Active Shooter Training in California: Employer Rules and Penalties

Active shooter training in California is governed by two separate laws depending on where the training happens. Since July 1, 2024, Labor Code section 6401.9 has required nearly every private employer in the state to maintain a written Workplace Violence Prevention Plan and train employees on it every year. K-12 schools work under a different rulebook: Education Code section 32282 requires each campus to build active threat response into its Comprehensive School Safety Plan, and a 2025 amendment sharply limits how realistic any active shooter drill can be. The requirements for employers, schools, and employees differ enough that knowing which set applies to you is the starting point.

What Employers Must Train Employees On

Senate Bill 553 created Labor Code section 6401.9, which took effect July 1, 2024. Covered employers have to establish and maintain a written Workplace Violence Prevention Plan (WVPP), either as a standalone document or folded into an existing Injury and Illness Prevention Program.¹ Training is the part employees see.

Initial training is required when the plan is first established. After that, employers must retrain annually. Additional training is required whenever a new workplace violence hazard is identified or the plan changes, though those supplemental sessions can be limited to the new material.²

Each annual session must cover:

The plan itself, including how to get a free copy and how to participate in developing it.
How to report workplace violence incidents or concerns to the employer or law enforcement without fear of retaliation.
The violence hazards specific to each employee’s job, the corrective measures in place, and strategies for avoiding physical harm.
How the violent incident log works and how employees can access its records.
A live opportunity to ask questions of someone knowledgeable about the plan. A pre-recorded video on its own doesn’t meet this requirement.

Training materials must match the educational level, literacy, and language of the workers receiving them.² If a significant portion of your workforce primarily speaks a language other than English, the training has to reach them in that language.

Which Employers Don’t Have to Comply

The law applies broadly, but several categories are carved out:²

Healthcare facilities already covered by the Cal/OSHA healthcare workplace violence standard at Title 8, section 3342.
Facilities operated by the Department of Corrections and Rehabilitation, if they comply with the general IIPP standard at 8 CCR section 3203.
Law enforcement agencies with POST compliance confirmation, provided their facilities also comply with the general IIPP standard.
Employees teleworking from a location of their own choosing that the employer does not control.
Workplaces with fewer than 10 employees on-site at any one time that are not accessible to the public, as long as the employer maintains a compliant IIPP.

One caveat worth knowing: Cal/OSHA can override any of these exemptions by issuing a special action order requiring a specific employer to comply. Technically fitting an exemption doesn’t mean enforcement is off the table if conditions at your worksite warrant it.

Training Records and the Violent Incident Log

Different records under this law have different retention periods, and employers routinely mix them up.

Training records must be kept for at least one year. They need to include the date of the session, a summary of what was covered, the names and qualifications of the trainers, and the names and job titles of everyone who attended.¹

Hazard identification and correction records, violent incident logs, and incident investigation records all have to be kept for at least five years. The one-year training record retention is noticeably shorter than everything else, but many employers keep training records longer anyway to document a consistent pattern of compliance.

The violent incident log itself must record the date, time, and location of each incident, a description of what happened, a classification of the person who committed the violence (coworker, customer, stranger, domestic partner, and so on), the circumstances at the time, and the type of incident. All personal identifying information has to be stripped out, including names, addresses, and phone numbers.² At shared worksites, the employer whose employees experienced the violence creates the entry and gives a copy to the controlling employer.

Penalties for Non-Compliance

Cal/OSHA enforces the WVPP requirement the same way it enforces other workplace safety rules. A citation comes with a notice of civil penalty, which can be appealed to the Occupational Safety and Health Appeals Board.²

General and regulatory violations can carry fines up to approximately $15,873 per violation. Serious violations can reach $25,000. Willful or repeat violations run from roughly $11,337 to $158,727. These figures are adjusted periodically for inflation.

Fines are only part of the exposure. If a workplace violence incident happens and the employer has no plan, outdated training, or no records showing preparedness, that gap becomes a central issue in any civil lawsuit that follows. Courts evaluating negligence look at whether the employer took reasonable steps to address known risks, trained people appropriately, and documented what it did. Workers’ compensation claims, insurance consequences, and reputational damage pile on top.

How California Schools Handle Active Shooter Preparation

K-12 schools operate under Education Code section 32282, not the workplace violence statute. Every public school, including charter schools, has to develop and maintain a Comprehensive School Safety Plan (CSSP). The plan covers school crime assessment, disaster procedures, child abuse reporting, and campus access, among other topics. Active threat response fits inside this broader framework, and schools must build the plan in cooperation with local law enforcement, community leaders, and parents.³

State law does not require schools to conduct active shooter drills. It regulates how any such drill must be done if a school chooses to include one.

What Drills Can and Can’t Look Like

Assembly Bill 1858, effective January 1, 2025, added strict limits on drill realism. Schools are prohibited from conducting “high-intensity drills” that mimic an actual shooter incident. The ban specifically covers theatrical makeup simulating blood or wounds, using someone to play the role of an assailant, using people to pose as victims, and instructing students to resist an attacker by throwing objects or swarming. Real weapons, blanks, and simulated explosions are separately banned.³

Every drill must take a trauma-informed approach and include:

Age-appropriate content and terminology, developed with input from school-based mental health professionals.
Advance notice to all parents and guardians, including the expected length.
The right for parents to opt their child out.
A school-wide announcement immediately before the drill starts and again when it ends.
Post-drill notice to parents and contact information for mental health counseling and community resources for anyone affected.⁴

What the Training Actually Teaches

The response model used across California workplaces and schools is “Run, Hide, Fight.” The California Governor’s Office of Emergency Services and the U.S. Department of Homeland Security both endorse it, and most curricula are built around it.⁵

The first priority is evacuation. If a safe route exists, leave immediately, leave belongings behind, help others get out if you can, but don’t wait for people who refuse to move. Once clear, call 911.⁶

If evacuation isn’t possible, hide. Find a room you can lock and barricade, stay out of the shooter’s line of sight, silence your phone, and stay quiet. Fighting back is the last resort, used only when your life is in immediate danger. Training teaches people to commit fully if it comes to that, using whatever improvised objects are at hand.

Good training also covers what happens when law enforcement arrives: keep your hands visible, follow instructions, and don’t grab officers or make sudden movements. Officers clearing a building are focused on stopping the threat, not providing medical care. Many programs now add “Stop the Bleed” techniques so bystanders can apply pressure, pack wounds, or use a tourniquet until paramedics reach the scene.

Choosing a Training Program

A generic click-through video satisfies the annual training requirement on paper but prepares no one for an actual emergency. Effective programs are customized to the facility’s layout, the people it serves, and the specific hazards identified in the employer’s WVPP or the school’s CSSP.

For civilian organizations, FEMA’s IS-907 course (“Active Shooter: What You Can Do”) provides a free federal baseline curriculum covering response during an incident, preparation beforehand, and management of the aftermath. It also teaches participants to recognize potential workplace violence indicators, which maps directly onto the hazard-identification requirements in the California law. For law enforcement, the California Commission on Peace Officer Standards and Training (POST) sets training standards and updates mandated courses as threats evolve.⁷

Private certification options exist as well. ALICE Training, for example, offers a two-day instructor certification course with a prerequisite e-learning module, valid for two years before recertification is required. These can work well for organizations that want in-house trainers, but no private certification is required by California law.

Whatever program you choose, coordinate it with local law enforcement and first responders. A plan employees have practiced but that local police have never seen creates confusion when it matters most. Deliver training in a language employees understand, and don’t skip the live question-and-answer component the statute requires.

Grant Funding for Nonprofits

Nonprofit organizations with 501(c)(3) status may qualify for the FEMA Nonprofit Security Grant Program (NSGP), which helps nonprofits strengthen physical security against acts of terrorism and extremist attacks. Under fiscal year 2025 guidance, eligible organizations can request up to $200,000 per physical site, with a maximum of $600,000 per organization per state across multiple locations.⁸ Applicants need a Unique Entity Identifier from SAM.gov. Grant cycles open annually, so nonprofits looking to offset security and training costs should watch FEMA’s announcements for the next application window.

1
Department of Industrial Relations. Cal/OSHA Workplace Violence Prevention for General Industry (Non-Health Care Settings)
2
California Legislative Information. California Code Labor Code 6401.9
3
California Legislative Information. California Education Code 32282
4
California Legislative Information. California Assembly Bill 1858 – Comprehensive School Safety Plans: Active Shooters: Armed Assailants: Drills
5
California Governor’s Office of Emergency Services. Active Shooter Awareness Guidance
6
Department of Homeland Security. Active Shooter How to Respond
7
Commission on Peace Officer Standards and Training. Training
8
FEMA. Fiscal Year 2025 Nonprofit Security Grant Program (NSGP) Subapplicant Quick Start Guide