What the Law Actually Does

SB 553 does two things, and most explainers only mention one of them.

• 1. It requires almost every California employer to have a written Workplace Violence Prevention Plan (WVPP). Plans must be site-specific (not a downloaded template), must include all the required §6401.9 elements, must be backed by initial and annual training, and must be reviewed at least once a year. Plans must also be reviewed after any incident or when a deficiency is found. Records of incidents, hazard assessments, and investigations must be kept for five years. Training records must be kept for one year. Employees can ask to see or copy the violent incident log within 15 calendar days.
• 2. It expanded who can petition for a workplace violence restraining order. Before SB 553, only an employer could go to court for a temporary restraining order to protect employees from a credible threat. SB 553 broadened the definition of who can be protected and adjusted who can petition on a worker’s behalf under California civil procedure. The plan requirement is what most employers focus on, but the restraining-order provision is also part of the same bill.

The plan requirement is the part Cal/OSHA enforces and the part that creates direct citation exposure. That is what the rest of this page covers.

Who Enforces It

Cal/OSHA, formally the Division of Occupational Safety and Health within the California Department of Industrial Relations. Federal OSHA does not enforce SB 553. Federal OSHA does not have a general-industry workplace violence prevention plan standard like SB 553. It has guidance and can cite employers under the General Duty Clause in certain cases, but that is not the same as California’s written WVPP requirement, which is one reason California passed its own mandate. If a Cal/OSHA inspector walks into your facility and asks to see your WVPP, federal guidance is not a defense.

The July 2024 Timeline (Now in the Past)

The compliance deadline was July 1, 2024. Cal/OSHA has been able to cite for non-compliance since that date. If you do not yet have a written plan, the legal answer is that you are already past due. The practical answer is that most facilities we walk into are in the same position, and Cal/OSHA’s enforcement so far has been inspection-driven rather than a sweep. That means the citation risk is real but most often surfaces during a routine visit or a complaint-driven investigation, not out of nowhere.

The point is not to panic. The point is that “we have not been cited yet” is not a compliance strategy.

Who Has to Have a Plan

Coverage is broad. The plan applies to:

• California employers with 10 or more employees at any time, or
• Any workplace accessible to the public, regardless of how few employees are present

There are four exception categories: employers already covered by the Workplace Violence Prevention in Health Care standard, employees teleworking from a location of their own choosing that the employer does not control, workplaces with fewer than 10 employees not open to the public, and California Department of Corrections and Rehabilitation and law enforcement facilities. For the detailed walk-through of who is in and who is out, see who is covered and exempt under SB 553.

What a Compliant Plan Has to Cover

The statute lists the required plan elements in §6401.9. At a glance:

The “site-specific” requirement is the one that trips up the most facilities. Cal/OSHA’s regulation is explicit that the hazard assessment has to reflect your actual operations, your actual employees, and your actual physical site. A generic plan downloaded from another company’s website or a university PDF is not site-specific by definition, even if it lists the right elements.

How SB 553 Compares to the Federal Picture

Federal OSHA does not have a general-industry workplace violence standard. It has sector-specific guidance for retail and for healthcare, and the General Duty Clause, which lets federal OSHA cite employers for “recognized hazards” without a specific standard. None of that is the same as a written program requirement.

California decided not to wait. SB 553 is the first general-industry workplace violence prevention mandate that covers nearly every employer, not just healthcare or retail. If you operate in multiple states, the California facility needs the plan even if your other locations do not.

The DIY Question

We get this call often: a safety lead or HR manager downloaded a template, started filling it in, and stopped when they hit the hazard assessment. The walls of the building, where employees enter and exit, the parking situation at 5 a.m. for the first shift, the public counter that gets walk-ins, the loading dock that sees outside drivers. None of that is in a template. The four types of workplace violence (a Cal/OSHA framing the plan has to use) have their own hazard criteria, and applying them is the part of the work a downloaded document cannot do for you. We walk through the four types and what each one captures in a separate piece.

The most common gaps we find when we audit DIY plans:

• no documented hazard assessment,
• generic training used facility-wide,
• no violent incident log,
• no named responsible persons for required plan functions,
• and no record of an annual review.

Any one is a citable deficiency. Several together is the pattern that turns a Cal/OSHA visit into a problem.

What This Means for Your Facility

If you have not done anything yet, the path forward is the same path most California facilities are on right now: assess the hazards, write the plan around them, train your employees on the actual content, set up the log, and put the annual review on a calendar so it does not get forgotten next year. Doing it yourself is possible. Hiring it out is also possible. The wrong choice is doing nothing, because Cal/OSHA does not weigh good intentions when it issues a citation.