The Workplace Violence Prevention Plan Mandate: A 2026 Compliance Briefing on California SB 553, Emerging State Laws, and the Federal Standard Taking Shape

The compliance posture for workplace violence prevention changed permanently in 2024. California's Senate Bill 553, signed into law on September 30, 2023, and effective July 1, 2024, imposed a written workplace violence prevention plan requirement on virtually every California employer, becoming the first state to extend this mandate beyond healthcare workers to the general workforce. It was not the last. Across the country, state legislatures are advancing similar requirements, and at the federal level the Occupational Safety and Health Administration is completing the rulemaking process on a national standard that would cover healthcare and social assistance workers in every state.

For security directors, risk managers, and operations leaders, the practical implication is straightforward: a written workplace violence prevention program is no longer a best practice. It is increasingly a legal obligation. And the question that follows, what technology supports a defensible WVPP, is one that AI-powered computer vision is increasingly positioned to answer. This briefing covers the regulatory landscape, what the mandates actually require, where they converge, and how detection technology fits into the compliance architecture.

LIVE CAM-07 · NURSE STATION

California SB 553: What the general-industry WVPP mandate actually requires

California Labor Code section 6401.9, enacted by SB 553, became effective July 1, 2024 for most employers and November 1, 2024 for employers in industries already covered by Cal/OSHA's existing healthcare-specific workplace violence prevention standard. It applies to virtually all employers in California with at least one employee, a scope far broader than previous state mandates, which had been limited to hospitals, skilled nursing facilities, or healthcare settings.

The law requires every covered employer to establish, implement, and maintain a written Workplace Violence Prevention Plan. That plan must contain, at minimum:

Identification of the person or persons responsible for the WVPP. The employer must designate someone accountable for the plan's implementation and operation. This cannot be an informal designation. It must be documented in the written plan.

Procedures for involving employees in developing, implementing, and reviewing the WVPP. The law specifically requires a mechanism for employee participation, not just employer promulgation. For multi-shift operations or facilities with unionized staff, this means a structured process that can be audited.

Methods to coordinate implementation of the WVPP with other employers when employees of different employers share a workplace. Multi-tenant office buildings, shared industrial facilities, and contractor-heavy environments must address coordination explicitly. This is a provision most general-industry employers had not previously encountered in occupational safety compliance.

Procedures for the employer to accept and respond to reports of workplace violence. Employees must have a way to report incidents and near-misses. The employer must have a documented response procedure. Retaliation against employees who report is explicitly prohibited and carries enforcement teeth.

Procedures to ensure that supervisors and employees comply with the WVPP. Compliance accountability must be internal. The plan cannot simply exist on paper; it must include how the employer will enforce adherence.

Procedures to communicate with employees regarding workplace violence matters. This encompasses how the employer notifies employees of incidents, near-misses, and changes to the WVPP. Communication records become part of the compliance documentation trail.

Procedures for conducting workplace violence hazard assessments. The employer must document how it identifies and evaluates workplace violence risks. This is the provision that most directly creates a role for detection technology: a system that logs threat detections and alerts creates an auditable record of the hazard identification process.

Procedures for investigating workplace violence incidents. Every incident must be investigated, not just reported. The investigation must identify root causes and corrective actions. An employer whose camera network detected a prior threat event but failed to respond to it is in a materially worse legal position than one whose detection system triggered a documented response.

Procedures for correcting workplace violence hazards in a timely manner. Identified hazards, whether from a formal assessment or a reported near-miss, must be corrected with documented timelines and responsible parties.

Procedures for post-incident response and investigation. Following a violent event, the employer must have a defined process for immediate response, preservation of evidence, and employee support.

Procedures for emergency response to workplace violence incidents. The plan must address what happens during an active incident, not just before and after. This is the element most directly addressed by real-time AI detection systems that trigger emergency alerts within seconds of a threat being identified.

An employee training program on WVPP procedures. Training must be provided to all employees and supervisors before they start work and annually thereafter. Training records must be maintained for one year.

A violent incident log. Every workplace violence incident must be recorded, including the date, time, location, type of violence, description of the incident, circumstances, and any corrective actions taken. Records must be maintained for five years. Cal/OSHA can request these logs at any time.

The state mandate landscape beyond California: where WVPP laws exist and where they are advancing

California's general-industry mandate is the broadest in scope, but it did not emerge from a vacuum. Healthcare-specific workplace violence prevention laws have been accumulating in state codes for more than a decade, and the passage of SB 553 has accelerated legislative interest in extending those frameworks to the general workforce. Understanding where mandates exist and where they are advancing is essential for multi-state employers building a WVPP program architecture.

The pattern across these mandates is not accidental. State legislatures are responding to the same pressure: workplace violence rates that have not improved despite decades of policy attention, a healthcare workforce under severe retention pressure, and unions representing nurses, social workers, and emergency responders that have made WVPP legislation a priority bargaining and legislative objective.

What the mandates require technically: the hazard identification and detection gap

Across every enacted and advancing WVPP mandate, a common technical requirement emerges: the employer must conduct and document a hazard assessment, implement preventive controls, and maintain a record of incidents and near-misses that allows iterative improvement.

This is where the gap between traditional physical security and AI-augmented detection becomes a compliance question, not just an operational one.

Traditional surveillance infrastructure — cameras, access control, manned guard stations — provides coverage and reactive documentation. What it does not provide is a systematic, auditable record of detected threat precursors: a person loitering at an entrance for 12 minutes before an incident, a weapon brought onto premises 4 minutes before an assault, an unauthorized access breach that preceded a patient elopement. Traditional systems record these events only if someone happens to be watching at the precise moment. The vast majority of surveillance footage captures threat precursors that are not acted on in real time and are reviewed only forensically, after harm has occurred.

The WVPP mandates ask employers to demonstrate that they have a systematic approach to identifying hazards, not a reactive hope that someone was watching. AI detection technology directly addresses this gap: it creates a structured, timestamped, auditable log of every threat event it detects, including drawn firearms, loitering beyond threshold, unauthorized zone access, and crowd formation, regardless of whether any human was watching the camera feed at that moment.

The federal standard taking shape: OSHA RIN 1218-AD08 and H.R. 2531

At the federal level, two parallel processes are converging on what will eventually become a national WVPP requirement for healthcare and social service workers.

H.R. 2531: The Workplace Violence Prevention for Health Care and Social Service Workers Act has been introduced in multiple Congresses and has re-entered the legislative calendar in the 119th Congress. The bill directs OSHA to issue a final workplace violence prevention standard for healthcare and social service workers within 42 months of enactment. It also establishes interim protections during the rulemaking period, requires covered employers to develop and implement a workplace violence prevention plan, and creates anti-retaliation protections for workers who report incidents or participate in WVPP implementation.

The bill defines "workplace violence" broadly: physical assault, threat of physical assault, verbal abuse, harassment, intimidation, and other disruptive behavior that occurs at the workplace and poses a risk to employees. This definition is wider than what many employers' current security policies contemplate. It explicitly includes non-patient sources of violence, visitors, contractors, domestic partners who appear at a worksite, not only the patient-on-staff incidents that dominate healthcare WPV research.

OSHA's regulatory docket (RIN 1218-AD08) is running parallel to the legislative process. OSHA completed its Small Business Regulatory Enforcement Fairness Act (SBREFA) panel process in 2023, gathering input from small healthcare and social assistance employers on the anticipated costs and requirements of a proposed standard. The SBREFA panel report confirmed that OSHA intends to require covered employers to:

• Develop and implement a written workplace violence prevention plan tailored to the specific hazards at their facility
• Conduct regular worksite analyses to identify potential workplace violence hazards
• Implement engineering controls, administrative controls, and work practice controls to prevent or mitigate identified hazards
• Provide training to all workers and supervisors on WPV prevention
• Maintain a violent incident log and incident reporting system
• Conduct annual reviews of the WVPP and update it as needed
• Involve workers in the development, implementation, and review of the WVPP

The proposed rule is expected to apply to hospitals, residential treatment facilities, non-residential treatment facilities, home health care, social assistance services, and outpatient mental health facilities. Employers already subject to state WVPP laws would remain subject to those laws. OSHA's standard establishes a federal floor, not a ceiling.

The practical implication for employers preparing now: the architecture of a WVPP built to satisfy California SB 553, documented hazard assessment, engineering controls, incident log, annual review, is substantially the same architecture that will be required under the federal standard when it is finalized. Getting into compliance with California's law is not California-specific compliance work; it is essentially pre-positioning for the federal standard.

What a defensible WVPP looks like: the five components that hold up under inspection

Across the enacted and advancing mandates, enforcement agencies and plaintiff's attorneys have developed a consistent picture of what a WVPP that holds up under scrutiny looks like. It is not simply a document on a shared drive. The following components distinguish a defensible program from a paper compliance exercise.

Where AI detection technology fits into the WVPP compliance architecture

Computer vision-based threat detection is not a WVPP in itself. It is an engineering control — one of the three control categories (engineering, administrative, work practice) that every enacted and proposed WVPP standard requires employers to implement in response to documented hazards. Understanding this framing matters: it means that deploying AI detection without the written plan, the hazard assessment, the incident log, and the training is still a compliance gap. And it means that a WVPP without engineering controls proportionate to the assessed hazards is also a gap. Both must exist.

Within the engineering control layer, AI-powered weapon detection, loitering detection, unauthorized access detection, and crowd formation detection address four of the most commonly cited precursor-event categories in workplace violence research:

Beyond the detection function, there is a documentation function that is equally important in the compliance context. Every AI detection alert generates a structured, timestamped record that can be exported and maintained as part of the employer's incident and near-miss log. This creates evidence of a continuous, active hazard identification program — not a periodic exercise. In Cal/OSHA inspections, OSHA General Duty Clause investigations, and civil litigation following a violent incident, the difference between an employer with an active detection log and one without is the difference between documented diligence and documented inaction.

IntelliSee's platform architecture is also specifically suited to WVPP compliance needs because of what it does not do. It does not perform facial recognition. It does not store video off-premises. It does not collect protected health information. For employers in healthcare settings where HIPAA, state behavioral health privacy statutes, and institutional privacy policies overlap, these architectural constraints are prerequisites for deployment approval, not optional features. See the Healthcare Workplace Violence Playbook for a detailed treatment of privacy architecture in clinical environments.

Multi-state employers: building a WVPP that satisfies multiple mandates simultaneously

For employers operating across multiple states, the compliance landscape in 2026 is genuinely complex. California's SB 553 applies to California employees regardless of where the employer is headquartered. New York's mandate applies to New York worksites. Oregon's applies to Oregon operations. The federal standard, when finalized, will apply to covered healthcare and social service employers in all fifty states. An employer with operations in California, New York, Oregon, and Texas faces four overlapping regulatory regimes simultaneously and must satisfy the most stringent applicable requirement in each jurisdiction.

The architecture that handles this most cleanly is a tiered WVPP:

A master written plan that satisfies the universal requirements shared across all mandates, written program, named accountability, hazard assessment process, incident log, training, annual review. This document is the foundation that satisfies the federal baseline and all state requirements simultaneously.

Facility-specific annexes that address the location-specific hazards identified in the hazard assessment and any jurisdiction-specific requirements not captured in the master plan. A California facility annex would include the violent incident log format required by SB 553 and the employee participation mechanism. A New York facility annex would address the NY-specific reporting obligations.

A shared technology and documentation infrastructure, a detection system, incident log, and training record management system, that generates the evidence base applicable across all jurisdictions. This is where the investment in AI detection pays its multi-jurisdictional dividend: a single platform that generates compliant detection logs, alert records, and response documentation that can be cited in response to any state or federal inspection.

What the BLS data says about the scale of the problem these mandates are designed to address

The regulatory response makes more sense in context of what the underlying data shows. The Bureau of Labor Statistics Census of Fatal Occupational Injuries, released in February 2026, documented 470 workplace homicides in 2024, up from 458 in 2023. Firearms accounted for 379 of those fatalities, or approximately 81 percent. These are not clustering in a single sector: they span retail, healthcare, transportation, hospitality, and service industries. The geography is national. The time-of-day distribution shows elevated risk during shift changes, early morning hours, and late evening, which aligns with the access-control and loitering-detection use cases that AI systems address most directly.

The nonfatal data from BLS's Injuries, Illnesses, and Fatalities program is arguably more alarming. For 2021-2022, the BLS documented 57,610 cases of workplace violence resulting in days away from work, restricted work, or job transfer (DART cases) in the private sector alone. Healthcare and social assistance accounted for 72.8 percent of all private industry workplace violence DART cases, a disproportionation that explains why healthcare has been the first sector targeted by every state legislature and by OSHA's proposed federal standard.

The violence-to-near-miss ratio is estimated at roughly 1:600 in occupational safety research generally. Applied to the 57,610 DART cases, that ratio implies more than 34 million workplace violence near-miss events per year in the private sector that are neither recorded nor reported. The WVPP mandates' incident log and near-miss reporting requirements are specifically designed to surface this dark figure — and AI detection systems that capture threat precursors automatically provide the only scalable mechanism for doing so.

Getting into compliance with SB 553 and preparing for what follows

For employers who have not yet built a WVPP, the compliance path is sequential. The steps are not optional, and skipping to the technology layer without completing the foundational documentation steps produces a program that will not hold up under inspection.

Step 1: Conduct a written hazard assessment. Walk every facility with the goal of identifying workplace violence risk factors: isolated work areas, cash-handling points, public-facing service environments, high-patient-acuity zones, parking structures, entrances with limited sight-lines. Document the assessment in writing, with the date, the facility address, the names of the persons who conducted it, and the hazards identified. This document is the legal foundation of the WVPP.

Step 2: Write the WVPP. Using the hazard assessment as the basis, write a plan that addresses every element required by California SB 553 if the employer has California locations, and the applicable state mandates for other locations. Name the person responsible. Document the employee participation mechanism. Define the incident reporting procedure. Establish the investigation procedure. Set the corrective action timeline standard.

Step 3: Implement and document engineering controls. Based on the hazard assessment, identify what detection technology is proportionate to the identified risks. For facilities with public access, parking structures, or high patient-acuity environments, this means AI detection for weapon presence, loitering, unauthorized access, and crowd formation. Document the controls in the WVPP with the date of implementation and the hazards they address.

Step 4: Establish the violent incident log. Create the log format required by SB 553 or the applicable state mandate and begin populating it. Every incident and near-miss, including those captured by AI detection, should generate a log entry. Configure the detection system to generate exportable alert logs that can be appended to the incident record.

Step 5: Train employees and document it. All employees must be trained before starting work and annually thereafter. Training records must be maintained for one year. The training must cover what workplace violence is, how to report it, what the WVPP requires, and what the emergency response procedure is. Training records are one of the first items Cal/OSHA requests in an inspection.

Step 6: Schedule and conduct the annual review. The WVPP must be reviewed and updated annually, and following any serious incident. Build the annual review into the compliance calendar as a documented meeting with named attendees and a written outcome.

For a structured assessment of where an organization stands on this path and what the implementation timeline and budget look like, IntelliSee's team conducts no-obligation risk assessments that produce a gap analysis against applicable mandates and a recommended controls architecture. See also the ROI calculator for a financial model of the cost-avoidance case.

Frequently asked questions about WVPP mandates and compliance technology

Continue the research

This briefing covers the standards-compliance architecture for workplace violence prevention plans. For related intelligence on specific sectors and technology dimensions:

• The Cal/OSHA Workplace Violence Prevention Regulation — how the SB 553 statute becomes an enforceable Cal/OSHA Title 8 standard, the April 2026 discussion draft, and the December 31, 2026 adoption deadline.
• Healthcare Workplace Violence: The AI Detection Playbook — detailed treatment of hospital-specific WVPP implementation, including department-by-department deployment architecture and privacy considerations in behavioral health environments.
• Security Legislation Tracker — actively maintained database of state and federal workplace violence prevention mandates, including effective dates, compliance scope, and pending legislation status.
• AI Weapon Detection — technical reference on the firearm detection modality, including DHS SAFETY Act Full Designation and detection architecture.
• Perimeter and Access Control Detection — how unauthorized zone access detection integrates with existing access control systems to satisfy engineering control documentation requirements.
• ROI Calculator — financial model for the cost-avoidance case across direct incident costs, staff retention, insurance positioning, and security personnel efficiency.