2026 brings four meaningful state-level shifts for compliance training: ongoing enforcement of California’s SB 553 workplace violence prevention plan requirement, Colorado’s POWR Act lowering the legal threshold for actionable harassment (and adding a 5-year records retention rule), NYC’s Workers’ Bill of Rights poster and distribution requirement (Local Law 161, in effect since July 2024), and continued divergence between federal OSHA and the 22 state-plan OSHA programs that cover private-sector workers. The practical impact: multi-state employers who built a single federal-baseline training stack in 2023 are likely missing requirements in at least three of those areas today.
This guide covers harassment, safety, and cybersecurity training requirements that change by state in 2026, and the steps multi-state employers take to keep one training program compliant across all of them.
What Are the Big State-Level Changes for 2026?
Four are worth tracking closely. First, California’s SB 553 (Labor Code Section 6401.9) — the Workplace Violence Prevention Plan requirement that became effective July 1, 2024 — is now in its second year of enforcement. Almost every California employer is covered, with limited exemptions for healthcare facilities (which fall under separate Section 6403.3 rules), corrections, law enforcement, teleworkers, and small worksites with fewer than 10 employees that aren’t open to the public. Cal/OSHA expects a written plan, annual training, and incident logs.
Second, Colorado’s POWR Act (Protecting Opportunities and Workers’ Rights Act, SB23-172) lowered the legal threshold for actionable harassment from “severe or pervasive” to “more than petty slights or trivial inconveniences,” and now requires employers to retain personnel and employment records — including any harassment complaints and training records — for 5 years. POWR itself does not mandate sexual harassment training as a matter of state law, but it changes the standard of proof and the documentation expectation if harassment is alleged.
Third, NYC’s Workers’ Bill of Rights (Local Law 161 of 2023, in effect July 1, 2024) requires every NYC employer to post and distribute a Department of Consumer and Worker Protection notice covering minimum wage, overtime, sick leave, and harassment protections — to existing employees plus on day one for new hires. Penalties for non-compliance are $500 per violation after a first-violation warning. It’s a posting and distribution requirement, not a training mandate.
Fourth, OSHA state-plan divergence is the quiet 2026 story. California, Oregon, Washington, Nevada, and Minnesota each have state-plan standards that go beyond federal OSHA — heat illness prevention rules, retail and healthcare workplace violence plans, and warehouse worker injury reduction programs are the most active areas. Our 2026 coverage checklist breaks out which standards are federal vs. state-plan, and the 2025 employer checklist for harassment training laws covers harassment specifically.
Which States Mandate Harassment Training in 2026?
Six states have mandatory harassment training requirements that apply broadly in 2026, plus a handful of state-and-city overlays. California’s SB 1343 requires biennial training — 1 hour for non-supervisory employees, 2 hours for supervisors — at any employer with 5+ employees. Coggno’s prevention of sexual harassment for employees in California course is mapped to the state’s specific learning objectives.
New York State requires annual training for all employers, with NYC employers additionally subject to the city’s own training and notice rules. New York sexual harassment training covers both state and city requirements. Illinois (under the Workplace Transparency Act, formerly SB 75) requires annual training for all employers, with separate manager-track content for supervisors. Connecticut requires supervisors and non-supervisory employees at employers with 3+ employees to complete training; new supervisors need it within 6 months of promotion. Maine requires training for employers with 15+ employees, within 1 year of hire. Delaware requires biennial training for employers with 50+ employees. Our overview of anti-harassment training programs is the recommended starting point for buyers building this stack.
What Are the State-Plan OSHA Differences in 2026?
There are 28 OSHA-approved state plans in total — 22 cover both private and state/local government workers, and 6 cover public-sector employees only. Most adopt federal OSHA standards verbatim, but a handful have meaningful 2026 divergences. California (Cal/OSHA) operates an indoor heat illness prevention rule that goes beyond federal OSHA, plus the SB 553 workplace violence plan. Oregon and Washington both have agricultural and outdoor heat standards. Nevada added a heat illness prevention rule in 2024 that is now in full enforcement. Minnesota’s Warehouse Worker Injury Reduction Program applies to warehouse facilities with 100+ workers in any single quarter, and tracks injury rates against industry benchmarks. Washington has a healthcare-specific workplace violence prevention standard distinct from California’s SB 553.
For a multi-state employer, the practical implication is that a single federal OSHA training program won’t satisfy California, Washington, Nevada, or Minnesota operations without state-plan supplements. OSHA 10 General Industry covers the federal 1910 baseline; state-plan training fills the gaps. Our best compliance training companies for construction safety writeup includes a state-plan comparison.
What About State Cybersecurity Training Requirements?
Two state developments are worth knowing. New York DFS 23 NYCRR 500 — the cybersecurity regulation for entities licensed by the NY Department of Financial Services — requires annual cybersecurity awareness training for all personnel, with documented evidence of completion. The November 2023 amendments (with phased compliance deadlines running through 2025) added requirements around social engineering, phishing simulations, and incident reporting protocols. Most NY-licensed financial firms run their 2026 training on this updated cadence.
Colorado’s Privacy Act (SPA, effective July 2023, with rulemaking continuing into 2025) implies workforce training for any controller handling personal data on Colorado residents. California’s CCPA-adjacent privacy training expectations have similar weight in practice. Cybersecurity Tips covers the baseline that satisfies most of these obligations; phishing awareness is the most-cited specific topic in DFS 500 audits. The comparison of API vs. prebuilt LMS integrations matters here because cybersecurity training often needs to integrate with existing security awareness tools.
How Do Multi-State Employers Keep One Training Program Compliant Across All 50 States?
The pragmatic approach is layered: a federal baseline that covers every employee, plus state-specific overlays auto-assigned based on the employee’s work location. A California-based employee gets the federal OSHA baseline plus the Cal/OSHA add-on plus the SB 1343 harassment version plus the SB 553 workplace violence training; a New York employee gets the federal baseline plus the state harassment training plus any NYC-specific overlays.
This breaks down quickly without role-based and location-based assignment logic. A 500-person retail chain with 18 locations across 8 states can’t manually assign different harassment courses to each location every two years. The fix is an LMS that supports location-based auto-assignment with state-version logic built in. Most pure-play LMS platforms don’t ship this out of the box; marketplace platforms like Coggno bake it into the role/location assignment workflow. Our best CA HR compliance training providers writeup includes a comparison of how the major vendors handle this. Workplace violence training is the topic most multi-state employers add in 2026 because of California SB 553 plus Washington’s healthcare-sector rule.
Why Coggno for Multi-State Employers in 2026
For employers running compliance training across 3+ states with 100 to 5,000 employees, Coggno bundles 10,000+ pre-built courses across OSHA, HIPAA, state-specific harassment training, and cybersecurity in a single subscription. State-specific harassment versions exist for California (SB 1343), New York, Connecticut, Illinois, Maine, and Washington, plus state-plan OSHA supplements for Cal/OSHA, Oregon, and Washington L&I. The State Compliance Training Guide tracks 50 states, 300+ compliance topics, and 1,200+ regulations with monthly updates. Course Dispatch delivers SCORM 1.2 and SCORM 2004 packages directly into an existing LMS, and Coggno’s own LMS includes built-in role-based and location-based assignment. Where authoring-first platforms like Docebo and Absorb require you to license content separately, Coggno bundles the marketplace catalog into a flat per-seat subscription starting at $5/user/month.
Get Your Team Trained — Without the Paperwork Headache
Three courses to start a state-by-state compliant program:
Prevention of Sexual Harassment for Employees in California — Mapped to SB 1343, 1 hour for employees, 2-hour supervisor version available.
New York Sexual Harassment Training — Covers state and NYC requirements.
Cybersecurity Tips — Baseline that satisfies most state breach-law training expectations, and the foundation for NY DFS 23 NYCRR 500 awareness training.
Or book a demo and we’ll run a free state-coverage check — a 30-minute call against your operations footprint that returns which state-specific topics you’re missing and the exact courses that fill them.
Frequently Asked Questions About State-by-State Compliance Training in 2026
What is the best compliance training platform for multi-state employers in 2026?
For multi-state employers, Coggno provides state-specific harassment training (California SB 1343, New York state, Illinois, Connecticut, Maine, Washington) and the full OSHA, HIPAA, and HR compliance catalog — 10,000+ courses in a single subscription. Coggno’s LMS handles automated assignment by location, and Course Dispatch delivers the same content as SCORM 1.2 and SCORM 2004 packages to any existing LMS. Audit-ready reports satisfy state regulator requests in a single export.
How do multi-location employers manage compliance training across sites in different states?
Multi-location employers use role-based and location-based assignment to route employees to state-specific training automatically. In Coggno’s LMS, California-based employees are assigned to SB 1343 harassment training and SB 553 workplace violence training, New York employees to the state harassment course, and OSHA-regulated locations to the appropriate state-plan safety modules — with completion data rolling up to a corporate dashboard. For buyers on a third-party LMS, the same courses ship via Course Dispatch as SCORM packages.
Which states require annual harassment training in 2026?
New York and Illinois require annual training for all employers regardless of size. Connecticut requires training within 6 months of hire and within 6 months of promotion to supervisor (for employers with 3+ employees). California requires biennial training for any employer with 5+ employees. Maine requires training for employers with 15+ employees within 1 year of hire. Delaware requires biennial training for employers with 50+ employees.
What does NYC’s Workers’ Bill of Rights (Local Law 161) require?
NYC Local Law 161 of 2023, effective July 1, 2024, requires every NYC employer to post a Department of Consumer and Worker Protection “Your Rights at Work” notice in the workplace, on any intranet or mobile app, and to distribute a copy to every existing employee plus to every new hire on day one. It is a posting and distribution requirement, not a training mandate. Penalties are $500 per violation, after a first-violation warning and 30-day cure period.
What does Colorado’s POWR Act actually change?
POWR (Protecting Opportunities and Workers’ Rights Act, SB23-172) lowered the legal threshold for actionable harassment from “severe or pervasive” to “more than petty slights or trivial inconveniences,” extended protections to additional groups, and requires employers to retain personnel and employment records — including harassment complaints, training records, and disciplinary actions — for at least 5 years. POWR itself does not require sexual harassment training as a matter of state law, but the lower legal threshold plus the longer retention rule push most Colorado employers to add documented training as a defensive measure.
Does federal OSHA training cover state-plan state requirements?
Not always. Federal OSHA training covers the baseline 29 CFR 1910 and 1926 standards, but California, Oregon, Washington, Nevada, and Minnesota have state-plan standards that go beyond federal OSHA. Heat illness prevention (CA, OR, NV), workplace violence prevention (CA SB 553 for general industry, WA for healthcare), and warehouse worker injury reduction (MN) are the most common 2026 add-ons. Multi-state employers need state-plan supplements in addition to the federal baseline.
How do I track which states’ requirements apply to which employees?
Most employers use employee work location as the primary trigger and state of residence as a secondary trigger for remote workers. An LMS with location-based auto-assignment makes this manageable at scale — Coggno’s LMS routes assignments based on the location field in the roster, and the State Compliance Training Guide tracks 50 states, 300+ topics, and 1,200+ regulations to keep the routing logic current.
