SB 553 for California cannabis dispensaries

Is a dispensary covered by SB 553?

Yes. SB 553 applies to all California employers by default, and the small-worksite exemption only helps a site that meets all three conditions at once: fewer than ten employees present at the site at any given time, the site is not accessible to the public, and the employer keeps a compliant Injury and Illness Prevention Program. A dispensary's retail floor is open to customers, so it fails the public-accessibility condition — and any worksite open to the public is covered regardless of headcount. A single-budtender shop is just as covered as a high-volume store with a dozen staff on the floor.

Coverage is evaluated per worksite. If you operate more than one location, each is its own analysis, and a thinly staffed satellite is covered the same as your flagship if customers can walk in. A separate cultivation or distribution facility that the public can't enter is a different question and turns on whether it independently meets all three exemption conditions — but the moment a site has a public-facing sales counter, the exemption is off the table. Want a quick read on a specific location? Run the coverage checker, then work through the broader retail picture in the SB 553 guide for retail.

Why cash makes a dispensary different

Most California retailers route nearly everything through cards. Dispensaries often can't — federal banking limits push much of the industry toward cash, which means a store can hold meaningful sums on the floor, in a back-office count room, and in transit to a bank or cash-handling service. That single operational fact reshapes the violence profile. Robbery isn't a remote possibility a plan can wave at in one line; it's a reasonably foreseeable Type 1 hazard — an aggressor with no legitimate business at the store, there for the cash — and the WVPP has to treat it that way.

"Reasonably foreseeable" is the operative phrase. Cal/OSHA's hazard-identification requirement isn't satisfied by acknowledging that robberies happen somewhere; it expects you to look at this site — its cash levels, its hours, its entry and exit points, its history — and write down what you found and what you're doing about it. A dispensary that doesn't name armed robbery as a primary hazard has a plan that doesn't match its own risk, and that gap is exactly what an inspector reads first.

The dispensary threat landscape

Under SB 553's four-type classification, a dispensary's exposure clusters in Type 1 and Type 2, with Type 3 and Type 4 present as they are anywhere people work:

• Type 1 — armed robbery and till grabs. The dominant hazard. The aggressor has no legitimate business at the store and is there for the cash or product. The controlling WVPP question is the same one retail faces but with higher stakes: what are budtenders and floor staff permitted to do, and what is the directive? A clear comply, don't resist, observe, then report policy protects staff and is far cleaner than leaving it to instinct in the moment.
• Type 2 — denied sales and ID-check confrontations. A customer turned away at the door for failing an age or ID check, or refused a sale, is still someone the business is dealing with at the counter — a Type 2 hazard when it crosses into a threat or an act of violence. These confrontations are a recurring friction point precisely because the refusal is non-negotiable and the customer often isn't expecting it.
• Type 3 — worker-on-worker. Conflict between current or former staff, supervisors, or managers. In a cash business with access controls, a disgruntled former employee who knows the close routine and the vault location is a specific concern the plan should address — including how a threat is reported and how access is revoked.
• Type 4 — personal relationships. An outsider with a personal connection to an employee — for example a domestic or ex-partner — who shows up at the store. The plan should describe how staff alert each other and respond when an employee flags this risk.

Cutting across all four types are the cash-handling chokepoints. Opening means a lone or near-lone employee unlocking a known-cash site at a predictable time. Closing means counting the day's takings, often with thin staffing and visible activity behind glass. Deposit and bank runs put an employee outside the store's controlled environment, on foot or in a vehicle, carrying cash on a route that becomes a pattern if it isn't varied. And the parking lot and exterior carry Type 1 exposure before opening and after close, when staffing is thinnest — the hazard assessment should note lighting, camera coverage, visibility from the street, and any history of incidents outside the building.

State cannabis security rules vs. an SB 553 plan

This is the point most dispensary operators get wrong, so it's worth stating plainly: the security requirements that come with your state cannabis license overlap with SB 553 but do not replace it. California's cannabis regulator already requires a great deal — commercial-grade cameras and recording, alarm systems, controlled and limited-access areas, and in many cases security personnel. Those controls are real and they genuinely reduce violence risk. They are not, by themselves, an SB 553 program.

SB 553 asks for things a camera and a guard contract don't produce on their own:

• A written, site-specific workplace violence prevention plan, in effect at all times, that names the responsible person and includes procedures for employee involvement, reporting without retaliation, communication, multi-employer coordination, emergency response, training, hazard identification and correction, post-incident response and investigation, and review.
• Training that is interactive and built around your own plan — not a generic safety video — with a chance to ask questions of someone who knows how your dispensary actually operates.
• A violent incident log capturing every act or threat of violence, kept for five years.
• Documented hazard identification, evaluation, and correction, plus a record of each incident investigation and the annual review.

The practical move is to make the two regimes reinforce each other. Your camera coverage, access controls, and guard presence are controls you cite in the hazard-correction section of the WVPP. If you use a contracted security firm, the statute's multi-employer coordination requirement applies: write down which party provides base training and which covers your site-specific procedures, so neither side assumes the other did it. For the written plan itself, the free Cal/OSHA template is the place most operators start — the section-by-section walkthrough of the model WVPP shows what each blank is asking for.

What a dispensary WVPP must address

• Robbery response directive. State plainly what staff do during an armed robbery — comply, do not resist, observe details for later, do not chase or intercede. Name where the panic or hold-up alarm is and who it notifies. The goal is a single, rehearsed response, not improvisation under threat.
• Vault and cash-room access. Who may open the vault, when, and with whom present. Limit the number of people who handle large sums, and avoid leaving an employee alone in a count room visible from the floor. Name the control, not just the risk.
• End-of-day and deposit-run procedures. How the day's cash is counted and secured, who performs a bank or service deposit, and the rule to vary routes and times so the run doesn't become a predictable pattern. Two-person runs and discreet transport belong here.
• Open and close protocols. Minimum staffing for the first person in and the last person out, a check-in procedure, and the communication chain if a lone employee feels unsafe. A "last person out" walk-out-together rule belongs in the plan.
• Door and counter de-escalation. The steps a budtender or doorperson takes when a denied sale or ID check turns hostile, the threshold at which they disengage, and how they summon a manager or security. Explicit limits protect staff who would otherwise feel obliged to win the argument.
• Reporting without retaliation. A confidential way to report incidents and threats, the named contact, and a restatement of the anti-retaliation rule — Labor Code §6310 protects employees who report. Every reported robbery, threat, or near-miss feeds the log.

The violent incident log at a dispensary

The violent incident log is where dispensary operators most often under-record. The standard is broad: every act or threat of violence goes in, regardless of whether anyone was injured and regardless of whether police were called. The only carve-out is lawful self-defense or defense of others. That means an armed robbery, an attempted till grab, a threat made by a refused customer, a budtender threatened over an ID check, and an after-hours confrontation in the lot all belong in the log — even the ones that ended without contact.

Two details matter for cannabis specifically. First, a verbal or written threat counts; you don't wait for it to become physical. A denied-sale customer who says something menacing on the way out is a loggable incident. Second, the log deliberately omits personal identifying information — names of those involved go in the separate incident investigation record, not in the log itself. The log captures what happened, when, where, the type of incident, and the circumstances; the investigation record holds the people. Keep the log for five years. For the field-by-field detail, see the violent incident log requirements.

Training budtenders and security staff

Everyone who works under the plan gets trained — full-time, part-time, and seasonal staff, plus supervisors and managers. Training is required initially (when the plan is established, or before a new budtender starts working under it), annually, and again whenever a new hazard appears or the plan changes. The training that satisfies SB 553 is interactive: it has to include a real chance to ask questions of someone who knows your dispensary's plan, not a passive video everyone clicks through.

For a cash-heavy, high-turnover floor, a structure that holds up to inspection looks like this:

• Initial training inside onboarding. Fold it into day-one paperwork so a new budtender is trained before their first shift on the floor. "Before working under the plan" is the legal threshold — don't leave it to a slow week.
• One annual reset date for the whole team. A fixed annual training date gives you one clean set of attendance records per year instead of a scatter of individual anniversaries to chase.
• Robbery and de-escalation as named topics. Cover the comply-don't-resist robbery directive, denied-sale de-escalation, and the disengage-and-report threshold explicitly — these are your job-specific hazards, and the training has to reflect them.
• Coordinate contracted security training. If a security firm staffs your door, write down in the plan which party trains them on their general role and which covers your site-specific procedures, so the multi-employer coordination requirement is actually met.

Training records have a shorter retention floor than most SB 553 records — keep them for at least one year — but in practice it's cleaner to retain them on the same schedule as the rest of the program. Employees can examine or copy the plan, their training records, the log, and the hazard records within fifteen calendar days of asking, at no charge, so the records need to be findable, not buried in a binder behind the counter.

Frequently asked questions