Workplace safety software: the expiry list knows who has lapsed, but it stops nobody from getting on the forklift

At six in the morning, the shift supervisor of an engineering firm near Vicenza, a hundred and forty employees across three shifts in stamping and metal fabrication, is two forklift drivers short. He puts the first available worker who can drive one on the forklift. And he really can drive it: he has done it for twelve years. The trouble is that his forklift licence expired four months ago, and the only place that fact is written down is a spreadsheet on a computer in the HR office, which opens at half past eight. If you are looking for workplace safety software, this article shows you how to work out what you actually need, what not having it costs you today and what it will give back, with a number instead of a hunch.

You will find the real cost of running safety on a deadline tracker and email, the single number that tells you whether a piece of software will protect you or just give you a tidier archive, what Italy's safety law actually requires once translated into data to keep, the table almost no company has written down and on which everything else depends, the check at the moment work is assigned, which is the part almost no product does, the real price ranges of an HR system module, a dedicated product and a custom system, and the threshold beyond which the maths changes.

I have been writing software since 1999, and I have almost always met workplace safety systems through the back door: while designing a production management system, a shift planner, an application for construction sites, and finding every time that the most important question, namely whether this person can do this job right now, had no answer in any system. The answer lived in three different places: the HR office deadline tracker, the company doctor's filing cabinet and the shift supervisor's memory. And the three places did not talk to each other.

What I have learnt, and what explains why so many companies buy a digital deadline tracker and a year later find themselves with the same risk as before, is this: the number that matters is not how many deadlines you have under control, it is how many hours of work are performed by people who, at that moment, lack a valid requirement for the role they are doing. A perfect deadline tracker that nobody checks when assigning work tells you with great precision who has lapsed. It does not stop anyone from sending him out on the forklift.

What workplace safety software is, and what it is not

Workplace safety software is the system that holds together three things which, in most small and medium-sized businesses, currently live in different places. The first is the requirements: what a person must have to perform a given role, meaning which training, which occupational health fitness judgement, which licence for which equipment, which protective equipment. The second is the evidence: for each person, which of those requirements they hold, with issue date, expiry date and the document that proves it. The third is the assignment: who is doing what, today, in which department, on which machine, on which site.

If you have the first two but not the third, you have a deadline tracker. It is a huge step forward from the ring binder, and for many small companies it is all they need. But a deadline tracker looks at people, not at work: it tells you that Marco's forklift licence has expired, not that Marco is on the forklift right now. And it is the second piece of information that determines the risk, and the liability too.

Deadline tracker, document archive and management system: three things everyone calls safety software

Under the same label the market sells three generations of tools, and confusing them is the commonest way to buy the wrong one. The archive stores documents: the risk assessment document, course certificates, minutes of the periodic safety meetings, equipment data sheets. It answers the question "where did I put it", which during an inspection is no small thing.

The deadline tracker adds dates: it knows when every course, every medical check, every licence and every periodic inspection expires, and sends a reminder a few weeks ahead. It answers the question "what do I need to renew next month", and it is what the vast majority of products on the market do well.

The management system adds the rules and the link to the work: it knows which requirements each role needs, it knows who is doing which role, and when the two do not match it says so the moment it happens, not at the end of the month. It answers the question "who is working right now without the requirements for it", which is the question that counts. It is also the only one of the three you really need if one day you have to prove that the organisation had put a control in place, and not just a list.

Why the spreadsheet only holds up to a point

The spreadsheet is not the enemy. In a company of twenty people, with two forklift drivers and one first aider, a well kept deadline tracker in a shared sheet is an honest solution and costs nothing. The problem starts when three things happen at once: there are more than fifty or so people, they work in shifts or across several sites, and the same person can be moved from one role to another within the same day. At that point the tracker stays correct but becomes irrelevant, because whoever decides who does what does not look at it at the moment of deciding.

At the Vicenza company the tracker was beautifully kept. One person in HR spent more than half their time on it, every deadline had its own colour, the reminders went out. And yet, when we measured it, almost one hour of work in ten was performed by someone lacking at least one valid requirement for what they were doing. Not through negligence: through structure. The tracker lived in the office, the work on the shop floor.

The real bill: what safety run on a deadline tracker costs you today

When a business owner asks me what workplace safety software costs, the first thing I ask is what not having it costs today. Almost nobody knows, because the cost is scattered across five items that end up on five different lines of the income statement, and none of the five is called safety. This is the bill we drew up at the reference company, a hundred and forty people, turnover of around twenty-two million.

The time spent chasing deadlines. About sixteen hundred events a year across training refreshers, periodic medical checks, licence renewals, periodic equipment inspections, and the issue and replacement of protective equipment. Each one means noticing it, finding a date, calling the person in, taking them off their shift, collecting the certificate, updating the sheet. Six tenths of one HR employee plus some ninety hours a year from the head of the prevention and protection service, the external safety consultant Italian law requires, billed separately because it falls outside the package: twenty-nine thousand euros.

Training bought badly. When deadlines only become visible two weeks out, courses are bought one at a time, in a hurry, at the individual price instead of the group price. Some people take the same module twice because the certificate for the first was never recorded, others are sent on a course their role did not need. On a mandatory training budget of forty-five thousand euros, the share wasted or overpaid was around twenty-seven per cent: twelve thousand euros.

Stoppages and reassignments. When someone notices, and sometimes they do, the unlicensed person has to be taken off the machine. If no replacement with the requirements is available at that moment, the line slows down or stops. Thirty-eight episodes in a year, an average of three hours of slowdown on a line worth around a hundred and eighty euros an hour in margin: twenty-one thousand euros.

Injuries. Four injuries with a prognosis of more than three days in the last year, twenty-two days of absence on average. From the fourth day the benefit is paid by INAIL, Italy's compulsory workplace injury insurer, but the company pays for the first days, the replacements, the overtime of whoever covers, the loss of production, the time spent on analysis and reporting, and a premium that in later years reflects the claims record. Counting only direct, measurable costs: twenty-six thousand euros.

The discount you do not claim. The injury insurance scheme offers a rate reduction to companies that can show they have carried out prevention measures beyond the legal minimum, through an application to be filed by the end of February each year. For a company with between fifty-one and two hundred employees the reduction is worth around ten per cent of the premium. The reference company had never applied, not because it had not taken any measures, but because it could not document them. On a premium of roughly a hundred and ten thousand euros: eleven thousand euros.

The total comes to about ninety-nine thousand euros a year. That does not include the real risk, the one that never goes on the balance sheet: fines, criminal proceedings after a serious injury, the company's own administrative liability. I come back to it later, because it has a peculiarity that multiplies the numbers and that almost no business owner knows about. But even leaving it out, the cost of safety run on a deadline tracker was higher than any software that could be bought or built.

The item that surprises people most, once calculated, is almost always the second. Nobody imagines mandatory training can be bought badly, because it is experienced as a tax. But a tax paid in a hurry, at full price and sometimes twice, is still a tax that costs more than it should.

The share of hours worked without a valid requirement: the number that decides

The definition is simple. Take the hours worked in a month, with who worked them and in which role, which you get from clock-ins and shift plans. Take, for each role, the list of requirements it needs. Take, for each person, the requirements they hold, with their expiry dates. For each hour worked, check whether at that moment the person held every requirement of the role they were performing. The share of hours worked without a valid requirement is the total of hours in which at least one requirement was missing, divided by the total hours worked.

It is measured in hours rather than people for a practical reason. An office clerk whose general training refresher lapsed a month ago is an irregularity to put right. A forklift driver with an expired licence who drives eight hours a day for four months is a concrete risk that builds up every hour. Counting people puts the two situations on the same level; counting hours weighs them for what they are. At the reference company the share was nine point four per cent: more than twenty-one thousand hours a year, out of about two hundred and thirty thousand, worked by someone missing a piece.

I use four thresholds. Below one per cent the system holds: deadlines are renewed on time and whoever assigns work knows who can do what, so new software will give you order, time saved and documentation, not much extra protection. Between one and five the problem is the process: deadlines are seen too late, or renewals are scheduled without regard to shifts and people do not turn up, and a few organisational decisions are worth as much as software. Above five the tracker does not talk to whoever assigns the work, and no email reminder will fix it, because the reminder reaches someone who does not decide. And then there is the commonest case, never measured, which almost always sits in the third band and almost always surprises management, who were convinced they were in the first.

How to measure it in two weeks without buying anything

You measure it with what you already have. You need three things: hours worked by person and by role, the deadline tracker with its dates, and a table saying which requirements each role needs. You certainly have the first two. Almost nobody has the third written down, and writing it is the first real step of the project: I cover it in a section of its own, because everything depends on it.

The real difficulty is the role. Clock-ins tell you who was there, not what they were doing. If you have a shift system that assigns people to workstations, you have the role. If not, for the initial measurement the main role recorded in the employee file will do, knowing that it underestimates the problem: people occasionally moved onto another machine, which is exactly the riskiest case, slip through. At the reference company we took both measurements. With the main role the share was six point one per cent; with the actual role rebuilt from the department shift plans, nine point four. The difference was almost entirely people moved to cover an absence.

If your data is in a database, or in sheets you can import, the measurement is a query. This is the one I use.

-- Share of hours worked by people missing at least one valid requirement
-- for the role they were performing, by department and requirement type.
-- Worked = hours from clock-ins, matched to the role performed (from the shifts).
-- RoleRequirements = the matrix: which requirements each role needs.
-- Evidence = the requirements each person holds, with issue and expiry dates.
WITH CheckedHours AS (
    SELECT
        w.Department,
        w.PersonId,
        w.WorkDay,
        w.Role,
        w.Hours,
        rr.Requirement,
        rr.RequirementType,
        CASE
            WHEN e.PersonId IS NULL            THEN 'never held'
            WHEN e.ExpiresOn < w.WorkDay     THEN 'expired'
            WHEN e.IssuedOn > w.WorkDay      THEN 'not yet valid'
            ELSE 'valid'
        END AS Status
    FROM Worked AS w
    JOIN RoleRequirements AS rr
        ON rr.Role = w.Role
    LEFT JOIN Evidence AS e
        ON e.PersonId = w.PersonId
       AND e.Requirement = rr.Requirement
       AND e.IssuedOn  <= w.WorkDay
    WHERE w.WorkDay >= @From AND w.WorkDay < @To
),
HoursPerShift AS (
    SELECT
        Department, PersonId, WorkDay, Role, MAX(Hours) AS Hours,
        MAX(CASE WHEN Status <> 'valid' THEN 1 ELSE 0 END) AS Uncovered
    FROM CheckedHours
    GROUP BY Department, PersonId, WorkDay, Role
)
SELECT
    Department,
    SUM(Hours)                                          AS HoursWorked,
    SUM(CASE WHEN Uncovered = 1 THEN Hours ELSE 0 END)  AS HoursUncovered,
    CAST(100.0 * SUM(CASE WHEN Uncovered = 1 THEN Hours ELSE 0 END)
         / NULLIF(SUM(Hours), 0) AS DECIMAL(5, 2))      AS UncoveredShare
FROM HoursPerShift
GROUP BY Department
ORDER BY UncoveredShare DESC;

Two details make the difference between a credible measurement and one management disputes at the first meeting. The first: a requirement never held and a requirement expired must be kept apart, because they describe two different problems. Never held is almost always a mistake in the matrix or a recent hire not yet trained; expired is a renewal process that does not work. The second: when the same hour is uncovered for several requirements, it must be counted only once, otherwise the share goes above a hundred per cent in the worst departments and the measurement loses credibility. That is the reason for the second step in the query.

Alongside the share it is worth measuring a second number, which tells you how much of the problem software will give back: the share of uncovered hours due to requirements that had already been expired for more than thirty days. Those are the hours in which the information existed and never reached whoever was deciding. At the reference company they were seventy-one per cent of uncovered hours. It is the part that a check at the moment of assignment removes almost entirely.

What Italy's Decree 81 actually requires, translated into data to keep

You do not need a law course to design workplace safety software, but you do need to know which data the law requires you to hold, because a system that does not keep all of it will leave a piece of the tracker in a spreadsheet, and that piece will be the one that lets you down. The reference text is Italy's Legislative Decree 81 of 2008, the consolidated workplace health and safety act. Translated into tables, it asks you to keep six families of information.

Worker training. Every worker must receive four hours of general training and four, eight or twelve hours of specific training depending on the company's risk class, with a six-hour refresher every five years. Supervisors, managers, first aiders, fire wardens and workers' safety representatives have their own courses, with different durations and intervals: the supervisors' refresher, for example, is every two years, first aid every three, fire safety every five. Course duration and content were reorganised by the 2025 State-Regions Agreement, a binding accord between Italy's central government and its regions, which also introduced a check on whether the training was effective. In data: for each person, each course with date, duration, provider, outcome and the due date of the next refresher.

Health surveillance. For roles exposed to specific risks, such as noise, manual handling, vibration, chemicals or night work, the company doctor, a physician every Italian employer with these risks must appoint, carries out periodic medical checks, normally once a year, and issues a judgement of fitness for the role, which may be full fitness, fitness with prescriptions or restrictions, or unfitness. This is where you find the sentence in the decree that more than any other should drive the design of the software: the employer must ensure that workers subject to health surveillance are not assigned to the specific role without the required fitness judgement. It does not say keep a tracker of medical checks. It says do not assign. It is an obligation you meet at the moment of assignment, not at the end of the month. In data: for each person, each judgement with date, the role it refers to, any restrictions and the expiry date.

Equipment licences. For certain equipment, including forklifts, mobile elevating work platforms, mobile cranes, lorry loader cranes, tractors and earth-moving machinery, specific training with a practical test is required, governed by the 2012 State-Regions Agreement, with a refresher every five years of at least four hours, three of them practical. In data: for each person, each licence with the type of equipment, the date and the expiry. And this is where the first trap of generic products appears: the licence covers a type of equipment, not the company. Someone licensed for self-propelled industrial trucks is not licensed for telescopic handlers.

Personal protective equipment. Every issue must be recorded, with the person, the item, the size, the date and, where required, training in its use, as for category III fall arrest equipment or respirators. Many items have a limited service life, and some must be checked periodically. In data: an issue register, with the planned replacement.

Equipment inspections. The equipment listed in Annex VII of the decree, including lifting appliances, elevating platforms, self-propelled telescopic handlers and pressure vessels, is subject to periodic inspections at annual, two-yearly or longer intervals depending on type, in addition to the checks and maintenance the manufacturer prescribes. In data: for each item, inspections, outcomes and the next due date. This is the part that overlaps most with maintenance, and I have written about it at length in maintenance management software: if you already have a maintenance system, the inspections live there, and the safety software must read them, not duplicate them.

Risk assessment and incidents. The risk assessment document, which must be revised within thirty days of any significant change to the production process or the organisation, after significant injuries, or when health surveillance shows the need. Injuries, which must be reported to the compulsory insurer within two days when the prognosis exceeds three days. And near misses, which the law does not require you to record but which are the most valuable information you have, because they tell you where the next injury will happen. In data: the document with its versions, the link between risks and roles, the incident register.

The rule that multiplies fines, and that almost nobody knows

Breaches of the training and health surveillance obligations are punishable by arrest or by a fine of a few thousand euros. Nothing new so far. The peculiarity lies in a paragraph added to the decree in 2015: when the same breach concerns more than five workers, the amounts double; more than ten, they triple. It is a rule designed precisely for companies that manage safety in bulk, and it hits exactly the typical case of the tracker that does not work: not one lapsed worker, but a whole department, because that group's refresher course was missed and nobody noticed.

At the reference company, on the day we took the first measurement, fourteen people had an expired specific training refresher, all in the same department, all hired in the same year and trained on the same course five years earlier. An inspection that day would have found one single breach, tripled.

The organisational model and the word that counts: recording

Then there is a level that concerns the business owner more than the safety manager. After a serious injury, under Italy's corporate liability law the company itself can be held liable on an administrative basis, with financial penalties and bans on activity, if the offence was committed in its interest or to its advantage, for example by saving money on safety. Article 30 of Decree 81 provides that an organisation and management model, adopted and effectively implemented, can exempt the company, meaning it can rule out that liability. And among the requirements of the model, the text expressly calls for suitable systems for recording that the activities have been carried out.

Recording, not declaring. The model must be able to prove that the checks were made, when and by whom. That is exactly the difference between a deadline tracker, which proves you knew, and a system that records the check at the moment of assignment, which proves you prevented it. Anyone who has adopted the international standard for occupational health and safety management systems, ISO 45001, will recognise the same logic: evidence counts for more than written procedures.

The role requirements matrix: the table nobody has written

If I had to name a single reason why workplace safety software projects disappoint, it would be this: companies buy the tool that tracks deadlines, and the table saying which deadlines apply to which job does not exist. The risk assessment document almost always contains it, but as prose, organised by risk rather than by role, and unreadable by any program. The company doctor has another one, in the health protocol for each role. HR has a third, implicit, in the head of whoever organises the courses. The three never match.

The role requirements matrix is a simple table. On the rows, the roles as they are really organised in the company, not as they are written in the employment contract: forklift driver, press operator, welder, maintenance electrician, overhead crane operator, warehouse operative, shift supervisor. On the columns, the requirements: every course, every fitness judgement, every licence, every item of equipment. In each cell, whether that requirement applies to that role, and at what level. At the reference company it came out at twenty-eight roles and forty-one requirements. The real work was not filling it in: it was getting the head of the prevention service, the company doctor and the department heads to agree on what a role actually was. Three meetings, two weeks.

Why people have more than one role, and why it matters

The second thing the matrix brings to light is that people do not have one role, they have several. The press operator moves bins with the forklift at the end of the shift. The maintenance technician goes up on the elevating platform twice a month. The warehouse operative stands in for the forklift driver when he is on holiday. The employee file holds a single role, and the tracker holds the requirements for that one. All the others are the roles where uncovered hours are born.

At the reference company sixty-three per cent of people performed at least one role other than the one in their file, at least once a month. For those secondary roles the share of uncovered hours was twenty-two per cent, against six for the main role. The practical conclusion is simple: a person should not be linked to one role, but to the set of roles they can perform, and the system must know, for each one, whether they meet the requirements right now. This is what I call the assignability profile: not who you are, but what you can do today.

The code: working out who can do what, right now

The heart of well designed workplace safety software is not the deadline tracker, it is a function that, given a person, a role and a moment, answers yes or no, and when it answers no, says why. That function is needed in four places: when the shift supervisor assigns a workstation, when the shift system proposes the plan, when a job is opened on a machine and when renewals are planned. This is the core I use, stripped down to essentials.

// Can this person perform this role at this moment?
// The answer is not yes or no: it is the list of missing requirements, with the reason.
public enum RequirementType { Training, Fitness, Licence, Equipment }

public record Requirement(string Code, RequirementType Type, string Description);

public record Evidence(
    int PersonId, string RequirementCode, DateOnly IssuedOn,
    DateOnly? ExpiresOn, string? Restriction);

public record Gap(string RequirementCode, string Reason, int DaysOverdue);

public sealed class AssignabilityProfile(
    IReadOnlyDictionary<string, IReadOnlyList<Requirement>> matrix,
    ILookup<int, Evidence> evidence)
{
    public IReadOnlyList<Gap> Check(int personId, string role, DateOnly day)
    {
        if (!matrix.TryGetValue(role, out var required))
            return [new Gap("-", $"Role '{role}' missing from the matrix", 0)];

        var held = evidence[personId]
            .Where(e => e.IssuedOn <= day)
            .GroupBy(e => e.RequirementCode)
            .ToDictionary(g => g.Key, g => g.OrderByDescending(e => e.IssuedOn).First());

        var gaps = new List<Gap>();

        foreach (var r in required)
        {
            if (!held.TryGetValue(r.Code, out var e))
            {
                gaps.Add(new(r.Code, $"{r.Description}: never held", 0));
                continue;
            }

            if (e.ExpiresOn is { } expiry && expiry < day)
            {
                var overdue = day.DayNumber - expiry.DayNumber;
                gaps.Add(new(r.Code, $"{r.Description}: expired on {expiry:dd/MM/yyyy}", overdue));
                continue;
            }

            // A fitness judgement with restrictions is not a full yes:
            // whoever assigns the work must see it, even if it does not block.
            if (r.Type == RequirementType.Fitness && e.Restriction is { Length: > 0 } restriction)
                gaps.Add(new(r.Code, $"Fit with restriction: {restriction}", 0));
        }

        return gaps;
    }
}

Three choices in this code are worth more than the code itself. First: the answer is not a boolean, it is a list of reasons, because a shift supervisor who gets a no without explanation works around it, while one who reads "forklift licence expired on 3 June" calls someone else. Second: a role missing from the matrix is a gap, not a green light, because the most dangerous hole in the system is the role nobody has catalogued. Third: a judgement with restrictions does not block but is shown, because the restriction, for example a ban on lifting loads above a certain weight, is information whoever assigns the work must have in front of them, and today it almost always stays in the doctor's file.

The check at the moment work is assigned

This is the difference between a system that protects and a system that documents. The deadline tracker sends a reminder to whoever manages deadlines. The check at the moment of assignment stops whoever is about to assign the work. They are two different recipients, and the second is the one who decides whether the person gets on the forklift.

In a manufacturing or service company, there are four moments when work is assigned, and a serious system covers all of them or states clearly which ones it does not. The first is shift planning: when deciding who works next week and at which workstation, the system must propose only assignable people, and flag the deadlines that fall within the planned period. This is where the check costs least, because there is time to find an alternative. The second is same-day assignment: the shift supervisor covering an absence at six in the morning, which is exactly the case in the opening. Here the check must be instant, on a phone or on the department terminal, and it must offer alternatives, not just say no. The third is access: to the construction site, the confined space, the department with a specific risk. The fourth, where automation allows it, is machine start: the badge on the forklift or the platform that only enables it for people who meet the requirements.

The fourth moment is the most effective and the most expensive, and it is almost never needed as a first step. At the reference company we started with the first and second, which on their own delivered the great majority of the return: the share of uncovered hours fell from nine point four to one point eight per cent in the first six months, without touching a single machine.

Warn or block: a decision for management

Every time I design this check the same question comes up: should the system prevent the assignment or just warn? The technical answer is easy, the organisational one is not, and it must be taken by management, not by the software vendor. The rule I propose is this: block for the requirements the law explicitly ties to the role, meaning the fitness judgement and equipment licences; warning with a recorded justification for training expiring within thirty days and for restrictions; simple flag for everything else. A block can only be overridden by a defined role, with a written justification that stays in the log.

With hindsight, the override log is the most useful tool in the whole system. In the first quarter at the reference company there were forty-seven overrides, thirty-nine of them in the same department and on the same equipment: there were simply too few licensed forklift drivers on the night shift. It was not a discipline problem, it was a training planning problem, and without the log nobody would have seen it.

The link with shifts and attendance

The check at the moment of assignment requires the safety software to talk to the system that assigns the work. If you plan shifts with a dedicated system, the link is with that, and the skills matrix I discussed in shift scheduling software is the same table seen from another side: it is best if it exists only once. If the data on who is actually present comes from clock-ins, the link is with the attendance system, which I wrote about in time and attendance software. If the work takes place on construction sites, access control and the paperwork of the contractors come into play too, which on temporary or mobile sites follow their own rules and, since October 2024, Italy's points-based site licence for contractors: I cover this in construction site management software.

The rule I use for these links is that every piece of information has one owner and only one. People and their contracts live in the HR system. Evidence, meaning courses, judgements, licences and equipment issues, lives in the safety system. Assignments live in the shift or production system. The safety system duplicates none of the three: it reads them, cross-references them, and answers the question none of the three can answer alone.

Near misses: the most valuable data that nobody collects

There is one last thing workplace safety software must do, and almost no small or medium-sized business does it: collect near misses. The load that slides off the forks without hitting anyone, the wet floor someone nearly slipped on, the press guard found removed. The law does not require them to be recorded, and so almost nobody does. But every injury is preceded by a series of near misses in the same spot, and whoever records them knows where the next one will happen.

The reason they go uncollected is not cultural, it is practical: reporting means going to the office, filling in a form, and often naming a colleague. A system that lets people report from their phone in thirty seconds, with a photo and no mandatory name, changes the numbers. At the reference company reports went from three a year, all made by the head of the prevention service, to a hundred and fourteen in the first ten months. About thirty concerned the same crossing between the forklift aisle and the pedestrian walkway in the stamping department, and signage plus a barrier costing fifteen hundred euros closed the problem. That measure, documented with the reports before and after, was also the first item in the application for a reduced insurance premium.

What workplace safety software costs: module, dedicated product or custom build

There are three routes, and each has a price and a limit worth knowing before the sales demos.

The module in the system you already have. Many HR and payroll systems have a safety module, costing between zero and three thousand euros a year, with one huge advantage: the people are already there, with their personal details, contract and role. The limit is that it is almost always a pure deadline tracker: it holds courses and medical checks, sends reminders, but links each person to a single role and knows nothing about who is doing what today. For a company under fifty people, with stable roles and no shifts, it is often all you need.

A dedicated subscription product. Specialist workplace safety products are almost always priced per employee, between one and four euros a month depending on modules, meaning between sixteen hundred and seven thousand euros a year for a hundred and forty people, plus onboarding of between three and ten thousand euros, which is almost all loading historical data and configuring the matrix. They do the archive, the deadline tracker, course management with rooms and trainers, and protective equipment well, and often guided risk assessment and a reporting app too. The limit is the same as the module's, just pushed further out: they know which requirements a role needs, but they usually do not know who is performing that role right now, because that information lives in the shift or production system, and you have to build the link yourself.

A custom system. It starts at thirty-five thousand euros for the matrix, the evidence, the assignability profile, the check at the points of assignment and the reporting app, and reaches around eighty thousand with the link to equipment badges, integration with attendance, payroll, shifts and maintenance, and contractor management. Plus fifteen or twenty per cent a year for maintenance, which in safety is not optional: the rules change, and the 2025 training agreement is there to prove it.

On five-year cumulative cost the two routes cross at around three hundred people. The product costs in proportion to headcount, the custom build hardly at all: with a hundred and forty people the product costs around forty thousand euros over five years, onboarding included, against around seventy thousand for the custom build with its maintenance. Below three hundred people, then, the product almost always wins, and I say so knowing it does not suit those of us who sell custom software.

But the threshold drops considerably in three cases worth recognising. First: people change role often and the risk lies precisely in the secondary roles, as at the reference company. Second: work takes place across several sites or on construction sites, where access is the moment of control and involves people from different companies. Third: you already have a system that assigns work, a production management system, a shift planner or a field technician app, and the check has to go inside it, where the shift supervisor works, not in another window nobody opens. I explain why in more detail in production management software: a check that lives outside the system where the decision is taken does not get consulted.

The mixed route, which in most cases is the right one

The route I recommend in the vast majority of cases under three hundred people is a mixed one: the product for the archive, the deadline tracker, courses and reporting; a custom piece for the assignability profile and the check at the points where work is assigned. In practice you keep in the product everything the market already does well, and build separately the piece that cross-references evidence with assignments: it reads from the product who holds what, reads from the shift or production system who is doing what, and answers in the right place. It costs between ten and twenty-five thousand euros, connects to the product through its APIs, and leaves to the market the part the market already does well. The reasons why this route almost always works better than either pure option are on the page about custom business software.

At the reference company it went like this: a dedicated product at fifty-two hundred euros a year plus six thousand for onboarding, and a custom piece costing nineteen thousand euros for the matrix shared with the shift system, the assignability profile, the check on the shift supervisor's terminal and the override log. Just over thirty thousand euros in the first year, against ninety-nine thousand of measured cost. In the first year the share of uncovered hours fell from nine point four to one point eight per cent, training scheduled in groups three months ahead saved around nine thousand euros, and for the first time the application for a reduced insurance premium was filed, with the documentation the system produced by itself.

Five questions to ask before you sign

Whichever route you choose, there are five questions that separate workplace safety software from a deadline tracker with a nice dashboard. One: can a person have several roles, each with its own requirements, or does the system know only one? Two: can I ask the system, through an external call, whether a person can perform a role on a given date, and get the list of reasons if the answer is no? Three: is a fitness judgement with restrictions a structured field I can show to whoever assigns the work, or a document attachment? Four: does it keep history, meaning can it tell me not only who is compliant today, but who was compliant on 14 March at six in the morning? Five, worth more than the other four: will it agree to load the real history of one of my departments, with three months of clock-ins, and calculate the share of uncovered hours before I sign? If it gives you the number within a week, you have the right product; if the answer is that it does not do that calculation, you have a deadline tracker.

Where to start: the first release in ninety days

The first release does not need to be complete, it needs to be useful to someone within three months. This is the order I use, and note that the first two steps require no new software and already deliver a sizeable part of the return.

Weeks one and two: measure. Take the last three months of clock-ins, the tracker you have, and for the initial measurement each person's main role. Calculate the share of uncovered hours by department and by requirement type, and the share of those hours in which the requirement had been expired for more than thirty days. At the end of the two weeks you should have two numbers and the department to work on. At the reference company, already at this stage, it emerged that two departments out of seven accounted for two thirds of the problem, and that almost all of it came from three licences.

Weeks three to six: the matrix and the evidence. The role requirements matrix, agreed between the head of the prevention service, the company doctor and the department heads, with real roles rather than contract ones. The census of each person's secondary roles, which takes an hour with each department head. Cleaning up the evidence: every certificate, judgement and licence with its true date, tracking down missing documents. At this stage you always discover something you would rather not have, which is why it must be done before any installation.

Weeks seven to ten: the check in planning. The assignability profile linked to the system that plans the week's work, with deadlines falling within the planned period highlighted. Scheduling renewals in groups, three months ahead and with shifts taken into account, which is the lever that cuts the cost of training. This is where HR starts to see a benefit, and their support decides whether the project survives.

Weeks eleven to thirteen: the same-day check and reporting. Only now the check on the shift supervisor's terminal or phone, with blocking for fitness and licences, suggested alternatives and the override log. And the near miss reporting app. They come last on purpose: if they arrive earlier they run on a wrong matrix and incomplete evidence, they block people who were compliant, and within two days the shift supervisors stop trusting them. In my experience that is the number one reason these projects fail: not the software, but the data you feed it.

One last piece of advice on what not to do first. The dashboard with the compliance percentage by department is the part that appears in every demo and the one you need least at the start. A weekly list of ten lines saying which people scheduled in the next two weeks will have an expired requirement, and in which role, is worth more than any chart, because someone reads it and does something.

If the number says it is not your problem

It can happen, and it is worth saying because hardly anyone does. If your share of uncovered hours is below one per cent, if roles are stable and whoever assigns work really knows people's requirements, workplace safety software will not give you much extra protection: it will give you order, time saved in HR, and documentation ready for an inspection and for the premium reduction application. Those things have value, but they are worth the price of a subscription, not of a custom project.

In that case the bottleneck is almost always elsewhere. If the problem is that safety, certification and supplier documents are scattered across shared folders and inboxes, the topic is document management software. If safety is part of a certified management system together with quality, with audits, non-conformities and corrective actions, it pays to keep them together, and that is what I cover in quality management software. If instead the risk lies in the equipment more than in the people, meaning missed inspections, postponed maintenance and removed guards, the starting point is maintenance management software.

And there is one case where software is not the answer even when the numbers are bad: when there are simply too few people with the requirements. If the night shift needs three forklift drivers and only two are licensed, no check will find a solution, because none exists: the system will tell you precisely where who is missing, which is valuable for planning training, but it will not cover the shift. The answer then is a licensing plan, which costs a few hundred euros per person and is almost always the investment with the fastest return in the whole safety budget.

If you have read this far, you probably have the six o'clock shift supervisor in mind. Before watching any demo, take one department and three months of clock-ins and work out how many hours were worked by someone missing a requirement: it is two weeks of analysis with data you already have, it costs nothing, and it tells you whether you are buying protection or just order. From there, decisions become much simpler, and you take them yourself instead of leaving them to chance at six in the morning.