Robot risk assessment: the ISO 12100 method, step by step

A robot risk assessment is a structured way of answering three questions: what could hurt someone, how badly and how likely, and what will be done about it. Nearly every robot safety standard requires one, and they all point back to the same method: ISO 12100, the general standard for risk assessment and risk reduction of machinery.

This guide walks through that method as it applies to robots, then covers what changes when the robot is driven by a learned model.

Assess the application, not the robot

The most common mistake comes before step one. A robot arm with a “collaborative” label is not safe by itself, and no certificate from the manufacturer makes it so. A force-limited arm carrying a knife is dangerous at any speed.

What gets assessed is the application: the robot, its end effector, the workpiece, the task, the layout, and the people who will be near it — including the ones who are not supposed to be.

Step 1 — Determine the limits

Write down the boundaries of what you are assessing.

• Use limits. The intended use, the operating modes, who interacts with the machine and how well trained they are — and the reasonably foreseeable misuse. If people will predictably reach in to clear a jam, that is in scope.
• Space limits. The range of motion, including tool and workpiece, and the space people need for operation and maintenance.
• Time limits. Expected lifetime, service intervals, and the wear that comes with them.

Step 2 — Identify hazards

Go through every phase of the machine’s life — transport, installation, commissioning, teaching, normal operation, cleaning, fault-finding, maintenance, decommissioning — and every task within each phase. For each one, ask what could cause harm.

For robots the list usually includes impact and crushing from robot motion, trapping between the robot and fixed objects, hazards from the tool and workpiece (sharp, hot, heavy, ejected), unexpected start-up, and loss of a held load when power is removed. Mobile robots add collision, tipping and battery hazards.

Most serious robot incidents happen outside normal operation: during teaching, clearing faults and maintenance, when someone is inside the safeguarded space. Give those phases the most attention.

Step 3 — Estimate the risk

For each hazard, estimate two things:

1. Severity of the possible harm, from a bruise to a fatality.
2. Probability that the harm occurs, which ISO 12100 breaks into how often and how long people are exposed, how likely the hazardous event is, and whether a person could avoid or limit the harm.

Most teams use a scoring matrix. The specific scale matters less than applying it consistently and writing down the reasoning.

Step 4 — Evaluate the risk

Decide, hazard by hazard, whether the risk is acceptably low. If it is, record why. If it is not, reduce it.

Step 5 — Reduce the risk, in this order

ISO 12100 prescribes a strict hierarchy, known as the three-step method. You may not skip to a later step because it is cheaper.

1. Inherently safe design. Remove the hazard or shrink it: a lighter payload, lower speed, rounded edges, a layout that eliminates trapping points, a gripper that holds its load without power.
2. Safeguarding and protective measures. Where a hazard remains, guard against it: fences and interlocked gates, light curtains and laser scanners, speed and separation monitoring, power and force limiting, enabling devices for teaching.
3. Information for use. Warnings, markings, training and procedures. This comes last because it depends on people behaving as instructed every time.

Then go back to step 2. Protective measures create hazards of their own — a fence creates a trapping point, a restart procedure creates an unexpected start-up risk — so the process repeats until the remaining risk is acceptable.

Safety functions and how reliable they must be

Any risk reduction that depends on a control system — a scanner that triggers a stop, a monitored speed limit — is a safety function, and it falls under functional safety. The risk assessment determines how reliable each one must be, expressed as a performance level from PL a to PL e under ISO 13849-1, or a safety integrity level under IEC 62061.

For industrial robots, the 2011 edition of ISO 10218 set a blanket default: PL d with a Category 3 architecture, unless the risk assessment justified something else. The 2025 edition replaced that with requirements assigned to each safety function. You can take the default for a given function from the standard, or derive a different level from a more detailed risk assessment — which means more analysis and more documentation.

The practical consequence: a safety function has to run on hardware and software built and verified for that purpose. A signal passing through an ordinary PC, or through the robot’s AI model, does not count.

What changes when the controller is a learned model

Traditional robot programs repeat the same path. A vision-language-action model does not, and that shifts three assumptions.

The motion is not known in advance. You cannot enumerate the paths the robot will take, so the assessment has to consider the whole reachable space at the maximum speed and force the hardware can produce — unless a safety-rated function limits them.

“Foreseeable misuse” now includes the model. A learned policy can misread a scene, pursue the wrong object, or act on an ambiguous instruction. Treat a wrong action from the model as a foreseeable event with a meaningful probability, not as a fault.

The model cannot be the safeguard. However good its perception of people is, it has no performance level. Detecting a person and stopping must be done by safety-rated sensors and logic that work the same whether the model is right or wrong.

The resulting architecture is the one this handbook returns to throughout: a flexible, unverified model on the inside, and a simple, verified envelope of limits on the outside.

Document it

A risk assessment that is not written down does not exist as far as an auditor, an insurer or a court is concerned. Record the limits, each hazard, the estimate before and after risk reduction, the measures chosen, the performance level required for each safety function, and how each was validated. Then keep it current.