California Workplace Violence Prevention Plan: What Changes Before December 31, 2026
Most California employers wrote a workplace violence prevention plan in the spring of 2024, filed it, and moved on. That was the right first step and it is no longer enough. The obligation created by SB 553 is a maintenance obligation, not a one-time filing, and the version of it that exists today is the interim version.
Cal/OSHA has been drafting a formal general industry standard since 2024, and under Labor Code section 6401.9 the Occupational Safety and Health Standards Board must adopt that standard no later than December 31, 2026.
A California workplace violence prevention plan is a written program every covered employer must establish, implement, and maintain in all work areas, backed by a violent incident log, annual training, and five years of records. It has been enforceable since July 1, 2024. What is changing is the level of detail Cal/OSHA will hold employers to, and the plan sitting in a shared drive from 2024 is unlikely to meet it.
Featured image: a real IntelliSee detection frame. A person is flagged in a commercial loading zone, one of the unauthorized access points the Cal/OSHA draft standard names as a workplace violence hazard.
What a California workplace violence prevention plan must contain
Labor Code section 6401.9 requires a written plan with eleven categories of content, and the omission of any one of them is a citable gap. Employers most often satisfy the narrative sections and skip the procedural ones.
The statute requires the names and job titles of the people responsible for implementing the plan, procedures for employee involvement in developing and reviewing it, methods for coordinating with other employers whose workers share the site, procedures to ensure compliance, procedures for communicating with employees about workplace violence, emergency response procedures, procedures for developing and providing training, procedures to identify and evaluate hazards on a scheduled basis, procedures to correct hazards in a timely way, procedures for post-incident response and investigation, and a process for reviewing the plan's effectiveness at least annually.
Two of those deserve particular attention. The plan must include procedures for accepting and responding to reports of workplace violence and for prohibiting retaliation against the employee who reports. And the hazard identification requirement is scheduled and recurring, not a single walkthrough. Cal/OSHA publishes a free model plan and fact sheets on its general industry workplace violence prevention page, which is the correct starting point for any employer whose plan is thin.
The one-sentence version: the written plan is the deliverable, but the violent incident log, the annual review, and the annual retraining are what Cal/OSHA will ask you to produce. A plan with no log behind it reads as a plan that was never implemented.
Who is covered, and the exemptions employers get wrong
Section 6401.9 applies to nearly every California employer, with five narrow exemptions. Those exemptions are health care facilities already covered by the separate standard at Title 8 section 3342, Department of Corrections facilities operating under an injury and illness prevention program that meets section 3203, law enforcement agencies with the required POST confirmation, employees teleworking from a location of their own choosing that is outside the employer's control, and places of employment with fewer than ten employees present at any given time that are not accessible to the public.
The last one is where employers misread the law. The small-headcount exemption has two conditions joined by "and," and public accessibility is the condition that fails. A ten-person clinic, showroom, branch office, or storefront that anyone can walk into is covered no matter how small it is. A back-office suite behind a locked door with eight employees is not.
The statute also frames workplace violence in four types, and a plan that only addresses one of them is incomplete. Type 1 is violence by someone with no legitimate business at the site. Type 2 is violence directed at employees by customers, clients, patients, students, inmates, or visitors. Type 3 is violence involving present or former employees, supervisors, or managers.
Type 4 is violence by a person who has a personal relationship with an employee but no relationship to the employer. Type 2 and Type 4 are the two most employers underplan for, and both of them begin in the parking lot or at the entrance rather than inside the building.
The violent incident log is the record Cal/OSHA actually asks for
The violent incident log is a per-incident record with a fixed field list, and it must be recorded for every incident regardless of whether anyone was injured. Employers who treat it as an injury log undercount by a wide margin, because threats, verbal abuse, and sexual assault are all recordable events under the statute even when no medical treatment follows.
Each entry must capture the date, time, and location; the workplace violence type or types involved; a detailed description of the incident; a classification of who committed the violence, such as a customer, a stranger, a coworker, or a person with a personal relationship to an employee; the circumstances at the time, including whether the employee was working alone, working late at night or early in the morning, working in an isolated area, or working in a location where money was exchanged; the type of incident, such as a physical attack with or without a weapon, a threat, an animal attack, or a sexual assault; the consequences, including what security or law enforcement response occurred and whether the incident was reported; and who completed the log and when. The log must omit any personal identifying information sufficient to identify the individuals involved.
Records retention is where a paper-thin program becomes a citation. The log, the hazard identification and evaluation records, the correction records, and the incident investigation records are all kept for five years. Training records are kept for one year. And on request from an employee or their representative, the log has to be made available, free of charge, within fifteen calendar days.
What changes when the Standards Board adopts the general industry standard
The interim statute is the floor, and the draft general industry standard raises it in ways that touch physical security directly. Cal/OSHA circulated revised discussion drafts through 2024 and 2025 and closed public comment on June 1, 2026, with Standards Board adoption required by December 31, 2026. The final text is not settled, so treat the following as the direction of travel rather than as adopted law.
| Area | Interim requirement today | What the draft standard adds |
|---|---|---|
| Scope | Places of employment in California | Extends to employer-provided transportation |
| Hazard assessment | Procedures to identify and evaluate hazards on a schedule | A named list of hazard conditions, including working alone, poor lighting or blocked visibility, unauthorized access points, lack of escape routes, exchange of money, late-night work, inadequate staffing, and stalking connected to the workplace |
| Inspection triggers | Scheduled periodic review | Inspection when the plan is established, after each incident, when workplace or job changes create new hazards, and when new processes or equipment introduce one |
| Controls | Timely correction of hazards | Engineering and work practice controls that eliminate or minimize exposure, plus staffing sufficient to maintain order and respond in a timely manner |
| Recordkeeping | Five-year retention on logs and hazard records | Five-year retention extended to threat and incident reports, employer evaluations, corrective actions, and employee notifications |
The hazard list is the part worth reading twice. Cal/OSHA is moving from "identify your hazards" to naming the specific conditions it expects to see assessed, and most of them are physical and observable: lighting, sightlines, access points, escape routes, isolation, and hours of work. That is a list a security team can be held to, and it is a list that maps cleanly onto what a camera network already covers.
Which named hazards a camera can actually see
Not every hazard in the draft standard is a detection problem, and pretending otherwise is how security vendors lose credibility with safety managers. Some of these conditions are fixed by facilities work or scheduling, and the honest answer is to say which is which.
| Hazard named in the draft standard | Who fixes it |
|---|---|
| Unauthorized access points | Facilities hardens the door. Detection covers the approach and flags a person in a restricted area |
| Working alone, late-night and early-morning work | Scheduling and staffing. Detection provides the second set of eyes a lone worker does not have |
| Poor lighting or blocked visibility | Facilities. Detection can operate in low light but does not substitute for fixing the lighting |
| Lack of escape routes | Facilities and life safety. Not a detection problem |
| Inadequate staffing or lack of security staffing | Staffing decision. Detection extends the reach of the staff you have |
| Exchange of money or valuables | Process controls. Detection covers the transaction area for weapons and loitering |
| Stalking connected to the workplace | Human resources, legal, and restraining order procedures. Detection can flag loitering and vehicles in the lot, but cannot identify a specific individual |
A real IntelliSee detection frame. A vehicle is flagged in an unstaffed lot after dark, the intersection of three hazards the draft standard names: working alone, late-night work, and poor lighting.
Annual review and annual retraining are the obligation that never ends
Section 6401.9 requires employers to review the effectiveness of the plan at least annually, after a workplace violence incident, and whenever a deficiency becomes apparent. Training follows the same rhythm: when the plan is first established, annually thereafter, and again when a new or previously unrecognized hazard is identified or the plan changes in a way that affects employees.
Training is not a video and a signature sheet. The statute requires it to cover the plan itself and how employees can obtain a free copy, the definitions and requirements of the law, how to report violence without fear of reprisal, the hazards specific to the employee's job and the corrective measures in place, and the violent incident log and how to obtain records. It must be delivered by someone knowledgeable about the plan, and it must include an interactive question-and-answer opportunity.
For employers who put a plan in place in mid-2024, that means at least two annual review cycles and two rounds of retraining should already be documented. If they are not, that gap is visible in the training records, which is exactly where a Cal/OSHA inspector will look. Employers already tracking a similar cadence for accreditation will recognize the pattern from the Joint Commission workplace violence requirements for hospitals, which run on the same annual-evaluation logic.
Where detection technology fits, and where it does not
No technology satisfies Labor Code section 6401.9 on its own, and any vendor who says otherwise is selling a compliance claim it cannot back. The plan, the log, the training, and the records are administrative obligations that belong to the employer. What technology can do is make two of the statute's requirements achievable rather than aspirational: identifying hazards on a recurring basis, and responding to an incident while it is still in progress.
AI video analytics layers onto the cameras a facility already owns, with no hardware replacement, and watches for the conditions the draft standard names. IntelliSee detects weapons, unauthorized access, loitering, crowd formation, vehicles in restricted areas, falls, slip and fall risk, rooftop intrusion, perimeter breaches, cell phone use, and smoke and fire, and sends an alert within seconds to the people who can act on it.
For a Type 1 or Type 2 scenario that begins in a lot or at an entrance, those seconds are the entire difference between an incident report and an intervention.
A California-specific point worth making internally: IntelliSee does not use facial recognition and does not store or retain video. The detection layer flags a behavior or an object, not a named person. That keeps the violent incident log where the statute puts it, as the employer's own record, and it keeps the technology out of the biometric privacy questions that follow facial recognition around this state.
The distinction matters for the hazard identification requirement specifically. An employer that reviews sightlines once a year is meeting the letter of the rule. An employer whose cameras surface a loitering pattern at a service entrance in week three has evidence to act on before the annual review comes around, and a documented correction to show for it. That is the difference between a compliant plan and an effective one, and it is the same argument made in our guide to running a physical security risk assessment.
California is not an outlier for long. Several states have moved on workplace violence prevention since 2023, and the direction is consistent, as covered in our review of how quickly workplace violence prevention laws are spreading. Multi-state employers who build to the California requirement generally find the rest of the country easier to satisfy. For the mechanics of writing detection into a plan document, see our walkthrough on building a workplace violence prevention plan around proactive AI.
Frequently asked questions
Does every California employer need a workplace violence prevention plan?
Nearly every one does. Labor Code section 6401.9 exempts only health care facilities covered by Title 8 section 3342, qualifying Department of Corrections facilities, law enforcement agencies with POST confirmation, employees teleworking from a location outside the employer's control, and workplaces with fewer than ten employees present at any time that are also not accessible to the public. Both parts of that last condition have to be true.
What is the deadline for the Cal/OSHA general industry workplace violence standard?
The Occupational Safety and Health Standards Board must adopt a general industry workplace violence prevention standard no later than December 31, 2026, under Labor Code section 6401.9. Cal/OSHA was required to submit its proposal to the Board by December 31, 2025, and public comment on the draft closed June 1, 2026. Until the standard is adopted, the statutory requirements in effect since July 1, 2024 are separately enforceable.
How long does a violent incident log have to be kept?
Five years. The same five-year retention applies to hazard identification, evaluation, and correction records and to incident investigation records. Training records are kept for one year. On request from an employee or their representative, the log must be provided free of charge within fifteen calendar days.
Does a workplace violence prevention plan require security cameras?
No. Section 6401.9 does not mandate any specific technology. It requires employers to identify and evaluate workplace violence hazards on a recurring basis and to correct them in a timely way, and the draft general industry standard names conditions such as unauthorized access points, poor lighting, isolated work, and late-night work. Cameras and video analytics are one way to assess and monitor several of those conditions. They are not a substitute for the written plan, the log, or the training.
Do AI security cameras use facial recognition?
Not necessarily, and IntelliSee does not. Detection can be built on behaviors and objects, such as a visible weapon, a person in a restricted zone, or a fall, without identifying who anyone is. The distinction is covered in more depth in our explainer on whether AI security cameras use facial recognition.
The bottom line
California employers have roughly four months before the Standards Board is required to adopt a general industry workplace violence prevention standard, and the draft signals a shift from broad procedural language toward a named list of physical conditions employers will be expected to assess and control.
The plan written in 2024 was built for the interim rule. The one that gets an employer through 2027 needs a documented hazard assessment, a live violent incident log, two years of completed annual reviews and retraining, and a realistic answer to the question of who is watching the lot at eleven at night.
That last question is the one cameras were supposed to answer and mostly do not. A recorded incident is documentation. A detected incident is a chance to intervene. Turning passive cameras into proactive protectors is the whole point, and it is the part of a workplace violence prevention plan that technology can genuinely carry.
Ready to see what your existing cameras could be catching? Talk with our team about layering AI detection onto the camera infrastructure you already have, with no hardware replacement and no facial recognition.
This article is general information about California Labor Code section 6401.9 and Cal/OSHA rulemaking as of September 2026. It is not legal advice. Rulemaking is ongoing and the adopted standard may differ from the draft described here. Consult qualified counsel about your obligations, and verify current requirements against Cal/OSHA's workplace violence prevention guidance and the text of Labor Code section 6401.9.
Your people. Your spaces.
See it on the cameras you already have.
Bring one priority event and one camera view. We will walk through how IntelliSee turns it into an alert your team can act on.