The Cal/OSHA Workplace Violence Prevention Regulation: The 2026 Standards-Compliance Briefing on the April Discussion Draft, the SB 553-to-Title 8 Transition, and the December 31 Adoption Deadline
California is converting SB 553 from a statute employers interpret into an enforceable Cal/OSHA Title 8 standard. What the April 2026 discussion draft changes, the recordkeeping that decides citations, and where documented detection controls fit inside a defensible plan.
California is about to turn a workplace violence statute into an enforceable Cal/OSHA standard, and the compliance bar moves with it
The Cal/OSHA general industry workplace violence prevention regulation is the moment California's workplace violence rules stop being a statute employers interpret on their own and become a Title 8 standard a compliance officer can cite line by line. Since July 1, 2024, California Labor Code section 6401.9 has required nearly every non-healthcare employer in the state to build and maintain a written Workplace Violence Prevention Plan. What did not exist yet was the formal regulation. On April 24, 2026, the Occupational Safety and Health Standards Board released a revised discussion draft of that regulation, and under the statute the Board must adopt a final standard no later than December 31, 2026, with an implementation date set for January 1, 2027.
This briefing is written for security directors, EHS leaders, risk managers, and general counsel at multi-site employers who already have a WVPP under SB 553 and now need to understand what changes when guidance becomes a citable rule. It covers the legal mechanics of the statute-to-regulation transition, what the April 2026 draft adds and removes, the recordkeeping and hazard-correction obligations that decide citations, and where AI-powered detection fits as a documented engineering control inside a defensible plan, without facial recognition, stored video, or any claim the technology can substitute for the program itself.
Why a statute becoming a regulation changes the compliance calculus
The distinction between a statute and a regulation is not academic for the employer facing an inspection. SB 553 created Labor Code 6401.9 and made it enforceable on July 1, 2024, but the statute itself reads as a list of plan components rather than a granular standard. Cal/OSHA has been enforcing those components since the effective date, primarily by folding them into Injury and Illness Prevention Program inspections under Title 8 section 3203. The forthcoming regulation will sit in Title 8 alongside the existing healthcare workplace violence rule at section 3342, giving inspectors a dedicated, self-contained standard with defined terms, explicit procedural requirements, and its own citation language.
That matters because a regulation removes interpretive ambiguity in the employer's favor and the agency's favor at the same time. Under the statute, an employer could argue about what an adequate hazard assessment looked like. Under a standard, the elements are enumerated and the absence of any one of them is a discrete, citable gap. The April 2026 discussion draft enumerates twelve required plan components, from naming the person responsible for the plan through procedures for periodic review and evaluation. Each of those twelve becomes a checkbox an inspector can mark present or absent.
The scale of the problem the standard addresses is not abstract. The U.S. Bureau of Labor Statistics recorded 470 workplace homicides in 2024, up from 458 in 2023, with homicides accounting for 64.1 percent of all fatalities from violent acts that year. The Department of Justice's Bureau of Justice Statistics, in its Indicators of Workplace Violence, 2019 report, documented an average of 1.3 million nonfatal violent crimes against workers each year between 2015 and 2019. California's own data, cited by Cal/OSHA, recorded 57 working people killed by acts of workplace violence in the state in 2021. These are the numbers the regulation is built to move, and they are the numbers an employer's WVPP is implicitly measured against.
Cal/OSHA has been citing SB 553 gaps since July 2024, and the regulation will sharpen the teeth
Enforcement of Labor Code 6401.9 did not wait for the regulation. The Division of Occupational Safety and Health has been accepting complaints and conducting inspections referencing WVPP compliance since the statute's effective date. California general violations carry penalties up to $15,625 per violation, and serious, repeat, or willful violations carry substantially higher exposure. For a multi-location employer, a single inspection that spans several facilities can convert one missing plan element into citations at every site. The absence of a violent incident log, even where there have been zero incidents to record, is itself a documentable gap because the standard requires the log to exist and be maintained.
What the April 2026 discussion draft actually changes
The April 24, 2026 revised draft is the clearest signal yet of what the final standard will require, and it moved on several points that materially affect who is covered and what they must do. The most consequential changes fall into three buckets: scope, exemptions, and the mechanics of the plan itself.
Scope expanded to employer-provided transportation. The revised draft states the regulation applies to "all employers, employees, places of employment, employer-provided housing, and employer-provided transportation." The addition of employer-provided transportation extends the covered footprint beyond the fixed worksite to shuttle services, crew transport, and similar arrangements. For employers in logistics, agriculture, and field services, this closes a gap that the original statute left ambiguous.
A defined small-employer exemption. The draft clarifies that the regulation will not apply to an employer when the place of employment is not accessible to the public and the employer has fewer than ten employees at that place of employment at all times during the preceding 365 days, provided the employer complies with the Injury and Illness Prevention Program regulations. This is a meaningful carve-out, but it is narrow: a public-facing location of any size remains covered, and the ten-employee count is measured across the full prior year, not on the day of inspection.
Plan mechanics tightened, two hazard references removed. The draft deletes the crime of stalking under California Penal Code 646.9 from the definition of workplace violence itself, while retaining stalking in the list of examples of workplace violence hazards. It also removes references to hostile work environments, required and excessive overtime, working in high-crime areas, and providing security services from the staffing-level hazard language. At the same time, it adds a requirement that any training not delivered in person must include interactive questions answered within one business day by a person knowledgeable about the plan, and it preserves the obligation to offer post-incident trauma counseling.
These are not cosmetic edits. Each one shifts the boundary of what an inspector can cite. The interactive-training requirement, for example, converts a passive video module into a documented two-way exchange, which an employer must be able to evidence. The remainder of the rulemaking calendar is short: the comment period on the revised draft closed June 1, 2026, a vote approving a final draft is expected in late summer 2026, and the implementation date is set for January 1, 2027.
From SB 553 statute to an enforceable Cal/OSHA Title 8 standard
How California's general-industry workplace violence rule moves from a list of plan components to a citable regulation.
Senator Cortese's bill is signed, creating Labor Code 6401.9 and directing Cal/OSHA to develop a standard.
Written WVPP becomes mandatory for general industry. Cal/OSHA begins citing gaps through IIPP inspections.
Standards Board releases the revised discussion draft: transportation scope added, small-employer exemption defined.
Comment period closed June 1, 2026. A vote approving the final draft standard is expected after notice.
Implementation date for the adopted Title 8 standard. Statutory adoption deadline is December 31, 2026.
The twelve required plan components and where employers fall short
The April 2026 draft requires a written workplace violence prevention plan containing twelve enumerated components. An employer can hold a binder that addresses eleven of them and still be cited for the twelfth. The components track the statutory list but read with more procedural specificity in the regulatory draft.
The plan must identify the name or job title of the person responsible for it; establish procedures for the active involvement of employees and their representatives in developing and implementing it; describe how the employer coordinates the plan with other employers sharing a worksite; set procedures for responding to reports of workplace violence; define compliance procedures; specify communication methods including how violence is reported and how investigation results are communicated; lay out emergency response procedures; describe training procedures; set procedures for identifying and evaluating hazards; define a methodology for correcting those hazards; establish post-incident response and investigation actions; and provide for periodic review and evaluation of the plan.
In practice, the components that generate citations are rarely the obvious ones. Most employers name a responsible person and write an emergency procedure. The gaps cluster in three places: the hazard identification and correction methodology, the violent incident log, and the evidence that training actually happened and was understood. The first is where detection technology most directly intersects with the standard, because hazard correction is the component that asks an employer to show what it changed after identifying a risk, not merely that it identified one.
Statute vs. Standard: what the Title 8 regulation sharpens for general-industry employers
| Compliance Dimension | Under SB 553 / LC 6401.9 (since July 2024) | Under the Title 8 standard (effective Jan 1, 2027) |
|---|---|---|
| Legal instrument | Labor Code statute enforced largely through IIPP (section 3203) inspections | Dedicated Title 8 standard alongside the healthcare rule at section 3342, with its own citation language |
| Covered footprint | Places of employment and employer-provided housing | Adds employer-provided transportation to the covered scope |
| Small-employer relief | No clearly defined exemption in the statute text | Non-public worksites with fewer than 10 employees over the prior 365 days, if IIPP-compliant |
| Training | Effective training required, format largely employer discretion | Non-in-person training must include interactive questions answered within one business day |
| Hazard correction | Required, but assessed against a general adequacy standard | Enumerated methodology component; absence of documented correction is a discrete gap |
| Recordkeeping | Violent incident log, hazard and training records required | Same records, now tied to a self-contained standard with explicit retention periods |
The recordkeeping obligations that decide citations
Recordkeeping is where the workplace violence standard converts good intentions into defensible compliance, and where the most avoidable citations originate. Cal/OSHA's published guidance under Labor Code 6401.9 sets specific retention periods that the regulation carries forward. Records of workplace violence hazard identification, evaluation, and correction must be kept for a minimum of five years. Violent incident logs must be kept for a minimum of five years. Records of incident investigations must be kept for a minimum of five years. Training records must be kept for a minimum of one year. The Cal/OSHA Form 300 log of recordable injuries must be kept for five years.
There is also an access obligation that catches employers off guard during inspections. All records of hazard identification, evaluation, and correction, along with training records and violent incident logs, must be made available to employees and their authorized representatives, on request and without cost, within fifteen calendar days. All workplace violence records, including incident investigations, must be made available to the Division on request. An employer that maintains immaculate records but cannot produce them within the fifteen-day window has still failed the access requirement.
A zero-incident year still requires a maintained violent incident log
One of the most common misreadings of the standard is the assumption that a facility with no violent incidents has nothing to log. The regulation requires the violent incident log to exist and be maintained as a control, not merely as an incident record. An empty, dated, properly formatted log demonstrates the program is operating. A missing log demonstrates the opposite, regardless of incident history. The same logic applies to hazard assessments: the absence of a documented periodic reassessment is a gap even at a site that has never had an event. This is why the recordkeeping architecture, not the incident count, is what an inspection actually examines.
The four types of workplace violence and the detection modalities that map to them
Labor Code 6401.9 defines workplace violence in four types, and each type implies a different physical-security exposure. Building a hazard assessment that an inspector finds credible means showing the employer understood which types apply to its environment and what controls address them. This is also where AI-powered computer vision earns a place in the plan, because detection modalities map cleanly onto the four statutory types.
Type 1: Criminal intent
Violence by someone with no legitimate business at the worksite. The classic exposures are retail robberies, attacks on delivery and ride-hailing drivers, and threats against security and maintenance staff. Perimeter and unauthorized-access detection and loitering detection address the pre-incident signal of a person entering or dwelling in a zone they have no reason to occupy.
Type 2: Customer or client
Violence directed at employees by the people they serve: customers, clients, students, or visitors. Social-service offices, customer-facing counters, and service settings carry the highest Type 2 exposure. Crowd and group-formation detection flags escalation in waiting areas, and weapon detection covers the worst-case escalation.
Type 3: Worker-on-worker
Violence by a present or former employee, supervisor, or manager, often tied to a perceived grievance. This is the type that connects most directly to insider-threat exposure, where access control and behavioral signals matter. The Insider Threat and Former-Employee Violence briefing covers the attack patterns in depth.
Type 4: Personal relationship
Violence by someone with a personal relationship to an employee, brought into the workplace. Domestic-violence spillover is the dominant Type 4 scenario. Unauthorized-access and weapon detection at entrances provide the earliest warning when a known or unknown aggressor approaches a covered employee at work.
The point of mapping modalities to types is not that technology satisfies the standard on its own. It does not. The point is that a hazard assessment naming the relevant violence types, paired with documented detection controls that address them, is a more defensible plan than a narrative assessment with no corresponding engineering control. Detection is one correction methodology among several, alongside physical design, staffing, and procedure.
Where AI detection fits inside a defensible WVPP, and where it does not
The honest framing of detection technology in a compliance context is that it is a documented hazard-correction control, not a compliance product. The regulation does not require, endorse, or mention any specific technology. What it requires is that an employer identify hazards, correct them, and document both. AI-powered computer vision contributes to the correction-and-documentation half of that obligation when it is deployed against hazards the assessment actually identified.
The architecture matters for whether the control is deployable at all. IntelliSee's platform performs object, posture, and motion-pattern detection on feeds from existing cameras. It does not perform facial recognition. It does not store video. It does not collect personal data about employees or visitors. For a workplace violence program, that architecture is what lets an employer add a detection layer covering employee-facing areas without triggering the privacy-review and labor-relations questions a facial-recognition system would raise, particularly in a state with California's biometric and privacy posture. The relevant detail for the plan is that the system produces an auditable alert log, which becomes part of the hazard-correction record the standard expects.
What the technology cannot do is substitute for the eleven other plan components. It does not write the plan, train the workforce, run the incident investigation, or maintain the violent incident log. A vendor that frames detection as a compliance solution is misreading the standard. Detection sits upstream of the human response workflow as the earliest possible trigger, and it sits inside the plan as one documented control. The plan, the training, the logs, and the periodic review remain the employer's obligations. For the broader statutory context across states, the Workplace Violence Prevention Plan Mandate briefing covers SB 553 and the emerging multi-state landscape, and the OSHA General Duty Clause analysis covers the federal enforcement mechanism that operates in parallel.
Why detection without identification is the only viable model in California
California's privacy framework, layered on top of the labor-relations questions that surround employee monitoring, makes the architectural choice decisive. A detection layer that identifies what something is, a drawn firearm, a person in a restricted zone, a fall, rather than who someone is, adds a safety control without introducing an identification system. That distinction is what allows the control to be deployed across employee-facing areas as part of a workplace violence program, and it is the distinction an employer should be able to articulate if asked how the technology in its plan respects worker privacy.
For multi-state employers: California as the leading edge, not the exception
Employers operating beyond California sometimes treat the Cal/OSHA standard as a California-only problem to be handled by a regional EHS lead. That is a mistake on two counts. First, the standard applies to any employer with employees at a California place of employment, regardless of headquarters location, so a company based elsewhere with California operations is covered for those operations. Second, California's general-industry standard is widely treated as a template that other states and the federal government watch. The federal OSHA healthcare workplace violence rulemaking has been moved to long-term-action status with no near-term proposed rule, which leaves state action as the leading edge of regulatory development in this space.
The practical implication is that a multi-state employer building a WVPP to satisfy California is building the most demanding version of a program it will likely need elsewhere within a few years. Designing the plan, the hazard methodology, the recordkeeping architecture, and the detection controls to the California standard now is cheaper than retrofitting a thinner program later. For employers weighing the economics of that investment, the seven-tier workplace violence cost decomposition frames the full exposure that a program is built to reduce.
Frequently asked questions about the Cal/OSHA workplace violence regulation
When does the Cal/OSHA general-industry workplace violence standard take effect?
The statute, Labor Code 6401.9, has been enforceable since July 1, 2024. The formal Title 8 regulation that implements it must be adopted by the Occupational Safety and Health Standards Board no later than December 31, 2026, with an implementation date set for January 1, 2027. The April 24, 2026 revised discussion draft is the current working text, and a Board vote approving a final draft is expected in late summer 2026 after the comment period that closed June 1, 2026.
Does the regulation apply to my company if we are headquartered outside California?
Yes, for your California operations. The requirement attaches to employers with employees at a California place of employment, regardless of where the company is headquartered. An employer based in another state with workers at California sites is covered for those workers and those sites. Multi-state employers generally cannot satisfy the obligation with a generic corporate policy that ignores the California-specific requirements.
Is there a small-employer exemption?
The April 2026 draft includes a narrow one. The regulation would not apply to an employer when the place of employment is not accessible to the public and the employer has fewer than ten employees at that place of employment at all times during the preceding 365 days, provided the employer complies with the Injury and Illness Prevention Program regulations. A public-facing location of any size remains covered, and the ten-employee threshold is measured across the full prior year.
What records does the standard require us to keep, and for how long?
Under Cal/OSHA's guidance for Labor Code 6401.9, records of hazard identification, evaluation, and correction must be kept at least five years; violent incident logs at least five years; incident investigation records at least five years; and training records at least one year. The Cal/OSHA Form 300 is kept for five years. Records must be made available to employees and their authorized representatives, without cost, within fifteen calendar days of a request, and to the Division on request.
Does AI detection technology make us compliant with the standard?
No. The regulation does not require or endorse any specific technology, and no product makes an employer compliant by itself. A written plan, employee involvement, training, hazard identification and correction, a maintained violent incident log, post-incident investigation, and periodic review are all the employer's obligations. AI-powered detection can serve as one documented hazard-correction control inside the plan, producing an auditable alert log, but it does not replace the other required components.
How does detection technology handle employee privacy under California law?
The relevant architectural distinction is detection versus identification. IntelliSee performs object, posture, and motion-pattern detection on existing camera feeds. It does not perform facial recognition, does not store video, and does not collect personal data. Because the system identifies what is happening rather than who is present, it adds a safety control without introducing a worker-identification system, which is the design choice that makes it deployable across employee-facing areas under California's privacy framework.
What changes when the statute becomes a Title 8 regulation?
The substance of the obligation is similar, but enforceability sharpens. A regulation gives inspectors a dedicated standard with defined terms and enumerated components, so the absence of any single required element becomes a discrete, citable gap rather than a matter of interpretation. The April 2026 draft also expands scope to employer-provided transportation, defines a small-employer exemption, and adds an interactive-question requirement for non-in-person training.
Continue the research
This briefing covers the California general-industry workplace violence regulation specifically. For adjacent reading on the surrounding compliance and threat landscape:
- The Workplace Violence Prevention Plan Mandate — the SB 553 statute, emerging multi-state mandates, and the federal standard taking shape.
- How OSHA's General Duty Clause Regulates Workplace Violence — the federal enforcement mechanism operating in parallel with state standards.
- Security legislation tracker — actively maintained database of state and federal workplace violence prevention mandates and effective dates.
- Perimeter and access detection — the modality that maps to Type 1 criminal-intent exposure.
- Request a risk assessment — a structured conversation about where documented detection controls fit inside your workplace violence prevention plan.
More intelligence like this
New IntelliSee research drops monthly at most. Subscribe and get the next sector playbook, technology briefing, or threat intelligence report in your inbox the day it ships.
Request a Risk Assessment
Talk to an IntelliSee security specialist. No sales pitch — a structured conversation about your environment, your threat profile, and whether computer vision is the right fit.
Request a Risk Assessment