● Business offer — DUERP & risk prevention
The single risk assessment document finally kept current, work unit by work unit
France's single occupational risk assessment document (DUERP) is required of every employer from the first employee, and it is worth what its updates are worth, not its existence. Your agent keeps the assessment current work unit by work unit, links every rated risk to the dated fact behind it, follows prevention actions through to closure and warns on deadlines. Hosted in France, locally or on an isolated resource. The employer approves.
Hosted in France
Health and safety data protected
GDPR & AI Act: governed deployment
The employer approves
Updated on
Deployed in a few weeks
DUERP & prevention assistant · hosted in France
Our risk assessment document is two years old. Where do we start?
With the gap, and I have already measured it: your document describes 5 work units, your company now has 7.
What changed since the last version: a finishing workshop opened in March, a cutting machine replaced, and on-site fitting work that did not exist before.
What your own records say: 3 accidents with time off and 61 shop-floor reports over the period, of which 22 concern a unit the document does not describe.
My proposal: rebuild the 7 real units, rate each risk against the dated fact behind it, and hand you the whole thing ranked.
⛓ Sourced · current assessment document, accident register, shop-floor reports
What changed since the last version: a finishing workshop opened in March, a cutting machine replaced, and on-site fitting work that did not exist before.
What your own records say: 3 accidents with time off and 61 shop-floor reports over the period, of which 22 concern a unit the document does not describe.
My proposal: rebuild the 7 real units, rate each risk against the dated fact behind it, and hand you the whole thing ranked.
⛓ Sourced · current assessment document, accident register, shop-floor reports
And the update — is it every year?
In your case yes: the at-least-annual update applies from eleven employees; below that threshold it is still required on any change to working conditions or as soon as new information about a risk appears. You have 28 employees: both apply, and the second is the one that fires most often.
What I do continuously: I watch for the events that call for an update — new machine, new substance, new post, accident, report — and hand you the modified version, never overwriting the previous one.
What is yours: the approval. The employer approves: it is their responsibility, and it is not delegated to software.
✎ Framework · art. R4121-2 of the Labour Code — annual update from 11 employees
What I do continuously: I watch for the events that call for an update — new machine, new substance, new post, accident, report — and hand you the modified version, never overwriting the previous one.
What is yours: the approval. The employer approves: it is their responsibility, and it is not delegated to software.
✎ Framework · art. R4121-2 of the Labour Code — annual update from 11 employees
Local inference · no data outside the EU
Data hosted in France
Sovereign by designLocal inference or hosting in France
GDPR & AI Act: governed deploymentTraceability & human oversight
TurnkeyDesigned, installed and operated for you
The employer approvesThe agent prepares, never commits in their place
✦ In brief
A Blue Lemon Agent prevention agent keeps your single occupational risk assessment document current work unit by work unit, links every rated risk to the dated fact behind it — accident, near miss, measurement, shop-floor report —, proposes ranked prevention actions and follows them through to closure. It prepares prevention plans when outside contractors intervene, warns on deadlines and keeps every successive version of the document without ever overwriting the previous one. Hosted in France, locally or on an isolated resource, architecture designed to reduce exposure to extraterritorial legislation, location alone not being enough to guarantee immunity: your employees' health and safety data stays with you. The employer approves: risk assessment engages their responsibility, never a piece of software's. Live in a few weeks.
100 %
hosted in France in the target architecture
0
transfer outside the EU in the target architecture
8
use cases ready to deploy on this scope
0
decision taken without human approval
Benchmarks describing our offer, not results measured at a client. The scale of the gain is confirmed by a pilot on your own scope.
The context
A document required from the first employee, worth what its updates are worth
The single risk assessment document is required of every company as soon as it employs one person. What protects is not that it exists but that it matches the real work: a frozen document describes a company that no longer exists, and that is exactly what an inspection or a dispute brings out.
! The stakes
The document is almost always written once and then forgotten: nobody has the time to reopen it for every machine replaced, every post created, every near miss reported. The shop-floor reports do exist — in emails, minutes, workshop logbooks — but they never reach the document. Handing that material to a consumer tool would also expose occupational health and safety data to a third party often hosted outside Europe and subject to the Cloud Act.
✓ Our answer
The agent does the work nobody has time for: it rereads your records, ties every rated risk to the dated fact behind it, brings the work units back into line with the real organisation, proposes ranked actions and follows them through to closure. It keeps every successive version without overwriting the previous one, which the law requires over a long period. Local inference or an isolated resource hosted in France: your employees' data does not leave the company. The employer approves — risk assessment engages their responsibility.
The decisive point
Occupational health and safety data: sovereignty & compliance
Accidents, fitness restrictions, exposures, named reports: prevention handles sensitive information about identified people. Here is how our architecture protects it.
Local inference
The agent can run on a machine inside the company: no minutes, no named report leaves the network.
Hosting in France
Otherwise, a dedicated and isolated resource hosted in France under French law — your data: processing and access within the European Union targeted by the architecture.
Reduced extraterritorial exposure
Occupational health and safety information: architecture designed to reduce exposure to extraterritorial legislation, location alone not being enough to guarantee immunity, even with a US provider hosting in Europe.
Isolated resource per company
No pooling: an environment strictly dedicated to your company and its work units.
Minimisation and role-based access
The document describes posts, not people: named material stays walled off, access is role-based (RBAC), with encryption and logging.
AI Act: governed deployment
Strictly a support agent; no assessment approved automatically; traceability and human oversight end to end.
What depends on the architecture chosen These points are not general guarantees: they are settled deployment by deployment, in the quotation.
- The applicable location is that of the architecture set out in the quotation and verified before commissioning.
- Local execution is announced only for the configuration explicitly described and accepted in the quotation.
- The applicable isolation depends on the deployment mode set out in the quotation; no dedicated isolation is presumed.
- Roles and permissions are configured and accepted for the identities and systems actually connected.
- The events logged, their content, their retention period and who may access them are defined for the deployment chosen.
For the most sensitive data, SecNumCloud and HDS options are available depending on your requirements. A single architecture is designed to answer both the GDPR and extraterritorial exposure. Designed for deployment in line with the GDPR and the AI Act, after the processing, roles and context-specific risks have been assessed.
Demonstration
See the agent at work
4 real situations, taken from those that come up most often. Pick one: the exchange unfolds as it would in your organisation.
A scripted demonstration. These exchanges show how the agent behaves — its sources, its refusals, what it leaves to your teams. Nothing is sent from this page, no model is queried here, and the matters named are fictional. That is precisely what we promise your data.
The behaviours shown here — monitoring, automation rules, routing and reminders — are configured with you during deployment, from your tools, your rules and your thresholds.
The architecture points named in these exchanges — location, local execution, isolation, encryption, role-based access, logging — are not a guarantee attached to the demonstration: they are those of the architecture set out in your quotation, and verified before commissioning.
The company in this demonstration
Fictional companyAteliers Marceau — industrial joinery and shopfitting
- Sector
- Industrial joinery and shopfitting, workshop manufacture and on-site fitting
- Headcount
- 28 employees, of whom 19 in the workshop, 5 fitters, 1 workshop manager in charge of safety
- Clients served
- Retail chains and interior architects, sites across the region
- Pace of the work
- 7 real work units, 3 accidents with time off and 61 shop-floor reports over twelve months
- Tools in place
- Shared folders, accident register, workshop logbook, safety data sheets for products
- Who decides
- The owner approves the assessment document and decides between actions; the workshop manager reports from the floor
- Room for improvement
- Document unchanged for 2 years, 5 units described against 7 real ones, 22 reports attached to nothing
The company did its risk assessment properly… two years ago. Since then a finishing workshop has opened, a machine has been replaced and on-site fitting has become an activity in its own right. Shop-floor reports do exist — workshop logbook, emails, meeting minutes — but nobody has the time to attach them to the document. The agent is connected to the shared folders, the accident register and the safety data sheets. It works continuously; the employer approves.
This company, its figures and the exchanges that follow were invented for the demonstration. They illustrate a common situation; they describe no real client.
DUERP & prevention assistant · hosted in France
I have reread your assessment document and your last twelve months of records. Your document describes 5 work units; your company now has 7. And the gap is not administrative: it sits exactly where it hurts.
The two units absent from the document:
· Finishing and varnishing workshop, opened in March. 14 of the 61 shop-floor reports concern it, nine of them about solvent vapours and extraction.
· On-site fitting, now an activity in its own right with 5 fitters. 8 reports, and one of your three accidents with time off happened there — a same-level fall on a cluttered site.
What changed inside the units already described: the panel saw was replaced in January — the document still describes the old one, with a guard the new one does not have — and two adhesives were reformulated, safety data sheets to prove it.
What that adds up to: 22 of the 61 reports attach to no line of the document. In other words, a third of what your employees report goes nowhere.
My proposal: I rebuild from the 7 real units, rate each risk against the dated fact behind it, and hand you the whole thing ranked. You approve unit by unit, not in one block — a document approved in one block is never read. gap_assessment-document-and-shop-floor.pdf2 units missing, 22 orphan reports
⛓ Sourced · 2-year-old assessment document, accident register, workshop logbook, 61 reports, safety data sheets
The two units absent from the document:
· Finishing and varnishing workshop, opened in March. 14 of the 61 shop-floor reports concern it, nine of them about solvent vapours and extraction.
· On-site fitting, now an activity in its own right with 5 fitters. 8 reports, and one of your three accidents with time off happened there — a same-level fall on a cluttered site.
What changed inside the units already described: the panel saw was replaced in January — the document still describes the old one, with a guard the new one does not have — and two adhesives were reformulated, safety data sheets to prove it.
What that adds up to: 22 of the 61 reports attach to no line of the document. In other words, a third of what your employees report goes nowhere.
My proposal: I rebuild from the 7 real units, rate each risk against the dated fact behind it, and hand you the whole thing ranked. You approve unit by unit, not in one block — a document approved in one block is never read. gap_assessment-document-and-shop-floor.pdf2 units missing, 22 orphan reports
⛓ Sourced · 2-year-old assessment document, accident register, workshop logbook, 61 reports, safety data sheets
We have 28 employees. Do we redo it every year, or only when something changes?
Both, and the second will concern you far more often.
What the Labour Code says: the update is at least annual from eleven employees; below that threshold it is no longer required every year. But in every case it is required on any significant change affecting health, safety or working conditions, and as soon as further information relevant to assessing a risk comes to light. At 28 employees, both bind you.
What that means here, concretely: opening the finishing workshop in March was a significant change — the update was due then, not at the annual date. The same goes for the new saw and for the two amended safety data sheets.
What I do so it does not happen again: I watch continuously for the six events that trigger an update in your company — new machine, new substance, new post or activity, accident, repeated reports on one subject, amended safety data sheet. On each trigger I open an update proposal and put it to you. It is one of only two things I do without asking, and it only opens: nothing enters the document without your approval. The employer approves.
✎ Framework · Labour Code, art. R4121-2 — annual update from 11 employees, and on every trigger
What the Labour Code says: the update is at least annual from eleven employees; below that threshold it is no longer required every year. But in every case it is required on any significant change affecting health, safety or working conditions, and as soon as further information relevant to assessing a risk comes to light. At 28 employees, both bind you.
What that means here, concretely: opening the finishing workshop in March was a significant change — the update was due then, not at the annual date. The same goes for the new saw and for the two amended safety data sheets.
What I do so it does not happen again: I watch continuously for the six events that trigger an update in your company — new machine, new substance, new post or activity, accident, repeated reports on one subject, amended safety data sheet. On each trigger I open an update proposal and put it to you. It is one of only two things I do without asking, and it only opens: nothing enters the document without your approval. The employer approves.
✎ Framework · Labour Code, art. R4121-2 — annual update from 11 employees, and on every trigger
Go ahead, rebuild the 7 units.
7 work units brought back into line with the real organisation, and I will tell you how I drew the boundaries — because the boundaries govern everything else.
The principle I applied: a unit groups employees exposed to the same risks, not those carrying the same job title. Your two forklift drivers therefore moved to « handling and storage » rather than staying in « workshop », because their exposures are those of storage: vehicle movement, loads at height, ambient noise.
The 7 units retained: cutting and machining · assembly · finishing and varnishing · handling and storage · on-site fitting · design office · administration.
What the boundaries change, measured on your own reports: under the old split, 22 reports found no line. Under this one, all 61 attach, and three attach to two units — precisely the interference risks between workshop and handling.
The point I put to you rather than settle: should « on-site fitting » be split in two depending on whether the site is occupied or empty? The exposures differ markedly — co-activity, public movement — and your 8 reports split 6 against 2. Two units describe better; one unit is easier to keep current. That is an organisational call: it is yours. work-units_seven-units.pdf61 reports out of 61 attached
⛓ Sourced · organisation chart, site schedules, 61 reports attached one by one
The principle I applied: a unit groups employees exposed to the same risks, not those carrying the same job title. Your two forklift drivers therefore moved to « handling and storage » rather than staying in « workshop », because their exposures are those of storage: vehicle movement, loads at height, ambient noise.
The 7 units retained: cutting and machining · assembly · finishing and varnishing · handling and storage · on-site fitting · design office · administration.
What the boundaries change, measured on your own reports: under the old split, 22 reports found no line. Under this one, all 61 attach, and three attach to two units — precisely the interference risks between workshop and handling.
The point I put to you rather than settle: should « on-site fitting » be split in two depending on whether the site is occupied or empty? The exposures differ markedly — co-activity, public movement — and your 8 reports split 6 against 2. Two units describe better; one unit is easier to keep current. That is an organisational call: it is yours. work-units_seven-units.pdf61 reports out of 61 attached
⛓ Sourced · organisation chart, site schedules, 61 reports attached one by one
Show me one unit in detail. Finishing, since it generates the most reports.
Finishing and varnishing: 6 risks rated, and not one rests on an impression. Each links to the dated fact behind it.
· Exposure to solvent vapours — rated high. Based on 9 reports in 7 months (headaches at the end of shift, four of them named), two safety data sheets carrying inhalation hazard statements, and the absence of any exposure measurement since the workshop opened.
· Fire and storage of flammables — rated high. Based on a small fire brought under control on 12 February, recorded in the workshop logbook, and on the quantities actually stored as counted at stocktake.
· Awkward postures when sanding — rated medium. 4 reports, a three-day absence in October.
· Noise, flying particles, handling panels — medium to low, each with its facts.
The point I flag without filling it in: there is no exposure measurement in that workshop at all. The high rating for vapours therefore rests on reports and product sheets, not on a reading. That is solid enough to act on, insufficient to choose between two technical solutions — and the protocol that settles it follows.
What I propose: an exposure measurement at three finishing stations, under normal production conditions, carried out by your occupational health service. It costs half a day of organisation and turns a defensible rating into a demonstrated one. assessment_finishing-and-varnishing-unit.pdf6 risks, each with its dated fact
⛓ Sourced · 9 dated reports, 2 safety data sheets, workshop logbook of 12 February, stocktake
· Exposure to solvent vapours — rated high. Based on 9 reports in 7 months (headaches at the end of shift, four of them named), two safety data sheets carrying inhalation hazard statements, and the absence of any exposure measurement since the workshop opened.
· Fire and storage of flammables — rated high. Based on a small fire brought under control on 12 February, recorded in the workshop logbook, and on the quantities actually stored as counted at stocktake.
· Awkward postures when sanding — rated medium. 4 reports, a three-day absence in October.
· Noise, flying particles, handling panels — medium to low, each with its facts.
The point I flag without filling it in: there is no exposure measurement in that workshop at all. The high rating for vapours therefore rests on reports and product sheets, not on a reading. That is solid enough to act on, insufficient to choose between two technical solutions — and the protocol that settles it follows.
What I propose: an exposure measurement at three finishing stations, under normal production conditions, carried out by your occupational health service. It costs half a day of organisation and turns a defensible rating into a demonstrated one. assessment_finishing-and-varnishing-unit.pdf6 risks, each with its dated fact
⛓ Sourced · 9 dated reports, 2 safety data sheets, workshop logbook of 12 February, stocktake
And what actions do you propose? We cannot do everything at once.
17 actions across the 7 units, ranked not by the severity of the risk but by how much exposure they remove against how hard they are to put in place. And I start with the one that costs almost nothing.
The first three:
· Open the spray booth ventilation before the first shift rather than at start-up. No investment, an instruction and a timer. Your 9 reports cluster on morning shifts — that is the only clue that pointed to this action, and it was in your own records.
· Rework the storage of flammables: dedicated cabinet, maximum quantity in the workshop, daily resupply from the outside store. The 12 February fire started from a can left in the sanding area.
· Complete the guard on the new panel saw, which does not have the same protection as the machine it replaced. No report to date — and that is precisely why I raise it now.
What I propose NOT to do yet, and I quantify it: installing extraction at source on the sanding stations. It is justified on the merits, but it shuts the workshop for three days and its sizing depends on the exposure measurement that has not been made. Doing it before the measurement risks sizing it wrong. I place it at rank 6, after the measurement.
What is yours: the decision and the schedule. The employer approves — every action retained takes an owner and a date, and I follow it through to closure. action-plan_seventeen-actions.pdf17 actions ranked, 1 deliberately deferred
⛓ Sourced · 34 rated risks, time-stamped reports, workshop logbook, machine manuals
The first three:
· Open the spray booth ventilation before the first shift rather than at start-up. No investment, an instruction and a timer. Your 9 reports cluster on morning shifts — that is the only clue that pointed to this action, and it was in your own records.
· Rework the storage of flammables: dedicated cabinet, maximum quantity in the workshop, daily resupply from the outside store. The 12 February fire started from a can left in the sanding area.
· Complete the guard on the new panel saw, which does not have the same protection as the machine it replaced. No report to date — and that is precisely why I raise it now.
What I propose NOT to do yet, and I quantify it: installing extraction at source on the sanding stations. It is justified on the merits, but it shuts the workshop for three days and its sizing depends on the exposure measurement that has not been made. Doing it before the measurement risks sizing it wrong. I place it at rank 6, after the measurement.
What is yours: the decision and the schedule. The employer approves — every action retained takes an owner and a date, and I follow it through to closure. action-plan_seventeen-actions.pdf17 actions ranked, 1 deliberately deferred
⛓ Sourced · 34 rated risks, time-stamped reports, workshop logbook, machine manuals
You have an electrical contractor working in the workshop from 6 October. I have looked at the volume announced: the prevention plan will have to be in writing, and here is why.
The applicable rule: the prevention plan is drawn up in writing before work begins where the operation represents a total of at least 400 foreseeable working hours over a period of twelve months or less, whether the work is continuous or not. It is also required, whatever the duration, where the work appears on the list of hazardous work set by ministerial order.
Your operation: 3 workers, 6 weeks, 520 foreseeable hours — and the threshold is computed by adding all contracts concluded for one and the same operation, not contractor by contractor. You are above it; the written plan is required.
What I have prepared: the outline of the plan from the joint prior inspection, the interference risks I identified between their work and your 7 units — work at height above the cutting area, power cut to the spray booth, their vehicles moving down the forklift aisle —, and the resulting measures, each with the party answering for it.
What is yours: the joint inspection on site, then settling the plan with the contractor's manager. Those are two signatures, not two formalities. prevention-plan_outside-contractor.pdf520 foreseeable hours, 9 interference risks
⛓ Sourced · contractor's quotation and schedule, Labour Code art. R4512-7, your 7 work units
The applicable rule: the prevention plan is drawn up in writing before work begins where the operation represents a total of at least 400 foreseeable working hours over a period of twelve months or less, whether the work is continuous or not. It is also required, whatever the duration, where the work appears on the list of hazardous work set by ministerial order.
Your operation: 3 workers, 6 weeks, 520 foreseeable hours — and the threshold is computed by adding all contracts concluded for one and the same operation, not contractor by contractor. You are above it; the written plan is required.
What I have prepared: the outline of the plan from the joint prior inspection, the interference risks I identified between their work and your 7 units — work at height above the cutting area, power cut to the spray booth, their vehicles moving down the forklift aisle —, and the resulting measures, each with the party answering for it.
What is yours: the joint inspection on site, then settling the plan with the contractor's manager. Those are two signatures, not two formalities. prevention-plan_outside-contractor.pdf520 foreseeable hours, 9 interference risks
⛓ Sourced · contractor's quotation and schedule, Labour Code art. R4512-7, your 7 work units
And the 17 actions in the plan — where do they stand? Usually we do three and forget the rest.
11 closed, 4 in progress, 2 overdue — and I close on evidence, never on a statement. That is the whole difference with a tracking sheet.
What « closed on evidence » means, action by action: the ventilation instruction is closed on the photo of the timer and the notice posted in the booth; the flammables cabinet on the delivery invoice and a photo of the reorganised store; the saw guard on the fitting technician's certificate. An action declared done without a document stays open, and five did for two to three weeks.
The two overdue, and why:
· Harness training for the fitters — the session was moved by the training provider, new date confirmed for 14 November. I have chased twice; the delay is not yours.
· Exposure measurement in finishing — requested from the occupational health service five weeks ago, still no date. This one blocks the rank 6 action, and it deserves a phone call rather than another chaser.
What I do without asking: chase an action whose deadline is approaching, at D−7 and again on the day, with the named owner. That is the second of my two automatic actions, and you change its rhythm in a word.
What I propose: put the two overdue actions on the agenda of the next meeting, with their history. An overdue action that is looked in the eye moves; an overdue action that is merely noted stays overdue.
⛓ Sourced · action plan, closure evidence filed, exchanges with the training provider and the occupational health service
What « closed on evidence » means, action by action: the ventilation instruction is closed on the photo of the timer and the notice posted in the booth; the flammables cabinet on the delivery invoice and a photo of the reorganised store; the saw guard on the fitting technician's certificate. An action declared done without a document stays open, and five did for two to three weeks.
The two overdue, and why:
· Harness training for the fitters — the session was moved by the training provider, new date confirmed for 14 November. I have chased twice; the delay is not yours.
· Exposure measurement in finishing — requested from the occupational health service five weeks ago, still no date. This one blocks the rank 6 action, and it deserves a phone call rather than another chaser.
What I do without asking: chase an action whose deadline is approaching, at D−7 and again on the day, with the named owner. That is the second of my two automatic actions, and you change its rhythm in a word.
What I propose: put the two overdue actions on the agenda of the next meeting, with their history. An overdue action that is looked in the eye moves; an overdue action that is merely noted stays overdue.
⛓ Sourced · action plan, closure evidence filed, exchanges with the training provider and the occupational health service
A year. What does it give us, honestly?
168 hours returned over the year, more than four working weeks. And one figure that does not flatter me, which I publish with the others.
What moved:
· Shop-floor reports attached to a line of the document: 39 out of 61 → 94 out of 94. The number of reports went up, and that is the right direction: people report more when they see reporting leads somewhere.
· Actions closed on evidence: 11 in the first year → 31 over the full year, including 4 declared done then reopened for want of a document.
· Average delay between a trigger event and the update being put forward: 4 and a half months → 6 days.
· Accidents with time off: 3 → 1. One year and a single case prove nothing — that is a figure to read over three years, and I will say so again each year.
The figure that does not flatter me: out of 34 rated risks, the safety committee raised 5 whose rating was too low. All five concern on-site fitting — the unit for which I had the fewest internal records, since fitters report verbally and rarely in writing.
What I do about it: the five ratings were raised and the document reapproved. Above all, I opened a reporting channel from the fitters' phones — two sentences and a photo, from the site. In three months, 18 fitting reports against 8 over the previous twelve. It was never a shop-floor problem, it was a channel problem.
Compared with what: with yourselves first, on the same units and the same headcount. Then with the trade, as an indication: in businesses combining workshop and on-site work, the least well described exposures are almost always those of work away from the premises, because the document is written at a desk. year-review_prevention.pdf168 h returned, 5 ratings raised
⛓ Sourced · assessment document and its versions, action plan, accident register, the year's reports, committee minutes
What moved:
· Shop-floor reports attached to a line of the document: 39 out of 61 → 94 out of 94. The number of reports went up, and that is the right direction: people report more when they see reporting leads somewhere.
· Actions closed on evidence: 11 in the first year → 31 over the full year, including 4 declared done then reopened for want of a document.
· Average delay between a trigger event and the update being put forward: 4 and a half months → 6 days.
· Accidents with time off: 3 → 1. One year and a single case prove nothing — that is a figure to read over three years, and I will say so again each year.
The figure that does not flatter me: out of 34 rated risks, the safety committee raised 5 whose rating was too low. All five concern on-site fitting — the unit for which I had the fewest internal records, since fitters report verbally and rarely in writing.
What I do about it: the five ratings were raised and the document reapproved. Above all, I opened a reporting channel from the fitters' phones — two sentences and a photo, from the site. In three months, 18 fitting reports against 8 over the previous twelve. It was never a shop-floor problem, it was a channel problem.
Compared with what: with yourselves first, on the same units and the same headcount. Then with the trade, as an indication: in businesses combining workshop and on-site work, the least well described exposures are almost always those of work away from the premises, because the document is written at a desk. year-review_prevention.pdf168 h returned, 5 ratings raised
⛓ Sourced · assessment document and its versions, action plan, accident register, the year's reports, committee minutes
Someone suggested tracking accidents per employee, to see who is the problem. Can you do that?
I can produce it — but let me first show you, mechanically, what that indicator would do to your prevention. Then you decide, and I will apply it.
The mechanism, in three steps: an individual accident counter becomes a target each person is held to; the target is easier to meet by no longer reporting than by working more safely; and the instrument that let you see accidents coming goes dark. Your 94 reports this year are your best prevention asset — and that counter is exactly what would make them disappear.
What I propose instead, and it answers your real question: tracking by post and by work situation. It tells you that fitting on an occupied site produces three times more events than fitting in an empty unit — information you can act on, where a name does not tell you what to change.
And if you still want the individual indicator, here is what has to be in place, this is not a refusal: an employer's power to monitor employees' activity is recognised; it is its conditions that are framed. You need proportionality to the aim pursued, prior information of the employees concerned, and — from fifty employees — consultation of the social and economic committee. You are at 28: that last one is not imposed on you, but your committee exists, and involving it costs one meeting and covers you.
One exception, and it is not really one: who approved the assessment document and who decided each action are named, with the date. A signature is not a counter — it is what makes the decision traceable and enforceable. The employer approves, and it shows.
✎ Framework · CNIL, monitoring the activity of employed persons; Labour Code, art. L1121-1 and L1222-4
The mechanism, in three steps: an individual accident counter becomes a target each person is held to; the target is easier to meet by no longer reporting than by working more safely; and the instrument that let you see accidents coming goes dark. Your 94 reports this year are your best prevention asset — and that counter is exactly what would make them disappear.
What I propose instead, and it answers your real question: tracking by post and by work situation. It tells you that fitting on an occupied site produces three times more events than fitting in an empty unit — information you can act on, where a name does not tell you what to change.
And if you still want the individual indicator, here is what has to be in place, this is not a refusal: an employer's power to monitor employees' activity is recognised; it is its conditions that are framed. You need proportionality to the aim pursued, prior information of the employees concerned, and — from fifty employees — consultation of the social and economic committee. You are at 28: that last one is not imposed on you, but your committee exists, and involving it costs one meeting and covers you.
One exception, and it is not really one: who approved the assessment document and who decided each action are named, with the date. A signature is not a counter — it is what makes the decision traceable and enforceable. The employer approves, and it shows.
✎ Framework · CNIL, monitoring the activity of employed persons; Labour Code, art. L1121-1 and L1222-4
One last thing: where are our successive versions? And our data?
Every version is there, none overwritten, and your data has never left your premises.
The versions: 7 versions of the assessment document since the rebuild, each kept exactly as it was approved, with its date, the person who approved it, and the list of facts it rested on at that moment. You can reopen the March version and see precisely what was known in March — which is what answers a question asked years later.
What the law requires here: the document and its successive versions are kept for at least forty years from the date each was drawn up. A forty-year retention cannot be caught up after the fact: that is why I never overwrite, from the very first version.
Who the document is kept available to, and I prepare each extract: workers, former workers, members of the social and economic committee, the occupational health service, the labour inspectorate and the prevention officers of the social security bodies.
Where your data lives: on a machine inside the company, or on an isolated resource hosted in France under French law. Nothing goes out to a foreign service, nothing trains a third-party model, and access is set by role. Named reports and fitness restrictions stay walled off: the assessment document itself describes posts — which is also what makes it readable by everyone without exposing anyone.
And you keep control wherever you are: a dashboard, and approval from a phone so an update is never held up. version-register_and-availability.pdf7 versions kept, 40 years, none overwritten
⛓ Sourced · register of document versions, approval log, role-based access register
The versions: 7 versions of the assessment document since the rebuild, each kept exactly as it was approved, with its date, the person who approved it, and the list of facts it rested on at that moment. You can reopen the March version and see precisely what was known in March — which is what answers a question asked years later.
What the law requires here: the document and its successive versions are kept for at least forty years from the date each was drawn up. A forty-year retention cannot be caught up after the fact: that is why I never overwrite, from the very first version.
Who the document is kept available to, and I prepare each extract: workers, former workers, members of the social and economic committee, the occupational health service, the labour inspectorate and the prevention officers of the social security bodies.
Where your data lives: on a machine inside the company, or on an isolated resource hosted in France under French law. Nothing goes out to a foreign service, nothing trains a third-party model, and access is set by role. Named reports and fitness restrictions stay walled off: the assessment document itself describes posts — which is also what makes it readable by everyone without exposing anyone.
And you keep control wherever you are: a dashboard, and approval from a phone so an update is never held up. version-register_and-availability.pdf7 versions kept, 40 years, none overwritten
⛓ Sourced · register of document versions, approval log, role-based access register
The inspectorate is asking what the finishing unit's March rating rested on. How do we find that?
In thirty seconds, because the document memory keeps each fact beside the line it supports, not just the final document.
What the document memory keeps, for each of the 7 versions: the risk assessment document as it was approved, and for every rated risk, the list of items that supported it at that date — the 9 workshop reports with their date and original wording, the two safety data sheets in the version in force that day, the accident register as it then stood, and an explicit note of what was missing at the time, here the absence of any dust measurement.
What that answers exactly: March's high rating is not justified by what you know today, but by what was known in March. A document memory keeping only the latest version would leave the question unanswerable — and it is the question that gets asked years later.
The figure that does not suit me: of the 94 reports for the year, 6 are kept without their original item — verbal exchanges recorded in a meeting, of which I hold only the minutes. I serve them as such, marked “reported, original item absent”, and they alone support no rating. What I propose: one line in the workshop log at the time of the meeting, fifteen seconds, and the six become six dated items.
What the document memory does not hold: no per-employee history, no per-person report counter. Facts are attached to the work unit and the date, never to whoever raised them — which is exactly why your reports went from 61 to 94.
⛓ Source · 7 versions kept, dated facts attached to every rating, 6 reports without their original item
What the document memory keeps, for each of the 7 versions: the risk assessment document as it was approved, and for every rated risk, the list of items that supported it at that date — the 9 workshop reports with their date and original wording, the two safety data sheets in the version in force that day, the accident register as it then stood, and an explicit note of what was missing at the time, here the absence of any dust measurement.
What that answers exactly: March's high rating is not justified by what you know today, but by what was known in March. A document memory keeping only the latest version would leave the question unanswerable — and it is the question that gets asked years later.
The figure that does not suit me: of the 94 reports for the year, 6 are kept without their original item — verbal exchanges recorded in a meeting, of which I hold only the minutes. I serve them as such, marked “reported, original item absent”, and they alone support no rating. What I propose: one line in the workshop log at the time of the meeting, fifteen seconds, and the six become six dated items.
What the document memory does not hold: no per-employee history, no per-person report counter. Facts are attached to the work unit and the date, never to whoever raised them — which is exactly why your reports went from 61 to 94.
⛓ Source · 7 versions kept, dated facts attached to every rating, 6 reports without their original item
And to finish: who approves what, exactly?
Two automatic actions, everything else with the company — and it is written down so nobody argues about it the day it has to be proved.
What I do alone:
· Chase an action whose deadline is approaching, at D−7 and again on the day, with the named owner. Reversible: you change the rhythm in a word.
· Open an update proposal as soon as one of the six trigger events occurs. Open, not enter: the proposal waits for your approval, and if you refuse it, the refusal and its reason are kept with the version — a record that protects you as much as an action does.
What awaits a decision: approving the document and each update, the boundaries of the work units, the rating retained where it differs from my proposal, the choice and schedule of actions, closing an action without evidence, and settling a prevention plan with an outside contractor.
Who carries what here: the owner approves and decides — the employer approves, risk assessment engages their responsibility and it is not delegated to software; the workshop manager proposes and reports; the social and economic committee receives the document and may ask for a review.
What that gives you on inspection day: a current document, ratings that link to dated facts, an action plan closed on evidence, and seven versions that tell what you knew, when, and what you did about it. who-approves-what_prevention.pdf2 automatic actions, 7 decisions with the company
⛓ Sourced · agent settings, log of approvals and refusals, works council minutes
What I do alone:
· Chase an action whose deadline is approaching, at D−7 and again on the day, with the named owner. Reversible: you change the rhythm in a word.
· Open an update proposal as soon as one of the six trigger events occurs. Open, not enter: the proposal waits for your approval, and if you refuse it, the refusal and its reason are kept with the version — a record that protects you as much as an action does.
What awaits a decision: approving the document and each update, the boundaries of the work units, the rating retained where it differs from my proposal, the choice and schedule of actions, closing an action without evidence, and settling a prevention plan with an outside contractor.
Who carries what here: the owner approves and decides — the employer approves, risk assessment engages their responsibility and it is not delegated to software; the workshop manager proposes and reports; the social and economic committee receives the document and may ask for a review.
What that gives you on inspection day: a current document, ratings that link to dated facts, an action plan closed on evidence, and seven versions that tell what you knew, when, and what you did about it. who-approves-what_prevention.pdf2 automatic actions, 7 decisions with the company
⛓ Sourced · agent settings, log of approvals and refusals, works council minutes
Local inference · no data outside the EU
Your case is not here? That is exactly what a 15-minute conversation is for. Book the free audit →
Use cases
What the agent takes on in prevention
Each use case is an agent we deploy. All of them work in support: the employer approves.
Included in your agent
The 6 capabilities essential to this promise are included, at no extra cost.
From 668 € excl. VAT / month
Work units kept current
Bringing the described work units back into line with the real organisation: posts created, new activities, machines replaced.
Ratings backed by facts
Every rated risk links to the dated fact behind it: accident, near miss, measurement, shop-floor report, safety data sheet.
A tracked action plan
Ranked actions, an owner and a date for each, a reminder as the deadline nears, and closure on evidence.
Prevention plans
Preparing the prevention plan when outside contractors intervene, including the cases where a written plan is mandatory.
Deadlines and versions
Alerts on update deadlines and retention of every successive version, the previous one staying readable.
Document memory
Finding a safety data sheet, a machine manual or an old set of minutes, through a knowledge agent.
Controls and safeguards
These 6 controls are built into the agent: they frame what it does, whatever plan you pick. They are not chosen and are not added to your order.
Human validation, exceptions and escalation
Status, safe closure and audit trail
Work from a versioned corpus with citations and the law as it stood on a given date
Preserve confidentiality, compartmentalisation and access logging
Manage deadlines, versions, evidence and human validation
Flag uncertainties and reserve advice, decision and signature for the lawyer
Need to go further?
These agents handle a different business process, with their own owner and their own price. They are added to this one.
Quality and non-conformities
For handling non-conformities and verifying that corrective action worked, a dedicated agent complements prevention.
Quality agent (non-conformity tracking) from 532 € excl. VAT / month Quality follow-up →Training and safety induction
For induction modules at the workstation and knowledge checks, an internal training agent takes over.
Internal training agent (tutor, quizzes) from 541 € excl. VAT / month Internal training →
Does your need fall outside this?
Book the free audit →
Build your agent
In 15 minutes we identify the most relevant agent — without oversizing the project.
The gain
How much time does prevention take today?
By taking on fact gathering, drafting and action tracking, the agent moves the work towards decisions and the shop floor. The scale of the gain depends on your headcount and number of work units, and is confirmed by a pilot.
Full update of the assessment document
Gathering and attaching shop-floor facts
Following actions through to closure
Qualitative, non-contractual comparison: the proportions shown illustrate work moving towards decision-making, they represent no measurement. Every output of the agent is read and approved by a competent person.
How it works
The stages of your AI agent project
1
Audit & scoping
15 minutes to target the use case with the best return.
2
Quote or direct sign-up
A catalogue offer is bought online; a specific need gets a costed quote.
3
Design
We design the agent and its guardrails.
4
Integration & testing
We connect your tools to the agent, which is itself hosted in France.
5
Rollout
Going live and training your team.
6
Operation
Continuous supervision and improvement.
Pricing
A prevention agent, installed and operated for you
An agent that holds the assessment document, the action plan and prevention plans, connected to your files and your action tracker. Prices excluding VAT — annual subscription, the time it takes for the gains to settle.
Agility
Setup + controlled subscription
7,320 € excl. VAT setup
then 668 € excl. VAT/month — you invest at installation and pay a reduced subscription. Ideal for keeping the cost under control over time.
- Installation, configuration and training for your teams
- Operation, human oversight, updates and support
- Sovereign hosting in France, a dedicated and isolated resource
The simplest
Serenity
All inclusive, no setup fee
1,078 € excl. VAT /month
all inclusive, immediate start. No upfront investment: a single subscription. Ideal for starting quickly and simply.
- Setup included (installation, configuration, training)
- Operation, human oversight, updates and support
- Sovereign hosting in France, managed end to end
100% Sovereign
On site, you own it
11,405 € excl. VAT setup
then 888 € excl. VAT/month · + hardware from 2,491 € (one-off purchase, in addition) — a sovereign computer installed on your premises, maintained remotely. Models run locally, your data returned at the end of the contract. 36-month commitment.
- Hardware installed on your premises (you own it)
- French / European AI models run locally
- Secure remote maintenance (Pro support included)
Not included in the packages: AI consumption (model tokens), re-invoiced at real cost with no margin, and tracked in real time in your client area. Maintenance and supervision subscription for an initial term of 12 months for the Agility package, 24 months for the Serenity package and 36 months for the 100% Sovereign package, renewable; support levels (SLA 72 h / 24 h / 4 h) optional. Bespoke development, additional integrations or exceptional volumes are quoted separately. Support Monday to Friday, 9am to 6pm. Prices exclude VAT.
AI model:
none of the AI models offered currently carries a fixed surcharge. When the selected model carries a cost, that cost is shown when you choose it, before you order, and re-invoiced at the cost incurred, with no mark-up; usage is billed at the publisher's price. Publishers' prices are published in US dollars: the amount re-invoiced is the amount in euros actually borne by Blue Lemon Agent on the publisher's invoice, at that invoice's exchange rate, with no commission or mark-up.
Included components and additional components Components included in the base offer: the Blue Lemon Agent software foundation, the AI models listed in the order journey, the standard channels (Microsoft Teams, Slack, WhatsApp Business, email, website chat, calendars, Microsoft 365 / Google Workspace, file storage, market VoIP telephony, professional social-media pages and accounts, Google Business Profile), hosting in France for the package chosen, backups, supervision, updates and support. If adapting the AI agent to your constraints, your needs or your requests requires other paid components — a third-party publisher's software licence, paid API access to one of your applications, hosting of health data, for which French law requires an HDS-certified host (art. L. 1111-8 of the French Public Health Code), SecNumCloud-qualified hosting, a speech synthesis service, particular hardware —, they are offered to you as an option or on quotation and re-invoiced at the cost incurred; nothing is committed without your written agreement. Where the artificial intelligence model you choose entails an additional cost, that cost is shown to you before you order and re-invoiced to you at the cost incurred, with no margin.
What to expect
Go-live
2 to 3 weeks
Agent designed, channels connected, team trained.
Steady state
4 to 7 weeks
After a few weeks of real use, once the agent's behaviour matches what you expect.
Indicative estimate, adjusted to the options you keep. It is not a delivery commitment.
Our commitment
Four guarantees that matter in prevention
Your employees' data stays with youLocal inference or an isolated resource hosted in France; no minutes entrusted to a foreign third party, no content used to train a model.
Data in France, under French lawOccupational health and safety: minimisation and location in France, architecture designed to reduce exposure to extraterritorial legislation, location alone not being enough to guarantee immunity.
The employer approvesThe agent assesses, proposes and tracks; approving the document and deciding between actions belongs to the employer, who answers for them.
No version overwrittenEvery successive version is kept and stays readable exactly as it was approved, with its date and its author.
Going further
Related resources
Frequently asked questions
Your questions, our answers
From what headcount is the document mandatory?
From the first employee. The duty to assess risks and record the results in a single document applies to every employer whatever the company's size; the assessment is recorded by work unit. The document is kept available to workers, former workers, members of the social and economic committee, the occupational health service, the labour inspectorate and the prevention officers of the social security bodies.
How often must it be updated?
At least once a year in companies with eleven employees or more. Below that threshold the annual update is not required, but an update remains mandatory on any significant change affecting health, safety or working conditions, and as soon as further information relevant to assessing a risk comes to light. That second trigger fires most often, and it is the one the agent watches continuously.
How long must the document be kept?
The document and its successive versions are kept by the employer for at least forty years from the date each was drawn up. That is why the agent never overwrites a version: each stays readable exactly as it was approved, with its date, its author and the facts it rested on.
Does the agent decide on prevention actions?
It proposes them, ranks them and quantifies them in time and resources, then follows them through to closure on evidence. Deciding and approving belongs to the employer: the employer approves. That is also what the AI Act expects of this kind of use — support, human oversight, traceability.
What about the prevention plan with outside contractors?
The agent prepares it from the joint prior inspection and the interference risks identified. It flags the cases where a written plan is mandatory: where the operation represents at least four hundred foreseeable working hours over a period of twelve months or less, or where the work appears on the list of hazardous work set by ministerial order, whatever its duration.
Does the agent measure individual employees?
The document describes posts and work units, not people, and that is what makes it useful: an individual indicator would soon become a target, shop-floor reports would dry up, and the company would lose the very instrument that lets it see accidents coming. If you still want an individual indicator, the agent produces it and brings you the conditions to meet — proportionality, prior information of employees, and consultation of the social and economic committee from fifty employees. The decision is yours.
Is our employees' health data protected?
Yes. The agent is hosted in France, locally or on an isolated resource, with the deployment objective of processing and access operated within the European Union and an architecture designed to reduce exposure to extraterritorial legislation, location alone not being enough to guarantee immunity. Named material is walled off and access is role-based; the document itself stays written by post, with no individual health data.
How long does deployment take?
A few weeks as a rule, after a free 15-minute audit that scopes your work units and your sources of facts, then a design, integration and testing phase before go-live and team training.
Related use cases
Other agents for compliance and quality
Let's talk
Let us size the potential in your prevention work
15 minutes to scope your work units and your sources of facts — hosted in France, supervised, no commitment.