Compliance guideRead at source, 23 September 2026
Workplace Violence Prevention Plan: What California’s SB 553 Requires, and a Fill-In Outline
A workplace violence prevention plan is a written program for identifying, preventing and responding to violence at work. In California it is mandatory: Labor Code section 6401.9, added by SB 553, has required most employers to have one in effect since July 1, 2024, along with a violent incident log, annual interactive training, and records kept for at least five years. There is no general federal requirement, but New York now requires a written policy and training for retail employers with 10 or more retail employees, and a California standard is due to replace the statute’s interim rules. The plan below follows the statute’s own list of required elements.
Who must have a workplace violence prevention plan
Section 6401.9 “applies to all employers, employees, places of employment, and employer-provided housing” in California, with a short list of exemptions:
- Health care facilities, service categories and operations covered by Cal/OSHA’s separate health care standard (8 CCR 3342), and employers that comply with it.
- Places of employment with fewer than 10 employees working there at any given time that are not accessible to the public, provided they comply with the general Injury and Illness Prevention Program rule.
- Employees teleworking from a location of their choice that the employer does not control.
- Certain corrections facilities and law enforcement agencies that meet their own standards.
Two points catch people out. The small-site exemption needs both conditions: a nine-person store open to customers is covered. And Cal/OSHA can still order an exempt employer to comply. For most retail, restaurant, warehouse, logistics, security and service employers in California, the plan is required.
The four types of workplace violence the plan must address
The statute defines workplace violence by who commits it, and the plan has to consider all four:
| Type | Who commits it | Frontline example |
|---|---|---|
| Type 1 | A person with no legitimate business at the worksite | A robbery at a store or a break-in at a yard |
| Type 2 | Customers, clients, patients, students, inmates or visitors | A customer assaulting a cashier over a refund |
| Type 3 | A present or former employee, supervisor or manager | A dismissed worker returning to the site |
| Type 4 | Someone who does not work there but has a personal relationship with an employee | A former partner confronting an employee at work |
What the plan must contain
The plan must be “in writing and shall be available and easily accessible to employees,” and may be a stand-alone section of your Injury and Illness Prevention Program. Subsection (c) lists what it must include; in summary:
- The names or job titles of the people responsible for the plan.
- How employees and their representatives take an active part in developing and carrying it out.
- How you coordinate with other employers at the same site, such as staffing agencies or building security.
- How reports of violence are accepted and responded to, with retaliation prohibited.
- How you ensure supervisors and employees comply with it.
- How you communicate with employees about violence, including how to report without fear of reprisal.
- Emergency response: how employees are alerted, evacuation or sheltering, and how to get help from security or law enforcement.
- Training procedures.
- How hazards are identified and evaluated, including inspections when the plan is first set up, after each incident, and whenever a new hazard comes to light.
- How hazards are corrected.
- Post-incident response and investigation.
- Review: the plan must be reviewed “at least annually, when a deficiency is observed or becomes apparent, and after a workplace violence incident.”
The violent incident log
Employers must record “every workplace violence incident” in a log, without personal identifying information. Each entry records the date, time and location; the type of violence; a detailed description; a classification of who committed it; the circumstances and where it happened; the type of incident (physical attack, attack with a weapon, threat, sexual assault, animal attack or other); the consequences, including whether security or law enforcement was called; and the name, job title and date of the person completing the entry.
Training requirements
Training is required when the plan is first established and annually after that, with additional training when a new hazard is identified or the plan changes. It must cover the plan itself and how to get a free copy and take part, the definitions and requirements of the law, how to report without reprisal, job-specific hazards and corrective measures, how to get help and strategies to avoid harm, and the incident log. It must also include “an opportunity for interactive questions and answers with a person knowledgeable about the employer’s plan” — a video on its own does not meet that.
For employers with high turnover, the practical consequence is that this training belongs in onboarding. A site that hires 60 people a year cannot wait for the annual session.
Records and how long to keep them
| Record | Minimum retention |
|---|---|
| Hazard identification, evaluation and correction | Five years |
| Violent incident logs | Five years |
| Incident investigation records (no medical information) | Five years |
| Training records (dates, content, trainer, attendees) | One year |
Employees and their representatives can request these records, and the employer must provide them within 15 calendar days.
A fill-in outline for your plan
This structure follows the statute’s required elements in order. Fill in every bracket for each site; a plan that is identical across a store, a warehouse and a call center has not assessed anything.
1. Responsibility
Plan administrator: [name, title]. Site leads: [site – name, title]. Authority: [who can change procedures and approve corrections].
2. Employee involvement
How employees help identify hazards, design training and review incidents: [safety committee, shift huddles, anonymous reporting line].
3. Coordination with other employers
[Staffing agencies, security contractors, landlords]: who reports to whom and how incidents are shared.
4. Reporting and non-retaliation
How to report: [channels]. Response time: [target]. Statement that no employee will be retaliated against for reporting.
5. Compliance
How supervisors and employees are held to the plan: [recognition, retraining, discipline].
6. Communication
How employees hear about hazards and changes: [postings, huddles, text alerts]. Languages used: [list].
7. Emergency response
Alert method: [code words, alarms]. Evacuation and shelter locations: [by site]. Who calls security or 911.
8. Training
At hire: [when, who delivers]. Annually: [month]. After changes: [trigger].
9. Hazard identification and evaluation
Inspections at plan setup, after every incident, and on new hazards. Known risk factors by site: [cash handling, late hours, working alone, isolated areas, poor lighting].
10. Hazard correction
Hazard: [ ] Correction: [ ] Owner: [ ] Date completed: [ ].
11. Post-incident response and investigation
Immediate care, preservation of information, log entry, root-cause review, and corrective actions.
12. Plan review
Annually in [month], after any incident, and whenever a deficiency is found. Reviewer: [name, title].
What is coming next in California, and outside it
California. The statute directed Cal/OSHA to propose a general-industry workplace violence standard by December 31, 2025 and the Standards Board to adopt one by December 31, 2026. As of September 2026 the standard is still a discussion draft — the latest is dated July 22, 2026, with comments closed on August 17, 2026 — and the Standards Board had not published a formal proposal. Until a standard is adopted, the statute’s requirements above are what Cal/OSHA enforces.
New York. The Retail Worker Safety Act (Labor Law 27-e) requires retail employers with at least 10 retail employees to adopt a written retail workplace violence prevention policy and train employees on hire and annually (every two years for employers with fewer than 50 retail employees). From January 1, 2027, retail employers with 500 or more retail employees in the state must provide silent response buttons — a physical button, a wearable device or a phone app.
Federal. There is no general OSHA workplace violence standard. OSHA’s rulemaking for health care and social assistance is listed in the federal regulatory agenda as a long-term action, with no proposed rule date. Healthcare employers should check their own state, several of which have sector-specific requirements.
Why this matters for hiring
Customer-facing violence is a reason frontline staff leave, and a reason some applicants never start. A plan that is real — with a reporting route people trust and a response they can see — is part of what keeps a retail or care team staffed. It also gives you something honest to say in an interview when a candidate asks about safety, which in some sectors they now do.
Frequently asked questions
Who needs a workplace violence prevention plan in California?
Most California employers. Labor Code 6401.9 applies to all employers, employees, places of employment and employer-provided housing, with exemptions for health care operations covered by 8 CCR 3342, sites with fewer than 10 employees present at any time that are not open to the public, employees teleworking from a place the employer does not control, and certain corrections and law enforcement facilities.
When did SB 553 take effect?
The section was added effective January 1, 2024, and its requirements for the plan, incident log, training and records became operative on July 1, 2024.
What must a workplace violence prevention plan include?
Under Labor Code 6401.9(c): the people responsible, employee involvement, coordination with other employers, reporting and non-retaliation procedures, compliance, communication, emergency response, training, hazard identification and evaluation, hazard correction, post-incident response and investigation, and a review at least annually and after incidents.
How often is workplace violence training required?
Initial training when the plan is first established and annually after that, plus additional training when a new hazard is identified or the plan changes. The training must include an opportunity for interactive questions and answers with someone knowledgeable about the plan.
How long must the violent incident log be kept?
At least five years. Hazard identification, evaluation and correction records and incident investigation records are also kept for five years; training records for at least one year.
Is there a federal workplace violence prevention plan requirement?
No general one. OSHA has no general-industry workplace violence standard, and its rulemaking for health care and social assistance is listed as a long-term action with no proposed rule date. Some states have their own requirements, including California and New York for retail.
What does New York require for retail workplace violence?
Under the Retail Worker Safety Act, retail employers with at least 10 retail employees must adopt a written workplace violence prevention policy and train employees on hire and annually, or every two years for employers with fewer than 50 retail employees. From January 1, 2027, those with 500 or more retail employees in New York must provide silent response buttons.
Will California adopt a new workplace violence standard?
The law requires the Cal/OSHA Standards Board to adopt a general-industry standard by December 31, 2026. As of September 2026 the standard was still a discussion draft dated July 22, 2026. Until it is adopted, the requirements in Labor Code 6401.9 apply.
Keeping a customer-facing team staffed is a safety issue too.
Boostpoint runs local Facebook and Instagram recruitment campaigns for retail, healthcare and warehouse employers who need a steady flow of applicants for hard-to-hold roles.
Book a Demo