Compliance

What Does California Require for Workplace Violence Prevention?

What the law actually requires

Five things, and all five are enforceable now. A written plan that is specific to the site rather than generic. A hazard identification and evaluation process, applied on a schedule and repeated after any incident. A Violent Incident Log recording every incident, retained for five years. Effective training delivered when the plan is established and annually thereafter, with training records retained for at least one year. And a procedure for employees to report incidents and threats without fear of reprisal, along with a defined process for investigating and responding.

The plan may sit inside the existing Injury and Illness Prevention Program or stand alone. Either is acceptable. What is not acceptable is a document that has never been tailored to the actual site, the actual work, and the actual people doing it.

Who is covered

In practical terms, nearly every California employer. The statute applies broadly, and the exemptions are narrow enough that most organizations that assume they are exempt are not.

The exemptions cover employers already subject to the Cal/OSHA workplace violence prevention in health care standard, employees teleworking from a location of their own choosing outside the employer's control, locations not open to the public where fewer than 10 employees work at any given time, and certain corrections and law enforcement agencies.

The fewer than 10 employees exemption is the one organizations reach for and the one that most often fails. It requires that the location be closed to the public. A workplace that accepts deliveries, receives vendors, or has any routine outside foot traffic will struggle to claim it.

The training requirement most programs fail

Training must be interactive. Employees have to be able to ask questions and receive answers in real time, and the content has to be tailored to the specific job assignments of the people being trained.

This is where the largest share of nominally compliant programs break. A recorded e-learning module purchased at a per seat price satisfies neither condition. It is not interactive in the sense the statute requires, and it is not tailored to a specific site or a specific job. Organizations that bought a compliance product often have documentation showing training was completed and a program that would not survive an inspection.

The same problem appears in the plan itself. A downloaded template with a company name inserted is a document, not a program, and the hazard assessment it contains describes a workplace that does not exist.

The Violent Incident Log

The log records every incident of workplace violence, and the definition of an incident is broader than most managers assume. It captures threats, verbal abuse, and incidents that produced no injury, not only physical assaults.

Each entry requires detail: the date, time, and location, a description of the incident, the classification of the type of violence, the circumstances, the consequences, and who completed the entry. Personal identifying information about the people involved is excluded from the log.

Logs are retained for five years. This is the record an inspector will ask for first, because it is the fastest way to determine whether a program is real. An empty log at an organization with a busy incident history is a finding, not a clean record.

What changes when the permanent standard arrives

SB 553 required Cal/OSHA to propose a general industry workplace violence prevention standard, with the Occupational Safety and Health Standards Board required to adopt it no later than December 31, 2026. Draft versions have moved through advisory and comment stages, with the most recent public comment period closing in mid 2026.

The drafts released so far build on the statutory framework rather than replacing it, and go further on hazard assessment, post incident response, and program implementation. Reporting and communication obligations expand, including communication with authorized employee representatives about how incidents are reported, investigated, and resolved.

The practical consequence is straightforward. Organizations that built a substantive, site specific program will handle the transition as a routine review. Organizations that relied on a template will face a rebuild, under time pressure, at the same moment every other California employer is doing the same thing.

How a real program is scoped

Program development is a project, not a subscription. The work is a site walk and hazard assessment, a written plan built from what the walk found, a records system including the Violent Incident Log, on site interactive employee training, a separate supervisor module covering recognition and response, and a train the trainer handoff so the organization can deliver future sessions without buying them.

Cost is driven by headcount and shift count rather than by the length of the scope description, because the number of training sessions required is the dominant variable. A single shift operation with 13 employees and a three shift operation with 130 are different engagements even where the written plan is nearly identical.

Ongoing work is retained annually and banded to headcount, covering the annual plan review, the annual training cycle, incident log oversight, and the transition to the permanent standard when it is adopted.

Compliance and threat management are the same discipline

A workplace violence prevention plan that exists only to satisfy Cal/OSHA is a filing exercise. The statute happens to describe, in regulatory language, the same work that behavioral threat assessment describes in operational language: identify who might act, evaluate capability and access, remove what in the environment makes acting easier, and define who decides what happens next.

Organizations that treat the requirement as an opportunity to build actual threat management capability get a compliant program and a functioning one. The reporting procedure becomes a real intake channel. The hazard assessment becomes a live picture of the site. The supervisor training becomes early detection.

That capability carries directly into higher risk moments the statute does not address: a termination involving a person who has made threatening statements, a workforce reduction, a public facing event, or an executive whose exposure has grown. The program is the foundation, and the protective work sits on top of it.

A note on scope

This page describes statutory and regulatory requirements in general terms and is not legal advice. Cal/OSHA rulemaking is active and the permanent standard is not final. Verify current requirements against the Department of Industrial Relations and, where the stakes warrant it, with counsel.