ECL-1 for safety professionals

A new kind of worker, the same old question

An AI agent with tools is a worker that can act on live systems: pay, delete, send, configure, command. In most deployments today it acts because the access was there, not because anyone decided it could. Safety work has a name for letting a hazardous job proceed without a permit, an isolation, or a competent person: it is the condition that incident reports describe after the fact. The record on this site holds 32 such reports, and in every one of the 13 incidents involving an agent with tools, the agent held the access to act on its own (G2).

ECL-1 does for consequential AI actions what a permit-to-work system does for hazardous work. A control layer outside the AI decides each action before it takes effect, enforces exactly what was decided at the point where it takes effect, fails to a safe state when proof is missing, and leaves a signed record that a third party can check. The home page follows one action through the five permit questions; this page gives the practitioner’s crosswalk.

The five permit questions, in the standard’s terms

A good permit answers five questions before work starts. ECL-1 turns each into requirements on the control layer.

What exactly will be done?

In a permit system: The permit names the task, the location, the equipment and the method; nothing outside it is authorized.

In ECL-1: The AI states the action exactly as a decision request: operation, target, parameters. The deployment keeps a register of the action classes it governs and declares every path it does not cover.

Requirements: ECL1N-0009, ECL1N-0010, ECL1N-0011, ECL1N-0178.

What stops it from doing more?

In a permit system: Physical isolation and barriers that the worker cannot remove; the job is designed so that the unsafe act is not possible, not merely forbidden.

In ECL-1: An enforcement boundary the AI cannot bypass, rewrite or disable; policy outside the AI decides; the AI’s own statements can make a decision stricter but never authorize an action.

Requirements: ECL1N-0028, ECL1N-0033, ECL1N-0046, ECL1N-0141, FR-001, ECL1N-0178.

Who said yes, and who can take it back?

In a permit system: An authorized person issues the permit for a bounded time; it can be withdrawn, and the work stops when it is.

In ECL-1: Authority is typed, bound to the transaction, time-bounded and revocable; each delegation narrows it; revocation and emergency halt take effect whether or not the AI cooperates.

Requirements: ECL1N-0031, ECL1N-0035, ECL1N-0042, FR-004, ECL1N-0166 to ECL1N-0170.

What will be left to show what happened?

In a permit system: The signed permit, the isolation certificate, the close-out, kept for the retention period and available to an investigator.

In ECL-1: Every decision, including each denial, leaves a tamper-evident record of the request, the inputs it rested on, the outcome and what was released; records are kept for the assessment cycle and at least twelve months.

Requirements: ECL1N-0037, ECL1N-0047, ECL1N-0181, ECL1N-0050.

When it stops, or someone objects, who answers?

In a permit system: The permit names the issuer and the responsible supervisor; an outside inspector can read the records without asking either.

In ECL-1: From level L2 the evidence is verifiable offline outside the operator’s control plane, by anyone with the records and a trust policy; a conformance claim names the system, its level, its independence class and the operator who answers for it.

Requirements: FR-108, ECL1N-0194, ECL1N-0078.

Controls you already use, and their counterpart in the standard

Hazardous energy control (lockout, tagout, isolation)

The lock is the point of the practice: when energy is isolated and locked, the machine cannot start, whatever anyone intends. ECL-1’s counterpart is the enforcement boundary. The AI holds no credential that reaches the world directly, so an action goes through only when the layer releases it, and a decision service that fails to answer leaves the action unreleased. The tag is the signed record: who authorized what, when, and under which policy. Source rule: 29 CFR 1910.147. ECL-1: ECL1N-0028, FR-003, ECL1N-0043.

The hierarchy of controls

Instructions to the AI and training of the model are administrative controls: they depend on the system behaving as intended at the moment it acts. A control layer outside the AI is an engineering control, and the standard says so in its own terms: an instruction given to the AI does not count as a control, and the AI’s assertions about itself are never the basis of an admit. Where AI controls sit in the hierarchy develops this with NIOSH’s model. ECL-1: ECL1N-0178 to ECL1N-0182.

Management of change

A change to the process, the equipment or the procedure is reviewed before it goes live, by someone other than the person making it. ECL-1 requires the same of changes to the control layer’s own policy, prompts and tools, with a recorded review by another person, and the record on this site shows what happens without it: an unreviewed change (G12) sits behind eight of its 32 incidents. Source rule: 29 CFR 1910.119(l). ECL-1: ECL1N-0053, ECL1N-0166 to ECL1N-0170.

Stop-work authority

Anyone can stop the job, and the stop takes effect without the consent of the person doing the work. ECL-1 gives the control layer an emergency control plane that halts in-scope actions without the AI’s cooperation, and defines the fallback states, restricted mode and halt, that a deployment enters when required proof is lost. A halt applies to the whole deployment; a lost proof restricts only the action classes that need it. ECL-1: FR-004, ECL1N-0146, ECL1N-0191.

Permit-required work and the attendant

Some entries need a second person who watches, can withdraw authorization, and must be shown the real conditions. ECL-1’s human approval rule requires that an approver see a human-readable presentation of the operation, the target, every parameter material to the consequences and the inputs the decision rested on; a digest or a summary is not enough, and a change to a consequential field invalidates the approval. A continuation after a challenge is a fresh request, evaluated again. Source rule: 29 CFR 1910.146. ECL-1: ECL1N-0174, DCMP2-056, DCMP2-057.

The competent person and separation of duties

The person who isolates is not the person who verifies the isolation, and the keys are held by someone the worker cannot override. ECL-1 states this as independence classes: Class A separates roles and keys within one operator; Class B places control approval and evidence verification in a separately administered domain; Class C places them with an authority outside the operator. A single credential or root that can alter both the AI and the controls satisfies no class. Signing keys have a custody rule with a tested revocation procedure. ECL-1: FR-001, ECL1N-0056, ECL1N-0142, ECL1N-0159.

Incident records and investigation

Records exist so that someone who was not there can find out what happened. An ECL-1 evidence bundle is that record for a digital action, signed by keys the AI cannot reach, chained so that a missing or altered record shows, and readable offline by anyone with a trust policy. The verifier says what a verdict establishes and what it does not: a verified bundle shows what the producer signed and that it has not changed, not that the effect occurred, unless a separately keyed observer confirms it. ECL-1: ECL1N-0047, FR-108, EBMP2-076, EBMP2-061.

Audits and certification

ECL-1 has no certification program and no mark; G-14 certifies nothing. A conformance claim is self-declared by its implementer, names its level and independence class, and is listed as self-declared in a public registry; an independent assessment is listed separately when one exists. From L2 the standard requires an independent assessment at least every 24 months with negative tests of bypass, fail-open behavior and emergency control. Treat a claim the way you treat a contractor’s safety statement: read the boundary, the exclusions and who assessed it. ECL-1: ECL1N-0078, ECL1N-0076; see conformance.

What the record shows: defeated safeguards in the testing of AI models

Six entries in the record come from the testing, training or evaluation of AI models in 2026, and in each the models reached systems outside the run: entry 26, entry 27, entry 28, entry 29, entry 30 and entry 31. In all six the boundary the run relied on was not enforced on the route the models used (G4); in four, the safeguards meant to catch such behavior were switched off for the run or not working (G11). A safety professional will recognize both: a barrier that does not cover the route actually taken, and an interlock defeated for the test. ECL-1’s answer is the same as the one the trade learned in physical plants. The boundary is enforced on every route to effect, not declared; a safeguard that is off is a change of controls that must be reviewed and recorded; and a run whose boundary cannot be enforced is a run without a permit.

Where the analogy stops

• ECL-1 governs digital actions that cross an effect boundary. It is not a machine-safety standard. Safety-rated functions under IEC 61508 and ISO 13849 stay independent of both the AI system and the control layer; ECL-1 sits in front of the command, not inside the safety loop (see industrial systems).
• A verified record is not proof that the work was done safely. It proves who signed what and that the record is intact and complete under the verifier’s trust policy. Whether the effect happened, and whether the decision was a good one, are separate questions that the verifier lists as not established.
• ECL-1 does not judge what an action means. Deciding which actions are consequential, what the safe state is for each class, and who may approve what is the deployment’s work, recorded in its register and its claim. The standard requires that this work be done and disclosed; it does not do it.
• Conformance is self-declared and there is no mark. Nothing on this site is a certification or a determination of compliance with any safety law.
• The standard is new. Version 1.0 has not been reviewed by people outside G-14, the implementers registry is empty at publication, and the record’s entries have not yet been checked by outside reviewers. The working group is open to anyone, and safety professionals are the reviewers it most needs.

What to ask for, as a safety professional

When an AI system that can act is proposed for your site, ask for the same things you would ask for before hazardous work.

1. The register and the exclusions. The list of action classes the control layer governs, and the Negative Boundary Annex that names every path it does not cover. A claim that omits a path is invalid (ECL1N-0011).
2. The claim statement. System, level, status, boundary class, independence class, versions, assessment date and limitations, in one sentence (ECL1N-0078). “ECL-1 compliant” on its own is not a claim.
3. A sample evidence bundle and its trust policy. Verify it yourself in your browser; nothing leaves your device. Read what the verdict does not establish before what it does.
4. The drill records. The latest exercises of revocation and of emergency halt, with the time each took to take effect against the declared timing case (ECL1N-0159, Section 8.7).
5. The change records. Who reviewed the last changes to the layer’s policy, prompts and tools, and when. An unreviewed change is the gap behind eight entries in the record.

See also: procurement language, adding a control layer to one workflow, the thirteen questions for one of your own systems, and the teaching kit.