California SB-553 Workplace Violence Prevention: What Employers Must Do (2026)

SB-553 gave California the country's first general-industry (not just healthcare) workplace-violence prevention law. If you operate in California and have employees, you almost certainly have to comply — and "we adopted a template plan" is not the same as meeting the statute. This guide explains what the law actually requires, how Cal/OSHA enforces it, the restraining-order remedy the same bill created, and where security services and assessments fit into a defensible compliance program. It is general information, not legal advice; confirm specifics with employment counsel for your operation.

Key dates: the SB-553 compliance timeline

SB-553 rolled out in stages, and the rules are still tightening. Here is the consolidated timeline a buyer needs on one screen.

What SB-553 requires and who it covers

Senate Bill 553 (Cortese) was signed September 30, 2023. It amended Labor Code section 6401.7 and added a new section, 6401.9, which became operative and enforceable on July 1, 2024. The core obligations are four: maintain a written Workplace Violence Prevention Plan, record incidents in a violent-incident log, train employees, and identify, evaluate, and correct workplace-violence hazards on an ongoing basis.

Coverage is deliberately broad. The requirement applies to essentially all California employers, employees, workplaces, and employer-provided housing. The statute defines "workplace violence" as any act or threat of violence at a place of employment, including physical force that results in — or has a high likelihood of resulting in — injury, psychological trauma, or stress (whether or not an injury occurs), and any incident involving a firearm or other dangerous weapon, including common objects used as weapons. Lawful acts of self-defense or defense of others are excluded.

There are narrow exemptions. If you fall outside every carve-out below, assume you are covered — and note that each exemption comes with its own condition:

The Workplace Violence Prevention Plan (WVPP)

The heart of the law is a written, worksite-specific plan. It can stand alone or be built into your existing IIPP, but it must be in effect at all times and available to employees. Cal/OSHA published a model plan in March 2024 that you may adopt, but the agency cautions that using the model by itself does not ensure compliance — it is a generic "fill-in-the-blank" template that will not automatically match your worksite, hazards, or existing IIPP, so most employers should tailor it. (You can download the current Model Written Workplace Violence Prevention Plan for General Industry from Cal/OSHA's General Industry page.)

Section 6401.9 requires the plan to include, at minimum:

• The names or job titles of the people responsible for implementing the plan.
• Procedures to obtain the active involvement of employees and their authorized representatives in developing and implementing the plan.
• Methods for coordinating implementation with other employers who share the workplace (relevant to landlords, staffing agencies, and multi-tenant sites).
• Procedures to ensure supervisory and non-supervisory employees comply with the plan.
• Procedures to accept and respond to reports of workplace violence and to communicate with employees about workplace-violence matters, including how to report incidents without fear of reprisal or retaliation.
• Procedures to respond to actual and potential workplace-violence emergencies.
• Procedures to identify, evaluate, and correct workplace-violence hazards, including scheduled periodic inspections and a post-incident response and investigation process.
• Procedures to review the plan's effectiveness and revise it as needed.

The plan must be reviewed at least annually, whenever a deficiency becomes apparent, and after any workplace-violence incident. It must be accessible to employees — on the worksite, posted in common areas, or available electronically via an intranet or software platform. The hazard-identification and correction element is where physical security controls live: access control, lighting, panic alarms, camera coverage, guard staffing, and safe-room or lockdown procedures are all "corrective measures" you can document as part of the plan.

Who owns the plan for temp workers, staffing agencies, and shared sites

One of the most common real-world questions — and one 6401.9 answers only in part — is who is responsible when more than one employer touches a worksite. The statute requires your plan to include methods for coordinating implementation with other employers who share the space, but it does not let anyone off the hook. In practice:

• Temporary and leased workers. Under California's dual-employer doctrine, both the staffing agency and the host/client employer generally share responsibility for a temp's safety. The host controls the physical worksite and its hazards, so it typically owns hazard identification, correction, and site-specific training; the agency shares training and recordkeeping duties. Don't assume the agency's boilerplate plan covers your floor — it rarely reflects your actual hazards.
• Contract security officers. Your guard vendor is itself an employer with its own 6401.9 obligations, but that does not transfer your plan duties to them. Coordinate: your WVPP should reference the guard scope, and the vendor's incident reporting should feed your log.
• Multi-tenant and landlord sites. Common areas, parking structures, and shared entrances are frequent Type 1/Type 2 hazard zones. Coordinate lighting, access control, and emergency response with the property manager and neighboring tenants, and document that coordination in your plan.

The violent-incident log and recordkeeping

Separate from OSHA injury logs, SB-553 requires a dedicated violent-incident log. You must record every workplace-violence incident, including near-misses and threats, based on information from employees who experienced or witnessed the event. For each incident the log must capture:

• The date, time, and location of the incident.
• The workplace-violence type — the statute's classification is Type 1 (perpetrator has no legitimate business at the worksite, e.g., a robber), Type 2 (customer, client, patient, student, inmate, or visitor), Type 3 (a present or former employee, supervisor, or manager), and Type 4 (a person with a personal relationship to an employee, e.g., domestic violence spilling into work).
• A detailed description: physical attack, attack with a weapon, threat, sexual assault, and so on, and whether weapons or objects were involved.
• The classification of who committed the act (customer, coworker, stranger, etc.) and the circumstances at the time (poor lighting, isolation, low staffing, etc.).
• The consequences — whether security or law enforcement was contacted and what actions were taken to protect employees from a continuing threat.

Two privacy rules matter: the log must omit personal identifying information, and workplace-violence records must not contain "medical information" as defined by the Civil Code. On retention, the log must be kept for a minimum of five years. So must hazard-identification/correction records and incident-investigation records. Training records must be kept for at least one year — though because the other records run on a five-year cycle, many employers simply retain everything for five years. All of these records must be made available to employees, their authorized representatives, and Cal/OSHA on request, without cost, for examination and copying within 15 calendar days.

Employee training requirements

Employers must provide effective, interactive training tailored to the violence risks employees face in their specific jobs and at their specific location. Training must be delivered when the plan is first established and at least annually thereafter, plus additional training whenever a new or previously unrecognized hazard is identified or the plan changes materially. At minimum, training must cover:

• The employer's plan, how it works, and how to participate in and get a free copy of it.
• How to report workplace-violence incidents or threats to the employer or law enforcement without fear of reprisal.
• Workplace-violence hazards specific to the employees' jobs, and the corrective measures the employer has put in place.
• The violent-incident log and how to obtain copies of it and other records.
• An opportunity for interactive questions and answers with a person knowledgeable about the plan.

Training records must document the dates, contents or a summary, the names and qualifications of the trainers, and the names and job titles of attendees. The statutory standard is specific: training has to be interactive, annual, and job- and site-specific. A passive video or a one-size-fits-all module does not meet it.

Enforcement, deadlines and penalties (Cal/OSHA)

SB-553 folded workplace-violence obligations into the IIPP framework, so Cal/OSHA enforces it through its standard citation-and-penalty process — inspections, complaint investigations, and citations. There is no separate registration; the operative deadline was simply July 1, 2024, and enforcement has been active since.

Crucially, penalties do not attach only after a reported assault. Failing to have, or failing to actually implement, a compliant WVPP is itself citable — commonly as a general/regulatory violation and, where the exposure is serious, as a serious violation. Recordkeeping failures (no log, incomplete log, records not produced within 15 days) have their own tier. Because each requirement is a separate obligation, Cal/OSHA can cite multiple instances on a single inspection, and each carries its own per-violation penalty. An employer with no plan at all can be cited even if nothing violent has ever happened on site.

2026 Cal/OSHA penalty schedule (figures current as of July 2026): Cal/OSHA's civil penalties track the federal OSHA schedule, which adjusts annually for inflation. For 2026 there was no CPI increase — the Bureau of Labor Statistics could not produce the required October 2025 CPI figure during the federal government shutdown, so the 2025 amounts carry into 2026 unchanged. The current maximums are:

Penalties are not applied at the maximum automatically — Cal/OSHA sets a base within the category and adjusts for gravity, employer size, good faith, and history — but because a missing or unimplemented plan can be cited as several separate violations, real-world exposure adds up fast. The compliance takeaway is blunt: adopt a tailored plan, actually implement it, document every incident, correct hazards promptly, and keep records producible within 15 days.

Workplace-violence restraining orders (Code of Civil Procedure 527.8)

The other half of SB-553 — right in the bill's title, "restraining orders and workplace violence prevention plan" — is an employer remedy most compliance guides skip. If a threatening ex-employee, hostile customer, or stalker is targeting your staff, you don't have to wait for them to act. Under Code of Civil Procedure 527.8, an employer whose employee has suffered unlawful violence or a credible threat of violence that can reasonably be construed to be carried out at the workplace may petition for a temporary restraining order and an order after hearing, on behalf of that employee and other employees at the workplace. SB-553 amended this statute effective January 1, 2025. Key changes:

• Who can petition. As of January 1, 2025, in addition to the employer, a collective-bargaining representative of the affected employee may seek the order on the employee's behalf and on behalf of other employees at the workplace.
• Employee opt-out. Before filing, the employer or union rep must give the affected employee an opportunity to decline to be named in the TRO. If the employee opts out, that does not block the employer from still seeking an order to protect other employees — and, where appropriate, employees at other worksites.
• Harassment as a basis. Through coordinated Senate Bill 428 (also operative January 1, 2025), the grounds expanded beyond violence and credible threats to include harassment — a knowing and willful course of conduct directed at a specific person that seriously alarms or annoys them, serves no legitimate purpose, and causes substantial emotional distress.

Note the limit: 527.8 is an employer (or union) tool. An individual employee still cannot file a workplace-violence restraining order on their own behalf under this statute; a targeted worker who wants to act personally would use the separate civil-harassment process (CCP 527.6). For businesses, though, 527.8 is a fast, concrete way to put a court order between a dangerous individual and your people — pair it with the physical controls your WVPP already documents.

The forthcoming permanent Cal/OSHA standard (2026 status)

Right now, employers comply directly with the statute (6401.9). A permanent regulatory standard is still in rulemaking, and it is close. Cal/OSHA released a revised discussion draft on April 24, 2026 (a substantial rewrite of the earlier May 2025 draft), and the Standards Board accepted public comments through June 1, 2026. A final vote is expected in late summer 2026, with an anticipated implementation date of January 1, 2027; the statutory backstop requires adoption no later than December 31, 2026.

For buyers setting multi-year security budgets, the direction of travel matters: the draft would expand scope to employer-provided transportation (company shuttles and fleet vehicles), narrow the small-employer exemption (365-day headcount test), require remote-training questions to be answered within one business day, and remove stalking from the definition of "workplace violence" while keeping it as an example hazard. The rules can tighten before your next renewal — build flexibility into contracts now.

Minimum viable WVPP: a compliance checklist

If you want a fast self-assessment, this is the shortest defensible path. If you can't check every box, you have a gap Cal/OSHA can cite.

Verify against the primary sources rather than a summary: the statute itself (SB-553 / Labor Code 6401.9 bill text), Cal/OSHA's General Industry Workplace Violence Prevention page and its downloadable model plan, and Cal/OSHA's main workplace-violence resource page for rulemaking updates.

Where outside security help fits your compliance program

SB-553's hazard-identification-and-correction requirement is where outside security expertise earns its keep. A professional security risk assessment maps your Type 1–4 exposure — cash handling, public access, isolated workers, parking-lot lighting, entry control — and produces documented findings and recommended corrections, which is exactly the record Cal/OSHA looks for. That assessment becomes the backbone of the hazard section of your written plan, and the physical controls it recommends become the "corrective measures" you log: on-site security guards to deter Type 1 and Type 2 violence, mobile patrol and video surveillance for after-hours coverage and stronger incident investigations, and de-escalation training for high-contact roles.

Sector context shapes the controls. Retail — organized retail crime, robberies, customer aggression — was a major driver of the law and carries some of the clearest hazard-correction duties (cash-drop procedures, panic alarms, camera coverage, trained staff); see retail loss-prevention security. Healthcare sits in a different lane: hospitals already covered by the Title 8 Section 3342 standard are exempt from a second 6401.9 plan, but face the highest Type 2 patient/visitor risk of any sector. Multifamily housing and hospitality fall squarely under 6401.9 and benefit from the same assess-then-control approach.

These are recurring costs, so budget for them. Use our security cost calculator to estimate staffing around your hours of exposure, then verify any provider's license before you sign and request scope-matched quotes from vetted security companies.