Since July 1, 2024, nearly every California employer — regardless of size or industry — has been required to establish, implement, and maintain a written Workplace Violence Prevention Plan under Labor Code § 6401.9, enacted by Senate Bill 553. This is not guidance; it is an enforceable Cal/OSHA obligation with training, recordkeeping, and incident-logging components, and inspectors ask for the plan during routine visits. Many businesses adopted a template in 2024 and have not touched it since. Here is what the law requires and how to keep your plan defensible.
Who must comply — and the narrow exceptions
The requirement covers virtually all California employers, employees, and places of employment. The exceptions are narrow:
- Health care facilities already covered by Cal/OSHA's separate violence-prevention standard for health care
- Employees teleworking from a location of their own choosing that the employer does not control
- Worksites not accessible to the public with fewer than 10 employees working at any given time, provided the employer complies with its Injury and Illness Prevention Program
- Certain corrections and law enforcement facilities
Note how conditional the small-worksite exception is: a storefront, a customer-facing office, or a site that occasionally has 10 employees working there does not qualify. Most small businesses are covered.
What the written plan must contain
The statute defines workplace violence broadly — any act or threat of violence occurring in a place of employment, including a threat or use of physical force against an employee that results in, or has a high likelihood of resulting in, injury, psychological trauma, or stress, regardless of whether the employee sustains an injury — and sorts it into four types: violence by strangers, by customers or clients, by current or former employees, and by people with personal relationships with an employee (such as domestic violence spilling into the workplace). The plan must be in writing, specific to your worksite, and include, among other elements:
- Names or job titles of the people responsible for implementing the plan
- Procedures for active employee involvement in developing and implementing it
- Methods to accept and respond to reports of workplace violence — with an express prohibition on retaliation against reporting employees
- Procedures to communicate with employees about concerns and incident investigations
- Emergency response procedures, including how employees will be alerted
- Procedures to identify, evaluate, and correct workplace violence hazards, on a scheduled and post-incident basis
- Post-incident response and investigation procedures
- Procedures for annual and event-driven review of the plan and revision as needed
A generic downloaded template that names no responsible person and reflects no site-specific hazard assessment does not satisfy the statute — site specificity is the point.
Training and the violent incident log
Employers must train employees when the plan is first established, annually thereafter, and again when a new hazard is identified or the plan changes. Training must cover the plan itself, how to report incidents without fear of reprisal, the hazards specific to employees' jobs, and the violent incident log — and it must be interactive, with an opportunity for questions.
The violent incident log is its own discipline: for every workplace violence incident, the employer must record detailed information — date, time, location, the type of violence, a description of the incident, classification of who committed it, consequences, and corrective actions — while omitting personal identifying information of those involved. Records carry long retention periods: the log and hazard-identification records for five years, training records for at least one year, and incident investigation records for five years. Employees and their representatives are entitled to copies of most of these records on request, generally within 15 calendar days.
Enforcement and the related restraining order tool
Cal/OSHA enforces § 6401.9 through its citation and penalty framework, and a missing or paper-only plan is low-hanging fruit in any inspection, including one triggered by an unrelated complaint or injury. SB 553 also expanded Code of Civil Procedure § 527.8, allowing collective bargaining representatives — in addition to employers — to seek workplace violence restraining orders on behalf of employees who have suffered violence or credible threats. Employers responding to an actual incident should think about both tracks: the Cal/OSHA compliance record and, where a threat is ongoing, a restraining order petition.
A practical annual maintenance cycle
- Reconfirm who owns the plan and update names and titles after turnover.
- Re-run the hazard assessment for each site, including parking areas and late-shift conditions.
- Deliver and document the annual interactive training.
- Audit the incident log against HR complaints and security reports — unlogged incidents are a common citation theory.
- Review the plan and revise it as needed, noting the review date in the document itself.
Folding this cycle into your broader regulatory compliance calendar — alongside handbook updates and required postings — keeps it from being forgotten until an inspector asks.
Talk to a California business attorney
If your workplace violence prevention plan is still a 2024 template, or you have had an incident and are unsure of the required response, a brief review now beats explaining gaps to Cal/OSHA later. Schedule a free consultation or call (949) 418-2113.
This article is attorney advertising and provides general information only. It is not legal advice and does not create an attorney–client relationship. Facts matter; consult a lawyer about your specific situation.
