A permit-to-work signed at 7am tells you nothing about what happened at 2:30pm.
You know this. Most EHS Directors in heavy industry know it from experience.
By mid-shift, a barrier gets moved to get a lift through. A harness gets unclipped "just for a minute". The exclusion zone around the crane shrinks a little, because the job is running late. None of it ends up in the permit file, the induction log or the prequalification score.
And that's exactly the kind of work where contractors get hurt.
Your board is starting to ask a different question. Not "what's our TRIR?" but "how do we know our contractor controls actually work?" This article is about answering that with evidence, not with another policy. I'll cover why contractors carry so much of the serious risk, why paperwork alone can't answer the board, and how to build a chain of evidence that can. It's written for EHS Directors in steel, metals, energy and chemicals.
On many industrial sites, the person most likely to be seriously hurt isn't on your payroll. The industry numbers are clear about it.
Steel. In 2024, worldsteel members reported 67 fatalities, and 42 of them were contractors, according to the worldsteel 2025 data report. In 2025, the number went up to 74, as the worldsteel 2026 data report shows. worldsteel explains it plainly: fatalities now happen mostly in "high-risk, non-routine activities" like working at height, maintenance, vehicle movement, forklift operations and gas-related work, and "these activities are also frequently carried out by contractors, which explains the disproportionate number of contractor fatalities."
Oil and gas. IOGP's latest data, for 2025, is a warning. Members reported 52 fatalities, up from 32 in 2024. The fatal accident rate rose 75%, even though work hours fell 7%. And 85% of those fatal incidents involved breaking one or more of IOGP's Life Saving Rules. Contractors carry most of the exposure: in 2024, 726 of the 946 lost-workday cases involved contractors, as JPT reported. That's roughly three out of four.
Meanwhile, the headline numbers keep getting better. worldsteel's lost-time injury frequency rate dropped from 0.72 in 2024 to 0.64 in 2025. You've probably seen the same thing on your own sites: the injury rate goes down, but the serious incidents, often involving contractors, barely move.
Why? It's not because contractors are careless. It's about how the work is set up:
So most boards see contractor safety through prequalification scores and induction completion rates. Those tell them what went in. They don't tell them what actually happened on site.
The question in the boardroom is changing. It used to be "what's our TRIR?" Now it's more like "show me that our controls actually work." Three things are pushing it.
Reporting. Health and safety numbers are moving out of the EHS appendix and into sustainability statements that get externally assured. Under the EU's reporting standards, this can reach beyond your own employees to workers in the value chain, and contractors on your site are the obvious example. Exactly what's in scope depends on your group, and that's a question for your reporting team. But the direction is clear: assured reporting needs evidence that would stand up to an audit.
After an incident. When a contractor gets seriously hurt, investigators usually ask three things. What was the rule? How did you tell people about it? And how did you check it was followed, on that day, on that shift, on that job? Paperwork answers the first two. The third is where it struggles, and that's when "we had a policy" stops sounding like a good answer.
Insurers and lenders. Underwriters look more and more at leading indicators and proof that controls work, not only at past losses. Lenders and customers ask about contractor safety in due diligence too.
What links all three is one question: can someone check the evidence? Evidence that a board, an auditor or an investigator will trust usually has four things going for it.
Very little in a typical contractor management setup ticks all four boxes.
Go through the usual contractor process step by step and you'll see the evidence get weaker as you go.
You need every one of these. But none of them checks what actually happened. Put together, they give you a well-documented intention. That's what investigators mean by "paper compliance".
What's missing is a way to keep checking, during the work itself, that a small set of life-critical rules is being followed. That's the stage where the risk is highest, and it's always been where the evidence is weakest.
Contractor safety verification means checking, while the work is happening, that the rules which prevent serious injuries are actually being followed, and keeping a record that someone else can review later.
More paperwork won't get you there. What works is a layer that keeps checking the few rules that kill people when they're broken, and feeds what it finds into your governance process. In practice, that comes down to four steps.
Permits and inspections stay. Continuous checks sit on top of them and feed the board pack.
Step 1: Keep the rule list short, and only include rules you can see. Golden rules work when there aren't too many of them, and they're where the stakes are: in IOGP's 2025 data, 85% of fatal incidents involved breaking at least one Life Saving Rule. For sites with a lot of contractor work, the list usually looks something like this:
Everything on this list, from exclusion zone safety to PPE detection, can be seen on camera. That means you can check it all the time, using the CCTV most sites already have.
Step 2: Check the rule, not the person. Computer vision on your existing cameras makes this practical. Someone standing inside a crane exclusion zone is an event. It doesn't matter if they're an employee or a contractor, or if it's a normal Tuesday or day nine of a turnaround. In EU heavy industry, two things are non-negotiable. They're also what gets contractor firms on board:
This changes the hardest conversation you'll have with a contractor: "you're filming our people?" Your answer becomes: we check conditions and zones, we don't identify or score anyone, and your crew gets the same rules and the same anonymity as ours.
Step 3: Turn detections into evidence the board can use. Detections only become audit-ready when the output is built for review. That means:
That covers all four things the board needs.
Step 4: Feed it back into how you manage contractors. These checks make every paper step better. Prequalification gets real outcome data. Inductions can use anonymised clips from your own site instead of stock videos. Toolbox talks can focus on this week's hotspots. Contract reviews get numbers instead of stories. And joint safety committees with your contractors get the same facts on the table, so the discussion is about the pattern, not the person.
Turnarounds bring all of this together. Lots of contractors, lots of high-energy work, crews who don't know the site, and supervisors stretched thin. If this kind of checking is going to pay off anywhere, it's here. Here's a simple plan for a major outage.
60 to 30 days before: plan. Decide on the life-critical rules for the outage area: lift zones, vehicle routes under temporary traffic plans, confined-space areas, housekeeping in laydown yards. Check camera coverage against the planned work fronts and fix the gaps now, while it's still an email and not a crane lift. Agree with the audit committee what the evidence pack will look like. Tell contractor firms what's detected, what isn't and what happens after a detection, and add it to the site rules.
The last 30 days: get ready. Adjust detection as the layout changes week by week. Measure baseline rates as crews arrive and traffic builds up. Use anonymised clips from this site, from this week, in your inductions.
During the work: keep a daily routine. Every morning, go through the last 24 hours of detections by zone and bring them into permit meetings and toolbox talks. Put exclusion-zone and vehicle-route rates on the turnaround dashboard, next to schedule and cost. Give night shifts and weekends their own review slot. That's where human oversight drops off first.
At the end: put the evidence pack together. Rate trends by zone and week, with the actions you took marked on them. The log of actions and how each one was closed. Pattern summaries by contractor firm and work front, never by individual. And de-identified clips of any incidents and high-potential events. Two outages later, that pack is your planning baseline. And when the board asks "are our turnarounds getting safer?", you can finally answer with numbers.
Here's what the contractor safety part of your quarterly EHS report looks like when it's built to stand up as evidence. Five parts:
A board that gets this every quarter can answer the hardest question after an incident, "how did you check?", with a record that existed before anything happened. The same pack keeps people safer and keeps your governance in order.
You don't need new technology for the first step.
Won't contractors push back on being watched? They push back on being identified and scored, and they're right to. Anonymous checks on conditions, applied the same way to employees and contractors, with a person reviewing every event and no link to individual discipline, come across as shared protection. In practice, the tougher conversations are usually about what the data shows on your side: broken barriers, impossible schedules, traffic routes that clash.
Could this evidence be used against us? Ask your lawyers the opposite question: how does it look if you had no checks at all while violations piled up unseen? A documented loop of spotting, reviewing and fixing, with rates going down, is the strongest good-faith position you can have. This article isn't legal advice, so check the position for your jurisdiction.
Does it replace prequalification and audits? No. It keeps them honest. Rates from continuous checks are the outcome data that prequalification scores always claimed to be.
What one number should the board track? The rate of events that come before serious injuries in contractor work zones (exclusion-zone breaches and near-misses per unit of activity), trended across normal operations and turnarounds. Plus how many of the actions it triggers actually get closed. This number warns you before fatalities happen. TRIR only tells you afterwards.
Is camera-based safety monitoring allowed under GDPR? It can be, but the decision and the paperwork are yours. On your site, you're the data controller and the technology provider is the processor, so the DPIA is your responsibility. A few things make it much easier to justify: a clear safety purpose, no biometric identification, people de-identified before anything is stored or shown, and no raw footage kept. Bring in your DPO and legal team early. This isn't legal advice.
How accurate is AI safety monitoring in heavy industry? It depends on the camera, the conditions and the rule being checked. Steam, glare and dust make it harder. Surveily's average detection accuracy is around 95%, measured and reported continuously, not promised. Whichever system you look at, ask for accuracy measured on your own cameras, every week.
You won't win contractor safety in heavy industry with another procedure. You win it by being able to show, shift by shift, that the rules that matter held, and by fixing the places where they didn't.
That's what we built Surveily for. Surveily is workplace safety AI that uses the CCTV you already own to check life-critical rules continuously: exclusion zones, vehicle–pedestrian separation, PPE and man-down. It runs on-premises, de-identifies people by default (blur or silhouette), does no biometric identification and doesn't score individuals. A person reviews every detection. What you get is rate-based evidence that your EHS team, your contractors and your board can all work from.
This article is educational. It is not legal or reporting advice.
