Lockout tagout (LOTO) is the workplace safety procedure that prevents equipment from being re-energised while a worker is servicing it. The legal requirement is unambiguous across the UK, DACH region, and broader EU: any machine or system with hazardous energy must be isolated, locked, and verified before maintenance work begins. The procedures are well-defined. The hardware is mature. The standards have not changed materially in over two decades. So why does LOTO non-compliance remain a leading cause of preventable industrial injury across European manufacturing sites? Because the gap between regulation and reality lives in implementation, not specification. This guide covers what LOTO is, what each EU country's regulator requires, how to implement a compliant programme, and what hardware sits inside each step.
Table of Contents
- Part 1: What Is Lockout Tagout?
- Part 2: Is Lockout Tagout a Legal Requirement?
- Part 3: The Six Steps of a Compliant LOTO Procedure
- Part 4: The Seven Energy Types You Need to Isolate
- Part 5: Who Can Apply and Remove a Lockout Device?
- Part 6: What Hardware Do I Need?
- Part 7: Group Lockout and Shift Handover
- Part 8: Common LOTO Mistakes
- Part 9: Where The Lock Box Fits
Three questions every site implementing or refreshing a LOTO programme needs to answer:
- What is the legal requirement, and which document does my local auditor reference?
- What are the operational steps of a compliant LOTO procedure?
- What hardware do I need, and how do I match it to the energy types on my site?
Work through these three before you write a procedure or order any hardware. Most LOTO problems we see on European quote requests are not hardware problems. They are sequence problems, where one of the three questions has been answered before the others have even been asked.
Part 1: What Is Lockout Tagout?
Lockout tagout, often shortened to LOTO, is a structured procedure for isolating hazardous energy in industrial equipment so that maintenance work can be carried out safely. The lockout portion refers to physically applying a lockable device, typically a padlock, to an energy isolation point so the equipment cannot be re-energised. The tagout portion refers to the warning tag attached to that device, naming the worker who applied it and stating the equipment is out of service.
Historically, lockout and tagout were two distinct procedures. In current EU and UK practice they are treated as a single combined obligation, with tagout permitted only in narrow circumstances where physical lockout is technically not possible and equivalent protection can be demonstrated. The default expectation is physical lockout.
You may also see the term LOTOTO (Lockout-Tagout-Tryout). The Tryout addition is a verification step: after applying the lock and tag, the authorised worker attempts to start the equipment using its normal controls to confirm that isolation has succeeded. The Tryout step is implicit in most EU frameworks but spelling it out separately is good practice and reduces a class of audit findings.
The procedure is performed by named workers with specific competencies. In OSHA vocabulary these are "authorised employees" (the workers who apply and remove locks) and "affected employees" (the workers who operate or work near the equipment). In EN 60204-1 vocabulary, used across DACH and the wider EU, these are "skilled persons" and "instructed persons" respectively. The terminology differs by jurisdiction. The competence requirement is functionally the same.
Part 2: Is Lockout Tagout a Legal Requirement?
Yes, in every EU member state and the UK, by direct reference in the operative regulation. The legal route is not identical from country to country, but the procedural obligation is.
United Kingdom. The Provision and Use of Work Equipment Regulations 1998 (PUWER) Regulation 19 requires that work equipment with hazardous energy is provided with means of isolation that can be locked off[1]. The Health and Safety at Work Act 1974 places the underlying duty on the employer. HSE guidance L22 provides the practical detail an inspector will reference.
Germany. DGUV Vorschrift 3 governs electrical installations and equipment[2]. DGUV Regel 100-500 covers the operation of work equipment including isolation procedures. The Berufsgenossenschaften are the practical enforcement bodies. A site procedure that does not cite DGUV directly will be questioned in audit.
Switzerland. Ordinance 3 to the Labour Act (ArGV 3) sets out the employer's general duty of care. SUVA publications provide the practical references that Swiss inspectors will cite by document number.
France. Code du Travail Articles R4544-1 onwards cover the obligation. INRS publishes practical guidance, particularly for electrical isolation work.
Italy. D.Lgs. 81/2008 (Testo Unico sulla Sicurezza) covers the workplace obligation. INAIL guidance provides procedural detail. Italian-language procedures are expected on Italian sites.
Netherlands. Arbobesluit Article 7.5 covers the workplace obligation. Nederlandse Arbeidsinspectie is the enforcement body.
Denmark. Arbejdsmiljøloven and Arbejdstilsynet guidance apply. Most published material is in Danish, which is what a local auditor will reference on site.
Underneath all of these national frameworks sits EN ISO 14118[3], the harmonised European standard on prevention of unexpected start-up. Compliance with EN ISO 14118 gives presumption of conformity with the Machinery Directive 2006/42/EC[4]. The standard does not have the force of law on its own, but it is the most defensible technical reference a site can cite.
For sites operating across the Atlantic as well, the equivalent US framework is OSHA 29 CFR 1910.147[5]. It is more prescriptive than the EU framework on procedural detail. Where there is no EU document covering a specific scenario in detail, OSHA's language can be useful as a working template, but the site procedure must still cite the local regulation as the legal anchor.
Best Practice: Your procedure cover sheet must cite the local regulation, not just EN ISO 14118 or OSHA. A German auditor wants to see DGUV referenced by document number. A Swiss inspector wants SUVA. A French inspector wants the Code du Travail article. The body of the procedure can stay in English on multi-site programmes. The regulatory reference on the cover sheet cannot.
Part 3: The Six Steps of a Compliant LOTO Procedure
Every compliant LOTO procedure follows the same six-step sequence, regardless of jurisdiction. The terminology varies. The physical actions do not.
| Step | What happens | Common failure mode |
|---|---|---|
| 1. Preparation | Identify all energy sources, plan the isolation sequence, gather the correct lockout devices for each isolation point | Skipping the energy inventory. Missing stored or secondary energy sources that are not visible at the main disconnect |
| 2. Notification | Affected workers are told the equipment is being locked out, when, and why. Documented in writing, not verbal only | Verbal-only notification with no record. Affected employees on a different shift never told the equipment is out of service |
| 3. Shutdown | Equipment is stopped using its normal control sequence. This is the standard production stop, not the emergency stop | Equipment killed using the emergency stop instead, which may leave the machine in a hazardous intermediate state |
| 4. Isolation | Energy is disconnected at the named isolation point for each energy type present | Only main electrical isolated. Pneumatic, hydraulic, or stored mechanical energy left active |
| 5. Lockout and tagout application | Each authorised worker applies their personal padlock and tag to the isolation device. One worker, one lock | One worker applies a single lock for a multi-worker team, removing the personal-accountability principle and the audit trail |
| 6. Verification of zero energy state | Attempt to start the equipment using its normal controls (the Tryout). Test instrumentation reads zero. Stored energy is confirmed released | Verification skipped or treated as a paperwork formality. Stored hydraulic or pneumatic energy not actively bled |
This six-step sequence is sometimes extended to a seventh step covering restoration of energy after the work is complete. The restoration sequence is the reverse of the isolation sequence: each worker removes their personal lock, the equipment is confirmed safe to re-energise, energy is restored, and a final functional check confirms normal operation. For a deeper walk through each step with the practical detail, see our pillar guide to the six (and more) steps of lockout tagout.
Part 4: The Seven Energy Types You Need to Isolate
Most LOTO programmes get electrical isolation right and miss something else. The seven energy categories every procedure has to address are below, with the typical lockout device class for each.
Electrical. The most familiar form. Circuit breaker lockouts, plug lockouts, and switch lockouts handle isolation at panels, sockets, and switchgear. See our electrical lockout range.
Mechanical. Movement that can be initiated by gravity, springs, or stored kinetic energy. Chock pins, support stands, and physical barriers prevent unexpected motion during maintenance.
Hydraulic. Pressurised fluid that can move equipment after the pump stops. Hydraulic line lockouts and pressure-release procedures address both line pressure and accumulator pressure.
Pneumatic. Compressed air that holds pressure after the supply is disconnected. Pneumatic quick-disconnect lockouts plus downstream bleed-and-vent are the standard combination. See our pneumatic lockout range.
Thermal. Hot or cold surfaces from steam jackets, cooling lines, or recently active reactors. Isolation requires a cool-down period as a procedural element, not just a valve closure upstream.
Chemical and process fluids. Liquids or gases that can leak past a single closure. Valve lockouts, blind flanges, and double-block-and-bleed procedures are needed in chemical, pharma, and food sites. See our valve lockout range.
Gravity and stored. Raised loads, springs under tension, capacitors holding charge. Each requires a named release method in the procedure, not just a lock on an isolation point.
The most common procedural failure across European audits is incomplete energy inventory. A motor disconnect locked off does not address the pneumatic line that still has stored pressure. The procedure has to name each energy type present and the isolation method for each one.
Part 5: Who Can Apply and Remove a Lockout Device?
Lockout tagout devices are applied and removed only by named, trained workers. The terminology differs by jurisdiction. The competence requirement is consistent.
In OSHA vocabulary, an authorised employee is a worker trained and named to apply and remove lockout devices. An affected employee is anyone who operates or works near the equipment. An other employee is anyone else on the site who needs to know LOTO is in effect.
In EN 60204-1 vocabulary, used across DACH and most of the EU, a skilled person has the technical knowledge and experience to recognise and avoid hazards. An instructed person has been informed of the necessary precautions but does not have the full technical depth. Only skilled persons apply and remove lockout devices in the strict EN reading.
The personal padlock rule is universal. Each authorised worker applies their own uniquely identifiable padlock to the isolation device. No other worker, supervisor, or contractor removes that lock outside of a documented emergency exception procedure. This rule has no routine exceptions, and breaking it is the single most common pattern in fatal LOTO incidents.
Real-World Case: A maintenance team replaces a motor on a conveyor. The original technician applies their personal padlock to the disconnect. At end of shift the technician goes home but forgets to remove the lock. The next shift supervisor cuts the lock off because the line is needed and the original worker cannot be reached. The following morning, work resumes on the motor without re-applying lockout. The motor is energised because no one knew the lock was no longer in place. A worker is injured. The control failure was not the cutting of the lock. It was the absence of a documented exception procedure that would have surfaced the unfinished work before energy was restored.
Training requirements vary by jurisdiction. In Germany, DGUV Vorschrift 3 sets out the requirements for electrical work specifically. In the UK, PUWER Regulation 7 places the duty on the employer to ensure all users of work equipment are adequately trained. In Switzerland, SUVA and ESTI publications set out the equivalent. In every framework, the training record must be dated, named, and traceable to the specific procedure the worker is authorised to perform.
Contractor LOTO adds a coordination layer. The host employer and the contractor employer both have independent obligations, and the breakdown between them is a frequent finding in cross-employer audits. For the detailed treatment, see our guide to contractor lockout tagout.
Part 6: What Hardware Do I Need?
Lockout tagout hardware breaks down into seven categories, matching the seven energy types and the common procedural variations.
Personal LOTO padlocks. The foundation of every programme. Each authorised worker has at least one personal padlock, uniquely identifiable, used only by them. Material choice depends on the working environment. Aluminium for general industrial use. Thermoplastic for electrical work where dielectric body properties matter. Steel for high-security applications. See our LOTO padlock range.
Lockboxes. Centralised key storage for group lockout. The keys to all equipment-side isolation devices go inside the lockbox. Each worker in the group applies their personal padlock to the lockbox perimeter. The box cannot be opened until every personal lock is removed. See our lockbox range.
Valve lockouts. Devices that physically prevent a valve from being opened or closed. Different valve types require different lockouts: ball valve lockouts, gate valve lockouts (the rotating-wheel covers), butterfly valve lockouts, and plug valve lockouts. The right device matches the valve geometry on the equipment. See our valve lockout range.
Electrical lockouts. Circuit breaker lockouts for MCBs, MCCBs, and main breakers. Plug lockouts for industrial sockets. Switch lockouts for wall switches and isolation switches. See our electrical lockout range.
Hasps. Devices that allow multiple padlocks to be applied to a single isolation point. Essential whenever more than one worker is working on the same equipment. Steel hasps for general use, nylon for electrical and lightweight applications. See our hasp range.
Pneumatic and hydraulic line lockouts. Devices that lock out air or fluid line disconnects, often combined with a downstream bleed valve to release stored pressure. Covered in the pneumatic range linked above.
Tags and signage. Warning tags attached to each lockout device, plus area signage indicating LOTO is in effect. Tags should be durable enough to survive the working environment and carry named-worker information. See our signage and barrier range.
For sites starting a LOTO programme from scratch, our pre-built lockout kits provide a starting position by energy type. For sites refreshing an existing programme, the relevant conversation is matching kit composition to the energy types and authorised-employee count at your specific sites.
Best Practice: Designing or refreshing a LOTO programme across European sites? Send us your energy-type inventory and authorised-employee count per site. We will propose a hardware standard sized for your operations without doubling your inventory across countries. Request a quote.
Hardware selection is not the difficult part of a LOTO programme. Procedure-writing is. But hardware that does not match the energy types present at a site will be bypassed at the point of use, and a procedure that names devices the site does not own is not a procedure. Get the hardware right, and the procedure becomes implementable.
Part 7: Group Lockout and Shift Handover
Single-worker LOTO is the simplest case. Most real maintenance work involves multiple workers, sometimes across multiple trades, and often across multiple shifts. The two extensions to the basic procedure are group lockout and shift handover.
Group lockout. Multiple workers applying personal padlocks to a centralised lockbox that holds the keys to the equipment-side isolation devices. Each worker enters and exits the group independently. The lockbox cannot be opened until every personal lock has been removed. The primary authorised employee (typically a supervisor or lead technician) is responsible for the overall integrity of the isolation and removes their lock last. For the procedural detail, see our guide to managing group lockout safely.
Shift handover. When work spans a shift boundary, the outgoing shift's lockout has to transfer to the incoming shift's lockout without any window where the equipment is unprotected. Two acceptable approaches exist: continuous-lock transfer with a physical meeting at the equipment between outgoing and incoming workers, or removal and re-application by the incoming shift starting from the standard application sequence. The unacceptable approach, which appears regularly in audit findings, is leaving locks in place between shifts with no documented handover. The lock is then owned by no one, the incoming shift assumes it belongs to the outgoing shift, and nobody is positioned to confirm zero state when work resumes.
Part 8: Common LOTO Mistakes
Five mistakes account for most LOTO failures we see on European quote requests.
- Incomplete energy inventory. Only electrical isolation captured. Stored pneumatic, hydraulic, or mechanical energy forgotten until someone is hurt.
- Procedure drift. Documentation no longer matches the equipment after a motor swap, guard relocation, or weekend shutdown. The procedure says one thing. The machine on the floor reflects something else.
- Removal by someone other than the worker who applied the lock, outside of any documented exception procedure. The personal padlock rule is broken under operational pressure and not flagged.
- Missing or incomplete training records. Workers performing LOTO without dated, named training tied to the specific procedure they are running.
- Verbal-only notification of affected employees. No written record that affected workers were informed. The audit trail starts with the lockout application instead of the notification.
For the full treatment of these patterns and the procedural fixes for each, see our guide to five common LOTO mistakes and how to avoid them.
Part 9: Where The Lock Box Fits
The Lock Box is a Switzerland-based supplier of lockout tagout hardware to European industrial sites. Our customer base sits across the DACH region, France, Italy, Benelux, and the Nordics. We supply only into European markets.
The hardware ranges most relevant to a foundational LOTO programme are personal LOTO padlocks, lockboxes, valve lockouts, electrical lockouts, and hasps. For sites starting a programme from scratch, our lockout kits provide a starting position by energy type that can be customised against your specific equipment. For sites refreshing an existing programme, the relevant conversation is matching kit composition to the energy types and authorised-employee count at each site, particularly when the programme has to satisfy different national audit references across the EU.
The harder problem on most quote requests is not the hardware itself. It is matching the hardware to a procedure that is currently being rewritten. We will help you align kit composition against the local audit references in each country your programme covers, and we will be honest about where the right answer is a specialist supplier rather than ourselves.
Browse our full lockout device range for the hardware that underpins a complete LOTO programme.
Ready to Build a LOTO Programme That Holds Up?
Contact The Lock Box with your energy-type inventory and site list. We will propose a hardware standard that matches your procedure and the local audit references in each country you operate.
For the digital procedure-management layer that records every lockout application and removal with timestamp and named user, explore Zentri.
A lockout tagout programme does not protect workers because it exists. It protects workers because every single one of them, every single time, follows a procedure that is current, correct, and supported by hardware that is on the shelf when they need it. The point of this work is not the document. The point is that the technician on shift at three in the morning has what they need to go home safely at the end of it.
References
- Health and Safety Executive. Provision and Use of Work Equipment Regulations 1998 (PUWER), Regulation 19. HSE. https://www.hse.gov.uk
- Deutsche Gesetzliche Unfallversicherung. DGUV Vorschrift 3: Elektrische Anlagen und Betriebsmittel, and DGUV Regel 100-500. DGUV. https://www.dguv.de
- International Organization for Standardization. EN ISO 14118: Safety of machinery - Prevention of unexpected start-up. ISO. https://www.iso.org
- European Union. (2006). Directive 2006/42/EC of the European Parliament and of the Council on machinery. EUR-Lex. https://eur-lex.europa.eu
- OSHA. 29 CFR 1910.147 - The Control of Hazardous Energy (Lockout/Tagout). Occupational Safety and Health Administration. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147
- European Union. (2009). Directive 2009/104/EC on minimum safety and health requirements for the use of work equipment. EUR-Lex. https://eur-lex.europa.eu
- Suva. Lockout-tagout and isolation guidance for Swiss workplaces. Suva. https://www.suva.ch
- Institut National de Recherche et de Sécurité. Energy isolation and electrical safety guidance. INRS. https://www.inrs.fr
