What a Safety AI Agent Should — and Should Never — Decide

The vehicle had been drifting toward the pedestrian walkway for eleven seconds before the alarm reached the control room operator. On that particular site — a large chemical plant in the north of England — the control room was staffed, the operator acted, and the forklift driver was redirected before anyone was hurt. The event was logged, reviewed, and used to tighten the vehicle exclusion zone boundary.

What nobody on that site had done, and what no vendor at the time was proposing, was let the AI decide what to do next. The system detected, classified, and alerted. A human confirmed and acted. That division of labour was right. The question this article addresses is where the boundary should sit as AI capability grows and marketing language becomes increasingly aggressive about what safety systems can and should do autonomously.

The term "agentic AI" has arrived in safety technology with considerable momentum and very little precision. It is worth being exact about what it means in practice, and honest about where the limits should sit — not because the technology is unimpressive, but because the stakes are too high to get wrong.

What "AI Agent" Actually Means in a Safety Context

In general software, an AI agent is a system that perceives its environment, reasons about a goal, and takes actions — potentially across multiple steps and without a human confirming each one. A customer service agent can book a return flight, send a confirmation email, and update a CRM record without anyone checking its work at each stage.

In a safety context, "acting" means doing something in the physical world — triggering an alarm, closing a door, stopping a machine, or dispatching emergency services. The consequences of an error are not a wrong booking confirmation that can be cancelled. They are a machine that shuts down unexpectedly and injures the worker who did not expect it to stop. They are an emergency services dispatch to a location that did not, in fact, have an incident. They are a confined space entry denied to a rescue team because an automated door control did not re-evaluate correctly.

The hype cycle often presents agentic AI as a spectrum upgrade: more AI capability equals better outcomes. In safety-critical systems, that assumption is both the selling point and the potential failure mode. More autonomous action is not automatically safer — it depends entirely on whether the action being automated carries a risk of harm if wrong, and whether a human could have caught the error first.

The useful framing is not "how much can the AI do?" but "which actions can be taken faster and more reliably by a machine, and which actions require a human to absorb responsibility before they are taken?"

The Action Spectrum

Safety AI operates on an action spectrum that runs from pure observation through to autonomous physical intervention. Naming the five points clearly is more useful than debating whether any given system is "agentic":

The SecureSafety control room view: AI detects and raises events; human operators review, acknowledge and escalate. The interface is designed to make the decision point explicit.

1. Detect — The system perceives an event: a person without PPE, a vehicle too close to a pedestrian, a flame signature, a fall.
2. Alert — The system notifies a human: control room screen, smartwatch, site radio, PA announcement.
3. Recommend — The system suggests a response: "Recommend: suspend loading operations on Bay 4 — wind speed at sensor 3 exceeds 15 m/s."
4. Automate — The system takes a predefined, bounded action without waiting for human confirmation: trigger a PA warning, route an alert to a supervisor, create an incident log entry.
5. Decide — The system exercises judgment about what to do in a situation it was not explicitly pre-programmed to handle — and acts.

Points one and two are where almost all deployed safety AI currently operates, and where it has built its track record. Point three is useful and relatively safe, provided the recommendation interface requires a human acknowledgement before any action follows. Point four — bounded automation — is where genuine capability exists and where responsible deployment is straightforwardly achievable. Point five is where the conversation needs to stop, at least until the legal and technical frameworks for genuine autonomous decision-making in safety-critical environments are established.

Where the Line Is — and Why

The EU AI Act, which applies to AI systems placed on the EU market or used in the EU and which came into full effect for high-risk systems in August 2025, provides a useful legal anchor. Workplace safety AI falls within Annex III, category 4, which covers AI systems intended for use in employment and workers management — including safety management functions. For these systems, Article 14 requires that high-risk AI systems be designed and developed so they can be effectively overseen by natural persons during their use.

That is not a bureaucratic formality. It reflects the considered position that the class of decisions with serious or irreversible consequences must, for now, sit with people. A human can be held accountable. A human can exercise judgment that accounts for context the system did not have. A human can pause and say: "I need more information before I act."

HSE guidance on automated control systems — including the principles developed from the offshore industry's experience with alarm management and safety instrumented systems — makes a parallel argument from an engineering safety perspective. Automation handles well-defined, bounded, time-critical functions. Human operators handle ambiguous, irreversible, or escalating situations. The discipline of Safety Instrumented Systems (SIS) engineering, governed by IEC 61511 in the UK process industry, encodes exactly this distinction: automatic protective actions are defined precisely and tested rigorously; anything outside those definitions routes to the operator.

The practical line runs through consequence and reversibility. Two questions resolve most cases:

• If this action is wrong, can it be quickly undone without harm?
• If this action is wrong, could it directly injure someone or expose the organisation to serious legal liability?

Where the answer to the first is yes and the second is no, automation is appropriate. Where the answers reverse, a human must be in the loop before the action happens.

What Machines Can Safely Trigger Automatically

There is a meaningful category of actions that safety AI can and should trigger without a human confirmation step, because they are time-critical, bounded, reversible, or consequentially low-risk.

PA announcements and audible warnings. A pre-recorded safety announcement played over the site PA is low-stakes. A false positive causes a brief operational disruption; a true positive may prevent a serious incident. The asymmetry strongly favours automation. The same applies to audible alarms at a specific location.

Machine interlocks and controlled stops. Where a safety AI is integrated with a machine's safety PLC, a detected event can trigger a controlled stop — the same functional role as a safety light curtain or proximity sensor. The critical distinction is that the AI is triggering a pre-engineered, pre-tested safety function, not inventing a novel response. The stop is bounded and defined. This is engineering automation, not autonomous decision-making.

Access control and door locks. Automatically preventing entry to a restricted zone via an access-controlled door or turnstile is bounded and reversible. If wrong, the worker waits for manual override. If right, an unauthorised entry is prevented. The delay from a false positive is an operational inconvenience; the consequence of a true negative — an unauthorised person in a live restricted zone — could be serious.

Alert escalation routing. Automatically routing an unacknowledged alert to the next-level supervisor, or escalating its priority category after a defined period without acknowledgement, is a notification management function. No physical action results. The human still decides what to do; the system ensures the right human knows in time.

Incident log creation. Automatically generating a timestamped incident record when an event is detected creates the audit trail a human will later review. The record is information, not action. No harm follows from an incorrect log entry; it is correctable at review.

What Must Stay Human

Disciplinary action. A safety AI system can provide evidence that a PPE non-compliance occurred — with timestamp, camera reference, and confidence score. The decision to act on that evidence, informally or formally, is a management decision with employment law implications. It requires human context: was the worker responding to an emergency? Is this part of a documented pattern? Was the PPE breach in a zone where the rule was correctly configured? No AI agent should trigger a disciplinary process.

Incident escalation to authorities. Reporting a notifiable incident under RIDDOR (the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) is a statutory act made by a responsible person in the organisation. The AI can flag that an event may be RIDDOR-reportable. The human verifies and makes the report.

Medical decisions. If a fall detection or person-down event fires, the AI's role is to alert first responders immediately. Whether to call an ambulance, which emergency protocol to apply, whether the worker is conscious — these decisions belong to the person on the ground or in the control room, informed by the AI's alert, not delegated to it.

Permanent operational changes. Redirecting permanent pedestrian routes, reclassifying zone risk ratings, or permanently shutting down equipment are decisions with consequences that extend beyond the moment. They require a human authorisation chain.

Novel or unclassified situations. If an event does not match a pattern the AI was designed and trained to handle, the system must not default to an autonomous response. Uncertainty should route to a human, not to a best-guess automated action. A system that acts confidently in situations it was not designed for is more dangerous than one that escalates to a human when it reaches the edge of its training.

Designing Human-in-the-Loop at the Right Intervention Point

The goal of human oversight is not to create friction for its own sake — it is to put a human in the loop at the moment where human judgment adds genuine value and the consequences of error are significant.

Over-inserting human checkpoints defeats the purpose of automation. If every PA announcement requires a supervisor tap, the system will be slower than a phone call and will be bypassed in practice. Under-inserting them creates liability exposure and — more importantly — risk.

The practical design principle is this: match the intervention point to the consequence window. For events that unfold in seconds — a vehicle in a pedestrian zone, a flame signature in a storage area — the machine must act immediately. The action should be bounded: an alarm, a controlled interlock, an automated alert routing. The human's role is acknowledgement and escalation, not first response. For events that unfold more slowly — a pattern of PPE non-compliance building over a week, a fatigue indicator accumulating across a shift — the machine surfaces the pattern, and the human decides what to do with it.

Interface design matters as much as logic. A control room display that forces binary choices — acknowledge or escalate — is safer than one that presents a menu of automated responses for the operator to authorise under pressure. Cognitive load at the moment of an incident is the enemy of sound decisions. The interface should make the right action the obvious and fast one.

Decision Matrix: Should the AI Act or Alert a Human?

Scenario	Consequence if wrong	Reversible?	Recommended approach
Vehicle in pedestrian zone	Brief disruption	Yes	AI triggers PA warning automatically
Missing PPE at zone entry	None immediate	Yes	AI alerts supervisor; human decides response
Fire signature detected	Disruption if false positive	Yes	AI triggers PA evacuation + interlock automatically
Unacknowledged alert (2 min)	None	Yes	AI escalates to next supervisor automatically
Worker on ground (fall)	Delayed response	N/A	AI alerts first responders; human confirms and acts
Worker enters restricted zone	Brief access delay	Yes (manual override)	AI triggers access hold automatically
Possible RIDDOR-notifiable event	Legal liability	N/A	AI flags; human reviews and reports
Disciplinary follow-up	Employment liability	N/A	Human only — AI provides evidence record
Pattern of non-compliance	None from the record	N/A	AI generates report; human reviews and acts
Novel or unclassified event	Unpredictable	N/A	AI routes to human; no automated action

The pattern across this matrix is consistent. Bounded, time-critical, reversible actions with low consequence-of-error belong to the machine. Irreversible actions, actions with legal or employment consequences, and situations outside the system's training scope belong to the human — informed by the best data the machine can provide, but not replaced by it.

Building Accountability Into the System

Any safety AI deployment that includes automated action — even bounded automation at point four on the spectrum — needs an audit trail that answers two questions clearly: what did the AI detect, and what did it do?

The log must be immutable, timestamped, and attributable. For automated actions, the log records what triggered the action, what the action was, and when it completed. For human-reviewed events, the log records the AI's alert, the human's acknowledgement, and the human's decision. This is not administrative overhead — it is the architecture of accountability that both the EU AI Act (Article 14 and the transparency and record-keeping requirements of Articles 12 and 13) and HSE's general duty framework expect.

HSE's principles of good safety management — reflected in documents from Successful Health and Safety Management (HSG65) through to the recent Safety Management in Major Hazard Industries guidance — consistently return to the same point: effective safety management makes invisible hazards visible and creates clear records of who knew what and when. An AI system that acts without leaving a clear trace of its reasoning and its outputs does neither.

Offshore Proof at Scale

SecureSafety has operated within this framework — bounded automation, human-confirmed escalation — on oil and gas rigs since 2018. Thirteen offshore platforms, approximately 18,000 events processed daily, a sub-0.05% error rate. On an offshore platform, a false positive that triggers an unnecessary evacuation of the drill floor carries serious operational and safety consequences of its own. A false negative that misses a genuine fire signature is worse. The pressure to calibrate the machine-versus-human boundary correctly is not theoretical — it is the condition under which the system was designed.

That same framework applies onshore. Let the machine be fast and tireless where speed and consistency matter most. Let the human be accountable where judgment and consequence demand it. The boundary between those two is the most important design decision in a safety AI deployment — and it should be explicit, documented, and reviewed as both the technology and the operating environment evolve.

If you are evaluating a safety AI deployment and want to map this framework against your site, operations, and risk profile — including which automated actions are appropriate and which require a human in the loop — book a demo. We are direct about what the system does, what it does not do, and where the line sits.