Your workplace violence plan is about to get graded.

The deadline nobody is talking about

Cal/OSHA posted a revised draft workplace violence prevention regulation on April 23, 2026. It broadens the scope to cover additional employers and adds definitions, plan requirements, post-incident procedures, recordkeeping and training obligations. The Occupational Safety and Health Standards Board is required to adopt a standard no later than December 31, 2026.

That is a hard date, roughly four months out, and it has gotten almost none of the attention that a bill in Sacramento gets. Which is backwards, because a regulation the Standards Board has to adopt is a great deal more certain than a bill that has to survive a floor vote.

Why this is different for a guard company

Every California employer with more than a handful of employees already owes a written workplace violence prevention plan. Most treat it as a form: download a template, put a name in the blank, file it.

A private patrol operator does not get to do that, for a reason that is obvious once you say it out loud. For your employees, workplace violence is not a contingency. It is the job description.

An office manager's plan describes an unlikely event. Yours describes Tuesday. That difference shows up in three places:

• Hazard identification. A generic plan identifies the workplace. Yours has to identify posts — and your posts change every time you win or lose an account. A plan written against last year's client list is describing a company that no longer exists.
• Post-incident procedures. Your officers have incidents. Real ones. The question a regulator or a plaintiff's attorney will ask is not whether you had a procedure, it is whether the procedure you had was followed the last eleven times.
• Training and recordkeeping. You already run a training operation for BSIS purposes. If your workplace violence training lives in a completely separate system with a separate record trail, you have doubled your failure points for no benefit.

The part that costs money is not the plan

Writing a compliant plan is a day of work. The exposure is not in the document — it is in the gap between the document and what your officers actually do.

That gap is where a workplace violence plan stops being a compliance artifact and becomes evidence. In a serious incident, your plan gets read out loud by someone whose job is to show that you knew the risk and wrote down how you would handle it, and then did something else. A plan you cannot demonstrate you followed is worse for you than a thinner plan you can.

A plan describes the company you say you are. The incident file describes the company you are. A regulator only cares about the distance between them.

The fair objection

Small operators will point out, correctly, that layering another written program on top of BSIS registration files, training records, DIR posting requirements and the injury and illness prevention program is real administrative weight on a business that runs on thin margins. Nobody in Sacramento is costing that out.

That is true. It is also not a defense that survives an incident. The realistic response is not to fight the requirement — it is to stop maintaining five separate compliance systems that all describe the same officers doing the same work at the same sites.

What I would do before December

• Find your existing plan and read it. Not skim — read it, with your current post list next to it. If it names sites you no longer serve, it is out of date in exactly the way that matters.
• Reconcile it against your last twelve months of incident reports. Where the plan says one thing and the reports show another, fix one of them. That single exercise finds more real exposure than any template will.
• Put workplace violence training on the same record trail as your BSIS training. One system, one set of signatures, one place to look when someone asks. This is the highest-leverage hour you will spend on it.
• Calendar the Standards Board. When the adopted standard lands, you want to be comparing it against a plan you have already read, not opening the file for the first time.
• Do not rewrite to the draft. It can still change. Get your current plan accurate; adapt it when the final text exists.

If you are already thinking about how this stacks with your BSIS obligations, that is the right instinct — see how to pass your BSIS audit and my notes on workers' comp and Cal/OSHA.