Workplace Violence Prevention Mandate Compliance · Last Updated April 2026 · aspppro.com
What do workplace violence prevention mandates require from employers in 2026?
Forty-eight states changed HR compliance requirements in 2026. Workplace violence prevention mandates now cover virtually every California employer, retail workers in New York, healthcare organizations across more than twenty states, and general industry employers in jurisdictions that are finalizing OSHA standards before December 31, 2026. The question is no longer whether your organization must act — that question has been answered by law. The question is whether the program you build will actually prevent violence, or simply perform compliance until something happens anyway. The PRO Model™ by Active Shooter Prevention Project, LLC builds prevention that satisfies mandates and protects people. aspppro.com/contact-us
By Chris Grollnek ·
Nation’s Leading Active Shooter Prevention Expert ·
Founder, Active Shooter Prevention Project, LLC ·
aspppro.com ·
Last updated April 2026
There is a folder sitting on a desk somewhere in America right now, inside a law firm, an HR department, or the office of a general counsel, and it has your organization’s name on it.
It arrived because a mandate did.
Forty-eight states changed HR compliance requirements in 2026. Workplace violence prevention is no longer a best practice conversation. It is a legal obligation that includes deadlines, documentation requirements, annual training mandates, incident logs, site-specific plan requirements, and, in some states, fines that quadruple when an incident occurs and the training was not completed.
The question your organization needs to answer is not whether to comply. That question has been answered for you by the legislature of your state. The question is what kind of compliance you are going to build, the kind that puts a binder on a shelf and waits for an audit, or the kind that actually prevents violence and happens to satisfy every mandate along the way.
Those are not the same thing, and the difference between them is the difference between compliance theater and genuine prevention.
“The question is not whether to comply. That has been answered by the legislature of your state. The question is whether what you build will actually protect people or just perform compliance until something happens anyway.”
~ Chris Grollnek | Active Shooter Prevention Project, LLC | aspppro.com
What the Mandate Landscape Looks Like Right Now
The pace at which state legislatures have moved on workplace violence prevention in the past two years should tell every HR director and general counsel in America something important: this is not a trend. This is a permanent shift in how the law defines employers’ safety responsibilities.
California led the way. Senate Bill 553 took effect July 1, 2024, and covers virtually every employer in the state. It requires a written, site-specific Workplace Violence Prevention Plan, not a template downloaded from the internet, but a plan built around actual workplace conditions, specific hazards, and real reporting procedures. Cal/OSHA is now in year two of enforcement, and the standard is clear that generic off-the-shelf plans are insufficient. Regulators are assessing whether a plan exists, whether it is site-specific, whether it has been implemented in practice, and whether the documentation supports all of it. If an incident occurs and the training was not done, the fines quadruple. Penalties range from $25,000 for serious violations to $158,727 for willful violations.
California is not alone.
California – SB 553 – Effective July 1, 2024
Covers virtually all California employers. Requires a written site-specific Workplace Violence Prevention Plan, interactive annual training, and detailed incident logs retained for five years. Cal/OSHA finalizing comprehensive general industry standard by December 31, 2026. Penalties up to $158,727 for willful violations quadrupled if the incident occurs without completed training.
New York — Retail Worker Safety Act — Effective January 2026
Requires retail employers with ten or more employees to adopt a workplace violence prevention policy, provide annual training, and develop site-specific prevention plans. Fines up to $10,000 for non-compliance. New York has set the standard for retail sector mandates that other states are already following.
Oregon — SB 537 — Effective January 2026 / Full Implementation July 2026
Healthcare organizations are under a sweeping new standard requiring safety committees, annual employee training, incident data tracking and reporting to state regulators, and enhanced emergency department protections. Oregon OSHA is moving to formal rulemaking that will extend requirements beyond healthcare.
Washington — HB 1162 — Effective January 1, 2026
Healthcare employers must implement workplace violence prevention plans with input from committees, conduct timely incident investigations, and submit annual reviews. The bill passed with unanimous legislative support, a signal of where the broader compliance environment is heading nationally.
Colorado — Hospital Violence Prevention — Effective July 1, 2026
Healthcare organizations in Colorado face a July 2026 implementation deadline for comprehensive workplace violence prevention programs. Organizations that have not started building compliant infrastructure now are already operating against the clock.
Federal OSHA — General Industry Standard — December 31, 2026 Deadline
The Cal/OSHA Standards Board is required to adopt a comprehensive general industry workplace violence prevention standard by December 31, 2026. Federal momentum continues to build. The Workplace Violence Prevention for Health Care and Social Service Workers Act advances in Congress with bipartisan support. The federal floor is rising.
Beyond these specific laws, 48 states changed HR compliance requirements in 2026. The ADP annual compliance report documents the scope of what employers are now required to navigate. Workplace violence prevention sits at the center of that landscape.
The Problem With Compliance Theater
Here is what compliance theater looks like in practice. An HR director downloads a template from the internet, fills in the company name, schedules a one-hour training session that nobody takes seriously, and files the documentation. The binder sits on a shelf. The box is checked. The organization moves on.
Then something happens.
And in the aftermath of the lawsuit, in the OSHA investigation, in the news coverage, every one of those shortcuts becomes evidence. The generic plan was never site-specific. The training that was scheduled but not documented was interactive. The incident log was never maintained. The reporting system that nobody used because nobody trusted it.
Cal/OSHA has made this explicitly clear in its enforcement guidance for 2026: regulators are not just asking whether a plan exists. They are asking whether it was implemented in practice. Whether the hazard assessments were specific to actual workplace conditions. Whether training was interactive and job-specific. Whether documentation was maintained and retained. Generic plans are insufficient. A template is not a program. A binder on a shelf is not prevention.
And more importantly, a binder on a shelf does not protect anyone.
The organizations that get this right are the ones that understood from the beginning that compliance is the floor, not the ceiling. They built a prevention infrastructure that happens to satisfy every mandate because genuine prevention always does.
Compliance Theater
Downloaded template · Generic plan · One-hour check-box training · Binder on a shelf · No reporting culture · No threat assessment · No documentation · Exposed when something happens
The PRO Model™
Site-specific plan · Behavioral threat assessment · Anonymous reporting culture · Interactive training · Maintained documentation · Incident logs · Mandate-ready · Three documented saves
What the Law Actually Requires — And Why It Matters
Across the state mandates that are now in effect, several requirements appear consistently, and they are worth understanding precisely because they define the difference between a compliant program and a liability.
Every major mandate requires a written, site-specific plan. Not a template. A plan that identifies actual hazards at your specific location, names specific reporting procedures, defines specific response protocols, and is reviewed and updated at least annually. The site-specificity requirement is the one that most organizations get wrong when they start with a template, and it is the one that regulators examine most closely when an incident occurs.
Every major mandate requires interactive annual training. Not a video employees click through at their desks. Training that allows for questions, discussion, and demonstration to ensure that employees understand site-specific risks and response procedures. Training records must be retained in California for a minimum of one year, and incident logs for a minimum of five years.
Every major mandate requires a reporting system that protects employees from retaliation. This is where most organizations have the largest gap. Research consistently shows that sixty-eight percent of workplace violence incidents are reported to employers who then handle them poorly, and fifty percent of reports result in no action at all. A reporting system that nobody trusts is not a reporting system. It is a liability.
And every major mandate requires a process for hazard assessment, corrective action, and continuous improvement. A plan that was written once and never updated is not compliant under any current standard. Prevention is not a one-time event. It is an ongoing discipline and the mandates reflect that.
States with HR compliance changes in 2026 — workplace violence at the center
Fines quadruple in California if incident occurs and training was not completed
Maximum willful violation penalty under California SB 553
PRO Model™ documented saves — real organizations where prevention worked
What Genuine Prevention Looks Like – And Why It Satisfies Every Mandate
The PRO Model™ Prevention. Response. Options. was adopted by the U.S. Department of Justice and the U.S. Department of Defense because it works. Not because it checks boxes. Because it prevents violence. And because genuine prevention, built the right way, satisfies every compliance requirement that exists and every requirement that is coming.
Here is why. Every state mandate that requires a site-specific plan requires what the PRO Model™ builds by design: a prevention infrastructure tailored to your organization’s specific environment, workforce, risk profile, and physical layout. Not a template. A prescription.
Every mandate that requires interactive annual training requires what the PRO Model™ delivers — training that is practical, calm, and built around the actual scenarios and behavioral warning signs that are specific to your industry and your people. Training that gives every employee the language and the pathway to say something when they see something, without fear of being dismissed or penalized.
Every mandate that requires a reporting system free from retaliation requires what the PRO Model™ builds at its foundation, an anonymous reporting culture where the people closest to emerging threats feel safe and empowered to act before those threats reach an irreversible point. That culture does not come from a policy statement. It comes from training, from leadership modeling, and from a system that consistently demonstrates that reports are taken seriously and acted upon.
And every mandate that requires documentation, incident logs, corrective action records, and annual reviews requires the infrastructure that genuine prevention creates naturally, because when prevention is working, the documentation is evidence of a living program, not a compliance exercise performed for an auditor.
“Every state mandate that requires a site-specific plan requires what genuine prevention builds by design. Compliance is not the destination; it is what happens when you build prevention the right way.”
~ Chris Grollnek | Active Shooter Prevention Project, LLC | aspppro.com
What Documented Prevention Looks Like
The PRO Model™ has three documented saves. Three real organizations where the infrastructure was in place before the threat arrived, and because it was, the threat never became an event.
The first was a manufacturing facility where a domestic threat arrived armed with grenades and a firearm. Access control kept the threat outside. Nobody was harmed. The PRO Model™ physical security layer did exactly what it was designed to do: it made the building a harder target than the threat was prepared for.
The second was a corporate environment where a felon planned a full attack and cased the facility for two weeks. An anonymous report led to an arrest. The suspect is in prison. The PRO Model™ reporting culture did what no policy statement can do on its own: it gave an employee the confidence and the pathway to say something before it was too late.
The third was a service company where an individual threatened employees and had a kill list. The PRO Model™ reporting culture combined with a four-layer physical security solution gave the organization the time and the information to act. Everyone went home.
Three saves. Three organizations that built the infrastructure before they needed it. That is what every mandate is trying to create, and that is what the PRO Model™ delivers.
“The mandate is the floor. Prevention is the destination. Build the infrastructure that gets your people to #NEVERHERE™.”
~ Chris Grollnek | Active Shooter Prevention Project, LLC
#NEVERHERE™ · aspppro.com
The Road to #NEVERHERE™ – Continue Reading
Post #1 — Prevention Always Beats Response
Post #2 — Who Is Chris Grollnek
Post #3 — Experts Behind Every Solution
Post #4 — Prevention Proven Three Times
Post #5 — Storytellers Choose Truth Now
Post #6 — Corporate Americas Blind Spot
History Cannot Be Ignored — The Good Guys Crisis 35 Years Later
Post #7 — Healthcare Cannot Afford Reactive
Destination #NEVERHERE™ — Learn More
Download the 2026 ASPP White Paper
Active Shooter Prevention Project, LLC · aspppro.com
Your Mandate Deadline Is Real.
Your Prevention Program Should Be Too.
The PRO Model™ builds the site-specific prevention infrastructure that satisfies every mandate requirement and actually protects your people. The Community of Experts includes behavioral scientists, threat assessment professionals, legal compliance specialists, and physical security experts ready to build a program around your organization, not a template.
aspppro.com · Active Shooter Prevention Project, LLC · Available in 28 States & 4 Countries
Frequently Asked Questions — Workplace Violence Prevention Mandate Compliance
What workplace violence prevention mandates apply to my organization in 2026?
The answer depends on your state, your industry, and your workforce size. California SB 553 covers virtually all employers in the state, regardless of industry. New York’s Retail Worker Safety Act covers retail employers with ten or more employees. Oregon SB 537 and Washington HB 1162 both took effect January 1, 2026, for healthcare organizations. Colorado’s hospital violence prevention requirements take effect July 1, 2026. Federal OSHA is advancing both healthcare-specific and general industry standards with growing Congressional support. Forty-eight states changed HR compliance requirements in 2026 — organizations should verify current requirements in their state and build compliance-ready prevention infrastructure now, before the deadline, rather than after it.
What are the penalties for failing to comply with workplace violence prevention laws?
Penalties vary by state and violation type. In California, under SB 553, serious violations carry penalties up to $25,000, and willful violations up to $158,727. Critically, if a workplace violence incident occurs and the required training was not completed, those fines quadruple. New York’s Retail Worker Safety Act carries fines up to $10,000 for non-compliance. Beyond regulatory fines, organizations that fail to comply face civil liability exposure when incidents occur — and plaintiff attorneys are increasingly using non-compliance with workplace violence prevention mandates as evidence of employer negligence. The financial case for genuine prevention has never been stronger.
What is the difference between compliance theater and genuine workplace violence prevention?
Compliance theater is a generic template downloaded from the internet, filled with the company name, submitted for the file, and forgotten. Genuine prevention is a living program — built from a site-specific hazard assessment, an anonymous reporting culture that people actually use, behavioral threat assessment capability, interactive training that employees remember, and documentation that reflects a program being practiced rather than performed. Cal/OSHA’s 2026 enforcement guidance makes this distinction explicit: regulators are examining whether plans are site-specific, whether training was interactive, whether documentation was maintained. Generic plans are insufficient. The distinction matters legally, operationally, and for the safety of every person in your organization.
What does a site-specific workplace violence prevention plan require?
A site-specific plan identifies actual hazards at your specific location, not generic risks, but the specific conditions, populations, workflows, and environmental factors that create risk at your facility. It names specific individuals responsible for implementation. It establishes specific reporting procedures that your employees actually understand and can use. It defines specific emergency response protocols appropriate to your floor plan and workforce. It is reviewed and updated at least annually and after any incident. Organizations with multiple locations must create a site-specific plan for each location. This is where most template-based approaches fail, a template cannot assess your specific site because it was never there.
Does the PRO Model™ satisfy current state workplace violence prevention mandate requirements?
Yes, because the PRO Model™ builds genuine prevention, and genuine prevention satisfies every compliance requirement by design. The PRO Model™ produces a site-specific plan built around your actual workplace conditions. It delivers interactive training that is documented and retained. It builds an anonymous reporting system that employees trust and use. It establishes a behavioral threat assessment capability and a multidisciplinary response team. It creates the documentation infrastructure that regulators examine during audits. The PRO Model™ was adopted by the U.S. Department of Justice and the U.S. Department of Defense. It was built to the highest standard, which means it exceeds every state mandate currently in effect.
How long does it take to build a compliant workplace violence prevention program?
The timeline depends on your organization’s current state and deadline requirements. For organizations with an immediate mandate deadline, the Active Shooter Prevention Project, LLC works with leadership to prioritize the elements regulators examine first: the written site-specific plan, training documentation, and reporting infrastructure, while building the deeper prevention culture in parallel. For organizations building proactively before a mandate arrives, the full PRO Model™ implementation typically unfolds in layers over a period that ensures genuine adoption rather than performance. The right time to start is always before the deadline. Contact us at aspppro.com/contact-us to discuss your specific timeline.
Before You Hire Anyone
Questions that protect your organization and its people when comparing workplace violence prevention vendors.
How do I know if a workplace violence prevention company is building genuine prevention or just selling compliance paperwork?
Ask them one question: how many documented saves do they have? A save is not a good review. A save is not a completed training session. A save is a real incident that was intercepted before violence occurred, with a timeline, with specifics, and with law enforcement involvement. The Active Shooter Prevention Project, LLC has three. Real organizations. Real threats. Real people who went home. If a company cannot answer that question with specifics, what they are selling is compliance documentation with a prevention label on it. For your people, the difference is everything.
What should I ask a workplace violence prevention vendor before signing a contract?
Ask whether they conduct site-specific hazard assessments or work from templates. Ask whether their training is interactive and job-specific or a standard video module. Ask whether they have experience with your industry’s specific mandate requirements. Ask what documentation they provide and in what format, and whether it meets the retention requirements of your state. Ask what happens after the engagement end:s is there infrastructure left behind, or just a binder? Ask about their track record with regulatory audits. And ask about documented outcomes. The PRO Model™ was built to answer every one of those questions with specifics, not marketing language.
Our organization already has a workplace violence prevention policy. Does that mean we are compliant?
Not necessarily, and this is the most important distinction for HR directors and general counsel to understand. A policy is a statement of intent. Compliance requires an implemented, site-specific program with documentation of training, incident logs, hazard assessments, and corrective actions. Cal/OSHA’s 2026 enforcement guidance is explicit: having a policy is not the same as having a compliant program. If your policy was not built around site-specific hazard assessments, if training has not been conducted interactively and documented, if you do not have a functioning anonymous reporting system, and if your records do not demonstrate ongoing implementation, you are not compliant regardless of what the policy says.
What is the liability exposure for organizations that have a workplace violence incident without a compliant prevention program?
The exposure is significant and growing. Beyond regulatory fines, which in California quadruple when an incident occurs without completed training, organizations face civil liability in negligence claims where plaintiffs argue the employer failed to take reasonable steps to prevent foreseeable workplace violence. Plaintiff attorneys are increasingly using non-compliance with state workplace violence prevention mandates as evidence of that failure. Courts have awarded substantial damages in cases where employers had documented warnings they did not act on, generic plans that were never implemented, or reporting systems that employees did not trust. The legal case for genuine prevention has never been more compelling.
We operate in multiple states with different requirements. How do we manage that complexity?
This is one of the most common challenges facing multi-state employers right now, and it is exactly where the PRO Model™ framework provides its greatest value. Rather than building a separate compliance program for each state, which quickly becomes unmanageable, the PRO Model™ builds a prevention infrastructure that meets the highest standard in effect across your footprint, then adapts the site-specific components for each location. The result is a unified prevention culture, with location-specific documentation that meets every jurisdiction’s requirements. The Active Shooter Prevention Project, LLC operates across 28 states and 4 countries. Managing multi-state complexity is not the exception for us, it is the standard engagement.
Where do we start if we have a mandate deadline approaching and no program in place?
Start by contacting the Active Shooter Prevention Project, LLC at aspppro.com/contact-us today. The first conversation is an assessment of your current state, what exists, what your deadline requires, and what the fastest path to genuine compliance looks like for your organization. From there, the PRO Model™ is implemented in a sequence that addresses your most urgent regulatory requirements first while building the prevention culture that makes compliance sustainable. Do not wait for the deadline to pass. Do not wait for an incident to trigger the conversation. Start now because the people in your organization deserve a program that was built before it was needed, not after.
PRO Model™ and #NEVERHERE™ are trademarks of Active Shooter Prevention Project, LLC. All rights reserved.
© Active Shooter Prevention Project, LLC · aspppro.com
Chris Grollnek is the nation’s leading active shooter prevention expert and Google’s #1 ranked authority on active shooter prevention.
The PRO Model™ has been adopted by the U.S. Department of Justice and the U.S. Department of Defense.
Mandate and compliance information cited in this post is current as of April 2026. Laws and enforcement guidance change frequently — organizations should verify current requirements in their jurisdiction and consult qualified legal counsel regarding specific compliance obligations. This content is educational in nature and does not constitute legal advice. Active Shooter Prevention Project, LLC is a prevention training and consulting organization, not a law firm.
Share this article
Written by : Chris Grollnek
Chris Grollnek, M.S. is the nation's leading active shooter prevention expert and Google's #1 ranked authority on the phenomenon of active shooters. A former U.S. Marine and retired police detective, Chris survived a real-time active shooter event in 2010 an experience that redirected his postgraduate studies and launched a mission that has never stopped. He is the founder of Active Shooter Prevention Project, LLC and creator of the DOJ and DOD adopted PRO Model™ — Prevention. Response. Options. He has testified before the U.S. Senate and Congress, consulted for three U.S. Presidents, briefed the Under Secretary of Defense, and delivered the national active shooter prevention standard to all 115,000 U.S. Department of Justice personnel. He has been called upon by the Center for Strategic and International Studies in Washington D.C. and serves as a consultant to the Mackenzie Institute. Featured in Time Magazine, BBC, CNN, Fox News, Russia Today, France 24, and every major U.S. network. Keynote speaker at the World Police Summit in Dubai. Expert witness in Parkland and multiple federal cases. Author of the national standard. Champion of #NEVERHERE™ the destinatio
Latest articles
April 15, 2026
April 15, 2026
April 15, 2026
