ISO 12100:2010 is the global baseline for machine-safety risk assessment, and ANSI has adopted it as ANSI/ISO 12100:2012 [S1]. The standard lays out a logical, sequential procedure applied during the relevant phases of a machine's life cycle, from concept and design through installation, operation, maintenance, and decommissioning [S1][S2].
Under the EU Machinery Regulation, EN ISO 12100 is not a checklist to tick; it is a structured engineering process that must be executed, documented, and justified at every step before CE marking can be issued [S2]. The output is a risk assessment file that traces every hazard, every risk-reduction measure, and every residual risk, and which other technical-file documents (declarations of conformity, instructions, test reports) all reference back to [S2].
Step 1: Define the machine limits across the whole life cycle
The first step in an ISO 12100 risk assessment sets the boundaries of the exercise by defining the machine's limits: intended use, reasonably foreseeable misuse, the user groups who will interact with it, the operating environment, and the life-cycle phases the machine will pass through from transport to decommissioning [S6][S9]. A machine intended for a clean, climate-controlled food plant and the same model destined for a foundry or outdoor quarry typically end up with different limit definitions, because the environmental and human factors differ [S2].
Common limit parameters captured in this step include: physical limits (range of motion, weight, dimensions), environmental limits (temperature, humidity, dust, explosive atmospheres per IEC 60079), time limits (service life, maintenance intervals), and human limits (operator skill level, presence of maintenance staff, bystanders) [S4]. The output is a written description that scopes the entire risk assessment, so the next steps do not drift beyond what was actually evaluated [S6].
Step 2: Hazard identification and analysis
Once the limits are fixed, the second step systematically identifies and analyzes all relevant hazards across the defined life cycle: mechanical (crush, shear, entanglement, drawing-in), electrical (shock, arc flash), thermal (hot surfaces, burns), noise, vibration, radiation, ergonomic, and hazardous-substance hazards [S3][S4]. Each hazard is documented with the associated hazardous situation and the potential harm it can cause, in line with the standard's definitions of "harm", "hazard", "hazardous situation", and "hazard zone" [S4].
Statistics on machine injuries underline why this step is not optional: industry fatality data consistently point to heavy equipment as a primary cause, and approximately 30% of machinery-related injuries involve amputations or deep lacerations, which makes systematic hazard identification a regulatory expectation rather than a nice-to-have [S3]. The hazards are recorded against each life-cycle phase, including transport, installation, setup, operation, cleaning, maintenance, and decommissioning, since the same machine exposes workers to different hazards at different stages [S3].
Step 3: Risk estimation
Step 3 estimates the risk for each hazardous situation identified in Step 2, typically by combining severity of potential harm with the probability of its occurrence and the possibility of avoiding or limiting the harm [S6][S9]. ISO 12100 itself does not prescribe a single numerical scoring method; the standard leaves the choice of estimation method to the assessor, but the inputs (severity, probability, frequency of exposure, possibility of avoidance) and the output (a risk level that can be compared against a reference) are mandated [S6].
Common practical methods include risk graphs, numerical scoring matrices, and the Preliminary Hazard Analysis (PHA) worksheet format. The estimate is recorded per hazard per life-cycle phase, and the result becomes the input to the risk-evaluation decision in the next step [S6][S9].
Step 4: Risk evaluation against acceptable criteria
Step 4 compares each estimated risk against the manufacturer's predefined criteria for acceptable risk, and decides whether risk reduction is required [S9]. If the estimated risk is above the threshold, the iteration continues into the three-step risk-reduction procedure; if below, the assessment moves to documentation and the next hazard [S6].
Because the procedure is iterative, hazards that fail Step 4 loop back to Step 3 after each risk-reduction measure is applied, until either the risk is reduced to acceptable or the residual risk is explicitly accepted and communicated to the user via information for use [S6][S9]. For the US-side comparison, ANSI B11.0 follows the same define-identify-estimate-evaluate logic, but the EU layer extends it with a Performance Level determination for safety functions [S2].
Risk reduction: the fixed three-step hierarchy
Risk reduction under ISO 12100 is not free-form: the standard mandates a fixed hierarchy in a strict order [S6]. Step 1 of risk reduction is inherently safe design: eliminate the hazard or reduce risk by changing the machine itself, through geometry, material selection, removal of sharp edges, lower operating speeds, lower stored energy, or mechanical re-arrangement. If a hazard can be designed out, that takes priority over any add-on device [S2][S6].
Step 2 is safeguarding and complementary protective measures: guards, interlocks, two-hand controls, light curtains, safety mats, emergency-stop devices per EN ISO 13850, and safety-related parts of control systems (SRP/CS) per EN ISO 13849. Step 3 is information for use: signs, warnings, training, and instructions that communicate residual risk the user must manage [S4][S6]. Each step lower in the hierarchy is only acceptable after the higher steps have been exhausted or shown to be insufficient [S6].
When Performance Level (PLr) enters the picture
Where the risk assessment identifies a safety function, ISO 12100 defers to EN ISO 13849-1 (and IEC 62061 in the alternative path) to specify the required Performance Level PLr, from PL a (lowest) to PL e (highest), based on severity, frequency of exposure, and possibility of avoidance [S2][S3]. The designed SRP/CS architecture is then verified to actually achieve a Performance Level equal to or greater than PLr, and that calculation is documented in the technical file [S2].
This is the layer that has no direct equivalent in ANSI B11.0: American machinery-safety practice focuses on hazard control, but does not require the same explicit PLr assignment, category check, and MTTFD / DCavg / CCF calculation that EU conformity assessment demands [S2]. For a manufacturer building a machine with safety-rated drives and interlocks, the PLC that hosts the safety logic, the pressure sensor chain feeding the safe stop, and the industrial valve actuator on a hydraulic block all have to be specified against the PLr that falls out of the risk assessment, not against generic catalog ratings [S2][S3].
Documentation outputs and life-cycle coverage
Clause 7 of EN ISO 12100 requires the risk assessment and risk-reduction process to be documented, including the limits, the hazards identified, the risk-estimation method used, the risk-reduction measures applied at each step, and any residual risk communicated through information for use [S4]. The resulting file is the single document the notified body, market surveillance authority, or customer will request first in any CE conformity audit [S2].
The risk assessment also has to be revisited when the machine is modified, when new hazards emerge from field feedback, or when a type-C standard is updated, because a change anywhere in the standards chain (for example a revision of EN ISO 13857 on safety distances, or of EN ISO 14120 on guards) can shift the limits of what is considered adequate risk reduction [S4]. On the field side, this is the same logic operators apply during pre-use inspections, where missing guards and faulty controls are caught before the machine is energized [S3]. For context on how type-C standards like EN ISO 10218-2 sit below the type-A / type-B framework, see the breakdown of machinery-safety standards structure [S4]. Related coverage of mobile-robot safety under ISO 3691-4 shows the same logic applied to AMRs, where zones and CE marking interlock with the ISO 12100 baseline [S2].
Common failure modes and limits of the method
ISO 12100 is a type-A / type-B standard; it gives the methodology, not the detailed requirements for any specific machine, and those are in the type-C product standards [S4]. A common audit finding is a risk assessment that names the methodology but skips the explicit declaration of the limits of the machine; without that, none of the downstream hazard identification is traceable. Another is applying safeguarding or information-for-use measures before exhausting inherently safe design, which violates the hierarchy and is a non-conformity in CE reviews [S2][S6].
Engineers moving from ANSI B11.0 to EN ISO 12100 should plan extra time for the PLr determination step, since that requires component-level data (Category, MTTFD, DCavg, CCF) that is not part of a US-style risk assessment. Trackable signals to watch: CEN/TC 114 work program updates on type-B standards referenced in the hierarchy (EN ISO 13849, EN ISO 13850, EN ISO 13857, EN ISO 14120), and any revision activity on ISO 12100 itself through ISO/TC 199.
For related coverage, see Cuplock Spigot Joint vs Internal Joint Pin for Vertical Standards.