Labor & Employment Law Daily Wrap Up, EXPERT INSIGHTS—Cal/OSHA’s proposed workplace violence rule: What California employers should do now, (Sep 10, 2026)

By John D. Surma of Fisher Phillips, LLP

The proposal and Labor Code section 6401.9 require a continuous prevention process and cannot simply be satisfied by developing a new policy for your handbook.

With Cal/OSHA facing a New Year’s deadline to finalize comprehensive workplace violence prevention rules for all businesses operating in the Golden State, California employers should start preparing now. While businesses operating in California already have obligations to maintain a workplace violence prevention plan and related training, Cal/OSHA has nearly finalized a rule that would set up a detailed regulatory framework for employers to prevent violent incidents occurring on their jobsites. Cal/OSHA is still refining the proposal, meaning the precise regulatory language may change, but the proposal serves as a helpful roadmap for what obligations employers may face come next year. Here’s everything you need to know about the proposal and how to prepare.

Existing Rules

Since July 2024, California employers have been required to:

• establish, implement, and maintain an effective written workplace violence prevention plan;

• maintain a violent incident log;

• train employees;

• investigate incidents;

• and retain specified records.

The pending proposal being considered by Cal/OSHA would be the general-industry regulatory standard implementing those statutory duties.

Who’s Covered?

The statutory framework applies broadly to employers, employees, places of employment, and employer-provided housing. Important exceptions include certain health-care operations already covered by section 3342, specified correctional and law-enforcement settings, telework locations selected by an employee that are outside the employer’s control, and certain non-public workplaces with fewer than 10 employees present at a time.

Scope must be assessed carefully. A small office may qualify for an exception only if it is not accessible to the public and meets the other conditions. Retail stores, customer-service operations, worksites with visitors, field operations, and shared or multiemployer locations will commonly require a program.

What’s in the Proposal?

The proposal and Labor Code section 6401.9 require a continuous prevention process and cannot simply be satisfied by developing a new policy for your handbook. An effective workplace violence prevention plan should identify the person or job title responsible for implementation and address the hazards of each work area and operation. The plan may stand alone or be incorporated into the employer’s Injury and Illness Prevention Program.

The program should explain how employees and authorized employee representatives will participate in identifying, evaluating, and correcting hazards; how the employer will coordinate with other employers at shared worksites; and how employees can report concerns without retaliation.

Hazard Assessments

The statute expects employers to actively and frequently inspect the workplace for violence-related hazards, including when the program begins, after a workplace violence incident, and when the employer learns of a new or previously unrecognized hazard. Employers must correct identified hazards in a timely manner.

For safety professionals, this calls for an assessment that accounts for situations you would encounter in your actual work environment: public access, cash handling, late-night work, isolated work, delivery or field work, staffing levels, lighting, parking areas, customer or patient interactions, domestic-violence spillover, and access to emergency assistance.

Reporting, Investigation, and Emergency Response

The program must provide an accessible way to report actual or potential workplace violence, threats, and related safety concerns without fear of reprisal. It also must describe how reports will be investigated, how findings and corrective actions will be communicated, and how the organization will respond to a workplace violence emergency.

A well-designed response protocol should define who receives a report, who makes immediate safety decisions, when security or law enforcement is contacted, who coordinates internal communications, and how the employer preserves the information needed for a post incident review.

Incident Logs and Recordkeeping

The law requires a violent incident log for every workplace violence incident. The log must capture information such as the date, time, and location; the type of workplace violence; a detailed description; perpetrator classification; relevant circumstances; the type of incident; and resulting protective actions.

You must omit personal identifying information. You must also retain hazard-identification, evaluation, and correction records; violent incident logs; and incident-investigation records for at least five years. You must retain training records for at least one year.

Employee Training

Employees must receive initial training when the plan is established and annual training afterward, with additional training when a new hazard is identified or the plan changes. Training must cover the employer’s plan, reporting methods, job-specific hazards, protective measures, the incident-log process, and an opportunity for interactive questions and answers.

What This Means For Your Business

You should expect Cal/OSHA to evaluate whether a written plan is specific, implemented, and supported by evidence.

Site-specific analysis matters. While one statewide policy may be useful, it will not replace local evaluation of different facilities and their unique risks. Documentation is key to your defensibility. Inspection records, incident logs, training records, investigation materials, and proof of corrective action will be central to showing that the program operates in practice.

Steps To Consider Now

1. Confirm coverage and assign ownership

Determine whether each worksite is covered, exempt, or subject to a separate industry-specific standard. Designate accountable program owners and make their roles clear. For larger employers, identify both a central owner and local site contacts who can act when a report or incident occurs.

2. Audit the current program against the statute and proposal

Compare the current workplace violence prevention plan to Labor Code section 6401.9 and the current Cal/OSHA draft. Confirm that the plan addresses employee participation, reporting without retaliation, hazard assessment, emergency response, post incident investigation, training, recordkeeping, periodic review, and coordination at multiemployer worksites.

3. Conduct and document site-specific violence-hazard assessments

Perform documented assessments at each covered location and reassess following incidents, operational changes, or newly identified hazards. Involve affected employees and supervisors. Evaluate physical conditions, work practices, staffing, access controls, communication methods, and the ability to obtain prompt help.

4. Test reporting, investigation, and escalation procedures

Make sure employees know how to report threats, violence, or related concerns and that the reporting paths work in practice. Train managers on triage and escalation. Establish a consistent investigation process that protects confidentiality as appropriate, documents findings, and tracks corrective actions to completion.

5. Strengthen incident-log and record-retention practices

Use a log that captures the information required by section 6401.9 while omitting personal identifying information. Maintain supporting investigation, hazard-correction, and training records for the required periods. Periodically analyze log data for trends involving location, time, task, staffing, perpetrators, or recurring controls failures.

6. Deliver practical, job-specific training—and keep it current

Provide initial and annual training that is understandable to the workforce and includes a live opportunity for questions. Tailor scenarios to the work performed: customer disputes, parking-lot risks, lone work, field visits, threats by current or former employees, and personal-relationship violence that may reach the workplace. Update training after incidents, plan revisions, or newly recognized hazards.

Conclusion

Fisher Phillips will continue to monitor any new developments related to this rule and will update employers as needed. Make sure you are signed up for Fisher Phillips’ Insight System to receive updates straight to your inbox. If you have questions about creating a workplace violence prevention program, contact your Fisher Phillips attorney, the author of this Insight, or any member of our Workplace Safety and Catastrophe Management Practice Group.

John D. Surma

Fisher Phillips, LLP

URL: https://www.fisherphillips.com/

ExpertInsights: ExpertInsights Safety StateRegulations IndustryNewsTrends ESGNews PracticeTip