Is Amberhold COMAH compliant? Is it PSSR compliant?

Neither phrase means anything, and any vendor who uses it is telling you something about themselves. Regulations place duties on organisations, not on software. A site becomes compliant through people, procedures, maintenance, competence and a management system that actually runs. What software can do is hold the operational evidence behind those duties in a form that survives being asked about years later. That is what Amberhold does, and it is the strongest honest claim available.

Will an inspector accept digital records?

Inspectors care about properties, not media. Can you produce the record covering the period being asked about? Is it attributable to a person? Can you show it hasn't been quietly tidied up? Does it distinguish a check that was missed from one that was never required? Paper can satisfy all of that with real discipline. So can a system — and a system can make some of it structural rather than a matter of everyone behaving well.

Does Amberhold replace our safety management system?

No. The management system is the set of arrangements your organisation makes and maintains — policy, organisation, planning, implementation, measurement, review. Amberhold occupies one part of the measuring: active monitoring of plant by the people who run it, and the evidence that it happened. Everything else stays exactly where it is.

We already have a CMMS. Isn't this the same thing?

No, and the overlap is smaller than it looks. A CMMS is built around maintenance work — work orders, planned maintenance, spares, cost. Operational assurance is built around the structured human look at the plant between those jobs, and the evidence of it. The two answer different questions and are usually consulted by different people. Amberhold is designed to sit alongside a maintenance system, never to be a thinner version of one.

Can we use it to evidence something you haven't listed here?

Very possibly — the regimes on this page are the ones we get asked about, not a boundary. The underlying record is generic: what was defined, what was due, what was done, who did it, on which equipment, what they found, and what was decided about it. If your duty needs that shape of evidence, the fit is worth a conversation. If it needs a judgement made about plant condition, it isn't a fit, and we'd rather say so early.

Do you support regimes outside Great Britain?

The record shape is jurisdiction-neutral by design — vocabulary is data, never hard-coded, so a site names its own controls and its own conditions. Sites working to Seveso III, OSHA PSM or EPA RMP recognise the same evidence needs; the home page sets those out alongside the GB regimes. What never changes is that applicability is decided by your site, not by the platform.

How Amberhold supports industrial safety management — regime by regime

The shape they all share

Read enough of them and the family resemblance becomes hard to miss. Almost no industrial regulation prescribes software, and very few prescribe a format. What they require is that an organisation can demonstrate operational control: that the right things were identified, that they were actually done, by people competent to do them, on the right plant, at the right time — and that this can be shown rather than asserted.

That is why the same conversation happens in a COMAH intervention, a COSHH visit, an ISO 45001 surveillance audit and an insurer's engineering survey. The vocabulary differs. The question underneath doesn't.

Regulations don't ask for software. They ask for evidence — and evidence has properties: attributable, complete, honest about its gaps, and impossible to quietly improve after the fact.

This page maps those expectations against what Amberhold actually holds. Every entry has four parts, and the last two carry as much weight as the first two. A mapping document that only lists what a product does is a brochure with a regulation stapled to it.

Supports, never certifies

Software cannot make a site compliant. People, procedures, maintenance, competence and management systems do that. Anyone selling you “COMAH compliance” in a licence fee is selling you something they cannot deliver, and the gap will be discovered by an inspector rather than by a salesperson.

There are three things, specifically, that Amberhold will not do:

Decide applicability.Whether a system falls under PSSR, whether your inventory puts you in scope of COMAH and at which tier, whether a substance is hazardous to health — those are the site's determinations, made by people who can be held to them.
Judge the plant. Amberhold never decides whether a reading is acceptable or whether a pump sounds wrong. It presents the guidance your site configured, records what the operator found, and flags what the operator flagged. A platform that graded plant condition would be issuing a judgement it has no standing to make.
Stand in for a statutory function. No examination, no thorough examination, no competent person, no permit authority, no verification scheme. The record sits alongside those functions; it never substitutes for one.

What remains after those three exclusions is still substantial — and it happens to be the part sites are usually weakest at proving.

COMAH 2015

The Control of Major Accident Hazards Regulations turn on a safety management system that demonstrably operates. Every establishment needs a major accident prevention policy; upper-tier sites produce a safety report. Both describe a system covering, among other elements, operational control, management of change, monitoring of performance, and audit and review.

The safety report is a claimabout how the site runs. An intervention tests that claim against the site itself — which is why inspectors so often work downwards from a written arrangement to the evidence it should have produced. “Your report says these critical checks happen each shift. Show me last February.”

What it requires: A safety management system that operates in practice: operational control of major accident hazards, monitoring of performance, and audit and review — evidenced, not merely described.
What Amberhold records: Governed, versioned definitions of what must be checked; the due window each check fell in; the observation with who took it, when it was taken on the plant, and on which equipment; the operator's flag where something looked wrong; and, for temporary controls, the declaration, the monitoring bound to it, and the authorised act that ended it.
What Amberhold does not do: No safety report, no MAPP, no hazard identification, no demonstration of ALARP, no emergency planning. Amberhold does not know your inventory and does not determine your tier.
Where the responsibility stays: The whole safety management system, competence, procedures, and the dutyholder responsibilities the regulations place on your organisation.

The practical value is narrow and real: when the intervention traces a written arrangement down to the shift that was supposed to execute it, the evidence exists, carries a name, and shows its gaps honestly rather than presenting a suspiciously complete wall of ticks.

PSSR 2000

The Pressure Systems Safety Regulations hang on a written scheme of examination, a competent person who draws it up or certifies it and examines against it, established safe operating limits, proper maintenance, and adequate instructions for the people operating the system.

Sites are generally strong here, because the competent person drives the cycle and the reports arrive on a schedule. Where evidence goes thin is everything between examinations — which is precisely where the operating duties live.

What it requires: Examination against the written scheme at its intervals; operation within safe operating limits; proper maintenance; records available when asked.
What Amberhold records: The routine surveillance around the system: pressures and temperatures read with the site's own limits visible at the point of entry, relief paths and valve positions confirmed, weeps and abnormal noise flagged — each entry anchored to the pressure equipment itself.
What Amberhold does not do: No examinations, no written scheme, no assessment of fitness for service, and no judgement about whether a system may continue to operate.
Where the responsibility stays: The written scheme, the competent person and their reports, the establishment of safe operating limits, and the decision to run or stop.

Straight talk

An operator round is never part of the statutory examination and never can be. If a vendor implies that digital rounds reduce your examination burden, that is a claim to take up with your competent person before your procurement team.

COSHH 2002

COSHH is often read as an assessment regime, but the duty that generates the most evidence is downstream of the assessment: control measures must be used, and must be kept effective in use. Engineering controls get maintained, examined and tested. And where control depends on people doing something — running extraction, confirming an isolation, keeping a store secured — somebody has to be able to show it happened.

This is where operational rounds do genuine work, because the checks are mundane and constant, and mundane constant checks are exactly what paperwork loses.

What it requires: Exposure prevented or adequately controlled; control measures properly used and maintained in effective working order; the engineering controls examined and tested as required.
What Amberhold records: Evidence that the operational precautions your assessment relies on were actually checked — extraction and ventilation running, chemical stores inspected, spill kits present and intact, isolations confirmed, containment condition observed — with the finding recorded as the operator described it.
What Amberhold does not do: No COSHH assessment, no exposure monitoring, no health surveillance, no thorough examination and test of local exhaust ventilation, and no determination of whether control is adequate.
Where the responsibility stays: The assessment, the choice and adequacy of controls, exposure monitoring, health surveillance, information and training, and the statutory examination of engineering controls.

HSWA 1974 and MHSWR 1999

Underneath the specific regimes sit the general duties: so far as is reasonably practicable, provide and maintain safe plant and systems of work — and make arrangements for the effective planning, organisation, control, monitoring and review of preventive measures.

The word doing the work there is monitoring. It is a named part of the arrangements, and it is the part most likely to be described in a policy and undocumented in practice.

What it requires: Arrangements for planning, organisation, control, monitoring and review of preventive and protective measures, appropriate to the nature and scale of the undertaking.
What Amberhold records: The monitoring half, in an inspectable form: what was defined as needing doing, what was due, what was done, by whom, on what, and what they found — plus the record that feeds review.
What Amberhold does not do: Nothing about risk assessment, competence, consultation, training, or the arrangements themselves. Amberhold evidences one strand of one element.
Where the responsibility stays: Every duty the Act and the Regulations place on the employer, and the arrangements in full.

HSG65 — Managing for health and safety

HSG65 frames health and safety management as Plan, Do, Check, Act. Amberhold lives almost entirely in Check — and specifically in active monitoring: looking at the plant and the systems before something goes wrong, rather than counting incidents afterwards.

Sites tend to be well equipped for reactive monitoring, because incidents force their own paperwork. Active monitoring is where the evidence thins, because nothing forces it except discipline.

What it requires: Measuring performance — active monitoring of plant, systems and behaviour before things go wrong, and reactive monitoring afterwards — feeding review and improvement.
What Amberhold records: Active monitoring that can be inspected: the schedule, the completions, the misses shown as misses, the abnormal findings, and the temporary controls with their monitoring bound to them. That record is the input to review, not a substitute for it.
What Amberhold does not do: No Plan, no Do, no Act. No incident investigation, no lagging indicators, no performance verdict. Amberhold does not tell you whether your monitoring regime is adequate.
Where the responsibility stays: Setting policy and cadence, organising for delivery, planning and implementing controls, and acting on what review finds.

ISO 45001

A certification auditor samples. They will pick an operational control described in your system, follow it to the documented information it should have produced, and see whether the two agree. They will also want to know that the records are protected against loss of integrity — a requirement that is difficult to satisfy with a spreadsheet anyone can edit and nobody versions.

What it requires: Operational planning and control; monitoring, measurement, analysis and performance evaluation; documented information controlled and protected — supporting continual improvement.
What Amberhold records: Auditable operational records that are append-only by construction, not by policy: corrections add entries rather than replacing them, every entry carries its author, and the access history — who could have written to the record, and when their access ended — is part of the evidence.
What Amberhold does not do: No management system, no internal audit programme, no management review, no gap analysis, and nothing whatsoever to do with the certification decision.
Where the responsibility stays: The entire OH&S management system, the audit programme, and the relationship with your certification body.

Permit to work — context, never authority

Permit systems work because a competent person authorises specific work against known plant conditions, and because that authorisation is communicated to everyone it affects. The failure mode is rarely the permit form. It is the plant status the permit assumed being stale, partial, or held in one person's head.

Amberhold does not issue permits, does not authorise work, and holds no permit authority. What it can offer is the operational context beside the permit process — and it is worth being precise about what that context is, because it is narrower than “plant status”.

Declared temporary controlson that equipment — an isolation in place, a defeated device, equipment out of service — in the site's own vocabulary, because the labels are the site's, not the platform's.
The monitoring bound to each control, and whether it has actually been running: an open concern on a control's timeline is a very different starting point for a permit conversation from a quiet one.
Verification status — whether recent checks on that equipment were confirmed at the machine by a scan, or recorded with an audited manual override because the tag or the hardware failed.

A temporary control is a declaration somebody made, not a measurement of the plant. Amberhold shows you the record; the plant is still the authority, and so is the person who walks out to look at it.

What it requires: Work authorised by a competent person against known conditions, with the authorisation communicated, and with cross-checking where work spans shifts.
What Amberhold records: Operational context that can be read before, during and after work: declared temporary controls on the equipment, the monitoring bound to them and its findings, and how presence was verified.
What Amberhold does not do: No permits issued, no work authorised, no isolation certificates, no lock-out register, and no assertion that plant is in a safe state.
Where the responsibility stays: The permit system and its authority, the isolation standard, and every judgement about whether work may proceed.

Shift handover — the honest position

The HSE has identified poor communication at shift handover as a contributor to major accidents often enough that it has its own guidance. Good handover is prepared rather than improvised, uses both written and verbal channels, and cross-checks the safety-critical items instead of relying on the outgoing shift to remember them.

Amberhold does not have a handover feature today. We are stating that plainly because it is the claim this territory most invites and because the temptation to blur it is obvious.

What does exist is most of the material such a pack would draw on. Today an incoming shift can look at the site board and see live temporary controls with their bound monitoring, rounds that are overdue or missed, abnormal findings from the shift just gone, and where presence at equipment could not be verified. That is genuinely more than “everything alright?” — but it is a board somebody reads, not a handover artefact the system assembles, and the two should not be confused.

What it requires: Safety-critical information communicated reliably between shifts: prepared, two-way, cross-checked, and with the highest rigour where plant is in an abnormal state.
What Amberhold records: Not a handover pack — on the road, not shipped. The underlying records exist today (live controls, overdue and missed rounds, abnormal findings, verification failures) and are visible on the board; assembling them into a handover artefact is future work.
What Amberhold does not do: No handover module, no shift log, no digital logbook, and no structured shift-to-shift acknowledgement. Sites needing a handover product today should buy one.
Where the responsibility stays: The handover procedure, its discipline, the conversation itself, and the judgement about what the next shift needs to know.

The consolidated list of what Amberhold does not do

Gathered in one place, because scattered caveats are how honest limitations get lost:

It does not decide compliance, applicability, tier, or whether a duty applies to you.
It does not judge plant condition, grade equipment health, or decide whether a reading is acceptable.
It does not perform, replace or reduce any statutory examination, thorough examination or competent-person function.
It does not issue permits, authorise work, or manage isolations as a permit system does.
It is not a shift log, a handover product, or a digital logbook — and offline capture and notifications are still in development rather than live.
It is not a CMMS: no work orders, no planned maintenance scheduling, no spares or cost. It is designed to sit alongside one.
It does not carry a pharmaceutical validation package, so it should not be positioned against Part 11 requirements.

If one of those is the thing you actually need, the honest answer is that Amberhold is the wrong purchase, and we would rather establish that in the first conversation than the third.

Using this when someone asks

The practical form of all of this is unglamorous. An inspector, auditor or surveyor picks something specific and follows it down. The record either answers or it doesn't.

“Show me these checks actually happened.” Each entry carries who, when it was taken on the plant, and on what. The schedule shows what was due, so a gap appears as a gap.
“What was watching the plant while this was isolated?” The temporary control's whole life — declaration, every bound check, every concern, the authorised clearance — is one printable timeline.
“How do I know this wasn't tidied up?” Append-only by construction. Corrections add entries; they never replace them.
“Who could have written to this record?” The membership trail — invitations, roles, access windows, deactivations — is evidence too, and it is kept.

An honest gap beats a suspicious blank. A record that distinguishes “missed” from “not required” from “before we started monitoring” is worth more in an audit than one that looks perfect.