A workplace violence prevention plan (WVPP) is the written program that says how your organization prevents, responds to, and learns from violence at work – and 2026–2027 is the period when it stops being optional for many US employers: California enforces its plan requirement and finalizes a formal standard by the end of 2026, Washington’s isolated-worker law took effect in January 2026, and New York’s silent response button arrives in January 2027. This guide covers the seven elements reviewers expect, the state-by-state timeline, and where alerting technology honestly fits.
If an employee pressed a panic button in your building today, would everyone nearby know what happens next? That gap – between a device and a rehearsed response – is what the new laws are really regulating.
Table of contents
1. What is a workplace violence prevention plan?
2. The seven elements of a WVPP
3. The 2026–2027 compliance timeline by state
4. Panic buttons and silent response buttons: what the laws actually ask for
5. Beyond the button: the communication layer of the plan
A workplace violence prevention plan is a written, site-specific program that identifies violence risks in your workplace, defines the controls and response procedures that address them, names who is responsible, and sets the training and recordkeeping that keep the plan alive. It covers the spectrum from threats and harassment through physical assault, whether the source is a stranger, a customer, a coworker, or a personal relationship that follows an employee to work.
Who requires one today: California requires a written WVPP from most employers under SB 553 – enforceable since July 1, 2024. At the federal level there is no general OSHA workplace-violence standard: OSHA enforces serious hazards through the General Duty Clause and publishes guidance and industry resources. Other states regulate specific sectors and scenarios – the timeline below covers the three that matter most in 2026–2027.
Across Cal/OSHA’s requirements, OSHA’s guidance, and the state laws, the same seven elements keep appearing. A reviewer – regulator, insurer, or auditor – will look for each:
Three state regimes define the current wave. Dates and thresholds below are as published by the regulators; confirm applicability for your organization with counsel.
| Jurisdiction | Who is covered | What is required | In force |
|---|---|---|---|
| California – SB 553 (Labor Code 6401.7/6401.9) | Most California employers; limited exceptions (e.g., worksites with fewer than 10 employees not open to the public, and employees teleworking from a location of their choice) | Written site-specific WVPP, annual interactive training, violent-incident log; penalties up to $162,851 for willful/repeat violations | Enforceable since Jul 1, 2024; Cal/OSHA formal general-industry standard due by Dec 31, 2026 |
| Washington – HB 1524 | Hotels, motels, retail, security-guard entities, property services contractors with isolated employees (≥ half of hours alone, or where coworkers cannot immediately respond) | Panic button provided to and carried by each isolated employee; training; response procedures; L&I civil penalties $1,000–$10,000 for willful violations | Jan 1, 2026 – in force now |
| New York – Retail Worker Safety Act (as amended Feb 2025) | Covered retail employers; button requirement applies at 500+ retail employees statewide | Violence-prevention policy + training (in effect since Jun 2, 2025); silent response button summoning on-site help – physical, wearable, or a mobile app on employer-provided equipment | Button requirement from Jan 1, 2027 |
| Federal – OSHA | All employers | No general workplace-violence standard; serious hazards enforced under the General Duty Clause; published guidance by industry | Ongoing |
Primary sources: SB 553 bill text, Cal/OSHA workplace violence resources, Washington HB 1524, NY DOL Retail Worker Safety.
The two newest requirements are device requirements, and the details matter:
That third form is where software enters the picture. In many organizations the practical route is a panic button in the alerting platform employees already have – one tap on mobile, one click on a desktop – with every activation logged with time and location context for the incident record. Whether a specific implementation satisfies a specific law is a question for your counsel and, where relevant, the regulator – but the direction of the laws is clear: help must be one action away, and the response must be internal and immediate.
Elements 4, 5, and 7 of the plan are communication elements in disguise:
The sections a complete written plan needs. Copy the skeleton and fill it against your own hazard assessment.
Workplace violence prevention plan – skeleton
1. Scope and responsibility
Sites covered · plan owner (name, role) · effective and review dates
2. Hazard assessment
Risk walkthrough by area and shift · lone-work inventory · prior-incident review
3. Prevention and controls
Physical security · staffing and lone-work rules · de-escalation procedures · alerting and panic-button capability (who carries what, what one activation does)
4. Incident response
Alert paths by scenario · lockdown / evacuate / avoid instructions · who communicates with employees, and on which channels
5. Reporting and incident log
How employees report (incl. anonymous option) · log fields: date, time, location, type, response, corrective action
6. Training
Initial + annual refresher + on new risks · records of completion
7. Review and after-action
Post-incident and post-drill review · corrective actions with owners and due dates · next revision date
The compliance wave is not subtle: California enforces the plan today and finalizes its formal standard by the end of 2026, Washington’s isolated-worker law is already in force, and New York’s silent response button lands in January 2027. The seven elements above are the same work regardless of which law reaches you first – and the plan that exists only as a document protects nobody. Write it, train it, drill it, and give every employee a way to summon help in one action. The laws differ; the pattern doesn’t.
DeskAlerts puts a one-tap panic button on employee mobile devices and desktops and alerts the people who need to respond – with every activation and acknowledgment logged for the incident record.
A written, site-specific program that identifies workplace violence risks, defines prevention controls and response procedures, names responsible people, and sets training and recordkeeping requirements. California requires one from most employers; elsewhere it is the expected structure for meeting general safety duties.
Management commitment and responsibility; hazard assessment; prevention and controls; incident response procedures; reporting and the violent-incident log; training; and plan review with after-action follow-up. Regulators and auditors look for each element in writing.
California requires a written plan from most employers (SB 553, enforceable since July 2024, formal Cal/OSHA standard due by December 31, 2026). Washington requires panic buttons, training, and procedures for isolated employees in covered industries from January 1, 2026. New York requires a violence-prevention policy and training for covered retail employers, with a silent response button requirement from January 1, 2027. Other states regulate specific sectors – confirm your obligations with counsel.
From January 1, 2027, covered employers with 500 or more retail employees statewide must give employees a silent response button that summons immediate assistance from an on-site security officer, manager, or supervisor. The law allows a physical button, a wearable, or a mobile application on employer-provided equipment.
HB 1524, in force since January 1, 2026, covers hotels, motels, retail, security-guard entities, and property services contractors. Each isolated employee – someone spending at least half their working hours alone or where coworkers cannot immediately respond – must be provided a panic button and carry it while working, backed by training and response procedures.
There is no general federal OSHA workplace-violence standard. OSHA enforces serious violence hazards under the General Duty Clause and publishes guidance for high-risk industries. A written plan is the practical way to demonstrate you are meeting that duty.
Under New York’s law, yes – a mobile application on employer-provided equipment is one of the three named forms of the silent response button. Washington’s law requires a carried, simple-to-activate button and does not prescribe the technology. Whether a specific implementation satisfies a specific law is a question for your counsel.
California requires interactive training when the plan is introduced, annually after that, and whenever a new hazard is identified. Washington and New York require training under their own laws. Treat annual as the floor and retrain after every significant incident or plan change.
Send urgent notifications to PCs, phones, tablets, digital signage, and other corporate devices.
Display high-visibility alerts directly on employees' screens to help ensure critical messages are seen and acknowledged. Reach employees even when computers are locked, in screensaver mode, or idle.
12 min read
Steve Wilson: Aug 20, 2026, 9:00:00 AM
A workplace violence prevention plan (WVPP) is the written program that says how your organization prevents, responds to, and learns from violence at...
16 min read
Steve Wilson: Aug 17, 2026, 9:00:00 AM
A cybersecurity tabletop exercise is a discussion-based walkthrough of a simulated cyber incident – no systems touched, just your team, a scenario,...
15 min read
Steve Wilson: Aug 13, 2026, 5:58:44 AM
An after action report is the document that decides whether your drill was practice or just interruption. It records what was supposed to happen,...
Steve Wilson