Yes, almost every California employer needs one. Since July 1, 2024, Labor Code section 6401.9 has required a written workplace violence prevention plan, annual training, and a log of every violent incident, with narrow exemptions. Cal/OSHA enforces it through citations and civil penalties. The bigger risk shows up later: when an incident or a retaliation claim reaches court, the plan, the log, and the training records are the first documents the other side asks for, and a missing plan is hard to explain.
Which California employers need a workplace violence prevention plan?
Nearly all of them. Section 6401.9(b)(1) says the law “applies to all employers, employees, places of employment, and employer-provided housing,” subject to a short list of exemptions.
Most of the exemptions cover health care facilities and public safety agencies, which have their own rules. For an ordinary business, two are worth knowing. Section 6401.9(b)(2) doesn’t cover “Employees teleworking from a location of the employee’s choice, which is not under the control of the employer.” And it exempts “Places of employment where there are less than 10 employees working at the place at any given time and that are not accessible to the public,” but only if those places comply with the general injury and illness prevention rule in Title 8, section 3203.
That small-site exemption is narrower than it looks. The statute doesn’t define “accessible to the public,” and a two-person office that receives customers likely counts, so it probably doesn’t qualify. And Cal/OSHA can still order an exempt employer to comply.
The plan also isn’t optional in another way. The injury and illness prevention program (IIPP) that Labor Code section 6401.7 has long required must now include “A workplace violence prevention plan conforming to the requirements of Section 6401.9.”
What has to be in the written plan?
A lot more than a zero-tolerance policy. Section 6401.9(c) requires an employer to “establish, implement, and maintain an effective workplace violence prevention plan” that is in writing, available to employees and to Cal/OSHA “at all times,” and “specific to the hazards and corrective measures for each work area and operation.”
The statute lists what the plan has to include. In plain terms:
| Plan element | What the statute requires | What it looks like in a later dispute |
|---|---|---|
| Responsible people | Names or job titles of those who implement the plan | Who should have acted on a warning |
| Employee involvement | Procedures to involve employees in identifying hazards, designing training, and investigating incidents | Whether the plan was real or a template |
| Reporting and anti-retaliation | Procedures to accept and respond to reports, and to prohibit retaliation against the reporter | The employer’s answer to a retaliation claim |
| Emergencies | Alerts, evacuation or sheltering plans, and how to get help | What happened during the incident |
| Hazard inspections | Inspections when the plan is first set up, after each incident, and when a new hazard surfaces | Whether a known risk was evaluated |
| Correction and investigation | Timely correction of hazards and post-incident investigation | Whether the employer fixed what it found |
| Annual review | Review at least once a year, after a deficiency, and after an incident | Whether the plan was kept current |
A template isn’t enough by itself. Cal/OSHA’s FAQ page says “Use of Cal/OSHA’s model written WVPP does not ensure compliance with LC 6401.9.” A single corporate plan also has to account for each location. The same page says “Employers are required to ensure that their written WVPP is specific to the hazards and corrective measures for each work area and operation.”
I’d put more weight on the location point than most employers do. Under Labor Code section 6317(b), when an employer with multiple worksites “has a written policy or procedure that violates” a Cal/OSHA requirement, “there shall be a rebuttable presumption that a violation is enterprise-wide.” That presumption is written for Cal/OSHA’s standards and regulations, so the statute alone may not trigger it. Once Cal/OSHA adopts a standard, though, a generic plan rolled out to every location is the kind of written document that could turn one site’s citation into a company-wide one.
What goes in the violent incident log, and who can see it?
Every incident goes in, including threats. Section 6401.9(d) says “The employer shall record information in a violent incident log for every workplace violence incident.” The statute defines workplace violence to include a “threat of violence,” which can include texts and social media posts that convey an intent to cause physical harm or put someone in fear of it, and that serve no legitimate purpose.
Under section 6401.9(d)(2), each entry has to record “The date, time, and location of the incident”; the type of violence; a detailed description; who committed it, by category, such as a customer or a coworker; the circumstances; where it happened; the kind of incident; what the employer did in response; and who completed the entry. The log must leave out personal identifying information, such as names and phone numbers, that would allow anyone involved to be identified.
Employees can get copies. Under section 6401.9(f)(6), the hazard records, training records, and logs “shall be made available to employees and their representatives, upon request and without cost, for examination and copying within 15 calendar days of a request.” The same subdivision requires the employer to keep the logs, hazard records, and incident investigation records for at least five years, and training records for at least one year.
That access right is why the log deserves care. An employee can request a copy and hand it to a lawyer before any lawsuit is filed. Write each entry as a factual record, not as a conclusion about who was at fault.
What training does Labor Code section 6401.9 require?
Initial training when the plan is first set up, and then every year. Section 6401.9(e) requires training on the plan itself, how to report incidents “without fear of reprisal,” the hazards specific to the employee’s job, the incident log, and “An opportunity for interactive questions and answers with a person knowledgeable about the employer’s plan.” Extra training is required when a new hazard is identified or the plan changes.
That last element rules out a click-through video with no one to ask. Training records have to show the dates, the content, who trained, and who attended.
Has Cal/OSHA adopted a workplace violence standard yet?
Not yet. Section 6401.9(h) requires the Occupational Safety and Health Standards Board to adopt a general industry standard “no later than December 31, 2026.” Cal/OSHA’s workplace violence page says the agency “is currently working on the development of a workplace violence prevention standard for general industry.”
The draft is still in the advisory stage. Cal/OSHA’s advisory meeting page shows revised drafts of a new Title 8, section 3343 posted in April and July 2026, a September 2026 discussion draft, and an in-person advisory meeting on October 27, 2026. The Standards Board hasn’t yet issued a rulemaking notice for section 3343.
Until a standard is adopted, the statute is the rule, and it’s already enforceable. Any final standard has to include, “at a minimum, the requirements of this section,” so nothing in the statute should be expected to go away.
How does a missing workplace violence plan show up in a lawsuit?
In at least three ways, and none of them requires an injury.
A Cal/OSHA citation. Section 6401.9(g) says Cal/OSHA “shall enforce this section by the issuance of a citation alleging a violation of this section and a notice of civil penalty in a manner consistent with Section 6317.” The employer can appeal to the Occupational Safety and Health Appeals Board. A citation also becomes part of the employer’s history for later inspections.
A PAGA notice. Under the Private Attorneys General Act (PAGA), an employee can bring a civil action for Labor Code violations after giving notice. For most violations of the Cal/OSHA part of the Labor Code, including section 6401.9, section 2699.3(b) sets a different path: the employee files the notice with Cal/OSHA and sends a copy to the Labor and Workforce Development Agency, and Cal/OSHA “shall inspect or investigate the alleged violation.” If Cal/OSHA issues a citation, “the employee may not commence an action” under PAGA. That routing matters. An employer that gets a Division 5 PAGA notice should treat it as the start of a Cal/OSHA inspection. PAGA claims for retaliation under section 6310 are different: section 2699.5 lists them with the wage claims that go through the agency’s ordinary notice process.
A retaliation claim. Most workplace violence lawsuits I’d expect aren’t about the plan itself. They’re about what happened to the employee who complained. The plan must include procedures “to prohibit retaliation against an employee who makes such a report,” and Labor Code section 6310 separately gives an employee who is disciplined or fired for a “bona fide oral or written complaint” about unsafe working conditions a right to “reinstatement and reimbursement for lost wages and work benefits.” When an employee reports a threat and is let go a few weeks later, the employer’s plan, the log entry, and the investigation file become the core of the defense. If they don’t exist, the employer is left explaining the timing with nothing in writing.
My view is that the plan is cheap insurance against that last scenario. A real plan, a clean log, and a documented investigation give a defense lawyer something to work with. Their absence tends to become the plaintiff’s opening theme.
What should an employer do after a workplace violence incident or complaint?
Most of the exposure gets set in the first week after an incident, a threat, or a complaint. Start here:
- Preserve the records under a litigation hold: the written plan in effect on the date of the incident and every earlier version, the violent incident log, the investigation file, training records, security footage, and the texts and emails about the incident.
- Calendar the deadline on any Cal/OSHA citation, PAGA notice, demand letter, or summons, and check the arbitration agreement and any employment practices liability (EPLI) policy for notice requirements.
- Identify the witnesses, the people named in the plan as responsible, and whoever decided any discipline, and stop any action against the reporting employee that could look like retaliation.
- Pull the documents the claim will turn on: the log entry, the hazard inspection after the incident, the corrective steps taken, and the attendance records from the last annual training.
- Talk to a lawyer before responding to Cal/OSHA, the employee, or the employee’s lawyer, and before offering anything to settle.
Rosenberger + Kawabata’s page on California employment defense describes how retaliation and wage claims are defended.
Workplace violence plan questions from employers
Do remote employees need to be covered by the plan?
Employees teleworking from a place they choose, which the employer doesn’t control, are exempt. An employee who works from an employer-controlled site part of the week is covered while there. A hybrid workforce usually still needs the plan for its office or worksite, along with training for anyone assigned there. Read the exemption narrowly: it depends on who controls the location, not on the job title.
Can we fold the workplace violence plan into our IIPP?
Yes. Section 6401.9(c)(1)(B) says the written plan “may be incorporated as a stand-alone section in the written injury and illness prevention program” or kept as a separate document. Either way, it has to meet every requirement of section 6401.9 and be easy for employees to get.
Do we have to log threats that didn’t lead to any injury?
Yes. Section 6401.9(a)(6) defines workplace violence to include threats of violence and the threat or use of physical force “regardless of whether the employee sustains an injury.” Every incident goes in the log. Cal/OSHA’s FAQ page explains that whether an incident also goes on the Cal/OSHA Form 300 injury log depends on the injury and the treatment.
Will the new Cal/OSHA standard replace the statute?
No. The statute requires the final standard to include, at a minimum, everything section 6401.9 already requires. Expect the standard to add detail, not remove duties. Watch the Standards Board’s proposed regulations page for a formal notice and a public hearing date.
If Cal/OSHA or an employee’s lawyer is asking for your plan
If a citation, a PAGA notice, or a retaliation lawsuit has followed a workplace violence complaint, the plan and the log usually decide how the case starts. Rosenberger + Kawabata represents employers defending employment lawsuits and claims through its business litigation practice, including claims involving workplace safety retaliation. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The statutes are Labor Code section 6401.9 (added by SB 553, Stats. 2023, ch. 289), section 6401.7, section 6317, section 6310, and section 2699.3. Cal/OSHA’s guidance is on its workplace violence page and FAQ page, and the draft standard’s history is on the advisory meeting page. Pending rulemaking is listed on the Standards Board’s proposed regulations page.
This post is general information about California and federal employment law as of November 5, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Employment statutes, regulations, and court decisions change often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.