What preventive site access control means
Preventive site access control connects the physical entry of people and equipment with the conditions agreed for work at a shared workplace. Its useful unit is more than a company name: it includes the person, employer, task, area, equipment and intervention period. A credential might allow someone to report to reception without authorising a manoeuvre, entry into a special enclosure or use of another organisation’s machinery.
Within business activity coordination, known in Spain as CAE, this control helps identify inconsistencies before exposure and communicate relevant changes. It does not certify a contractor’s entire prevention system or replace supervision of the work. Documentary status, operational authorisation and verification of present conditions should be kept distinct because they answer different questions and involve different responsibilities.
Who sets requirements and makes decisions
In Spain, Royal Decree 171/2004 distinguishes concurrent employers, the undertaking controlling the workplace and the principal employer. The principal employer has the specific oversight duty in Article 10 when it contracts works or services belonging to its own activity and performed at its own workplace. A commercial relationship alone does not settle that classification. The workplace holder is identified by its capacity to make the premises available and manage them.
Before configuring permissions, identify who checks each requirement, who understands the operation and who can suspend or review authorisation. Reception staff apply understandable rules and refer discrepancies to the designated responsible person; they should not improvise a technical assessment or judge clinical information. A platform can retain decisions, but allocating functions does not remove the legal obligations of the employers involved.
Sources: [1]
Requirements proportionate to the activity
The requirements matrix should start with risks introduced or shared: jobs, equipment, areas, schedules, interactions and emergency arrangements. Information is exchanged before work begins and when relevant circumstances change; necessary information about accidents or emergencies that may affect other companies must also be communicated. Coordination arrangements should reflect the hazards, number of people and duration of concurrent activities.
These Spanish provisions do not establish a universal CAE certificate with a single expiry date that allows every activity. A document may have a statutory validity period, a review triggered by change or a contractual condition; these must be distinguished. Asking every visitor for every document creates noise. A brief delivery, complex maintenance and work in production need different circumstances to be examined, without assuming that a short presence carries no risks.
People, training and the scope of authorisation
Identification should reliably link each person to their employer and intended activity, avoiding shared credentials. Induction explains workplace hazards, contacts, restrictions and emergency response in an understandable form. Training evidence is checked against the tasks and applicable requirements; a generic course does not demonstrate competence for every machine or intervention. Records should be understandable to those responsible for acting on them.
Useful explicit states include awaiting review, authorised for a defined scope, suspended and completed. Authorisation can specify an area, schedule and accompaniment without becoming permanent approval. When a worker, machine or task changes, check which conditions are no longer valid. Specific permits to work, where appropriate, retain their own function and are not replaced by an entry record. This also keeps reception decisions distinct from permission to begin a hazardous operation.
External machinery and applicable inspections
For external equipment, relevant information includes its identity, intended use, installation conditions, applicable documentation and designated operators. Spanish Royal Decree 1215/1997 requires suitability, maintenance and information, and distinguishes initial checks where safety depends on installation, periodic checks where deterioration could create danger and additional checks following relevant exceptional events. Competent personnel must carry them out. When equipment is used outside the undertaking, material evidence of the latest check must accompany it under the terms of Article 4.
Not every machine requires the same administrative authorisation or an identical inspection schedule: specific regulations may apply and must be identified. A system can flag a missing check or inconsistent document, but cannot by itself verify a guard, brake condition or compatibility with the workplace. Admitting machinery onto the site does not automatically authorise commissioning or a change of use. Documentation and physical verification therefore serve complementary purposes.
High visibility and other protective equipment
For road work or areas with vehicle movements, the need for high visibility clothing and its characteristics follow from assessment and the conditions applicable to the activity. Clothing does not replace pedestrian and vehicle separation or traffic organisation. It should be selected alongside other protection to avoid incompatibility, fit the wearer and retain its performance according to the manufacturer’s instructions. These principles derive from the Spanish rules on use of personal protective equipment.
Recording issue, observing a garment at entry and verifying correct use throughout a task are different forms of evidence. A photograph or automated detection does not alone prove suitability, cleanliness, reflective condition or continuous use. Reception should know what to do about a visible deficiency and whom to notify. Field checks and replacement remain necessary even when documentary records appear complete.
Sources: [3]
Liability insurance and coverage limits
Where applicable law or the contract requires insurance, review identifies the insured party, activity, validity, scope, limits and relevant exclusions. The Spanish Insurance Contract Act provides for coverage within statutory and contractual limits. A receipt or expiry date in isolation therefore cannot establish that every accident is covered; doubts about scope require examination of the policy and, where appropriate, specialist clarification. An administrative acceptance should accurately describe what was checked.
Insurance does not prove training, equipment safety or preventive compliance. Nor does a duty to insure one specific activity become a general legal requirement for every contractor. A management tool should distinguish contractual requirements, statutory obligations and reviewed evidence. An automated alert helps identify validity changes, but does not replace interpretation of a clause or determine whether an individual claim will be covered.
Necessary data, health and traceability
Access control processes personal data and requires a defined purpose, lawful basis, information for individuals, security measures and justified retention. Data minimisation means collecting what is needed for that purpose rather than accumulating files because it is technically possible. Physical entry to a site should be distinguished from permission to consult information within the system: reception, coordination and healthcare personnel have different needs.
Health surveillance is not a universally compulsory examination. Spanish prevention law regulates consent and its exceptions, as well as medical confidentiality. Where conclusions about fitness or preventive measures need to be communicated, access is restricted to those who need them for their functions; clinical records are not routinely handed to reception. Record who decided, using which evidence and when, and establish correction, review and deletion arrangements consistent with applicable obligations.
Incidents, exceptions and changes during work
An incident should describe the affected requirement and its scope: an identification error differs from missing protection or an unassessed change of work. The response should allow documents to be clarified without exposing a person to an unauthorised activity. No administrative exception can waive a legal obligation or turn a dangerous condition into an acceptable one. The procedure needs available responsible people and communication routes for urgent situations.
In a hypothetical example, a contractor arrives with a different mobile elevating work platform from the one expected. Although the people are accredited, equipment, checks, operating competence and site conditions are reviewed before the task. If the work area also changes, interactions and restrictions are updated. This example illustrates an organisational decision; it is neither a technical operating instruction nor evidence of results from a real implementation.
Indicators and integration with occupational safety
A monitoring dashboard could compare outstanding requirements by activity type, discrepancies found in the field, authorisations suspended after changes and incident resolution time. These are management suggestions, not legal thresholds or measures that independently prove an absence of accidents. The important questions include whether decisions are correct, people understand instructions and information arrives before work starts, rather than simply increasing the percentage of accepted documents.
Automation adds value when it preserves versions, alerts the appropriate person and makes decisions explainable. Test what happens with outdated data, system interruption and staff substitutions while maintaining effective coordination arrangements. Review the process with operations, prevention staff, contractors and data protection specialists. Records should make it possible to reconstruct which CAE conditions, permits to work and equipment checks supported each authorisation and how changes were communicated. Technical configuration should follow the agreed preventive process and remain reviewable when that process changes.
Frequently asked questions
Does CAE accreditation allow every kind of work?
No. Its scope must be defined by person, task, area, equipment and period. Specific permits and field checks retain their own function.
Does every machine need the same permit?
No. Identify provisions applying to the equipment, its use and required checks. Permission to enter the premises does not itself authorise operation.
Is detecting a high visibility vest sufficient?
No. The presence of a garment does not demonstrate suitability, condition, compatibility or continuous use. Protection requires effective selection and verification.
Should reception retain clinical records?
Not as a routine entry requirement. Information must be limited to the purpose and authorised recipients while preserving medical confidentiality.
