SecureSafety vehicle-pedestrian detection — alert fires in real time, operator confirms and escalates.
A reach stacker is moving along the eastern access road of a major port facility. The AI detects a pedestrian who has entered the vehicle exclusion zone through a gap in temporary barrier fencing twenty metres ahead. Within 190 milliseconds, the site PA system announces a caution message for the relevant sector. The pedestrian looks up, sees the vehicle, and steps back onto the walkway. The entire sequence — detection, classification, response — occurs without any human in the decision loop. That is entirely appropriate.
Forty minutes later, the same system detects a lone worker on the upper gantry of the transfer facility. The worker's head has dropped below normal working posture for the third time in sixty minutes. This time, the protocol demands something different. The alert reaches the control room operator, who reviews the footage, calls the worker's team lead on the radio, and initiates a welfare check before any further response goes out. No automated action fires towards the worker.
The difference between these two events is not in the sophistication of the detection. Both detections are accurate. Both reach the system within milliseconds. The difference is in the nature of the appropriate response — and getting that distinction right is arguably the most consequential governance decision in any safety AI deployment.
The response spectrum
Every detection event generates a decision about what happens next. That decision sits somewhere on a spectrum with four defined points.
Detect and log. The system identifies an event and records it, but no real-time response fires. This is appropriate for low-significance events where the value lies in accumulated pattern data rather than the individual instance: vehicle speed observations for trend analysis, for example, or people counting data used to plan emergency evacuation scenarios.
Detect and alert. The system identifies an event and notifies a human operator or supervisor, who decides what to do. The speed of delivery varies by channel — control room console, supervisory smartwatch, radio network, or all three simultaneously — but the human makes the response decision.
Detect, alert, and automate with acknowledgement. The system fires a bounded automated response immediately — a PA announcement, a flashing warning light, a door hold signal — while simultaneously alerting a human. The automated response is reversible, bounded in consequence, and does not affect any individual's employment or status. The human can escalate, confirm, override, or close out the event within a defined acknowledgement window.
Detect and automate. The system fires an automated response directly, with no human in the decision loop for that response. Appropriate only in a narrow set of circumstances, and only after the configuration has satisfied specific criteria.
Most correctly designed deployments operate predominantly in the middle two modes. A safety AI system that only detects and logs wastes its real-time capability. A system that automates every response is operating beyond both its appropriate scope and, in several categories, its legal mandate under applicable UK and EU frameworks.
What automated intervention actually means in practice
There is a persistent misunderstanding about what safety AI automation does. It does not make disciplinary decisions. It does not determine fitness for work. It does not dispatch emergency services. It does not make employment recommendations. Describing safety AI as "making decisions" conflates the detection of an event with the human decisions that the detection informs.
In practice, automated intervention in a correctly designed safety AI system means one or more of the following: a PA announcement in the relevant zone; a flashing amber or red warning light at a zone boundary; a door hold-open signal that delays vehicle movement until a pedestrian clears the zone; a push notification to a named supervisor's smartwatch or radio terminal; or an interlock signal to a non-safety-critical machine function where the hazard profile supports it.
Each of these actions is reversible. Each is bounded in consequence: the automated response makes noise or lights up, and if it fires on a false positive, the result is momentary inconvenience rather than harm. None of them makes a decision about any individual worker's employment, status, safety record, or fitness to work. The consequential decisions — what the event means, whether RIDDOR notification is required, whether further investigation is warranted — remain with people.
EU AI Act Article 14 sets a clear expectation on this point. High-risk AI systems must incorporate human oversight measures that enable operators to understand the system's operation, intervene when necessary, and override or disable outputs where the situation demands it. A safety AI deployment designed with Article 14 in mind treats automation as a speed advantage for bounded, reversible actions — not as a replacement for human judgement in decisions with lasting consequences. HSE's own guidance on emergency procedures reinforces the same principle: emergency response chains must include designated human decision-makers, particularly at the point where external services may be involved.
The three criteria for appropriate automation
For a safety response to be appropriate for automation without requiring human review at the point of decision, it must satisfy all three of the following criteria simultaneously.
Bounded consequence. The automated response must not be capable of causing harm if it fires incorrectly. A PA announcement that fires on a false positive is mildly disruptive. A machine interlock that fires on a false positive during a critical process step could itself create a hazard. The consequence of an incorrect automated response must be tolerable without human review — if it is not, human review is required before the response fires.
Reversibility. The automated response must be possible to cancel, override, or undo without adverse operational effect. A door hold signal can be manually released in seconds. A flashing warning light can be silenced from the control room. An emergency machine shutdown may not be reversible within the same operational window. Automation is appropriate where the action is easily undone; where it is not, human review precedes the response.
Time criticality. The automated response must address a hazard where the intervention window is genuinely shorter than the time required for human review and decision. Vehicle-pedestrian conflicts at speed, restricted zone entries at active machinery — these are scenarios where serious harm can occur in seconds, and where the value of a sub-200ms automated response is measurable in avoided injuries. Fatigue pattern monitoring, PPE compliance trend analysis, near-miss frequency mapping — these are scenarios where the value lies in the informed human response, not in the speed of an automated action.
If any one of these three criteria is absent, the appropriate response level is human-in-loop or human-only. This is not a limitation on the technology. It is the correct governance design.
What always requires human review
Four response categories are never appropriate for automation, regardless of how the three criteria above are assessed.
Any action that affects employment. This includes formal verbal warnings, disciplinary proceedings, removal from a site, suspension from duties, or any decision that becomes part of a personnel record. Safety AI generates the data and the pattern that informs such decisions. It cannot make them. This principle is embedded in both the Employment Rights Act 1996 and the EU AI Act's provisions on automated decision-making affecting individuals — and, practically, any employer who allows a machine to initiate a disciplinary action without human decision-making in the chain will face serious difficulties in any subsequent tribunal.
Any incident that may require RIDDOR reporting. The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require employers to report specified injuries, dangerous occurrences, and occupational disease to the HSE. A fall detected by camera, a lone worker welfare trigger, a fire detection event — all of these may generate a RIDDOR reporting obligation. The determination of whether a given event meets the reporting threshold is a legal judgement that must be made by a competent person, not automated.
Any situation that may require emergency services. If a detection event suggests a real emergency — fire, medical event, serious injury, unconscious worker — the response chain must pass through a human decision-maker before a call to the emergency services is initiated. False emergency calls divert resources from genuine incidents and carry legal consequences. The decision that an emergency call is warranted is human-only.
Any situation involving apparent medical or psychological distress. Fatigue detections, behavioural welfare concerns, and any event where the appropriate response involves the wellbeing of an individual worker must route through a human supervisor before any response reaches or concerns the individual. The potential for harm from acting incorrectly in a welfare context — and the sensitivity of the data involved — make human judgement non-negotiable.
Designing acknowledgement windows
For alerts configured as "detect, alert, and automate with acknowledgement," the acknowledgement window — the time between the automated response firing and escalation to the next response tier — is the most important configuration variable.
The window must be long enough for the operator to review the event, assess whether the automated response was appropriate, and decide whether to escalate. It must be short enough that a genuine emergency does not stall waiting for an acknowledgement that does not come.
A reasonable starting range for most industrial deployments is 90 to 180 seconds for advisory-class alerts, and 30 to 60 seconds for safety-critical classifications. These windows are calibrated during commissioning based on the staffing patterns of the control room, the average time required to review a detection event and reach a decision, and the risk profile of the hazard category.
The acknowledgement window is not a single setting applied uniformly. It should vary by alert class, by shift period — a control room with one overnight operator needs a shorter window than one with three daytime operators — and by operational context: a live production run and a maintenance shutdown have different response expectations, and the window configuration should reflect that.
Decision matrix: eight hazard types mapped to appropriate response level
| Hazard Type | Automated Response Appropriate? | Human Review Required? | Notes |
|---|---|---|---|
| Pedestrian detected in active vehicle exclusion zone | Yes — PA announcement, warning light | Yes, within acknowledgement window | Automated response fires immediately; human reviews within window and escalates if person has not cleared |
| Missing PPE at zone entry point | Yes — display board alert, supervisor notification | Yes — before any individual contact | Automated advisory appropriate at entry; any response to the individual routes through supervisor |
| Fire or smoke detected | Yes — PA evacuation announcement | Yes — emergency services decision is human-only | Automated building announcement appropriate; 999 call is human decision only |
| Restricted zone entry | Yes — door hold signal, PA alert | Yes, within window | Human review required before any employment consequence is considered |
| Worker down / fall detected | Yes — immediate welfare alert to nearest supervisor | Yes — emergency services decision is human-only | Alert to supervisor fires automatically; all further response is human-led |
| Fatigue or inattentiveness indicators | No — supervisor alert only, no automated response to individual | Yes — always | No automated action toward the worker under any circumstances; supervisor-only escalation route |
| Blocked fire exit or propped fire door | Yes — supervisor radio alert | Yes — removal decision confirmed by human | Alert fires immediately; obstruction removal is an operational instruction confirmed by a supervisor |
| Speeding vehicle in restricted zone | Yes — zone warning light, speed advisory | Yes, within window | Automated advisory for immediate hazard; repeat violations require human review and documented follow-up |
The SecureSafety control room alert interface. Each event is categorised with type, location, confidence and timestamp — giving the operator the information to apply the decision matrix in real time.
The site configuration that consistently creates the most management difficulty — including regulatory scrutiny and workforce trust issues — is not insufficient automation. It is automation applied to scenarios where human judgement should have been retained in the decision chain. Every case of a worker receiving an automated response to a welfare event without a human having reviewed it first represents a failure of governance design, not a capability failure of the underlying detection.
The sub-200ms alert latency that makes real-time automated responses valuable is the same capability that allows a human operator to be informed quickly enough to exercise meaningful oversight before the situation develops. Speed and human oversight are not in conflict. Getting the framework right means both are used where they belong.
Across thirteen offshore installations and major industrial facilities, SecureSafety's deployments have been designed around the principle that the system's job is to eliminate the information gap between when something happens and when the right person knows about it. What the right person does with that information is always, ultimately, a human decision.
To discuss how this framework applies to your specific site, hazard profile, and control room infrastructure, book a demo.
