California’s Workplace Violence Standard: What SB 553 Actually Requires (and What It Doesn’t)

California’s general-industry workplace violence prevention requirement has been enforceable since July 1, 2024. Two years on, a fair amount of what circulates about it is wrong — most commonly the claim that it requires panic buttons. It doesn’t. Understanding precisely what it does require, and where the actual device requirement lives in California law, matters for anyone making a compliance decision.

What SB 553 did

SB 553 (2023) added Labor Code § 6401.9. Subdivisions (b) through (g) became operative July 1, 2024.

It applies to all employers and all places of employment in California, with five exceptions:

• Health care facilities covered by 8 CCR § 3342, and employers complying with it
• Department of Corrections and Rehabilitation facilities in compliance with § 3203
• Law enforcement agencies certified under the POST program
• Teleworkers at a location not under the employer’s control
• Workplaces with fewer than 10 employees at any given time that are not accessible to the public and are in compliance with § 3203

Note the conjunctions in that last one. Under ten employees and not accessible to the public and compliant with the IIPP requirement. A ten-person retail shop is not exempt — and neither is a ten-person back office, because the threshold is fewer than ten. A nine-person back office with no public access is. And the Division can require an otherwise-exempt employer to comply through a special action order.

The four requirements

1. A written Workplace Violence Prevention Plan

Must be written, available at all times to employees, their representatives and Division officials, and may be standalone or folded into your existing IIPP.

Thirteen required elements, including: names and job titles of responsible persons; procedures for active employee and representative involvement in hazard identification, evaluation and correction, training design, and incident reporting; coordination with other employers at the site; procedures to accept and respond to violence reports prohibiting retaliation; procedures ensuring supervisory and non-supervisory compliance; training development and delivery; hazard identification and evaluation including periodic inspections; timely hazard correction; post-incident response and investigation; and effectiveness review at least annually, when deficiencies appear, and after an incident.

Two elements matter more than the rest for anyone with isolated workers:

§ 6401.9(c)(2)(F) — communication procedures covering how an employee can report a violent incident, threat, or concern to the employer or law enforcement without fear of reprisal.

§ 6401.9(c)(2)(G) — emergency response procedures, which must cover:

• (i) “Effective means to alert employees of the presence, location, and nature of workplace violence emergencies”
• (ii) evacuation and sheltering plans
• (iii) “How to obtain help from staff assigned to respond to workplace violence emergencies, if any, security personnel, if any, and law enforcement”

We’ll come back to those two clauses, because they are where most of the misreading happens.

2. A Violent Incident Log

Required for every workplace violence incident, with personal identifying information omitted. It must record the date, time and location; the workplace violence type or types; a detailed description; a perpetrator classification; a circumstances classification; a location classification; the incident type; the consequences including law enforcement contact and protective actions; and the name, job title and date of the person completing the log.

The statute’s own circumstances classification list is worth reading if you employ lone workers. It includes: usual duties, poorly lit area, rushed, low staffing, “isolated, unable to get help,” community setting, and unfamiliar location.

California put “isolated, unable to get help” on the statutory log as an enumerated circumstance. That’s the state naming the exposure in regulation.

At multiemployer sites, the employer whose employee was involved records the log and provides it to the controlling employer.

3. Training

Initial and annual, in appropriate content, vocabulary, educational level, literacy and language. Required topics: the employer’s plan and how to access it; the definitions and requirements of § 6401.9; reporting procedures without fear of retaliation; job-specific workplace violence hazards, corrective measures, assistance resources, and harm-avoidance strategies; the violent incident log and how to access records; and an interactive question-and-answer session with a person knowledgeable about the plan.

That last requirement rules out a pure video module. Additional training is required for newly identified hazards and plan changes.

4. Recordkeeping

All available to the Division on request. The first three categories must be made available to employees and their representatives free of charge within 15 calendar days of a request.

The four types of workplace violence

§ 6401.9(a) defines the categories your plan and log must use:

• Type 1 — violence by a person with no legitimate business at the worksite (criminal intent)
• Type 2 — violence directed at employees by customers, clients, patients, students, inmates or visitors
• Type 3 — violence against an employee by a present or former employee, supervisor or manager
• Type 4 — violence by a person who does not work there but has a known personal relationship with an employee

“Threat of violence” is defined broadly enough to include texts, electronic messages, social media messages and online posts, not just in-person conduct.

Does SB 553 require panic buttons? No.

This deserves a direct answer, because a lot of vendor marketing says otherwise.

§ 6401.9 contains no device mandate, no reference to alarms, and no reference to panic buttons. The two clauses people point to say something narrower than they’re often quoted as saying:

§ 6401.9(c)(2)(G)(i) — “Effective means to alert employees of the presence, location, and nature of workplace violence emergencies.” Read the direction of travel: this runs inbound to employees. It is a mass-notification duty — telling the workforce that an emergency exists — not a duty to give each employee a device to summon help.

§ 6401.9(c)(2)(G)(iii) — “How to obtain help from staff assigned to respond to workplace violence emergencies, if any, security personnel, if any, and law enforcement.” This is a procedural requirement: the plan must explain how employees get help. And note the twice-repeated “if any” — the statute doesn’t even require you to have responders or security personnel at all.

The accurate statement: SB 553 requires employers to have effective means to alert employees to an emergency and written procedures for how employees obtain help. It is technology-neutral. A panic button is one reasonable way to satisfy (c)(2)(G) and to control a hazard identified under the plan’s hazard identification and correction provisions — but it is a compliance option, not a compliance requirement.

Any marketing that says “SB 553 requires panic buttons” is inaccurate, and a compliance officer will know it.

The healthcare standard is the one that actually names devices

If your operation falls under 8 CCR § 3342 — the healthcare workplace violence standard, effective April 1, 2017 — you are in a materially different regulatory position. § 3342 covers health facilities, home health care and home-based hospice, emergency medical services and medical transport, drug treatment programs, and outpatient medical services in correctional settings.

And § 3342 is device-forward in a way § 6401.9 is not:

• Its definition of “alarm” is “a mechanical, electrical or electronic device that does not rely upon an employee’s vocalization in order to alert others.” That definition alone tells you what the drafters were thinking about.
• Its definition of “engineering controls” expressly includes personal alarm devices, alongside electronic access controls, weapon detectors, enclosed workstations, CCTV and sight-aids.
• § 3342(c)(11)(G) requires “installing, implementing, and maintaining the use of an alarm system or other effective means by which employees can summon security and other aid to defuse or respond to an actual or potential workplace violence emergency.”
• § 3342(c)(11)(B) — the line-of-sight provision: employers must provide line of sight or other immediate communication in all areas where patients or the public may be present, and “where patient privacy or physical layout prevents line of sight, alarm systems or other effective means shall be provided for an employee who needs to enter the area.”
• § 3342(c)(9)(A) requires the environmental risk assessment to evaluate “obstacles and impediments to accessing alarm systems” and identify “locations within the facility where alarm systems are not operational.”
• § 3342(e)(2) requires the annual review to evaluate the sufficiency of security systems including alarms.
• § 3342(f)(1)(A)(4) requires initial training to cover how to recognize alerts and alarms.

The contrast is the point. § 3342 requires an alarm system or other effective means by which employees can summon aid, and names personal alarm devices as an engineering control. § 6401.9 does neither.

Be precise about § 3342 too, though: (c)(11)(G) is one of a menu of corrective measures applied where the hazard assessment identifies the need. It is not a flat mandate that every covered worker be issued a device.

The rulemaking is behind schedule — and that matters

SB 553 set a two-step timeline: the Division must propose standards by December 31, 2025, and the Standards Board must adopt by December 31, 2026.

As of August 2026, the Occupational Safety and Health Standards Board’s Proposed Regulations page lists four active proposals — petroleum refinery process safety management, first aid, elevators for hoisting workers, and elevator safety orders. There is no workplace violence prevention proposal. Cal/OSHA’s own workplace violence page still describes the effort as at the advisory meeting and draft regulation stage.

So: the statute is enforceable today by its own terms; the implementing regulation has missed its statutory proposal deadline and, on the public record, has not been formally noticed. Meeting the December 31, 2026 adoption deadline would require a compressed process.

Why it matters for planning: the general industry standard is likely to be modeled on § 3342, which is the state’s existing template. Employers with isolated workers should assume the eventual regulation will be more prescriptive about summoning aid than the statute is, and should watch the rulemaking rather than treating current statutory compliance as the endpoint.

One more thing SB 553 did

It amended Code of Civil Procedure § 527.8 so an employer or a collective bargaining representative may petition for a temporary restraining order and injunction on behalf of an employee who has suffered harassment, unlawful violence, or a credible threat of violence.

Adding harassment alone — defined as a knowing and willful course of conduct that seriously alarms, annoys or harasses — was the change, and it became operative January 1, 2025.

A procedural condition worth knowing: before filing, the employer must give the affected employee an opportunity to decline to be named in the order.

How other states compare

New York — Retail Worker Safety Act, Labor Law § 27-e. This one does mandate a device, and the details changed after enactment. It covers New York employers with 10 or more employees at retail stores selling goods directly to consumers (restaurants excluded). Policy and training obligations took effect June 2, 2025. The device provision takes effect January 1, 2027 and applies to retailers with 500 or more employees statewide.

Critical correction, because the superseded version is still widely cited: the original law required a panic button that would “immediately contact 911 and dispatch local law enforcement.” A chapter amendment signed February 14, 2025 removed that and replaced it with a silent response button that “must request immediate assistance from a security officer, manager, or supervisor in case of emergency.” Internal responders, not 911. Any article or sell sheet describing the New York law as a 911-dispatch mandate is citing the old version.

Washington — RCW ch. 49.19 requires healthcare workplace violence prevention plans addressing “security systems, alarms, emergency response, and security personnel” and staffing patterns and procedures to limit employees working alone in high-risk areas. It does not mandate personal alarm devices — alarms are a required subject of assessment, not a prescribed control. Separately, Washington’s RCW 49.60.515 is the most device-explicit U.S. state statute currently in force, requiring panic buttons for isolated employees of hotel, motel, retail, security guard and property services employers.

Federally, there is no OSHA workplace violence standard. Enforcement is through the General Duty Clause and directive CPL 02-01-058 (January 10, 2017), which targets corrections, healthcare and social services, late-night retail, and taxi/livery.

The practical takeaway

If you’re a California general industry employer: you needed a written plan, a violent incident log, initial and annual interactive training, and the four record categories as of July 1, 2024. Those are enforceable now. You do not need a panic button to comply — but “isolated, unable to get help” is an enumerated circumstance on the state’s own incident log, and if your hazard assessment identifies isolated workers and you take no corrective measure, that is a documented gap sitting in your own records.

If you’re a California healthcare employer under § 3342: the alarm requirements are already explicit, and they’ve been in force since 2017.

And if you’re planning capital budgets: watch the general industry rulemaking. The template it’s most likely to follow is the one that names personal alarm devices.

Visit https://www.dir.ca.gov/dosh/Workplace-Violence.html for workplace violence prevention educational materials and other resources including fact sheets and fillable written safety plans.

This article is general information, not legal advice. It was drafted with the assistance of AI which can make mistakes. You should consult with a lawyer or the enforcing agency before making compliance decisions.

Grace Industries has been protecting lone workers for over 50 years, offering a wide variety of solutions for commercial and industrial applications.

MicroCELL^® is a 1.9-ounce, IP67-rated wearable that acts as a monitored personal emergency transmitter. It features custom scheduled check-ins, a dedicated one-touch SOS button, configurable fall detection and no-motion alarm, and GPS location reported with alerts. Available on a voice or data plan, it connects over 4G LTE to Grace Cloud Connect^® web and mobile apps. There, alerts escalate to multiple recipients based on your custom protocols. Every check-in, alert, and escalation is automatically logged into a timestamped activity history.

For harsher environments and those requiring specialized protection, SuperCELL^® (intrinsically safe) and WorkForce^® wearables also integrate seamlessly with Grace Cloud Connect^®. They share many of the same advanced features and functionality of MicroCELL^® but communicate with the cloud via a secure RF platform and a Gateway.

To learn more about MicroCELL^®, SuperCELL^®, WorkForce^®, and Grace Cloud Connect^®, visit graceindustries.com or contact us at 1-724-962-9231 or sales@graceindustries.com.