Business case and benefits
- Construction director
- A · Accountable
- H&S manager
- R · Responsible
- Site manager
- C · Consulted
- Solutions architect
- C · Consulted
- Technical PM
- C · Consulted
- Engineers
- I · Informed
- DPO
- I · Informed
- Worker reps
- I · Informed
People near moving plant, open edges and lifts spotted in seconds and flagged to the supervisor and the operator, with near-miss trends feeding next week's plan. No one is identified, scored or disciplined by the system, and people make every call.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Construction is still one of the most dangerous places to work in Great Britain. HSE's provisional figures for 2025/26 record 25 construction workers killed, more than any other industry, and across all industries falls from height and being struck by a moving vehicle are the two biggest causes of fatal injury. The risks are well known: people walking into the blind spots of excavators and dumpers, open edges left without guard-rails after a trade has finished, and people under or near a suspended load.
On a large site the controls are mostly physical and procedural: segregated haul routes, edge protection, lift plans, permits, banksmen and supervisors. They work when they're in place. The gaps appear when the site changes daily, a barrier is moved and not put back, a pedestrian takes a shortcut across a plant route, or a lift drifts outside its planned zone. A supervisor responsible for a whole floor or a whole compound can't see everything at once.
Near misses tell you where the next accident is likely, but most are never reported. The ones that are sit as free text in the health and safety system, and patterns across zones, phases and sites only show up when someone has time to read them all. A monitoring system has to help supervisors see and act on the gaps, without turning into surveillance of the workforce, which would destroy the reporting culture it depends on.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
People detected inside plant exclusion zones, per 1,000 plant operating hours, by zone. The measure that shows whether segregation is working.
ExampleFalling month on month after the pilot
Share of alerts that supervisors confirm were real. Too many false alerts and operators and supervisors stop looking.
ExampleAbove 80%, reviewed weekly by hazard type
How long from an alert to the supervisor recording what they did, such as a barrier replaced or a route closed.
ExampleUnder 15 minutes for open-edge and lift alerts
Near misses reported by people on site, not detected by cameras. It should rise at first, as reporting gets easier and trust grows.
ExampleRising in the first six months
Share of the zones in the construction phase plan that have working cameras today, updated as the site changes.
ExampleEvery zone the plan says is covered
Short survey and safety representatives' feedback: do people understand what the cameras do and trust what they're not used for?
ExampleAsked quarterly, results shared on site
Cross-sector rules are on the UK regulation map.
The principal contractor must plan, manage, monitor and coordinate the construction phase, and record the arrangements in the construction phase plan. Camera monitoring is one control in that plan, not a substitute for supervision, inspections, permits or segregation. HSE's statement on its approach to AI (June 2026) is clear that health and safety law applies to AI, so the system and its failure modes get their own risk assessment. Regulation 14 requires the principal contractor to consult and engage with workers, which is where this system is introduced.
People and plant must be kept apart by the site layout first. Cameras spot when that separation fails; they don't replace it. Fitting cameras and alert units to plant changes work equipment, so do it with the plant owner, keep the operator's view clear, and never connect the unit to the machine's controls. Any engineered proximity system that already slows or stops a machine stays in place and is outside this design.
The order is: avoid work at height, prevent falls with collective protection such as guard-rails, then minimise the consequences. A detected gap in edge protection prompts a supervisor to check and fix it; it never counts as the inspection the regulations require. PPE is the last line of protection, so PPE alerts are limited to designated zones and treated as a sign that a higher control has failed.
Every lift must be planned by a competent person, supervised and carried out safely. The lift plan defines the exclusion zone; the system checks that zone during the lift and alerts the lift supervisor and the crane operator. They decide whether to stop. The system never signals a crane or tells a slinger-signaller what to do.
Camera images of people are personal data, and many of the workers belong to subcontractors. That means a DPIA before any camera goes live, a clear purpose written down, the least intrusive means, signs and induction briefings so everyone on site knows, no covert monitoring, short retention, and views sought from workers and their representatives. The ICO says its monitoring guidance is under review following the Data (Use and Access) Act 2025.
Using facial recognition, or any biometric feature, to identify people is processing special category biometric data, which needs an additional legal condition and is hard to justify on a site. This design avoids it entirely: the models detect a person, a hard hat or a hi-vis vest, never who someone is. Faces are blurred on the edge box before any clip is stored.
The Act received Royal Assent on 18 December 2025. It sets no specific rule on site cameras, but the government consulted from July to September 2026 on whether employers should have to consult representatives before introducing monitoring technology. Consulting safety and worker representatives from discovery, and agreeing in writing that footage is not used for discipline, fits any likely outcome.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Site
02Edge
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Cameras and placementCamera positions follow the zones in the construction phase plan and move as the site changes. Angle and mask them so public areas and welfare facilities are never in view. | Rugged IP cameras, fixed and plant-mounted, chosen per zone | Rugged IP cameras, fixed and plant-mounted, chosen per zone | Rugged IP cameras, fixed and plant-mounted, chosen per zone |
| Detection on siteAlerts in under a second with no cloud round trip. Amazon Rekognition streaming video analysis closed to new customers on 30 April 2026, AWS Panorama ended on 31 May 2026, and Azure's Spatial Analysis container retired on 30 March 2025, so none is an option. | Model trained in SageMaker AI, deployed to a GPU edge box and plant units by AWS IoT Greengrass V2 | Model trained in Azure Machine Learning, run on Arc-enabled Kubernetes with Azure IoT Operations, or Azure IoT Edge 1.6 LTS | ONNX Runtime or NVIDIA Triton on Kubernetes in the site cabin; a small inference unit on each machine |
| Camera feeds at the edgeLive video stays on site. Only short, blurred clips of confirmed events leave it, and only when the link allows. | Kinesis Video Streams for event clips the safety team reviews (available in London) | Azure IoT Operations media and ONVIF connectors (preview) | An open-source media server and ONVIF discovery on Kubernetes |
| Privacy at the edgeBlur before storage, not after upload. No facial recognition, no badge reading, no linking a detection to a name. | Face and number-plate blurring model on the edge box | Face and number-plate blurring model on the edge box | Face and number-plate blurring model on the edge box |
| Model trainingTrain on your own sites' footage: mud, rain, low winter light, scaffold sheeting. Azure Custom Vision and the Azure Vision Image Analysis API (v3.2 and v4.0) retire on 25 September 2028, so don't start new work on them. | Amazon SageMaker AI | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Image labellingSageMaker Ground Truth closed to new customers on 30 July 2026. Supervisors' confirm or dismiss decisions are the best labels you have. | An open-source tool such as CVAT or Label Studio, in your AWS account | Azure Machine Learning data labelling | CVAT or Label Studio on Kubernetes |
| Near-miss trendsTrends by zone, activity, phase, weather and time of day. Never by named worker. Look-ahead risk is shown for planned activities, as a prompt for the planning meeting. | SageMaker AI | Azure Machine Learning | MLflow on Kubernetes, with open-source libraries |
| Safety review assistantThe vision models detect; the language model only groups, links and drafts. The original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock, Bedrock AgentCore | Microsoft Foundry, Foundry Agent Service | Open-weight models served with vLLM; an open-source agent framework (e.g. LangGraph) on Kubernetes |
| Workflow and events | AWS Step Functions, AWS IoT Core, EventBridge, SQS | Logic Apps or Durable Functions, Event Grid, Service Bus | Temporal or n8n; Apache Kafka or RabbitMQ |
| Link to the health and safety systemConfirmed events become observations in the system you already use. The AI never creates or closes an incident or a RIDDOR report. | API Gateway, plus your existing integration platform | API Management, plus your existing integration platform | Kong or your existing API gateway |
| Human reviewOne screen per alert: the zone, a blurred clip, and two buttons, confirmed or false alarm, with a short note of what was done. | In the supervisors' existing site app or handset | In the supervisors' existing site app or handset | In the supervisors' existing site app or handset |
| Platform on siteSites last a few years and move. Choose hardware that can be packed up and rebuilt on the next site from a standard image. | Greengrass on a rugged GPU edge box in the cabin | Arc-enabled Kubernetes (e.g. AKS Edge Essentials) on a rugged edge box | K3s or another lightweight Kubernetes on a rugged edge box |
| Identity, keys, device securityEach camera and edge box has its own certificate. Clip viewing is limited to named safety roles, and every view is logged. | IAM Identity Center, KMS, device certificates in AWS IoT Core | Entra ID, Key Vault, Azure Device Registry certificates | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditWatch camera health, alert rates and false alarms per zone, so a muddy lens or a moved camera is spotted the same day. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyAzure IoT Operations connects to Azure Arc through a listed set of regions, none of them in the UK today. Cloud resources can still sit in UK South; check what metadata goes where. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
Everything live stays on site: cameras, the edge box in the cabin, the in-cab units on plant, detection, blurring and alerts to operators and supervisors. Live video never leaves the site, and alerts don't depend on the internet link.
Uses cloud AI
Model training, labelling, near-miss trends, the safety review assistant and the archive of confirmed event clips run in AWS or Azure, or on your own servers if footage must not leave your estate. New models go back to site only after the health and safety manager approves them.
How they connect
Each site's edge box sends events and selected blurred clips out over an outbound-only, encrypted connection, usually 4G or 5G, sometimes satellite on remote jobs. Model updates come down through the same managed channel, scheduled for evenings when the link is free.
If the link drops
Detection and alerts carry on as normal. Events and clips queue on the edge box and upload when the link returns. If the edge box itself fails, the site works exactly as it did before cameras: segregation, supervision, banksmen and permits, which never depended on the system.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Safety review assistant
Where a person signs offSupervisors decide what to do about every alert, and anyone can still stop unsafe work under the site's own rules. The health and safety manager approves each weekly pack and every model change. Decisions about RIDDOR reporting stay with the responsible person. The assistant's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The alert path is local and simple. A detection on the edge box is checked against fixed rules for that zone (is this an exclusion zone, is a lift in progress) and sent over MQTT to the in-cab unit and the supervisor's handset. The in-cab unit on each machine also runs on its own, so an operator still gets an alert if the site network drops. None of this touches the machine's controls.
Lift status comes from the lift supervisor marking a lift as started and finished on their handset, or from the lift permit, not from the crane itself. Zones come from the construction phase plan and are redrawn by a named person when the site layout changes.
Every event carries an ID, the zone, the camera and the time, but no person's identity. Events queue on site and reach the health and safety system through the API layer as observations for a supervisor to confirm, in order and without duplicates.
The system can be switched off without affecting how the site runs. All existing controls, inspections and permits continue as they are.
Pick one site and two hazards (usually plant exclusion zones and lift zones), walk the site with supervisors and operators, test camera views in real conditions, measure today's near-miss reporting, and brief safety representatives.
Gate · must be true to passHazards and zones agreed, DPIA started, purpose statement drafted with representatives, plant owners agree the in-cab fit.
Cameras and edge detection on one site in shadow mode first: alerts go only to the health and safety team, who compare them with what really happened. Then live alerts to operators and supervisors for the two hazards.
Gate · must be true to passAlert precision and time to act within agreed limits, no use beyond the agreed purpose, representatives' feedback heard, DPIA signed off.
Live on the pilot site with monitoring, support, the weekly review pack and a rollback plan. Near-miss trends added once there's enough history.
Gate · must be true to passSupport model, zone ownership and supervisor training in place; rollback tested.
Add open-edge and PPE-zone detection, then more sites, reusing the edge build and the purpose statement.
Gate · must be true to passEach new hazard and site passes the same pilot gate, including consultation.
| Activity | Construction director | H&S manager | Site manager | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | DPO | Worker reps |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Consulted | Informed | Informed | Informed |
| Hazards, zones and response rules | Informed | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Consulted |
| DPIA, purpose statement and consultation | Consulted | Responsible | Consulted | Consulted | Consulted | Informed | Accountable | Consulted |
| Target architecture and edge design | Informed | Consulted | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Informed |
| Build, plant fit and integration | Informed | Consulted | Consulted | Accountable | Responsible | Responsible | Informed | Informed |
| Model validation on your own sites | Informed | Accountable | Consulted | Consulted | Consulted | Responsible | Informed | Informed |
| Go-live decision | Accountable | Responsible | Responsible | Consulted | Consulted | Informed | Consulted | Consulted |
| Run, review and improve | Informed | Accountable | Responsible | Consulted | Consulted | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the edge pattern on site and on plant, the alert path, the link into your health and safety system, and the gates. I'd report to your programme board and work closely with your health and safety manager, who owns what the system is for and the standard it has to meet.
Option B
If your partner, your camera integrator or your own team already has an architect, I'd take on the edge-to-cloud design, the integration with your health and safety system and the trends work under their lead, and give them a second senior opinion on privacy by design and on how models are validated.
Goes wrong
Workers hear about the cameras on the day they appear, assume they're being watched for discipline, and stop reporting near misses.
How the design avoids it
Consult representatives from discovery, publish the purpose statement, and stick to it. Never use the footage for discipline.
Goes wrong
Too many false alarms, so operators mute the in-cab unit and supervisors ignore notifications.
How the design avoids it
Shadow mode first, two hazards only, and a weekly review of false alarms with the people who receive them.
Goes wrong
The site changes every week, but the zones don't, so the cameras watch yesterday's layout.
How the design avoids it
A named owner for zones on each site, zone changes in the planning routine, and coverage measured daily.
Goes wrong
The demo used clear daylight footage. The site has rain, dust, glare and dark winter afternoons.
How the design avoids it
Prove each hazard can be seen in footage from your own sites, in winter, before choosing a model.
Goes wrong
The system quietly becomes the control: supervision thins out because the cameras are watching.
How the design avoids it
Record it in the construction phase plan as an extra layer, and keep supervision, inspections and permits exactly as they were.
Changes already announced or under way that affect this design. More in the UK horizon scan.
If you run detection on IoT Edge, build on 1.6 LTS or Azure IoT Operations, and plan an upgrade path for every edge box, since site kit moves from job to job.
Consult safety and worker representatives from discovery and keep the purpose statement and DPIA up to date. That fits any likely outcome.
Use event and near-miss categories that can map to new reporting types, and keep RIDDOR decisions with the responsible person, not the system.
Keep the DPIA, purpose statement, access logs and model validation records in a form you could show the ICO, HSE or a safety representative.
Don't build on them. Train models in Azure Machine Learning, SageMaker AI or an open-source stack, in a portable format such as ONNX.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.