Workplace Violence Prevention Plans: What Labor Code 6401.9 Requires

Since July 1, 2024, nearly every California employer has been required to have a written Workplace Violence Prevention Plan, keep a violent incident log, and train employees on both. The requirement comes from Labor Code Section 6401.9, added by SB 553, and it applies to warehouses, restaurants, retail, offices, manufacturing, property management, and film production alike. The gap I see most often is not a missing plan. It is a plan that was downloaded, never tailored to the actual work areas, and never followed up with a log or annual training.

Who Is Covered, and Who Is Exempt

Labor Code Section 6401.9 applies to all employers and places of employment in California except a short list. The exemptions are narrow, and I encourage you to read them literally before deciding you are off the hook:

Health care facilities, service categories, and operations that are already covered by Title 8, Section 3342, the health care workplace violence standard.
Facilities operated by the Department of Corrections and Rehabilitation, and law enforcement agencies that meet the statute’s POST-related criteria.
Employees teleworking from a location of their own choosing that is not under the employer’s control.
Places of employment where there are fewer than 10 employees working at the place at any given time and that are not accessible to the public.

That last exemption is the one employers misread. It has two parts, and both must be true. A nine-person office that customers walk into is covered. A twelve-person shop with no public access is covered. If you have a small crew but the public can reach them, you need a plan.

What Counts as Workplace Violence

The statute defines workplace violence as any act of violence or threat of violence that occurs in a place of employment. A threat of violence includes verbal or written statements and behavioral or physical conduct that conveys an intent to cause physical harm. No injury has to occur. The statute sorts incidents into four types, and your plan and log both need to use them:

Type 1: violence committed by a person with no legitimate business at the worksite, such as a robbery or trespasser.
Type 2: violence directed at employees by customers, clients, patients, students, inmates, or visitors.
Type 3: violence by a present or former employee, supervisor, or manager.
Type 4: violence by someone who has a personal relationship with an employee but does not work there, typically a domestic partner or family member.

In my experience, most employers write their plan around Type 1 because it is the easiest to picture. Type 2 and Type 4 generate more incidents in retail, hospitality, and service work, and the plan needs to address them.

What the Written Plan Must Contain

The plan must be written, available and easily accessible to employees, and in effect at all times and in all work areas. It must be specific to the hazards and corrective measures for each work area and operation. The statute permits the plan to be incorporated as a stand-alone section in your written Injury and Illness Prevention Program, which is how I usually recommend doing it, but the content requirements do not shrink because of where you file it. Section 6401.9 requires the plan to include:

The names or job titles of the persons responsible for implementing the plan.
Procedures for involving employees and their authorized representatives in developing and implementing the plan.
Methods for coordinating with other employers when a worksite has more than one, so every employee is covered.
Procedures for accepting and responding to reports of workplace violence, and for prohibiting retaliation against the employee who reports.
Procedures to ensure supervisory and nonsupervisory employees comply with the plan.
Procedures for communicating with employees about workplace violence, including how to report an incident and how concerns will be investigated and communicated back.
Procedures for responding to actual or potential emergencies, including how to alert employees, evacuation or sheltering plans, and how to obtain help from staff, security, or law enforcement.
Procedures for developing and providing the required training.
Procedures to identify and evaluate workplace violence hazards, including scheduled periodic inspections.
Procedures to correct hazards in a timely manner.
Procedures for post-incident response and investigation.
Procedures for reviewing the plan’s effectiveness at least annually, when a deficiency is observed, and after an incident, and for revising it as needed.
Any other procedures the Division requires.

A template can give you headings for all thirteen. It cannot tell an inspector where your panic button is, who unlocks the back door after dark, or what your cashier is supposed to do when a customer follows her to the parking lot. That is the content that makes a plan real.

The Violent Incident Log

This is the piece employers forget. Section 6401.9 requires you to record every workplace violence incident in a violent incident log. The information must be based on information solicited from the employees who experienced the incident, on witness statements, and on investigation findings. For each incident the log must capture the date, time, and location; the type of violence (Type 1 through 4); a detailed description of what happened; a classification of who committed it; the circumstances at the time; where it occurred; the nature of the incident (physical attack, weapon involved, threat, sexual assault, animal attack, or other); the consequences, including whether police were called and what was done to protect employees; and the name and title of the person completing the entry, with the date.

The log must omit personal identifying information sufficient to allow identification of any person involved. Employees and their representatives are entitled to examine and copy the log, the training records, and the hazard records without cost within 15 calendar days of a request, and Cal/OSHA can ask for the same records during an inspection.

Training: Initial, Annual, and When Something Changes

Training is required when the plan is first established and annually after that. It must cover the plan itself and how to obtain a copy, the definitions and requirements of the statute, how to report incidents without fear of retaliation, the workplace violence hazards specific to the employee’s job and the corrective measures in place, how to seek help, the violent incident log and how to get it, and an opportunity for interactive questions and answers with a person knowledgeable about the employer’s plan. Additional training is required when a new or previously unrecognized hazard is identified and when the plan is changed.

The material has to be appropriate in content and vocabulary to the educational level, literacy, and language of your employees. A twenty-minute video in English for a crew that speaks Spanish does not satisfy that, and inspectors know to ask.

Records, Retention, and Enforcement

Section 6401.9 sets four retention periods. Records of hazard identification, evaluation, and correction must be kept for a minimum of five years. Training records must be kept for a minimum of one year. Violent incident logs must be kept for a minimum of five years. Records of workplace violence incident investigations must be kept for a minimum of five years.

The statute directs the Division to enforce Section 6401.9 by issuing citations in the same manner as other safety violations. In practice that means a compliance officer who arrives for an accident investigation or a complaint about something unrelated can ask for your plan, your log, and your training records, and cite you if they are missing or generic. Penalties for a serious violation can run well into five figures, and higher for willful or repeat violations. The statute also required Cal/OSHA to propose a formal Title 8 regulation and set a deadline for the Standards Board to adopt it by December 31, 2026. Until a regulation is in place, the statute itself is what gets enforced.

What to Do This Week

Walk each work area and confirm the plan names its actual hazards: cash handling, lone work, late closings, home visits, angry customers, and terminated employees.
Check that the plan names a responsible person by name or title and that the person knows it.
Create the violent incident log if you do not have one, and enter any incidents from the last year that were never recorded.
Pull your training records and confirm every current employee has been trained within the last twelve months, in a language they understand, with a live question-and-answer component.
Add workplace violence hazards to your scheduled periodic inspections and document them.
Confirm the plan lives inside or alongside your IIPP and that employees can actually get a copy.
If you share a site with other employers, put your coordination method in writing.

If your plan is a template that has never been tailored to your operation, McNeil Safety Consulting can write one that reflects your actual work areas and survives an inspection. Learn more about our safety plan writing services or call (626) 546-9384.