California workplace violence prevention plan requirements for small business

Last updated 2026-07-09

What is California's workplace violence prevention plan law?

California Senate Bill 553 created Labor Code Section 6401.9, and it took effect July 1, 2024. It requires nearly every California employer to keep a written Workplace Violence Prevention Plan (WVPP), train employees on it, log every violent incident, and review the plan at least once a year. ^[1]

This is a California rule, not a federal one. Federal OSHA has no general-industry standard requiring a written WVPP for most businesses. So if your compliance thinking has been federal-only, you're behind on this.

The law covers general industry employers under Cal/OSHA. Healthcare already had its own standard (Title 8, Section 3342), and that sector is carved out of SB 553 and stays under the older rule. ^[2] For everyone else, retail shops, warehouses, offices, the works, SB 553 is now the floor.

The statute says employers must "establish, implement, and maintain" an effective WVPP. That word "effective" carries weight. Cal/OSHA's stance is simple: a template you downloaded and never customized probably isn't effective, because the plan has to match the actual hazards where your people work.

Does SB 553 apply to small businesses, and are there any exemptions?

Yes. SB 553 covers small businesses, and there's no exemption based on headcount. A three-person retail store and a 500-person distribution center are both on the hook. ^[1]

The exemptions are narrow:

• Remote employees working from home. Employees who work from their own home, with no fixed worksite the employer controls, are exempt for the time they're working there.
• Employers with fewer than 10 employees who are not accessible to the public, as long as they meet certain existing recordkeeping requirements. Read this one twice: it requires both conditions. If customers, patients, or clients come into your space, you're accessible to the public and the exemption is gone.
• Specific government entities covered by other statutes.
• Healthcare facilities already governed by the healthcare-specific standard. ^[2]

Run a home-based business with no public visitors and fewer than 10 employees? You may qualify. Most small businesses don't. Retail, restaurants, salons, auto shops, contractors on shared job sites, gyms, and most service businesses all have some public contact, and they're all covered.

When in doubt, assume you're covered and build the plan. A plan you didn't strictly need costs you nothing. A Cal/OSHA citation for the plan you skipped costs up to $15,625.

What are the required elements of a California WVPP?

Labor Code Section 6401.9 spells out exactly what a WVPP has to contain. ^[1] Cal/OSHA published a model plan that follows those requirements point for point, and it's the clearest checklist you'll find. ^[3] Here's the list:

1. Names or job titles of who's responsible for the plan. Someone specific owns this. If it's the owner, name the owner.

2. Effective procedures for employees to report hazards and incidents, and for the employer to respond. You need a clear, documented reporting channel. Anonymous reporting is encouraged, not required.

3. Procedures to prohibit retaliation against people who report incidents or threats. The plan has to say this out loud, in writing. Assuming people know it isn't enough.

4. Procedures to accept and respond to reports of workplace violence. This is different from reporting. It's what management actually does once a report lands.

5. Procedures to communicate with employees about workplace violence, including how you'll pass along information about threats that could affect them.

6. Procedures to respond to violence emergencies. Your response protocol. Who calls 911, who accounts for employees, where people go.

7. Procedures for post-incident response and investigation. After something happens: medical care, trauma support, root-cause review, corrective action.

8. Procedures to develop and provide training. The plan explains how training gets delivered, to whom, and how often.

9. Procedures to identify and evaluate hazards, including periodic inspections. This is the hazard assessment piece.

10. Procedures to correct hazards in a timely way.

11. Procedures to review the WVPP after an incident and at least annually.

The plan also has to be written, available to employees in their language, and accessible at the worksite. ^[1] Cal/OSHA's model plan hits all of these, and it's a fair place to start. You still have to fill in the site-specific details yourself.

What types of workplace violence does the plan need to cover?

SB 553 defines four types of workplace violence, and your WVPP should address each one that's realistic at your location. ^[1]

Type	Who commits the violence	Example
Type 1	Someone with no legitimate business relationship to the workplace	Robbery at a retail store
Type 2	A customer, client, patient, or visitor	A client who turns threatening
Type 3	A current or former employee	A worker who threatens a coworker
Type 4	Someone with a personal relationship to an employee	A domestic partner who shows up at work

Most small businesses fixate on Type 1 (robbery) because it's the loudest risk. But Type 2 and Type 4 incidents are common in customer-facing shops and small teams. Bureau of Labor Statistics data shows assaults caused 392 fatal work injuries in 2022, and a meaningful share of those involved someone the victim knew. ^[4] Nonfatal violence runs highest in healthcare, retail, and social assistance. ^[9]

Your hazard assessment should ask, honestly, which types are plausible where you work. A late-night convenience store carries a different profile than an interior design studio. The controls, the physical security, the emergency steps, should match your real risk, not some generic sheet.

What does the violent incident log requirement actually mean?

Starting July 1, 2024, employers must keep a violent incident log for every workplace violence incident. ^[1] It's separate from your OSHA 300 log, and it catches incidents that never hit the OSHA recordable threshold: threats, verbal assaults, near-misses.

For each incident, the log records:

• Date, time, and location
• Type of violence (Types 1 through 4)
• Who was involved (by category, not necessarily name, to protect privacy)
• What happened, and what weapons or objects were involved
• Consequences (injuries, medical treatment)
• Where the employee was at the time
• What the employee was doing
• Apparent motive, if known
• What the employer did in response

Personally identifiable information about victims stays confidential. It can't appear in the log in any way that could expose the person harmed. ^[1]

Keep the log for five years. Cal/OSHA can ask for it during an inspection. ^[1] If you're unsure how this ties into your broader recordkeeping, our guide on incident reports covers the federal baseline California builds on.

The log is also the raw material for your annual review. Three Type 2 incidents in a year should drive real changes to how you handle customer interactions. That's the point of writing it down.

What training is required under California's WVPP law?

Training had to happen by July 1, 2024 for existing staff, and at the time of hire for new employees. ^[1] After that it repeats annually, plus any time a new hazard shows up or procedures change in a meaningful way.

Training has to cover:

• The WVPP itself and how employees get a copy
• How to report hazards or incidents without fear of retaliation
• How to seek help after a threatening situation
• Violence hazards specific to the employee's job and worksite
• The corrective measures you've put in place
• Ways to avoid physical harm, including situational awareness and de-escalation

Employees who speak a language other than English get training in their language. ^[1][11] This trips up a lot of small businesses. If your crew is mostly Spanish-speaking, an English-only session doesn't count.

There's no minimum hour count. The law says training must be "appropriate," which gives you room but also means Cal/OSHA will judge whether it had substance. A five-minute glance at a posted flyer won't hold up. A one-hour session working through real scenarios at your location will.

Keep training records: dates, attendees, content covered. You'll want them for an inspection or a complaint. For how Cal/OSHA weighs training in general, our OSHA training overview covers the principles that carry across every program.

How does a small business actually conduct the hazard assessment?

The hazard assessment is where most small businesses fall down. Writing a plan is one thing. Walking your space and naming the real risks is the harder part, and it's the part inspectors actually look for.

Cal/OSHA guidance says to look at three buckets. Physical factors: lighting in parking areas, sight lines at entry points, cash handling, high-value merchandise. Staffing factors: lone workers, late-night shifts, too few people to handle a difficult customer. And incident history: your own records plus police reports for your address or neighborhood. ^[3]

Talk to your employees. They almost always know which customers are trouble, which situations feel unsafe, and which hours get sketchy. The law specifically requires employee input in the hazard assessment process. ^[1]

Write down what you find. Even if the risk turns out low, document that you did the assessment, what you examined, what you found, and what you changed as a result. That paper trail is your protection during an inspection.

Review it after any incident and at least once a year. Open a second location, add a night shift, or start serving a different crowd, and your risk profile shifts. That can trigger a mid-cycle review.

What are the Cal/OSHA penalties for not having a WVPP?

Cal/OSHA can cite any employer who doesn't comply with Labor Code Section 6401.9 and the rules under it. ^[5] Penalties follow a tiered structure, and a missing plan usually lands at the serious level.

2024 Cal/OSHA penalty amounts:

• Serious violation: up to $15,625 per violation
• Willful or repeat serious violation: up to $156,259 per violation
• General violation (non-serious): up to $15,625
• Failure to abate: up to $15,625 per day

Cal/OSHA also looks at whether a violation is "repeat" within a five-year window, which sharply raises your exposure. ^[5]

A missing WVPP tends to draw a serious citation, because no plan means a foreseeable risk of harm to employees. That foreseeable-risk standard is exactly how Cal/OSHA defines "serious."

Employees can't sue you directly under SB 553. What they can do is file a complaint with Cal/OSHA, through themselves or their union, and that alone can trigger an inspection even without a reported incident. The agency does the enforcing.

Here's the math that matters: writing the plan and running an hour or two of training costs you time. A single general violation costs up to $15,625. The compliance side wins that comparison every time.

Does Cal/OSHA have a model WVPP that small businesses can use?

Yes. Cal/OSHA published a free model Workplace Violence Prevention Plan that any employer can use as a starting point. ^[3] It's on the Cal/OSHA website and built to match the statutory requirements line by line.

It's a fill-in template. You answer who's responsible, what your reporting procedures are, and what hazards exist at your site. What you cannot do is print it blank, slap your name on the header, and call it done. Inspectors know this template cold, and they'll check whether the site-specific fields hold real information or air.

Multiple locations with different layouts, hours, and risk profiles? Each one probably needs its own completed plan, or at least location-specific appendices.

If you'd rather build a complete, customized WVPP without hiring a consultant, SafetyFolio's safety program generator walks you through the required elements and produces a plan specific to your worksite in about 15 minutes. That's genuinely faster than reading the full Cal/OSHA guidance and drafting each section from scratch.

Generator, Cal/OSHA model, or hired writer, the content has to be yours. Customization isn't a nice-to-have here. It's the whole requirement.

How does the WVPP relate to other Cal/OSHA programs you already have?

The WVPP sits alongside your Injury and Illness Prevention Program (IIPP), not inside it. California has required an IIPP for years under Title 8, Section 3203. ^[6] The WVPP is a separate document with its own recordkeeping.

The two share a structure, though. Your IIPP already calls for hazard identification, corrective action, and training. Your WVPP does the same, just aimed at violence. If your IIPP is solid, use its bones as a model for the WVPP.

The violent incident log is distinct from the OSHA 300/300A injury and illness log. Some incidents land on both (someone is injured and it meets OSHA recordable criteria). But plenty of violent incidents, threats without injury, verbal assaults, near-misses, go in the violent incident log alone. ^[1]

Run forklifts, handle hazardous chemicals, do other high-risk work? You're already juggling written programs. The WVPP is one more, and like hazard communication or lockout tagout, it needs its own documentation trail. Fold it into the safety rhythm you already run, the same annual review, the same training calendar. That's the efficient way.

For how California's approach lines up against the broader federal framework, our OSHA basics hub has the context. Federal OSHA, by comparison, has no general-industry WVPP standard and handles workplace violence through the General Duty Clause. ^[10]

What should the WVPP look like for a specific type of small business?

The required elements don't change from one covered employer to the next. What you write under each element does. A few examples of how setting shapes the plan:

Retail store. Your top risks are Type 1 (robbery) and Type 2 (difficult customers). Emergency procedures should cover robbery response, cash handling limits, duress signals, and who calls law enforcement. Physical controls might mean drop safes, low cash-on-hand policies, and better sight lines at the register.

Restaurant. Late-night service, alcohol, and tight quarters push Type 2 and Type 3 risk. Your plan should address de-escalation for intoxicated customers, how staff call for help without escalating, and what happens when a fight breaks out between employees. Kitchens add the wrinkle of tools that double as weapons.

Small office or professional services firm. Type 4 (domestic violence at work) is a real risk office employers routinely miss. Your plan needs a procedure for when an employee reports a threat from a personal relationship, including how to quietly raise security awareness without embarrassing anyone.

Construction. Multi-employer worksites add layers. As a subcontractor, you need a WVPP that covers your employees' exposure even when you don't control the site. Coordinate with the general contractor on how the requirements get met at the project level.

The through-line: your plan should describe what's true about your workplace, not what's true about workplaces in general.

What do employees have the right to know and do under SB 553?

SB 553 gives employees specific rights, and small business owners need to know them, because violating them creates both citation risk and retaliation risk. ^[1]

Employees have the right to:

• Get a free copy of the WVPP on request, and find it available at the worksite
• Take part in developing and reviewing the WVPP
• Report hazards without retaliation
• Have their reports taken seriously and acted on
• Receive training in their primary language
• Review the violent incident log, with personal identifying information removed

The no-retaliation piece deserves its own spotlight. If an employee reports a threat and you respond by cutting their hours, sticking them on a bad shift, or firing them, that's illegal retaliation under both SB 553 and Labor Code Section 6310. ^[7] The standard for what counts as retaliation is broad, and California courts haven't gone easy on employers here.

The best protection in practice is a clear, documented reporting process and a culture where reports are welcome. Small businesses tend to run on informal communication, which works fine until something goes wrong and there's no record that a report was ever made or handled.

Frequently asked questions

When was the California WVPP law deadline, and is it too late to comply?

The deadline was July 1, 2024. If you still don't have a written WVPP, you're already out of compliance and should build one now. Cal/OSHA has been inspecting and citing since that date. Getting compliant now beats waiting, because ongoing non-compliance keeps stacking exposure, especially if an incident happens before your plan exists.

Is there a size exemption for businesses with fewer than 10 employees?

There's a narrow one: employers with fewer than 10 employees who are not accessible to the public. Both conditions have to be true. If customers, patients, clients, vendors, or any members of the public can access your worksite, the exemption doesn't apply. Most small businesses in retail, food service, trades, and professional services don't qualify.

Can I use the Cal/OSHA model WVPP template without any changes?

No. The model plan is a legitimate starting point, but you have to fill in the site-specific fields: who's responsible, what your specific hazards are, how reporting works at your location, and what your emergency procedures look like. A blank or barely-filled template that doesn't reflect your actual worksite won't satisfy an inspector.

Does the WVPP cover remote workers?

Employees who work from their own homes are exempt for the time they work at home. Remote employees who work from locations your company controls, a client site, a company vehicle, a coworking space your company leases, are covered. The exemption is specifically for working at your own home, not for all remote arrangements.

How often does the WVPP need to be reviewed and updated?

At least annually. The law also requires a review after any workplace violence incident and whenever a new hazard is identified. Significant operational changes, adding locations, changing hours, onboarding a new type of customer, may call for a mid-cycle review. Document every review: what you looked at, what you changed, and why.

What counts as a workplace violence incident for the violent incident log?

Any act of violence, attempted violence, or credible threat of violence at work. That includes physical assaults with or without injury, credible verbal threats, threatening behavior like throwing objects or destroying property, and situations where an employee reasonably felt in danger. It doesn't require an injury, and it captures incidents that would never meet the OSHA 300 recordable threshold.

Do I need to hire a consultant to write a California WVPP?

No. Cal/OSHA's free model plan covers every required element, and many small businesses can finish it without outside help. The cost is time, not money. The plan has to reflect your specific worksite, so the owner or a manager who knows the business needs to drive the customization. A consultant can help with a complex operation or multiple locations, but it isn't required.

What happens if an employee gets hurt and I don't have a WVPP?

The missing plan matters for two reasons. First, Cal/OSHA will almost certainly cite you for it, likely as a serious violation, with penalties up to $15,625. Second, the absence of a plan can be relevant in workers' compensation proceedings and civil litigation, where it may be treated as evidence you failed to take reasonable steps to protect employees.

Does California's WVPP requirement apply to nonprofits?

Yes. Nonprofits are employers under California labor law and fall under Cal/OSHA rules. A nonprofit social services agency, community health center, or advocacy group is covered by SB 553 the same as any for-profit. Nonprofits that operate healthcare facilities fall under the healthcare-specific standard rather than SB 553.

How does the WVPP interact with my existing IIPP?

The WVPP is a separate written program from your Injury and Illness Prevention Program, which California has required for all employers under Title 8 Section 3203. They share structure, both need hazard assessment, corrective action, and training, but the WVPP is a standalone document focused on violence hazards. You can't satisfy the WVPP requirement by bolting a section onto your IIPP.

What languages does the WVPP training need to be in?

Training has to be in a language employees understand. If your workforce includes people whose primary language is Spanish, Tagalog, Cantonese, or anything else, English-only training doesn't satisfy the requirement for them. The written WVPP should also be available in the languages spoken at your worksite. This is an active compliance gap for many California small businesses in agriculture, construction, food service, and manufacturing.

Does a multiemployer worksite like a construction project need a WVPP?

Each employer on a multiemployer worksite is responsible for a WVPP covering their own employees. In practice the general contractor often leads on site-wide security and emergency response, but subcontractors still need their own plans addressing their workers' exposure. Coordinate with the GC on overlapping elements so your plan references site-wide procedures instead of duplicating or contradicting them.

Are there specific physical security measures the WVPP must require?

No. The law doesn't mandate specific engineering controls like locks, cameras, or buzzers. It requires you to identify hazards and put in corrective measures that fit your situation. Physical security is one category of corrective measure, and your hazard assessment decides which, if any, make sense. A high-cash business or one with a robbery history has a stronger case for engineering controls than a low-risk office.

How long do I have to keep the violent incident log?

Five years. That's longer than the four-year retention for OSHA 300 logs. Keep it in a format that protects victim privacy, meaning personally identifiable information about the person targeted or harmed gets redacted or omitted in any version that might be shared. Cal/OSHA can request the log during an inspection.

Sources

1. California Legislative Information, Senate Bill 553, Labor Code Section 6401.9: SB 553 requires nearly all California employers to establish, implement, and maintain a written WVPP by July 1, 2024, with specified required elements, a violent incident log retained for five years, and annual training.
2. Cal/OSHA, Title 8 Section 3342, Workplace Violence Prevention in Health Care: Healthcare employers covered by the existing healthcare-specific Cal/OSHA standard are excluded from SB 553 and remain subject to Title 8 Section 3342.
3. Cal/OSHA, Model Workplace Violence Prevention Plan for Non-Healthcare Employers: Cal/OSHA published a free model WVPP template that tracks the statutory requirements of Labor Code Section 6401.9 for non-healthcare employers.
4. Bureau of Labor Statistics, Census of Fatal Occupational Injuries Summary 2022: In 2022, assaults resulted in 392 fatal work injuries in the United States according to BLS Census of Fatal Occupational Injuries data.
5. Cal/OSHA, Penalty Schedule and Citation Information: Cal/OSHA serious violation penalties are up to $15,625 per violation and willful or repeat serious violations up to $156,259 per violation.
6. Cal/OSHA, Title 8 Section 3203, Injury and Illness Prevention Program: California requires all employers to have an Injury and Illness Prevention Program under Title 8 Section 3203, which is a separate document from the WVPP.
7. California Legislative Information, Labor Code Section 6310: California Labor Code Section 6310 prohibits retaliation against employees who report workplace safety hazards, including workplace violence concerns.
8. Cal/OSHA, Workplace Violence Prevention for General Industry FAQ: Cal/OSHA guidance confirms that the small-employer exemption requires both fewer than 10 employees AND no public access; meeting only one condition does not qualify.
9. Bureau of Labor Statistics, Nonfatal Occupational Injuries and Illnesses, 2022: BLS data tracks nonfatal workplace violence injuries by industry, showing elevated rates in healthcare, retail, and social assistance sectors.
10. Federal OSHA, General Duty Clause, Section 5(a)(1) of the OSH Act: Federal OSHA has no general-industry standard requiring a written WVPP for most businesses; workplace violence is addressed under the General Duty Clause at the federal level.
11. Cal/OSHA, SB 553 Implementation Guidance for Employers: Cal/OSHA guidance specifies that training must be provided in a language workers understand, and that the WVPP must be available to employees in their language.