Short answer: Labor Code 6401.9 has been in effect and enforceable since July 1, 2024, and the exemption most small shops assume covers them is about public access first and headcount second. It is scored per location, not per company. Cal/OSHA’s pending standard would tighten the headcount half of that test from a snapshot into a 365-day lookback.
Public access comes before headcount
Labor Code section 6401.9(b)(1) applies to “all employers, employees, places of employment, and employer-provided housing.” This is not a healthcare-only rule. Healthcare is covered separately under Title 8 section 3342.
The small-employer exemption sits in Labor Code section 6401.9(b)(2)(F). It covers a place of employment only when all three of these are true:
- There are less than 10 employees working there at any given time.
- The place is not accessible to the public.
- The place is in compliance with Title 8 section 3203, the Injury and Illness Prevention Program, or IIPP.
Miss one and the exemption does not apply.
A four-person shop inside a gated yard that the public cannot walk into generally clears the public-access and headcount parts. The third condition is the one that quietly fails. A shop with no written IIPP does not get the exemption at all, and a missing written program is a citable condition on its own, which is worth understanding alongside the rest of your Cal/OSHA penalty exposure.
This is one more written-program obligation of the kind that already follows your crew into an attic under the indoor heat rules. Like the workers’ comp requirement now running toward its 2028 deadline, it arrives whether or not you employ anyone whose job is safety.
The exemption follows the place, not your company
The statute tests each “place of employment.” It never asks whether your company has fewer than 10 people on the payroll.
Your places of employment include the locations where your crew actually works. That is what changes the answer on service calls and occupied projects.
You may be under 10 at the gated yard. That same crew working inside an occupied retail store is standing in a place of employment that is accessible to the public, and the exemption does not reach it. The same goes for a grocery store, an apartment building lobby, or a school during business hours.
That is also where the realistic risk sits. Type 2 violence is directed at employees by customers, clients, patients, students, inmates, or visitors. It is the category that fits the customer who turns on you when the invoice lands, the tenant standing there during a shutoff, and the stranger who walks up at a service call.
The other three types still count. Type 1 is a person with no legitimate business at the worksite, including robbery and other crimes by outsiders. Type 3 is a present or former employee, supervisor, or manager. Type 4 is someone who does not work there but has, or is known to have had, a personal relationship with an employee.
A covered place needs a written plan employees can reach
Labor Code section 6401.9(c)(1) requires an employer to “establish, implement, and maintain an effective workplace violence prevention plan.” It must be in writing and available and easily accessible to employees.
The required elements include the names and titles of the people responsible for implementing it, procedures for active involvement of employees and authorized employee representatives, and the methods you will use to coordinate the plan with other employers. It also needs procedures for employee compliance, communication and training, hazard identification and correction, incident response and report acceptance, prohibiting retaliation, post-incident response and investigation, and periodic review and revision.
That last part is the same trap other contractor paperwork sets. A program has to be written against the right Title 8 section, not left as an informal instruction living in the owner’s head.
Every incident needs a log
Labor Code section 6401.9(d) requires a violent incident log for every workplace violence incident.
The log records the date, time, and location, the violence type, a detailed description, and a classification of who committed it, such as a client, customer, stranger, coworker, supervisor, or family member. It records the circumstances, such as usual duties, poor lighting, rushed work, low staffing, or working alone. It states whether the incident happened at the workplace, in a parking lot, or elsewhere, and identifies the incident type, such as a physical attack without a weapon, an attack with a weapon, a threat, sexual assault, or animal attack. It records the consequences, whether security or law enforcement was contacted, what protective actions were taken, and who completed the log, with job title and date.
Leave out personal identifying information sufficient to identify anyone involved. That means no names, addresses, email addresses, phone numbers, or social security numbers.
Initial training is required when the plan is first established and annually after that under Labor Code section 6401.9(e)(2). You owe additional training when a new or previously unrecognized hazard is identified and when the plan changes. Cal/OSHA’s general industry guidance sets a five-year minimum for hazard identification, evaluation, and correction records, for violent incident logs, and for incident investigation records. Training records carry a one-year minimum.
The pending standard would look back 365 days
The statute today uses a snapshot. It asks whether there are less than 10 employees working at the place “at any given time.”
The July 22, 2026 revised draft standard, numbered section 3343, asks something harder. Its Exception 6 covers places of employment not accessible to the public where the employer “has less than a total of 10 employees at the place of employment at all times during the preceding 365 days” and is in compliance with section 3203.
That is a real tightening. One busy stretch last year that put 10 or more people at that location would push you outside the exception for the whole lookback, even if you are at four people today.
The draft is not in effect and no final standard has been adopted. Labor Code section 6401.9(h) required the Division to propose a standard by December 31, 2025 and requires the Standards Board to adopt one no later than December 31, 2026. Attorneys tracking the rulemaking expect a Board vote in fall or winter 2026, but that timing is not settled. The December 31, 2026 deadline is the firm date.
Three other pieces of the draft matter to an electrical sub. Exception 6 does not apply to security services, janitorial services, or domestic work employees under Labor Code section 1451. The Division may require an exempt employer to comply anyway through an Order to Take Special Action, so exempt is not permanently exempt. And at a multi-employer worksite, the employer whose employees experienced the incident records it in the log and provides a copy to the controlling employer, which puts a reporting line between you and the general contractor.
The draft also writes texts, electronic messages, social media messages, and other online posts directly into the definition of a threat of violence, and its post-incident procedures include offering individual trauma counseling. Counseling through workers’ compensation, an employee assistance program, or initial counseling you offer satisfies that.
What to do this month
List every place your employees work, not just the yard. For each one, mark whether the public can get in, whether 10 or more people are ever there at once, and whether your IIPP is current. Do not mark the whole company exempt off shop headcount alone.
Where a location is covered, put the plan in writing, name the people responsible, and make it something a crew member can actually pull up. Set the log up before you need it, schedule the initial and annual training, and hold the records for the retention periods above. Then watch the rulemaking into December, because if the 365-day test survives into the adopted standard, the exemption question stops being about who is on the truck today.
