do when someone leaves.
Keep the chain of renewals. When a certification is renewed, the old one becomes history, not rubbish. Keeping the chain lets you answer a question about any date, not only today, and it costs almost nothing. Certification expiry best practices covers keeping that history in day-to-day tracking.
Make disposal an event you can point to. When a record is finally destroyed, log it, under a named policy, with a date. The record of the disposal often matters as much as the record it removed.
Chapter 8
What a System Has to Do to Make This Cheap
See what a system has to do so that keeping training records costs almost nothing, and how CertLister does it.
None of this needs anything unusual. It needs records stored as data with dates, history that is added to rather than overwritten, and records that outlive the person's time at the company. It also needs a way to pull out one type of record for an auditor.
This is where CertLister fits. Every credential stores its issue date, and its expiry date if it has one, as fields, so expiry status follows from the dates: a credential counts as Expired from the day after its expiry date. Renewing adds a new credential and marks the old one Replaced, so the chain stays whole.
CertLister has no employee roster to take someone off. A credential is held under the person's name and email, and it stays until someone on your team deletes it. Search the person's name or email on the Credentials page, years after they left, and every credential they held is listed, expired and replaced ones too.
To answer an auditor, pick the category in the Category filter on the Credentials page, such as your forklift category, and click Export CSV. With a filter on, the export holds only the matching credentials, each with its credential number, title, recipient name and email, issue and expiry dates, status and category, plus the category's custom fields. Each credential also has its own verification page, so the person asking can check the record themselves instead of taking your word for it.
If your records are in spreadsheets today, the CSV import brings them in with their original issue and expiry dates. Importing sends no email and makes no PDF. For what else to check before you choose a system, see our guide to choosing a training records management system.
Try this step
Check your spreadsheet in a free account: rows with problems are flagged before anything is saved. The free plan includes 10 new credentials a month.
- Category: one certification type, here Forklift Operator.
- Export CSV: with a filter on, only the matching credentials.
- Replaced and Expired credentials stay in the list, and in the export.
Chapter 9
The Short Version
Here are the periods the rules in this guide set, in one table, then four questions to test whether your records would hold up.
| Record | Rule | How long to keep it |
|---|---|---|
| Employee medical records | 29 CFR 1910.1020(d) | Length of employment plus 30 years |
| Employee exposure records | 29 CFR 1910.1020(d) | 30 years |
| OSHA 300 Log, annual summary, 301 reports | 29 CFR 1904.33(a) | 5 years after the end of the year they cover |
| Personnel and employment records | EEOC | 1 year, or 1 year from an involuntary termination; longer once a charge is filed |
| Bloodborne pathogens training | 29 CFR 1910.1030(h)(2)(ii) | 3 years from the training date |
| Hazmat transport training | 49 CFR 172.704(d) | The last 3 years of training, while employed and for 90 days after |
| Select agents and toxins training | 42 CFR 73.15(d) and 73.17 | 3 years |
| Asbestos training | 29 CFR 1910.1001(m)(4), 29 CFR 1926.1101 | 1 year after employment ends |
| Fall protection training | 29 CFR 1926.503(b) | The latest certification only |
| Respirator fit tests | 29 CFR 1910.134(m)(2)(ii) | Until the next fit test |
| Forklift operator certification | 29 CFR 1910.178(l)(6) | No period set |
| Evidence of competence | ISO 9001:2015, clause 7.2(d) | You decide ("appropriate") |
Then ask four questions. If a letter arrived tomorrow about an incident three years ago, could you answer them?
- Can you produce the training record of someone who left two years ago? If offboarding deletes, or archives somewhere nobody can search, the answer is no. These are the people you will be asked about.
- Can you show what a credential's status was on a past date, not only what it is now? A single status field that gets overwritten can't.
- Do you have a written retention schedule with a legal-hold step that you could hand to an auditor? Without one, every deleted record raises a question about your intent.
- Did you set the period from your exposure window, or from the shortest rule someone found? One year, taken from the personnel-records rule, is the most common answer and the hardest to defend.
Getting this right is mostly a matter of not throwing things away. That sounds easy until you notice how many ordinary system habits do exactly that. For the other half of the problem, knowing what is current today, see compliance certificate tracking at scale and preparing for a training compliance audit.
