Machine guarding was OSHA’s tenth most-cited standard in fiscal 2025, with 1,239 violations under 1910.212 alone, and lockout/tagout sat at number four with 2,177. Those two numbers have been on the top-ten list for as long as the list has existed. Amputations are still the injury that changes a plant manager’s life. And yet the way most operations think about guarding has not moved in 40 years: a machine has a point of operation, you put a barrier around it, you write a LOTO procedure for when someone has to reach past the barrier, and you cite 1910.212 when the barrier is missing.
That model is about to become the minority case. Not because the regulation is changing, because it is not, but because the machines are. The equipment showing up on floors right now, and the equipment that will show up over the next decade, does not have a fixed point of operation to fence. It has a work envelope that moves, a control system that decides in real time whether a person is in danger, and a safety case that lives in software and a functional safety calculation rather than in a piece of expanded metal. If your guarding program still starts with “where is the fence,” you are going to be managing the new equipment with the wrong mental model, and you will find out the hard way.
The fence was never the point
The purpose of a guard is to keep a body part out of a hazard zone while the hazard is active. A fixed barrier does that by physical exclusion. That is the crudest possible implementation, and it comes with a cost everyone on the floor knows: it gets in the way. Operators need to clear jams, load parts, adjust tooling, and inspect. Every one of those tasks is an argument between the guard and the work, and the guard loses more often than any safety manager wants to admit. Interlocks get defeated. Fixed guards come off “just for the changeover.” The LOTO procedure that takes 20 minutes gets skipped for the 30-second reach.
The hierarchy of controls has always said the right answer is to design the hazard out or engineer it so the person and the hazard cannot coincide. For most of the last century, we could not afford to do that on a machine-by-machine basis, so we settled for barriers and procedures. That constraint is dissolving. Safety-rated sensing, meaning light curtains, laser scanners, safety-rated vision, and pressure-sensitive mats, combined with safety-rated control logic, can now know where a person is and bring the hazard to a safe state faster than a body can reach it. The guard is becoming a decision instead of an object.
What the standards already say
Here is the part that surprises most plant leaders: the engineering framework for all of this has existed for years. OSHA’s 1910.212 is a performance standard that dates to 1971 and says almost nothing about how to guard, only that you must. The real design guidance lives in consensus standards that OSHA can and does reference through the General Duty Clause.
ANSI B11.0 is the machine safety risk assessment standard, and the whole B11 series covers specific machine types. ISO 13849-1 and IEC 62061 define how to design and validate safety-related control systems, including the performance level or safety integrity level a given circuit must achieve based on the severity, frequency, and avoidability of the hazard. ISO 10218, revised in 2025, now folds the collaborative robot technical specification (ISO/TS 15066) directly into the industrial robot safety standard and adds cybersecurity requirements for the first time. The updated ANSI/A3 R15.06 follows it for the United States.
What these standards share is a shift in the question. The old question was: is there a guard? The new question is: has a risk assessment been performed, does the safety function achieve the required performance level, and has it been validated? That is a fundamentally different kind of evidence. It is a document trail, a calculation, and a test, not a photograph of a fence. It is also exactly what an OSHA compliance officer, an insurance loss control consultant, or a plaintiff’s expert will ask for after an amputation on a machine that had “all the guards on it.”
What the floor is going to look like
I do not think the fixed guard disappears. A press brake will still have a physical barrier where a physical barrier makes sense. But the center of gravity of guarding moves, and it moves in four directions at once.
From barrier to envelope. Collaborative robots, mobile robots, and increasingly ordinary automation cells will run with no fence at all or with a fence that is only part of the safety case. Speed-and-separation monitoring lets a robot slow as a person approaches and stop before contact. Power-and-force limiting lets a cobot touch a person without injuring them, within limits that are now written into ISO 10218:2025. The “guard” is a set of zones, thresholds, and response times.
From hardware to software. The safety function increasingly lives in a safety PLC, a safety-rated drive, and a configuration file. That means the guarding program has to include change control. A parameter change on a safety drive is a modification to a guard, and it should be treated with the same rigor as cutting a hole in a barrier. Most plants have no process for that. The 2025 revision of ISO 10218 adding cybersecurity is a recognition that a safety system that can be reconfigured over a network can also be compromised over one.
From procedure to design. The tasks that generate LOTO violations, meaning jam clearing, minor servicing, and adjustments, are exactly the tasks that alternative protective measures under ANSI/ASSP Z244.1 and safety-rated control can address. When a machine can bring itself to a verified safe state and hold it while an operator reaches in, the 20-minute LOTO becomes a designed function rather than a procedure people skip. That is how you actually reduce LOTO citations: not more training on the procedure, but fewer tasks that require it.
From compliance to evidence. The output of a modern guarding program is a risk assessment for each machine, a specification of the required performance level for each safety function, a validation record showing it was achieved, and a change log. When the equipment is delivered, the integrator’s documentation package is as important as the machine.
Where plants are going to get it wrong
I have been inside enough operations, at every scale, to know the failure modes in advance.
The first is buying the machine and not the safety case. A new cell arrives with a beautiful robot and a one-page safety sheet. Nobody asks for the risk assessment, the performance level calculation, or the validation report. Six months later, maintenance changes a scanner field to fix a nuisance stop, and the safety case that never existed on paper now does not exist in reality either.
The second is treating legacy equipment as exempt. The 1985 press is still on the floor, and it is still the one that takes fingers. A risk-assessment-based program has to cover the old machines too, and for most of them the answer will still be a barrier, an interlock, and a good LOTO procedure. The point is that the decision was made through a risk assessment rather than inherited.
The third is letting the integrator own the safety case. Integrators are good at making machines run. They are not responsible for your workers, and their risk assessment is written to their scope, which ends at the cell boundary. Your program has to cover the person walking past the cell, the forklift driver, the maintenance tech at 2 a.m., and the operator who has figured out how to reach around the scanner.
The fourth is assuming that OSHA will not ask. The standard has not changed, but the inspector’s toolkit has. Compliance officers use ANSI B11 and ISO 13849 in General Duty Clause citations, insurers use them in loss control reports, and expert witnesses use them in depositions. A machine with no risk assessment is not a machine with no requirement. It is a machine with an undocumented one.
What a guarding program needs to become
If I were rebuilding a plant’s machine safety program from scratch today, it would rest on five pieces.
A machine inventory with a risk assessment for every unit, following ANSI B11.0, that identifies each task, each hazard, and the required risk reduction. A specification for every safety function that states the required performance level and how it is achieved, whether that is a fixed guard, an interlocked guard, a light curtain with a safety relay, or a configured safety PLC. A validation record for each safety function that shows it was tested and meets the specification, updated whenever the function changes. A change control process that treats safety parameters, scanner fields, and safety PLC logic as controlled documents. And a procurement standard that requires every new piece of equipment to arrive with its risk assessment, performance level calculations, and validation documentation, or it does not get installed.
None of that is exotic. It is what the standards already describe. What most mid-size operations lack is someone who has done it before, who can read a functional safety calculation and tell whether it is real, who knows which of the 40 machines on the floor actually needs the work first, and who can sit across from the integrator and ask the right questions. That is senior judgment, not headcount, and it is the kind of work I built fractional EHS leadership to deliver.
Machine guarding is going to stop being a fence. The plants that understand that before the next capital project arrive at the new equipment with a program that can handle it. The plants that do not will guard a moving envelope with a static mindset, and the OSHA log will tell them how that went.
Key takeaways
- Guarding is shifting from barrier to decision — safety-rated sensing and control now decide in real time whether a person is in danger, and the “guard” is a set of zones, thresholds, and response times.
- The standards already exist — ANSI B11.0, ISO 13849-1, and the 2025 revision of ISO 10218 define risk assessment, performance levels, validation, and now cybersecurity; OSHA reaches them through the General Duty Clause.
- The evidence changes — a modern guarding program produces risk assessments, safety function specifications, validation records, and a change log, not a photo of a fence.
- LOTO citations fall when tasks are designed out — alternative protective measures and safety-rated control eliminate the reach-in tasks that generate skipped procedures.
- Buy the safety case with the machine — require the risk assessment, performance level calculation, and validation package on delivery, and put safety parameters under change control.
Related reading: When the Hazard Moves: Safety Management for Autonomous Work · Risk Assessment Is an Art Disguised as a Spreadsheet
