What SB 553 actually says
Short answer: signed in 2023, enforceable since July 1, 2024, SB 553 added Section 6401.9 to the Labor Code and it's enforced by Cal/OSHA. Almost every California employer needs four things: a written workplace violence prevention plan, employee training, a violent incident log, and organized records. This page is the full plain-English reference — the checklist, post-incident steps, inspections, citations, and retention rules.
The whole law in four sentences
- You need a written Workplace Violence Prevention Plan (WVPP) — a document specific to your workplace that names who's responsible, how employees report concerns, how you'll respond to incidents, and how you identify and fix hazards. It can live inside your existing Injury & Illness Prevention Program or stand alone.
- You must train every employee — when the plan is first put in place, then annually, plus whenever the plan changes or a new hazard shows up. Training must be interactive (employees can ask questions), not just a signed form.
- You must keep a violent incident log — every incident recorded with date, time, location, what happened, and what you did about it, without personal identifying information about the people involved. The log must still name the person completing it, their job title, and the completion date. Entries are kept for 5 years.
- You must keep records and share them on request — training records (1 year), incident logs, hazard assessments and investigations (5 years). Employees can request copies and you have 15 calendar days to provide them.
The four types of workplace violence the law covers
Someone with no business at your workplace: a robbery, an assault on staff by a stranger.
A customer, client, patient, or visitor becomes aggressive toward an employee.
Violence or threats between current or former employees, supervisors, or managers.
Someone with a personal connection to an employee (e.g., domestic situations) brings it to the workplace.
Who's exempt? Only a few: worksites where fewer than 10 employees are present at any given time and that are not accessible to the public (you still need your IIPP), employees teleworking from a location of their own choosing that isn't under the employer's control, healthcare facilities already covered by Cal/OSHA's separate healthcare violence standard (§ 3342), and certain corrections and law-enforcement facilities. The exemptions are narrow and specific — confirm yours against Cal/OSHA's FAQ before relying on it. If you run a shop, restaurant, office, warehouse, gym, salon, or pretty much any business the public or 10+ workers walk into, this law almost certainly applies to you.
The compliance checklist, A to Z
These are the core requirements. If you can honestly check all seven, you've covered the items inspectors ask about first.
Write your plan (WVPP)
Cal/OSHA publishes a free fill-in model plan. It must be specific to your workplace — a generic template with blanks left in is one of the most common things inspectors flag. Name the person responsible, describe your reporting process, and cover how you'll respond to each type of violence.
Actively involve your employees
Employees must participate in developing and implementing the plan, identifying and correcting hazards, designing and delivering training, and reporting and investigating incidents. Document how their input changed or confirmed the process.
Assess your hazards
Walk your workplace and note risk factors: handling cash, working alone or late hours, public access, past incidents. Write down what you found and what you changed. Keep it — hazard assessment records are a 5-year keep.
Train everyone — and repeat annually
Initial training on the plan, how to report concerns, and what to do during an incident. Record the date, the content covered, who ran it, and who attended. Re-run it every year and whenever the plan changes.
Set up your violent incident log
Have the log form and process ready before anything happens. Record the date, time, location, type (1–4), what happened, consequences, response, and corrective action. Omit identifying information about people involved, but include the log completer's name, job title, and completion date.
Organize your records
One folder (physical or digital): the plan, training sign-ins, hazard assessments, the incident log, and investigation notes. Employees and authorized representatives have a statutory access deadline; Cal/OSHA can also request the required records. Organized now beats scrambling later.
Review the plan at least annually
Also review after any incident and whenever a deficiency becomes apparent. Date each review. An out-of-date plan reads as no plan.
Reality check: a small, straightforward workplace may be able to complete the core setup quickly, while multiple locations or more complex hazards take longer. What matters is a complete, workplace-specific plan that is actually implemented. If you'd rather have a professional build it with you, compare that help here.
An incident happened — your first steps
Once everyone is safe and any emergency response is done, here's what the law expects from you in the hours and days that follow. Work through it top to bottom.
Make sure people are okay, and start the workers' comp paperwork
Injured employees get timely treatment through workers' compensation. If an employee's injury needed more than first aid, give them a DWC-1 claim form within one working day of learning about the injury, and send Form 5020 (Employer's Report of Occupational Injury or Illness) to your claims administrator within five days.
Report serious employee injuries to Cal/OSHA — the one hard deadline
A work-related death or serious injury or illness of an employee — inpatient hospitalization beyond observation or diagnostic testing, amputation, loss of an eye, or serious permanent disfigurement — must be reported to Cal/OSHA as soon as practically possible, and no later than 8 hours after you knew (or reasonably should have known) about it. Call your local district office. A hospital visit for observation or tests alone doesn't trigger this report.
Write it in your violent incident log
Date, time, location, type of violence (1–4), what happened, response, consequences, and corrective actions. Exclude identifying information about the people involved; include the completer's name, job title, and completion date.
Investigate and fix what you can
Talk to witnesses, review footage if you have it, and write down what you learned and what you're changing — better lighting, a new policy, a panic button, whatever fits. This investigation record is a 5-year keep.
Update your plan if the incident exposed a gap
The law requires reviewing the plan after every incident. Even a one-paragraph dated note ("reviewed plan on this date, added X") shows good faith and covers you.
Protect the people who reported it
No discipline, schedule cuts, or other adverse treatment toward anyone who reported the incident or cooperated. Retaliation is prohibited and can create separate legal exposure.
When to bring in a professional: if someone was seriously hurt, if the incident involved an employee as the aggressor, if a restraining order might be needed (SB 553 lets employers seek workplace violence restraining orders on behalf of employees), or if you expect a complaint or claim — this is the moment for a quick call to an employment attorney. Here's the official path.
A Cal/OSHA inspector came by — what they look for
Stay calm and courteous. Inspections are usually triggered by an employee complaint or a reported injury, and the inspector is working from a checklist. Here's what's on it:
- Your written plan — and whether it's actually specific to your workplace, not an unedited template.
- Training records — dates, content, trainer, attendee names. They may also ask employees directly whether they were trained and know how to report concerns.
- Your violent incident log — including whether past incidents they know about (from the complaint) appear in it.
- Hazard assessment and correction records — proof you looked for risks and did something about them.
- Post-incident follow-through — if the visit was triggered by an incident: the investigation, the log entry, the plan review, and any required injury reporting.
You're allowed to accompany the inspector, take your own notes and photos of anything they photograph, and ask what prompted the visit. Answer accurately, keep a copy of every record you provide, and confirm follow-up requests and deadlines in writing.
Got a complaint letter instead of a visit? Many investigations start with a letter, not an inspector. Cal/OSHA generally expects your written response — what you found when you looked into the complaint and what you corrected — within 14 days, and the letter usually includes posting instructions. Follow them exactly and keep copies of everything you send.
If you receive a citation
A citation isn't the end of the world, but it is a clock. Here's the shape of it:
- You typically have 15 working days to appeal from receipt. Miss it and the citation becomes final. Mark the date the moment the envelope arrives.
- Penalties scale with severity — at 2026 levels, general and regulatory violations run up to $16,285 each, serious violations up to $25,000, and willful or repeat violations up to $162,851 (amounts adjust most years). Each missing element (no plan, no training, no log) can be cited separately.
- Penalty adjustments may apply. Abatement, good-faith effort, and business size can affect the calculation. An informal conference is an opportunity to discuss the citation, but it does not extend the appeal deadline.
- Fix the underlying issue either way — abatement is usually required regardless of the appeal, and documented fixes strengthen your position.
This is a situation where employers often bring in professional help. An attorney or consultant who handles Cal/OSHA matters can help evaluate the classification, abatement requirements, and appeal options. Compare help here — and watch that 15-day deadline while you decide.
What to keep, and for how long
Bookmark this table. Employees and authorized representatives must receive the specified log, hazard, and training records within 15 calendar days of a request. Cal/OSHA may request all required records; the statute does not give the employer a 15-day grace period for an agency request.
| Record | Keep for | Notes |
|---|---|---|
| Written plan (WVPP) | Always current | Review annually, after incidents, and when gaps appear |
| Violent incident log | 5 years | De-identify people involved; include the completer's name, title, and date |
| Hazard identification & correction records | 5 years | What you found, when, and what you fixed |
| Incident investigation records | 5 years | Findings and corrective actions for each incident |
| Training records | 1 year minimum | Date, content summary, trainer name & qualifications, attendees |