Digital permit to work: what it is and how to roll it out

It is seven in the morning at a port support base. The maintenance supervisor needs to release a welding job on the quay and a job inside a tank. The paper permit leaves the safety office, goes to the issuer, comes back because one worker has not signed and only reaches the site at nine. At shift change, nobody is quite sure how many permits are still open, or where.

This article explains what a permit to work is, what Brazilian regulations ask for once it leaves paper, and how to roll out a system in stages. In the middle you will find an 18-item checklist to specify or assess your digital permit to work. If you are still deciding between buying an off-the-shelf product and building your own system, start with our article on custom software vs. off-the-shelf.

What is a permit to work?

A permit to work is the document that authorizes a hazardous activity, at a set place and time, after someone with the authority to release it has checked the control measures. Brazil's NR-35 defines it as a written document with a set of control measures for safe work, plus emergency and rescue measures.

The UK Health and Safety Executive's HSG250 guidance adds a point that matters when you choose a system. HSE describes a permit-to-work system as "a formal recorded process used to control work which is identified as potentially hazardous" and also as a means of communication between site management, supervisors, operators and the people doing the work. The guide itself uses the Piper Alpha disaster to show what happens when that communication fails.

A permit does not make a job safe on its own. It records that someone checked the conditions, that the crew knows the risks and that a named person released the work.

Which Brazilian standards cover the permit to work?

In Brazil, workplace safety rules are set by the Normas Regulamentadoras (NRs), regulatory standards issued by the Ministry of Labour and Employment. Four of them come up often in port, offshore and industrial operations, and each uses the term in its own way.

The last column matters. NR-33 and NR-35 state plainly that the permit may be issued in physical or digital form. NR-34 still refers to three copies: one posted at the site, one with the supervisor and one on file. A system that covers NR-34 work needs to print the permit in that format, even if the rest of the flow is digital.

This summary is general guidance and does not replace the standards. They change over time (NR-35 was amended in 2026, for example), and your company's occupational safety lead decides what applies to your operation. The official texts are in Portuguese.

Why do paper permits break down?

Paper breaks down where time and handover matter most: waiting for signatures, revalidating, and above all changing shifts. HSG250 uses the 1988 Piper Alpha disaster as an example. According to the guide, suspended permits were kept in the safety office instead of the control room, filed by trade instead of by location. Five months before the disaster, 124 permits were outstanding. On the night itself, the shift handover did not mention that a pressure safety valve had been removed for overhaul, and the leak started right there.

In the operations we work with, the symptoms of paper are smaller and they repeat:

• The form travels around the site collecting signatures while the job waits.
• Nobody knows, at a given moment, how many permits are open and where.
• Revalidation from one shift to the next depends on someone remembering.
• The checklist is the same for jobs with very different risks.
• During an audit, an illegible or misfiled permit becomes a question mark.

That was the picture before the system in our port operations case study. The permit to work was the first process to leave paper, and the other modules came later, reusing the same records of people, companies and locations.

What do the standards require when the permit is digital?

When the permit goes digital, the standards expect the system to do what used to depend on whoever filed the paper: keep the permit available at the site, make signatures reliable, control validity and keep everything traceable. NR-33 is the most detailed. Item 33.5.7.2 requires the digital entry permit to stay permanently accessible to the standby person during the activity, and the signature to follow a certification procedure under NR-01. Devices used to issue it must have a protection rating suited to the location. Entry permits must be traceable and archived for five years.

NR-35, in item 35.5.8, requires the permit to be approved by the person in charge, available where the work happens and, at the end, closed and archived so that it can be traced. Validity is limited to the duration of the job and to the shift or workday, and the approver can revalidate it if neither the conditions nor the crew change.

HSG250 adds practical points for electronic systems. The system must prevent unauthorized issue or acceptance, must not allow permits to be issued remotely without a site visit, and must tell everyone involved when an issued permit is changed. There should also be a backup plan for software failure or power loss.

Checklist: what must a digital permit to work do?

The checklist below turns the regulations and HSE good practice into 18 checks that someone can tick off. Use it at two moments: when writing the specification for a new system, and when assessing the system or spreadsheet you use today.

With a vendor, ask to see each item working in a demo built on your own activity types, rather than in a slide deck. Internally, tick what already exists and turn the gaps into change requests, starting with validity and shift handover, which are the items paper handles worst.

One technical item deserves extra attention: who can issue, approve or close a permit has to be enforced on the server, and not only hidden in the interface. In the security review of the port platform, we mapped route by route what each role could do and fixed actions that the screen hid but the server still accepted. That kind of review is part of our support and modernization work.

How do you roll out a digital permit to work?

Rollout works best in stages, starting with one activity type in one area, with paper still available as a backup.

1. Map the current form. List the fields, the activity types and who signs each one. The paper your crews already use is the best starting point, because it reflects the approved procedure.
2. Review it with the safety team. Adjust the checklists per activity type, check the minimum fields of each applicable standard and define who issues, approves, revalidates and closes.
3. Pick a pilot area. A workshop or a quay, with a crew willing to test and an activity type that comes up often.
4. Run paper and system in parallel for a short time, only until the crew trusts the digital record and the field adjustments are done.
5. Connect the records. Link the permit to training records and third-party access control, so the gatehouse and the permit check the same data, as in our industrial access control case study.
6. Expand and switch off paper, area by area, keeping the backup form for failures.

The system has to work on a phone, because permits are issued where the work happens. Ours run as apps installed from the browser (PWAs). The difference from an app store app is covered in PWA vs. native app.

What if there is no signal or the crew is a contractor?

Without signal, digital permits still work if the project plans for it from day one. An installed app keeps the interface on the device, and the system design defines which data is available offline and how it syncs later. For areas with no coverage at all, HSG250 recommends being able to produce a paper permit for display at the job site, plus a backup plan for system or power failure. The same applies to NR-34, which still asks for physical copies.

Contractors can request permits, with access limited to their own workers and their own requests. Issuing and approving stay with the host company's team. On the port platform, each contractor sees only its own data, and the gatehouse checks on screen that each person's mandatory training is valid before entry.

In confined spaces, NR-33 item 33.5.11 says the permit must be closed when the standby person is replaced by someone not listed on it. The system should treat that swap as a close-out and require a new permit, instead of letting someone edit the name.

When is a permit-to-work system not enough?

A permit-to-work system does not replace the risk assessment, crew training or the judgment of the person who releases the work. It makes the procedure faster to follow and easier to audit, but the procedure still belongs to the company. If today's checklist is out of date, review the procedure before you move it into a system. When routine inspection also needs a single model across units, the article on the digital inspection checklist covers that structure.

How permits are recorded and whether a digital signature is valid are decisions for the company, its safety team and, when needed, its legal team. We do not give legal advice on regulations. We build the system around the procedure your company defines, as in any custom web system project.

If the permit to work is the first step toward something larger (gatehouse, training, non-conformities, maintenance), it pays to design the records of people and locations with the next modules in mind. That is how the port platform has grown from the permit since 2019. If you would like to talk about your case, the first conversation has no cost.