Plain reading · not legal advice
What the law actually requires
Senate Bill 553 added Labor Code § 6401.9, operative 1 July 2024 and enforced by Cal/OSHA. Here is what it obliges an employer to do, in the order an inspector would ask about it.
Who is covered
Most California employers. The exemptions are narrow and easy to misread.
Broadly exempt: healthcare operations already covered by the separate healthcare standard; certain corrections facilities; law enforcement agencies meeting the POST conditions; employees teleworking from a location of their own choosing not under employer control; and worksites not accessible to the public with fewer than ten employees.
Two things employers get wrong about the small-employer exemption
Under the draft regulation it is measured across the preceding 365 days, not on the day someone asks — which closes the “we’re usually small” argument. And it expressly does not apply to security services, janitorial services or domestic-work employers, at any headcount.
The four obligations
| # | What is required | Where employers fall short |
|---|---|---|
| 1 | A written, site-specific plan — named administrative responsibility, employee involvement, hazard identification and correction, incident response and post-incident procedures | “Site-specific” is the operative term. A generic document can contain every required heading and still fail, because it does not describe your hazards or your work areas |
| 2 | Interactive training when the plan is introduced, annually thereafter, and whenever a new hazard appears — tied to your actual plan, with live question-and-answer with a person knowledgeable about it | A video, a PDF and a signature sheet do not satisfy “interactive.” A human who knows the plan has to be answerable to your employees |
| 3 | A violent incident log for every incident — date, time, location, type of violence, consequences — retained five years | A missing or incomplete log is very hard to remedy afterwards, because the rule specifies what must be captured and how long it is kept |
| 4 | Annual review of the plan, plus review after an incident | The review has to be documented. An undocumented review is an unperformed review |
What goes in the violent incident log
This is the single most commonly missing item, and the most specified. Under the draft regulation an entry is required for every workplace violence incident — whether or not anyone was injured, whether or not police attended — compiled from the affected employee, witness statements and the investigation.
- Date, time and location
- Which of the four violence types applied — stranger, customer or client, co-worker or supervisor, or someone with a personal relationship to an employee
- A detailed description, and a classification of who committed it
- The circumstances at the time — working alone, poorly lit, rushed, low staffing, unable to get help, unfamiliar location
- Where it happened — workplace, parking area, employer-provided transportation or housing
- The type of incident — physical attack with or without a weapon, a threat, sexual assault or threat, animal attack, or other
- Consequences, whether law enforcement was contacted and how they responded, and what was done to protect employees from a continuing threat
- Who completed the entry, their job title and the date
Names do not go in the log
Personal identifying information must be omitted — no names, addresses, emails, phone numbers, or any detail that would identify anyone involved. That is because the log is produced to Cal/OSHA on request, and to your own employees. Identities belong in a separate investigation file.
Recordkeeping
| Record | Keep for |
|---|---|
| Hazard identification, evaluation and correction, including inspections | 5 years |
| Violent incident logs | 5 years |
| Reports of threats, incidents and concerns — including anonymous ones | 5 years |
| Your evaluations of those reports and the corrective action taken | 5 years |
| Incident investigation records | 5 years |
| Training records — dates, content, trainer qualifications, attendee names and job titles | 1 year minimum |
Under the draft rule, employees and their designated representatives can request these records and must receive them free of charge within fifteen calendar days. Most of what you hold may be redacted for personal identifying information — training records may not.
Penalties
| Classification | Maximum | Minimum |
|---|---|---|
| General and regulatory, including recordkeeping | $16,285 | — |
| Serious | $25,000 | — |
| Willful or repeat | $162,851 | $11,632 |
Cal/OSHA maximums for citations issued on or after 1 January 2025. Each cited item is penalised separately, and the figures are adjusted periodically — confirm the current schedule with the Department of Industrial Relations before relying on these.
Where the regulation stands
§ 6401.9 is the statute and it is already enforceable. Cal/OSHA is separately writing the implementing general industry standard, 8 CCR § 3343, which the Occupational Safety and Health Standards Board is required by statute to adopt no later than 31 December 2026.
As of this writing it remains a discussion draft. The most recent version is dated September 2026 and a further advisory committee meeting was scheduled for 27 October 2026. Formal rulemaking — the notice period, public hearing and administrative review that precede a rule taking effect — had not been commenced.
When the final text is adopted, every program in California will need checking against it. That is what our monitoring is for.
Not sure where you stand?
An assessment is a fixed-price review of what you have against what the law requires, with a written gap report. You keep the report whatever you decide to do next.