California Workplace Violence Prevention Plan (SB 553) in Plain Words

Ask a California business owner about their workplace violence prevention plan and you'll hear one of three answers: "We have one somewhere," "That's for hospitals, right?" or a long pause followed by a very quiet "Which one?"

All three are common, and none of them will help much if Cal/OSHA comes calling. Since July 1, 2024, most California employers have had to keep a written plan, a log of violent incidents and a yearly training in place under Labor Code section 6401.9, which came from SB 553.

This guide walks through what the law asks for in plain words, who's covered, what to keep and when it makes sense to hand the writing to someone else.

Why California Workplace Violence Prevention Matters Now

It's easy to file this under "that happens somewhere else," but the numbers say otherwise. Cal/OSHA reports that 57 working people in California died from acts of workplace violence in 2021, and it points to a Bureau of Justice Statistics report showing an average of 1.3 million nonfatal violent crimes in US workplaces each year from 2015 to 2019.

The law also doesn't limit violence to punches. It covers threats, including texts and social media posts that reasonably read as an intent to cause harm, and it sorts workplace violence into four types: a stranger with bad intentions (Type 1), a customer, client or visitor (Type 2), a current or former coworker, supervisor or manager (Type 3) and someone with a personal relationship to an employee (Type 4).

So a plan for a front desk looks different from a plan for a warehouse, and that's on purpose.

The Takeaway: The law covers threats as well as physical attacks, so your plan has to cover how people talk and text, not just what they do.

Who Needs a Workplace Violence Prevention Plan in California?

Most California employers do. The statute applies to all employers, employees, places of employment and employer provided housing, and then carves out a short list of exceptions: health care operations covered by Title 8 section 3342, certain Department of Corrections and Rehabilitation facilities, certain law enforcement agencies, employees teleworking from a location of their own choice that the employer doesn't control, and places with fewer than 10 employees at a time that the public can't get into, as long as they comply with the Injury and Illness Prevention Program rule.

There are two catches. First, those exceptions are narrow, so a 15 person office with a front door open to customers isn't exempt. Second, Cal/OSHA can order an exempt employer to comply anyway, so "we think we're exempt" is something to confirm, not assume.

The Takeaway: Treat yourself as covered until you've checked the exceptions line by line.

The 13 Things Your Plan Has to Cover

The plan has to be in writing, easy for employees to get at any time and specific to the hazards in each of your work areas. It can be its own document or a section inside your Injury and Illness Prevention Program (IIPP). Here's what the statute lists, in plain words:

1. Who's responsible for the plan, by name or job title.
2. How employees and their representatives get involved in building and using the plan.
3. How you coordinate with other employers when you share a worksite.
4. How you take reports of violence and how you prohibit retaliation against people who report.
5. How you make sure supervisors and everyone else follow the plan.
6. How you talk with employees about violence, including how they report a threat without fear of reprisal and how they hear back about the investigation.
7. What happens in an emergency, including alerts, evacuation or shelter plans and how to get help.
8. How you build and deliver the training.
9. How you find and judge hazards, with inspections when the plan starts, after each incident and whenever a new hazard shows up.
10. How you fix those hazards on time.
11. How you respond to and investigate an incident.
12. How you review the plan, at least once a year, after an incident and whenever you spot a gap.
13. Anything else the Cal/OSHA standard requires as it develops.

Notice what's missing from that list: a generic binder. The law keeps using words like "effective" and "specific to each work area," and that's why a template is a good start but the filling in is where the plan lives or dies.

The Takeaway: Thirteen pieces, in writing, written for your workplace and not for the average workplace.

The Violent Incident Log: What Goes In and What Stays Out

You have to record every workplace violence incident in a violent incident log, whether or not anyone got hurt. Each entry includes the date, time and location, the type of violence, a detailed description, who did it (a customer, a family member or friend of a customer, a stranger, a coworker, a supervisor, a partner or spouse, a relative or someone else), the circumstances at the time (like working alone, rushed or short staffed), where it happened and what kind of incident it was.

The entry also notes what happened afterward, including whether security or law enforcement was called, and who filled out the log, with their name, job title and the date.

And here's the part people trip on: the log has to leave out anything that could identify the people involved, like names, addresses, email addresses, phone numbers and Social Security numbers, plus anything that points to a person when combined with other public information. So you collect the facts from the employee, the witnesses and your investigation, then strip the identity out before it goes in the log.

The Takeaway: Write down what happened, and leave out who it happened to.

Training: What "Effective" Means Under the Law

Employees need training when the plan first starts and every year after that, and the material has to fit their reading level and language. It covers your plan and how to get a free copy, the definitions and requirements in the law, how to report violence to you or to law enforcement without fear of reprisal, the hazards in their specific jobs and how to get help, and the log and how to get copies of the records.

It also has to include an interactive question and answer session with someone who knows your plan, which means an emailed slide deck on its own won't cover it. When a new hazard shows up or you change the plan, you owe people more training on that change.

Your managers carry most of this in real life, so it helps to have them ready, and our post on getting new managers ready covers how to do that. People also report what feels safe to report, which is a culture question before it's a paperwork question, and we dig into that in Don't Suck at Culture.

The Takeaway: Train every year, make it fit your jobs and leave room for real questions.

Records: What to Keep and for How Long

Keep records of hazard identification, evaluation and correction for at least five years. Keep training records for at least one year, with the dates, a summary of what was covered, the names and qualifications of the trainers and the names and job titles of everyone who attended.

Keep violent incident logs for at least five years, and keep incident investigation records for at least five years too, without any medical information in them.

Employees and their representatives can ask for the hazard, training and log records, and you have 15 calendar days to give them over at no cost. Cal/OSHA can ask for all of it.

The Takeaway: If it isn't written down and filed, an inspector will treat it as if it didn't happen.

What Happens If You Don't Have a Plan

Cal/OSHA enforces the law by issuing citations and notices of civil penalty, and employers can appeal them. The penalty depends on the citation, so the better question is how the time spent on a plan compares with the problem it's meant to prevent.

One more date worth putting on your calendar: the same law told Cal/OSHA to propose a formal workplace violence standard by December 31, 2025, and told the Standards Board to adopt one by December 31, 2026. So build a review into your plan now, because the rules around it may get more specific.

Template or Done For You?

Cal/OSHA has a free model plan for general industry, and it's a decent starting point. But the law wants the plan to be specific to the hazards and fixes for each work area and operation, and a model plan can't know that your back door sticks or that your closer works alone on Fridays.

Someone has to walk through your workplace and fill that in, and that's our job. We write the plan, the log and the training guide around how your company runs, you read it, your attorney reviews it and we fix whatever they flag.

And, a plan only counts if your people are trained on it every year, so read what yearly SB 553 training has to cover before you call your plan done.

If that sounds like what you need, see the California workplace violence prevention plan package, our services page and our page on fractional HR in California. And if you're still weighing whether you need outside help at all, our post on fractional HR leadership covers what that looks like.

If you're not sure your plan would hold up, the Fix First Plan checks it against the law and tells you what to fix first, in writing, with 1 call to talk it through.

I'm an HR pro, not a lawyer. This is my read of the law as of October 2026, so run your own situation by an employment attorney.

Frequently Asked Questions

Does my small business need a workplace violence prevention plan in California?

Most likely, yes. The law applies to all California employers with a few narrow exceptions, like a workplace with fewer than 10 employees at a time that isn't open to the public and that complies with the Injury and Illness Prevention Program rule. Cal/OSHA can also order an exempt employer to comply.

When did the California workplace violence prevention law start?

SB 553 took effect on January 1, 2024, and the plan, violent incident log and training requirements became operative on July 1, 2024.

Can the plan be part of our IIPP?

Yes. The law lets the plan be a stand alone section of your Injury and Illness Prevention Program or a separate document, as long as it's in writing, easy for employees to get and specific to each work area.

How often do we have to review the plan and train employees?

Review the plan at least once a year, when you spot a gap and after any workplace violence incident. Train employees when the plan first starts and every year after, with extra training when a new hazard shows up or the plan changes.

Does our harassment prevention training count?

No, it covers a different subject. Workplace violence training has its own topics, including your plan, how to report violence without fear of reprisal, the hazards in each job and an interactive question and answer session with someone who knows your plan.

Do remote employees need to be covered?

Employees who telework from a location of their own choice that the employer doesn't control are exempt. Employees who work at a site you control are not.

How long do we keep workplace violence records?

Keep hazard records, violent incident logs and incident investigation records for at least five years, and training records for at least one year. Employees can ask for the hazard, training and log records and you have 15 calendar days to give them over at no cost.

Is the Cal/OSHA model plan enough?

It's a good starting point, but the law wants a plan that's specific to the hazards and fixes for each of your work areas, so someone still has to walk through your workplace and fill in the details.

Let's Get Your Plan Written

So, go find the plan that's "somewhere" and hold it up against the list above. If most of that list is missing, get in touch and we'll walk you through what our plan package includes and how fast we can get you covered.

Hire Better. Lead Smarter. Don't Suck!