SB 553 Requirements: California Workplace Plans

§1What SB 553 requires now

California SB 553 requires covered employers to establish, implement and maintain a written Workplace Violence Prevention Plan (WVPP). The general-industry requirements became enforceable on July 1, 2024. They apply to workplace operations in California; the location of the corporate headquarters does not decide coverage. A small employer should first check the worksite exemptions, then assign responsibility for the plan, training and records. Cal/OSHA explains the enforceable requirements.

The Occupational Safety and Health Standards Board has a separate statutory deadline to adopt a general-industry workplace violence standard by December 31, 2026. That is a California rulemaking deadline. It does not postpone the duties already enforceable under Labor Code section 6401.9. This guide addresses those statutory duties, with sources checked on October 9, 2026; consult the Cal/OSHA resources page for subsequent regulatory changes. The current advisory page lists a September 2026 discussion draft and an October 27 meeting; the draft is not an adopted rule.

§2Check the exemption at the worksite

The small-worksite exemption has several conditions. The place of employment must have fewer than 10 employees working there at any given time, must not be accessible to the public, and must comply with the Injury and Illness Prevention Program (IIPP) requirements. Keep the analysis tied to the location and staffing conditions. Counting the company total or describing the business as small leaves the public-access question unanswered.

A hypothetical bookkeeping office with eight employees, no public access and a compliant IIPP may meet that exemption. A nine-person retail shop that admits customers does not meet the public-access condition. These are examples of applying the conditions, not determinations about a particular employer. Confirm unusual arrangements with Cal/OSHA or qualified California counsel. Ervin Cohen & Jessup summarizes the small-employer and telework exceptions; check the statutory conditions in Labor Code section 6401.9(b) before relying on an exclusion.

The telework exception concerns an employee working at a location of their own choice that is outside the employer's control. A company-selected shared office needs its own analysis. The statute also excludes employers that comply with California's section 3342 healthcare violence standard, and facilities, service categories and operations covered by that standard. Department of Corrections and Rehabilitation facilities must meet IIPP requirements to qualify. For an eligible law-enforcement agency, the exclusion requires confirmation of POST compliance and IIPP compliance at every facility it operates. Cal/OSHA may issue an order requiring an otherwise excluded employer or worksite to comply. See Labor Code section 6401.9(b), reproduced by Justia, for the conditions; an exclusion from this provision does not remove other safety duties.

§3Turn the written plan into operating instructions

Cal/OSHA states that the plan must be "specific to the hazards and correction measures for each work area and operation." Its general-industry FAQ also explains that employers can keep the WVPP as a separate document or as a standalone section in their IIPP. A corporate policy can provide a common framework, but each location still needs instructions that fit its hazards and correction measures.

Name the people responsible for implementation and specify who covers absences. Describe how employees and authorized representatives participate in identifying hazards, developing the plan and training, and reporting concerns. Employee involvement applies at nonunion workplaces too. Explain how your organization coordinates implementation with other employers, such as a staffing agency or another employer operating at the same site.

The plan also needs procedures for accepting and responding to reports without retaliation, communicating with employees, obtaining compliance with the plan, and responding to emergencies. Describe how workers seek help, receive alerts, evacuate or shelter when appropriate, and know who directs the response. Put the reporting route somewhere an employee can find during a shift, including when their own supervisor is involved in the concern.

Include hazard identification, evaluation and correction; post-incident response and investigation; training; and review of the plan's effectiveness. A useful implementation file records the hazard, responsible person, intended correction and follow-up. That file format is a suggested management method, not a separately prescribed form. Cal/OSHA's free model WVPP supplies a starting framework. Completing a template does not by itself establish compliance.

§4A handoff file for an HR team without safety staff

For a small business, the plan needs a usable handoff when a manager leaves. Build one location sheet that a replacement manager can use. Record the work area, shifts and public access; the plan owner and backup; how employees report concerns; how emergency assistance is summoned; the current plan location; and the date of the next review. Keep a link to the current instructions on the sheet so managers use the same version.

Keep a separate action register for hazards. For example, if employees identify an isolated closing shift as a concern, record the assessment, the assigned corrective action and how completion will be checked. Do not turn that example into a universal requirement to install a particular device or hire security. The assessment should determine the controls for the actual operation. Cal/OSHA identifies working alone, night work and exchanging money among potential risk factors.

Use the HR calendar to track training and review dates, while a designated person owns corrective actions. The HR compliance checklist covers employment requirements outside the safety plan. Accommodation requests belong in their own workflow, described in the Pregnant Workers Fairness Act guide. Restrict access to sensitive employee information when connecting those processes to a safety investigation.

§5Training must cover the plan employees will use

Covered employers provide training when the plan is first established and annually thereafter. Additional training is required when a new or previously unrecognized workplace violence hazard is identified or changes are made to the plan; that additional training can focus on the new hazard or changes. Training should fit employees' language, vocabulary and educational level and include an opportunity for interactive questions and answers with a person knowledgeable about the plan.

A generic video can supply background, but the training still needs to address the employer's plan, reporting procedures, relevant workplace hazards and corrective measures, how to get help, and the violent incident log. Record the session date, content or a summary, the trainer's name and qualifications, and attendees' names and job titles. Keep the questions route available during the training arrangement you use.

An r/humanresources discussion about California training raised the distinction between general violence-prevention content and company-specific instruction. That thread is an anecdotal implementation question, not evidence that any named course satisfies the law. The training duties above come from Cal/OSHA's employer guidance.

§6Keep the log usable without exposing identities

Workplace violence includes threats and weapon incidents even when no injury results. Cal/OSHA classifies incidents into four types: criminal intent by a person without legitimate business at the site; violence by customers, clients, visitors and similar people; violence by a current or former employee, supervisor or manager; and violence by someone who does not work at the site but has or previously had a personal relationship with an employee. Lawful self-defense or defense of others is excluded from the definition. A single incident can involve more than one type.

The violent incident log records each incident, including the date, time, location, a detailed account, the violence and incident types, circumstances, consequences and response. Exclude information that identifies people involved in the incident, such as names and addresses, and omit combinations of details that would reveal their identities. The person completing the log must still record their own name, job title and completion date. Store investigation records separately and do not include medical information as defined in California Civil Code section 56.05(j). The state model plan and log show these recordkeeping duties. Cal/OSHA Form 300 has different recording criteria, so an incident can require a violence-log entry without a Form 300 entry; the official FAQ explains the distinction.

Retention periods differ. Keep hazard identification, evaluation and correction records for at least five years; violent incident logs for at least five years; and investigation records for at least five years. Training records have a minimum retention period of one year. Employees and authorized representatives can obtain hazard records, training records and violent incident logs without charge for examination and copying within 15 calendar days of a request. Cal/OSHA can request all workplace violence records, including investigation records. These periods are listed in the agency's recordkeeping guidance.

At least annually, and after a workplace violence incident or when a deficiency becomes apparent, review the plan's effectiveness and revise it as needed. A personnel change, new shift pattern or change in public access can also prompt a management check of assumptions. Keep a dated review note and the current instructions accessible to employees. The suggested location sheet and action register above support that work; they do not replace the required plan, employee involvement or training.

If the response involves an employee leaving the business, assign the wage-payment deadlines to payroll separately from the safety investigation. The final paycheck reference covers that employment step. A completed violence report does not settle outstanding wages.

§7Frequently asked questions

Who is not covered under SB 553? Size alone is insufficient. For the small-site exclusion, check the simultaneous staffing limit, whether members of the public can enter, and whether its injury-prevention program meets section 3203. Other exclusions concern eligible healthcare, correctional, police and employee-selected remote settings. This legal summary discusses the exceptions; confirm unusual cases against section 6401.9(b).

What records must be kept under SB 553? Employers need documentation of hazards and their correction, employee instruction, violent events, and follow-up investigations. Training files need a one-year minimum; the other three categories need five years. Set an access process as well as a deletion date. The state recordkeeping overview sets out the duties.

Can a corporate WVPP serve several sites? A shared company document can work only when it contains the relevant local details. Test it by asking a site manager to find that location's hazards, controls and response instructions. Cal/OSHA answers the corporate-plan question in its WVPP guidance.

Does California require a particular WVPP template? No prescribed state form is mandatory. You may draft the document yourself, adapt a model, or make a separate WVPP section within your IIPP. Whichever format you choose, putting it into practice remains the employer's duty. The regulator explains the permitted formats.