Workplace safety & PPE compliance monitoring

Safety officers cannot watch every gate, crane lane and loading dock, and PPE rules (helmet, high-visibility vest, goggles, gloves) are routinely missed. Computer vision on existing cameras detects missing PPE, people in exclusion zones or near moving vehicles, and slips or falls, then warns on site and aggregates findings for the safety organisation. In the EU the deciding question is design: area-level, anonymised safety analytics with works-council agreement is feasible; individual performance surveillance or emotion inference is not.

Problem & value

• Today: compliance relies on spot checks, supervisor walk-rounds and incident investigations after the fact. Observation covers a tiny fraction of working time; near misses are rarely recorded.
• AI value: continuous, objective coverage of defined rules; immediate warnings at the moment of risk; trend data (which zone, which shift, which contractor) to target training, signage and layout changes.
• Evidence: the EU-OSHA treats AI-based monitoring as a growing field of digital OSH tools with both preventive potential and psychosocial and privacy risks [1]. Vendor-reported reductions in violations exist, but they are mostly self-published case studies; measure your own baseline rather than relying on them.
• Legal pull: employers must assess risks and provide and enforce PPE under Directive 89/656/EEC and the Framework Directive 89/391/EEC; analytics supports, but never replaces, the employer's duty [2].

Variants

• Construction sites: helmet, vest, exclusion zones around excavators and crane loads, often on temporary cameras with solar/LTE power.
• Manufacturing & chemicals: goggles, gloves, hearing protection, machine-guard zones, restricted areas.
• Warehouses & logistics: pedestrian/forklift proximity, blocked emergency exits, loading dock behaviour.
• Energy & utilities: high-voltage or confined-space entry checks, hard hats and vests at substations.

How it works

1. IP cameras (RTSP)
2. edge box / on-prem server
3. decode + privacy filter (optional face/body blurring, VIS-030)
4. person detection + tracking
5. PPE classification per person (helmet, vest, goggles, gloves) and zone logic (polygons)
6. temporal rules (e.g. violation > N seconds, confirmed over several frames)
7. alert (local signal / tablet / chat) + short anonymised clip
8. aggregation (counts per zone/shift, no names)
9. dashboard
10. safety-officer review
11. corrective action (training, signage, layout)

• Detection: YOLO-class detectors or open-vocabulary detectors identify people and PPE items; a tracker keeps identities across frames within one camera view only. PPE can be detected as separate objects or as person-attribute classification.
• VLM layer: vision-language models answer open questions on flagged clips ("is the person working at height without harness?") and summarise events, but run on clips, not on every frame (cost, latency). See VIS-031.
• Human-in-the-loop: alerts are reviewed by the safety officer; disciplinary use is excluded by design (and often by works agreement). Rules and thresholds are tuned with the works council.

Data preparation

Data: camera streams from existing CCTV or new cameras, site plans with marked danger and exclusion zones, PPE rules per area (risk assessments, Gefährdungsbeurteilung), and incident logs. In an SMB these live in the NVR or CCTV recorder, safety folders on file shares, paper accident books and the safety officer's knowledge.

Typical gaps: poor camera angles and lighting, no zone maps, PPE rules scattered across documents, no labelled examples of your own helmets or high-visibility vests, and no inventory of which cameras may legally be used.

Preparation steps: 1. Inventory cameras and capture RTSP access (PREP-001, PREP-005). 2. Digitise the zone map and per-zone PPE rules from risk assessments (PREP-013). 3. Collect 200-500 site-specific images and label them with the safety officer (PREP-018); blur faces before storing training images (PREP-022). 4. Define what is stored: events and counts only, no continuous video (PREP-024, PREP-025).

Effort: low, about 10-20%, because pre-trained PPE models exist; most work is camera setup and the legal and organisational clearance. See GUIDE-003.

Implementation paths

Which path for whom

• SMB: C, because the video shows employees, so keeping processing on a local edge device (HW1) with only anonymised counts leaving the site is the safest design, and the same platform can serve other camera use cases.
• Enterprise: C, because many sites make per-camera licences costly, the data is sensitive and a shared edge-vision platform with central governance pays off.
• Developer: C, because open-source detectors (e.g. YOLO-family models) run on HW1 and allow full control over privacy features like blurring.

Path A — Buy

• Specialised EHS video-analytics SaaS/platforms: Intenseye, Protex AI, Voxel (US; independent and venture-funded as of its 2025 Series B, check current ownership), Everguard, Viso Suite (Switzerland), plus PPE modules from large video-analytics vendors such as Hanwha Vision, Axis (on-camera analytics, EU/Sweden), Bosch (EU/Germany), Hikvision-class vendors (check supply-chain and security restrictions for public and critical-infrastructure buyers). Construction-specific: Newmetrix (Oracle); check current offers.
• EU/EEA-based options to shortlist: Axis, Bosch, Viso.ai, local integrators using Nvidia Metropolis/DeepStream or Hailo-based cameras.
• Check: on-prem or EU-region processing, no biometric identification, anonymised outputs, works-council-ready documentation (what is stored, how long, who sees it), DPIA support, retention settings, detection accuracy on your camera angles and lighting.
• Choose A when: under ~100 cameras and no in-house CV team.

Path B — Build on cloud APIs

• Managed vision services: Azure AI Vision / Video Indexer, Google Cloud Vertex AI / Video Intelligence, AWS Rekognition PPE detection (a dedicated API that returns PPE per detected person, in EU regions) [3].
• Multimodal APIs (Gemini, Claude, GPT, Mistral) for clip-level checks and summaries only; sending continuous video to a cloud API raises GDPR and cost issues, so use cloud for flagged snippets after on-prem anonymisation.

Path C — Self-host (open source)

• Models: Ultralytics YOLO (check AGPL/enterprise licence), RT-DETR, Grounding DINO / YOLO-World for open-vocabulary, SAM-class segmentation; pretrained PPE datasets are available but domain gap is common.
• Stack: NVIDIA DeepStream / Metropolis, Frigate, Roboflow Inference, OpenVINO, MediaPipe; tracking via ByteTrack/BoT-SORT; small VLMs (Qwen-VL family, Gemma) for clip review.
• Hardware: HW1 (Jetson Orin, Hailo-8, Intel iGPU) handles several streams at the edge; HW2 for dozens of streams and VLM clip review.

Path D — Custom training

Often worthwhile: fine-tune on your own PPE (company-specific helmet colours, hi-vis types, welding gear) and camera views. A few hundred to a few thousand labelled frames per site type typically lift accuracy substantially; use active learning on missed and false alerts.

State of the art (2026)

• Detection of helmets and vests is mature on clear, medium-distance views; gloves, goggles, earplugs, harness attachment and small items at distance remain much harder.
• Open-vocabulary detectors and VLMs reduce labelling effort for new PPE types and enable free-text rules, but are slower and less consistent than tuned detectors; hybrid designs (fast detector triggers, VLM verifies) are the practical pattern.
• Edge AI (Jetson, Hailo, on-camera chips) keeps video local and enables privacy-by-design: only events and counts leave the site.
• Limits and failure modes: occlusion, backlight, rain, night, dirty lenses, unusual viewpoints; look-alike colours (yellow vest vs. work clothes); false alarms causing alert fatigue.

Shared resources & combinations

• Same stack (object-detection + tracking + edge-runtime): VIS-010, VIS-012, VIS-008, VIS-019, VIS-034. Each purpose needs its own legal basis and works agreement; never repurpose safety footage for productivity measurement.
• Complements: VIS-024 (ergonomics), VIS-028 (in-cabin), VIS-030 (anonymisation), VIS-031 (VLM video search over events), ROBO-016 (certified machine safety; vision AI for PPE is not a safety function).

Effort, cost & KPIs

• Path A: days to weeks for a pilot with 2–5 cameras; pricing usually per camera per month plus edge hardware.
• Path B: 2–4 months; costs driven by video egress, inference volume, integration.
• Path C/D: 3–6 months incl. data collection, labelling, tuning; edge hardware per site.
• KPIs: precision and recall of alerts on a labelled test week, false alerts per camera per day, PPE compliance rate per zone (aggregated), near-miss rate, time from alert to correction, lost-time injury trend (long-term, confounded), acceptance by workforce (survey).

People & change

Involve early, before any camera is bought: management, the works council, the DPO, the safety specialist (Fachkraft für Arbeitssicherheit) and department lead, IT security for the camera network, HR, and finally the workers affected.

Works council: yes. Cameras that detect employees' behaviour are technical systems suited to monitor behaviour, so §87(1) no. 6 BetrVG gives co-determination; objective suitability is enough, even if the purpose is safety only. Also inform it under §90(1) no. 3 and consider engaging an expert under §80(3). Conclude a works agreement covering purpose limitation (safety only, no performance evaluation), no individual-level reporting, storage and deletion periods. Public bodies involve the Personalrat (BPersVG or state law).

Data protection: personal data is processed, and systematic observation of employees likely requires a DPIA (Art. 35 GDPR), an AVV with any processor and a documented legal basis (GUIDE-005). Prefer on-device processing, blurred or aggregated outputs.

AI literacy and communication: brief all affected staff on what is detected, what is stored and who sees alerts, and train safety staff to handle alerts (GUIDE-006, GUIDE-008).

Pilot: one zone with consenting teams and a fixed review date (GUIDE-009).

Concerns: "surveillance" (aggregated data, no individual discipline from AI output) and false alarms (human review before any consequence; people remain in control).

Risks, regulation & compliance

• EU AI Act: classification depends on the design. Pure PPE and zone detection that does not identify or evaluate individuals is generally not an Annex III use and counts as minimal risk, with AI literacy (Art. 4) applying. It becomes high-risk if outputs feed decisions about workers such as monitoring and evaluating performance or behaviour, task allocation, or discipline (Annex III, point 4) [4]. Art. 5(1)(f) prohibits AI systems that infer emotions of people in the workplace (except for medical or safety reasons as stated in the Act); fatigue or "stress" inference from faces must be assessed against this prohibition and the Commission's Art. 5 guidelines [5]. Real-time remote biometric identification is separately restricted; do not use face recognition to attribute PPE violations to named individuals (see VIS-016).
• GDPR: video of employees is personal data even if no names are stored. Needs a legal basis (typically legitimate interest/Art. 88 national employment rules; in Germany §26 BDSG, as modified by the CJEU decision on employee data rules), data minimisation, short retention, a DPIA (likely required for systematic monitoring of employees), and transparent signage and information [6].
• Co-determination (Germany/Austria etc.): works council must agree (§87(1) no. 6 BetrVG covers technical devices suitable for monitoring behaviour or performance). Conclude a works agreement that excludes individual performance evaluation and disciplinary use, defines retention and access.
• Mitigations: privacy-by-design (edge processing, blurring, aggregate-only dashboards), no identification, documented purpose limitation, regular accuracy and bias tests, human review of every alert-driven action, clear communication to staff.

Getting started

1. Define the objective with safety officer, data protection officer and works council before any pilot; write down the purposes you exclude (performance, discipline, emotion inference).
2. Choose 2–3 high-risk areas with existing cameras and a clear PPE matrix; record the baseline from manual observation.
3. Pilot with a vendor (Path A) or an open-source edge stack (Path C) in alert-only mode, no storage of identifiable video beyond short clips.
4. Measure precision/recall on a labelled week and tune zones, thresholds and alert channels to limit false alarms.
5. Complete the DPIA and works agreement, then scale zone by zone with aggregated reporting.

Sources

1. EU-OSHA — Digitalisation and occupational safety and health (AI-based worker monitoring) — https://osha.europa.eu/en/themes/digitalisation-work
2. Council Directive 89/656/EEC (personal protective equipment at the workplace) — https://eur-lex.europa.eu/eli/dir/1989/656/oj
3. AWS — Amazon Rekognition PPE detection — https://docs.aws.amazon.com/rekognition/latest/dg/ppe-detection.html
4. Regulation (EU) 2024/1689 (AI Act), Art. 5 and Annex III — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
5. European Commission — Guidelines on prohibited AI practices (AI Act Art. 5) — https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
6. EDPB — Guidelines 3/2019 on processing of personal data through video devices — https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en
7. Ultralytics YOLO documentation — https://docs.ultralytics.com/
8. NVIDIA DeepStream SDK — https://developer.nvidia.com/deepstream-sdk