Security Robots Major Accident Ordinance: 2026 Duties

Upper-tier Seveso establishments face dual audit pressure in 2026. The 12. BImSchV has required a documented safety management system for years. The KRITIS-Dachgesetz (KRITIS Umbrella Act) adds further physical protection duties on top. This article sorts out where autonomous patrols support the evidence chain and where they do not.

Security robots major accident ordinance: the 2026 regulatory frame

The 12. BImSchV (Major Accident Ordinance) obliges upper-tier operators to maintain a written safety management system per Annex III. Annex II Number 3 explicitly requires measures to prevent unauthorised access and to detect deviations from normal operation early. The documentation duty is not negotiable (ordinance text and KRITIS reference).

The KRITIS-Dachgesetz draft extends the duty perimeter from 2026. Chemical installations above threshold quantities face additional requirements on physical resilience, detection and reporting paths (Bundestag-Drucksache 20/9262). The trade inspectorate and BBK audit the monitoring chain including detection time, verification time and response time. Operators who cannot evidence detection time, verification time and response time fail the inspection (BBK guidance on KRITIS protection).

Personnel-based patrols increasingly fail to meet the evidence duty. Gaps on night and weekend shifts are on file. Sickness and shift handovers produce undocumented patrol windows. The authority reads this off the patrol log immediately.

Next step: hold the KRITIS-Dachgesetz checklist against the existing safety report.

Annex II and III duties of the 12. BImSchV in detail

Annex II Number 3 letter c requires identification and assessment of hazards under normal operation and foreseeable deviations. This includes leaks, mechanical damage to pipe bridges and tampering at loading stations. Operators who see hazards only in the DCS miss the outdoor space.

Number 4 mandates monitoring of operations including technical surveillance devices with a recording duty. Records must be audit-proof: timestamp, accountability, immutable storage. A radio patrol without a digital log file does not meet this standard.

Number 5 requires emergency planning including systematic analysis of foreseeable scenarios and defined alarm chains. The alarm chain must trigger in seconds, not minutes.

§ 8a Major Accident Ordinance requires a safety report every five years. Detection infrastructure must be documented in it, including maintenance, availability and interfaces. Deficiencies lead to prohibition orders under § 19. In practice this means shutdown of individual plant sections, not the entire site. That makes the damage quantifiable (and uncomfortable for the CFO).

Sensor requirements for autonomous patrols in the Seveso environment

Thermal detection (QR-2, QR-3) identifies leaks via temperature differential before optical damage becomes visible. A cold bridge at a flange connection reveals a leak the pressure sensors have not yet alarmed. The robot delivers the first indication here, not the diagnosis.

LiDAR on the QR-3 provides millimetre-accurate geometry checks on tanks, pipe bridges and loading stations. Deformations, missing bolts or removed earthing lines show up in target-actual comparison. The point cloud is archivable as an annex to the safety report.

Gas sensor head integration runs through the CAN interface. The robot carries PID or IR sensors depending on the substance spectrum. ATEX zone classification strictly limits deployment: QR models patrol Zone 2 outdoor areas, not Zone 0 or Zone 1. Sending the robot into a Zone 0 area violates the Industrial Safety Ordinance. The innermost tank environment remains the task of fixed gas detection systems and the works fire brigade.

Audio anomaly detection identifies pressure-drop noises (whistling, hissing) in the 80–4000 Hz band. Combined with thermal anomalies, this reduces the false alarm rate clearly versus single-sensor detection. Details on model selection in the section on the QR-3 with LiDAR and drone detection.

Integration into the safety management system (SMS)

Robot telemetry feeds the process control system directly via OPC UA or an MQTT bridge. The detection event becomes part of the plant status. The shift supervisor sees the incident on the same console as the process data.

Each patrol produces an audit-proof log file: timestamp, GPS position, sensor snapshot. This file is part of the safety report under § 8a and the internal audit duty. Authorities accept machine-generated evidence if the integrity chain is documented.

The escalation matrix is held in the control room. Level 1 is verification by the operator, Level 2 the alert to the works fire brigade, Level 3 the authority per § 19 Major Accident Ordinance. Each level needs a named function and a time target.

Patrol routes derive from the HAZOP report, not from the convenience of the road layout. Operators who let the robot drive the asphalt path instead of approaching the critical nodes from the hazard assessment document security theatre. Maintenance intervals and software updates belong in the SMS as audit-relevant plant items. A missed firmware update is a deficiency in audit terms, the same as an untested safety valve spring.

Operational template: the perimeter protection in the industrial park article supplies route patterns for typical plant layouts.

Economics: cost structure compared

A 24/7 guard post costs 15,000 to 25,000 euros per month in the DACH region including shift premiums, vacation and absence reserve (BDSW industry statistics). Training costs for the §34a Sachkundeprüfung and annual Manteltarifvertrag increases come on top.

A QR-3 with LiDAR and drone detection costs 3,800 euros per month in the RaaS model (Quarero Robotics price overview). No CapEx, no balance sheet activation, no five-year depreciation. Maintenance, updates and replacement equipment are included.

A typical chemical park needs three to four posts for perimeter coverage. The substitution rate through robotics sits at 60 to 70 percent in field experience (Quarero Robotics pilot study). What is not replaced: verification of critical detections, loading control with shipping papers and the inspection escort. These tasks require judgment and written form.

ROI is typically under nine months (TCO comparison guard service). A 24-month minimum term covers amortisation with a safety reserve and protects against early termination during a tense audit phase. The full calculation sits in the TCO comparison guard service.

Machinery Regulation 2023/1230 and EN ISO 13482

The EU Machinery Regulation 2023/1230 applies from January 2027 (EUR-Lex regulation text). It replaces the Machinery Directive 2006/42/EC and tightens requirements on autonomous systems noticeably (EUR-Lex regulation text). Transition periods run, but the conformity documentation must be prepared now.

Autonomous robots fall under raised requirements for risk assessment of collaborative functions. This includes every encounter with third-party personnel on the plant grounds.

EN ISO 13482 governs safety requirements for personal care robots (ISO standard page). It is applied by analogy to patrol robots as long as no specific standard for autonomous security robots in industrial outdoor space exists. The analogy has limits but is the current audit benchmark.

Quarero supplies the CE declaration of conformity, the risk assessment per Annex III of the Machinery Regulation and the technical documentation per deployment site. The operator carries the residual risk from the plant context. The manufacturer carries product liability. The Robotics-as-a-Service contract defines the interface clearly, including damage scenarios under sensor failure.

The robot does not replace the ATEX assessment of the plant. It does not replace the works fire brigade. It delivers detection and documentation. The responsibility under § 8a remains with the operator.

Pilot: from HAZOP to productive patrol

Week 1 to 2: walk-through with works security and the safety officer, reconciliation with the safety report, definition of patrol corridors along the HAZOP nodes. Output: a route plan with justification per waypoint.

Week 3 to 6: ATEX assessment of the deployment area, interface definition to the process control system and control room, approval by the competent trade inspectorate. This phase decides project release. Short-cutting here builds in audit risk.

Week 7 to 10: delivery within 48 hours of release, commissioning including sensor calibration under plant conditions, training of works security and the works fire brigade. Training covers escalation rules, manual override and emergency stop.

Week 11 to 14: shadow operation in parallel with existing personnel, evaluation of the false alarm rate, fine-tuning of escalation rules. Only after a robust false alarm rate below the internal threshold does the patrol move to regular operation.

Handover comes with audit documentation directly usable in the next safety report under § 8a. Detailed questions on sector boundaries: Marcus Köhnlein answers in advance.

For a concrete site assessment against 12. BImSchV duties, contacting Marcus Köhnlein is the direct route. Technical specification, sensor stack and deployment limits sit on the QR-3 page.