Hot Work Permit: Requirements and What It Must Cover

Ask ten facilities teams what a hot work permit is and most will describe a form: a pad in the security office, a carbon copy, two signatures and a time window. That description is accurate and almost entirely misses the point. The form is the residue of a decision. The permit is the decision: a competent person has looked at a specific task, in a specific place, on a specific day, established what could ignite and what will be done about it, and authorised the work on conditions. Everything useful about hot work control lives in that reasoning, which is why this article explains the reasoning rather than handing over a document.

The message up front: a hot work permit is not a record that work happened. It is a control that decides whether the work should happen at all, in that form and in that place, and it is the only permit type whose obligations continue after the task has finished. If your permit closes when the welder switches off, your system has a hole in exactly the place where hot work fires start.

1. What counts as hot work

Hot work is any work that introduces an ignition source into a place where an ignition source is not normally present. The familiar examples are welding, flame cutting, brazing and soldering, but the definition is wider than the flame-based trades and that is where teams get caught out. Grinding and abrasive cutting throw incandescent particles a long way. Thermal lances, torch-applied roofing, heat guns, thawing equipment, certain drilling and friction operations, and anything producing sustained heat sufficient to ignite what is nearby belong in the same category, as does plant that produces a spark as a by-product rather than as its purpose.

The practical test I would apply, rather than holding a list in your head, is functional: does this activity produce flame, sparks, hot slag, incandescent particles or enough heat to ignite anything that might reasonably be present or reachable? If so, treat it as hot work and let the permit process decide what happens next. Teams arguing about whether angle grinding "counts" are already having the wrong conversation, because the permit exists to settle that question with a competent person rather than with a tradesman under time pressure.

This article covers the hazards only as far as the permit needs them. The hazards themselves and the control principles behind the permit are the subject of the companion piece on hot work hazards, controls and permits, and the permit instrument here assumes the general shape of a permit system, covered in the complete guide to permit to work.

2. The organising insight: the hazard outlives the task

Everything else in hot work control follows from this. The hazard of hot work is confined neither to the work area nor to the duration of the work. Those two boundaries, the ones every permit form draws, are the two the hazard routinely ignores.

Sparks and hot particles travel. They fall through floor openings, service penetrations, expansion joints and gaps around pipework, and land somewhere the welder never looked and cannot see. Heat conducts. A steel beam, a pipe or a bolted plate carries heat from the point of application to the other side of a wall or floor, where insulation, stored goods or timber battens warm up quietly while the work proceeds on the visible side. And ignition is not always immediate: a hot particle lodged in dust, insulation, packaging or accumulated debris can smoulder for a long period with no flame and no obvious smoke, then develop into open fire well after the tools have been packed away and the area locked and left.

3. The first question the permit should force: can we avoid the hot work?

A permit system earns its keep partly by refusing work, and the most valuable refusal says "not like this". Before authorising hot work the permit should establish that hot work is actually necessary, in that location, by that method. There are three ways out, and a properly run system produces them regularly.

• Move the work. If the item can go to a designated workshop area where hot work is routine and the surroundings are already arranged for it, the hazard is not being controlled, it is being removed from the operational building. This is the highest-value answer a permit process can produce and it is available far more often than people assume, particularly for fabrication, bracketry and pipe spool work done in situ out of habit.
• Change the method. Mechanical cutting instead of thermal, sawing, shearing, hydraulic pressing or a proprietary cold technique eliminates the ignition source rather than managing it. Often slower, sometimes more awkward, and on many jobs a good trade.
• Change the design. A bolted, clamped, grooved-coupling or flanged detail achieves the same outcome without a weld. In refurbishment and small works this is frequently a specification decision made months earlier by somebody who never considered who would be welding it, and in an occupied building.

This is elimination and substitution, the top of the control hierarchy, which is required by ISO 45001:2018 (as amended by Amd 1:2024) clause 8.1.2 and by ANSI/ASSP Z10.0-2019 section 8.4 in the United States. Both are voluntary standards and neither is law anywhere by itself. The general principle is set out in the guide to the hierarchy of controls.

4. Designated versus non-designated areas

This distinction is genuinely useful and usually missing from articles on this topic. Hot work control does not have to be permit-based; it can be built into the arrangement of a place.

A designated hot work area is set up so that hot work is inherently safe there: non-combustible construction and finishes, no combustible contents or storage, no openings that let sparks reach other spaces, appropriate ventilation and fire-fighting provision, and a management regime that keeps it that way. Because the surroundings are permanently controlled, the assessment is done once for the area rather than once per job.

A non-designated area is everywhere else: plant rooms, risers, roofs, occupied floors, tenant units. Here the surroundings are not controlled and vary job to job, so the control has to be constructed for the individual task. That construction is the permit. The permit exists because the location does not do the job for you.

The drift failure is worth emphasising: a designated bay is created properly, then accumulates pallets, cardboard and insulation board because it is the only floor space nobody else has claimed. The permit system cannot detect this, because by definition no permit is raised there. Designated areas need periodic re-inspection precisely because they operate outside the permit process.

5. What the permit must establish, and why

This is the substance of the permit. Read it as a set of questions that must have real answers, not as fields to complete, because a permit is only as good as the survey behind it.

Exactly what work, exactly where, by what process. "Welding, level 3" is not a location, and neither is "hot work in the north plant room". The permit has to pin the work to a specific item in a specific position, because the whole assessment, what could ignite, what needs protecting, where the watch stands, depends on the physical spot. An area-level permit is an assessment of nothing in particular.

What is present that could ignite, and what cannot be moved. Combustible construction, contents and storage, and, critically, the interiors of voids, ducts, cavities, risers, cable containment and floor boxes, which almost nobody opens and looks into and which are precisely where dust, debris and combustible services accumulate out of sight. A survey of what is visible from standing height has not surveyed the places where hot work fires most often start. The first choice for anything found is removal; what cannot be removed must be shielded or separated, with the permit recording which applies and who verified it. The separation and shielding figures are set by the standard adopted in your jurisdiction and are not reproduced here.

The condition of anything that has contained a flammable substance. A vessel, drum, pipe, tank or line that has held a flammable liquid, gas or residue is a special case and should be treated as one without argument. Residues, sludges, absorbed product in linings and vapour in headspaces have a long and consistent fatal history on containers everybody present believed were empty. This is specialist work: assessment, cleaning, purging or inerting, and verification by people competent in that discipline, before any ignition source goes near it. I am deliberately giving no procedure and no test values, because a partial procedure here is more dangerous than none. If a permit is about to authorise hot work on something that once held flammables, the correct next step is to stop and involve somebody qualified in that work.

Whether a flammable atmosphere could be present or could develop. Not only now, but during the work, as adjacent processes run, as drains breathe and as the space warms. Where atmospheric testing is required it is done by competent people using calibrated and maintained equipment, with acceptance criteria from the applicable adopted standard rather than a figure remembered from a previous employer.

Then the operational elements, which the table below sets out with the reason each exists: protection verified rather than intended, named workers whose competence covers the fire risk of the method and not only the trade skill, a means of raising an alarm that survives the conditions the permit itself creates, the areas adjacent and above and below named explicitly, and a time window with stop conditions. Detection status, the fire watch and post-work monitoring get their own sections below.

6. Fire detection and suppression: isolation is itself a hazard

Hot work and automatic fire detection do not coexist comfortably. Welding fume, grinding dust and thermal plumes set off smoke detection, and on a live site one unwanted evacuation is expensive while a second destroys the credibility of the alarm. So detection in the work zone gets isolated. That is often legitimate and necessary, and it is also the point at which the permit takes a safeguard away from the building.

Isolation therefore needs handling as a controlled impairment in its own right rather than as a footnote on the permit: authorised by somebody competent to weigh what is being given up, limited to the smallest zone that solves the problem rather than the whole floor because that is how the panel is wired, covered by compensatory measures while in force, recorded in an impairment register, and then restored and verified by a named person with the panel confirmed back to normal.

The last step fails constantly. Unrestored isolations are among the most commonly forgotten items in the whole of facilities work, and they fail quietly, because an isolated zone produces no symptom until the day it is needed. Worse, an unrestored isolation leaves the building unprotected in exactly the period after hot work when smouldering ignition is most likely, at exactly the time when everyone has gone home. That is a compounding failure, not an administrative one.

The systems being isolated are covered in their own right in the guide to fire alarm system types and components. In the United States the detection and signalling document is NFPA 72, "National Fire Alarm and Signaling Code", 2025 edition, while inspection, testing and maintenance of water-based systems, including impairment handling, sits in NFPA 25, 2026 edition. Both are private standards and are law only where an authority having jurisdiction adopts them, in a named edition which may well not be the current one.

7. The fire watch and post-work monitoring: two obligations, not one

These two get merged constantly, and merging them is how the monitoring obligation disappears. They have different purposes and different timing.

The fire watch is a person whose only job, during the work, is to watch for ignition and act on it. The essential principle, violated more often than any other rule in hot work, is that the watcher watches. They do not hold the plate, fetch the rods or work through their own task list. The moment they assist with the work the watch has stopped existing, because the attention it depends on has gone.

Nor is the watch confined to the welder's field of view. It covers where sparks may actually have travelled: below the work, and on the other side of walls and floors, where conducted heat can ignite something nobody in the work area can see. On a job with a spark path into another space, one watcher in the work area is half a watch. Beyond position, the watcher needs the means to intervene on an incipient fire, training in how and when to use it, and the authority to stop the work and raise the alarm without asking permission from the person whose job is being interrupted. That last one is organisational rather than technical, and the one most often missing.

Post-work monitoring is a different obligation, existing for one reason: smouldering ignition. A hot particle lodged in combustible material can develop slowly, without visible flame, and become open fire after the task has finished. So the area continues to be monitored after work stops, for a period set by the applicable adopted standard and your fire safety authority, across the same extended set of spaces the watch covered.

8. Restoration and closure

Closure is where hot work permits differ most from every other permit, and where the discipline most often collapses, because a hot work permit cannot be closed simply on the task being complete.

It requires the work area and the extended area, above, below and on the far side, to be inspected for evidence of ignition rather than glanced at. It requires equipment made safe: torches shut down, gas cylinders isolated, valves closed, hoses depressurised and removed from the space rather than left coiled in the riser overnight, welding sets electrically isolated. Shielding comes off only once the area is confirmed cool and clear, and temporary sealing of openings is dealt with deliberately, since some should stay and some must come out. Then detection and suppression are restored and verified by a named person, with the panel actually checked rather than assumed, and the impairment register entry closed against that verification. And the permit is not closed until the monitoring period is complete and that completion recorded.

9. Where hot work meets other permits

Hot work rarely arrives alone. A permit system that issues several permits for one job without anybody holding the combined picture has created a gap between the documents.

• Hot work inside a confined space. A compounded hazard, not two hazards side by side. Hot work consumes oxygen, generates fume and heat in a space with limited ventilation, and introduces an ignition source into an atmosphere that may change during the work. Entry controls and hot work controls must be designed together, by people competent in both. See the confined space permit guide.
• Hot work requiring isolation. Cutting into pipework, or work on plant that must be shut down and drained, brings energy isolation into scope. The isolation and the hot work authorisation have to reference each other, and neither can be released independently. See lockout tagout and LOTO versus permit to work.
• Hot work at height. Welding from a scaffold or MEWP puts the ignition source above everything, with sparks falling onto areas the worker cannot see and the fire watch on a different level. See working at height hazards, controls and requirements.
• The coordination problem. When several permits touch one job, somebody has to own the interaction: sequence, dependencies, and which permit's stop conditions bind the others. The catalogue of permit types and how they relate is in types of permit to work.

10. How hot work permits fail

This is where the value is, because hot work permits fail in patterned, repeatable ways. Recognising several of these in your own operation is the normal result of looking honestly.

• The permit is issued for an area rather than a location. "Hot work, roof level" covers surroundings, spark paths and combustible content that differ completely from one part of it to another. Nothing specific was assessed, so nothing specific was controlled.
• The combustible material nobody saw. Inside a ceiling void, behind a plasterboard wall, in a cable riser, under a raised floor. The survey covered what was visible from standing height, and the fire started in the part that was not.
• Heat conduction ignoring the permit boundary. The permit drew a line around the work area. The steel beam did not. Ignition occurred on the far side of a wall, in a space never inspected, watched or monitored because it sat outside the boundary the paperwork drew.
• Work on a vessel that "was empty". Everybody present believed it was. This pattern has a long and consistent fatal history, and it recurs because the container genuinely looks empty.
• Detection isolated and not restored. The failure with the longest tail, leaving the building unprotected after everyone has gone, in the window when smouldering ignition is most likely.
• The fire watch given other duties. The watcher helps with the work, covers two jobs at once, or is the apprentice sent because nobody else was free. The role exists on paper and not in the room.
• The watch ended when the welder stopped, or the monitoring period truncated because the shift ended. The most consequential misunderstanding in hot work, because it removes the one control that exists for the hazard that outlives the task. Neither is defensible in writing, and both happen constantly.
• Contractor hot work with no site permit at all. A recurring pattern on multi-employer sites: a roofing contractor, a small-works fitter or a tenant's plumber does a quick job with a torch or a grinder under their own arrangements or none, because nobody told them the site had a permit system. This is the strongest argument for controlling site access against active permits rather than only at the gate.
• The honest organisational one. Hot work is very often the last task of a job running late: the pipe tied in before handover, the roof sealed before the weekend. That is exactly when the permit becomes a formality, the watcher is repurposed to help finish, and the monitoring period gets compressed. Hot work problems clustering at the end of projects and shifts is not coincidence, it is the pattern.

11. Standards and law: what applies, and where

Hot work sits across fire safety law, occupational safety law and voluntary standards, and the mix is jurisdiction-specific. A few points worth being precise about.

The hot work standard. In the United States the relevant NFPA document is NFPA 51B, "Standard for Fire Prevention During Welding, Cutting, and Other Hot Work", current edition 2024. That is the hot work document, and it is worth separating deliberately from its neighbours because the numbers get swapped in FM copy constantly: NFPA 51 is the oxygen-fuel gas systems hardware and piping standard, not the permit standard; NFPA 25 covers inspection, testing and maintenance of water-based fire protection; NFPA 13 is sprinkler installation; NFPA 72 is fire alarm and signalling. None of those four carries the hot work permit requirements. NFPA documents are private standards published by a US body and are not law by themselves anywhere. They become enforceable only where an authority having jurisdiction adopts them, that adoption names a specific edition, and the adopted edition is frequently several cycles behind the current one. So the practical question is never "what does NFPA 51B say", it is "which edition of NFPA 51B has my authority having jurisdiction adopted".

United States, occupational safety. There is no OSHA standard called "hot work permit". Welding, cutting and brazing in general industry sits in 29 CFR 1910 Subpart Q, sections 1910.251 to 1910.255, where 1910.252 is titled simply "General requirements" and the permit concept sits inside 1910.252(a); for covered process safety management processes the requirement is in 1910.119(k), and the construction counterpart is 29 CFR 1926 Subpart J, sections 1926.350 to 1926.354. This is US federal law only, and State Plan states may impose different requirements.

Great Britain. There is no single hot work regulation. The duties arrive through the general framework: the Health and Safety at Work etc. Act 1974 (c. 37), the risk assessment duty in Regulation 3 of the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), and, where flammable substances or explosive atmospheres are involved, DSEAR 2002 (SI 2002/2776) as amended. Hot work inside a confined space brings in the Confined Spaces Regulations 1997 (SI 1997/1713) with the Approved Code of Practice L101, 3rd edition, December 2014, which carries special evidential status rather than being ordinary guidance; hot work at height brings in the Work at Height Regulations 2005 (SI 2005/735). Fire safety law is a separate regime again, administered differently across England, Wales and Scotland. All of these are Great Britain instruments; Northern Ireland has separate ones, in several cases with different years.

Permit systems and management standards. No international standard specifies a permit-to-work system. The widely used reference is UK HSE guidance HSG250, "Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries", 2005, free to download; it is guidance, creates no duties, and was written for the petroleum and chemical industries largely around paper systems. ISO 45001:2018, as amended by Amd 1:2024, is the certifiable occupational health and safety management system standard and its clause 8.1.2 requires the hierarchy of controls; ANSI/ASSP Z10.0-2019 section 8.4 does the same in the United States. Risk assessment technique selection is covered by IEC 31010:2019, which is IEC 31010 and not "ISO 31010". None of these is law anywhere by itself.

United Arab Emirates, since a good proportion of readers here are in the Gulf. US OSHA regulations and UK HSE law have no legal force in the UAE; they are voluntary benchmarks. The binding occupational safety framework is Federal Decree-Law No. 33 of 2021 on the Regulation of Employment Relationships, in force 2 February 2022, administered by MOHRE, with the occupational safety duties in Article 13, applying to the private sector including free zones but excepting DIFC and ADGM. Fire safety is governed by the UAE Fire and Life Safety Code of Practice, issued by the Ministry of Interior, Directorate General of Civil Defence, federal in scope but enforced emirate by emirate by the local Civil Defence authority; the edition confirmable from an official source is September 2018, and it is NFPA-referencing rather than IBC-based. In Abu Dhabi the occupational safety framework is ADOSH-SF, Version 4.0, administered by the Abu Dhabi Public Health Centre; EHSMS and OSHAD are legacy names. As a regional contrast, Saudi Arabia's fire code SBC 801, issued by the Saudi Building Code National Committee with 2018 and 2024 editions, is ICC and IFC based rather than NFPA based. There is no GCC-wide fire code.

12. Where this lands in facilities and maintenance management

Three practical connections, where the permit stops being a safety artefact and becomes part of how the operation runs.

Hot work permits belong to work orders. A permit that exists only as a pad in the security office is disconnected from the work it authorises, so nobody can answer basic questions: which jobs this month involved hot work, on which assets, by which contractors, and did each close properly. Tying the permit to the work order that generated it makes hot work visible as a class of work rather than a sequence of unrelated pieces of paper. Any reasonably capable maintenance system holds that relationship; the mechanics are covered in permit to work integration with a CMMS, with the surrounding classification discipline in work order types in a CMMS. The point is the visibility, not the software.

The fire system impairment register is an operational control, not a compliance file. If hot work routinely isolates detection, the register records how often, for how long and in which zones the building runs with reduced protection. Read that way it is management information: repeated isolations in the same zone are telling you something about how work is planned there. Read as a compliance file it is a folder nobody opens. The restoration and verification discipline that closes each entry is the same discipline that keeps life safety systems credible generally, a theme in the guide to elevator, fire and life safety system PM.

Contractor control is where most of the residual risk sits. In-house teams generally know the permit system exists; small contractors on short jobs frequently do not, or work around it because the office is closed. Access control tied to active permits, an authorising person available at the hours contractors actually work, and induction that names hot work explicitly are the measures that address this. None is exotic. All cost management attention.

The idea to walk away with

A hot work permit is a decision about a specific task in a specific place, made by a competent person who has established what could ignite, what will be protected, what is given up when detection is isolated, who is watching, and what happens after the tools go away. It is the only permit whose most important obligations run after the work has stopped.

So the two tests of a hot work permit system are simple and uncomfortable. Does it ever produce the answer "do this in the workshop instead"? And does anything close without the monitoring period having elapsed and the detection having been verified back in service? A system that passes both is doing the job. A system that fails either is producing paperwork.

Final thoughts

I have deliberately not given you a checklist, and that is not caution for its own sake. A checklist copied from an article is detached from the standard your authority adopted, from the fire safety law that applies to your premises and from the building the work is happening in. It gives a feeling of coverage without the survey, competence or authority that makes coverage real, and its distances and durations will be wrong for somebody. What transfers is the reasoning: why each element exists, and what breaks when it is missing.

If you want somewhere to start on your own system, start at closure rather than at issue. Pull a sample of closed hot work permits and check three things: whether the location was specific enough to assess, whether the monitoring period had genuinely elapsed before the closing signature, and whether every detection isolation was restored and verified against the panel. Closure is where these permits fail, and it is the part nobody audits, because the task finished and the building did not burn down. That is not evidence the control worked.

Related reading: Hot work hazards, controls and permits, Permit to work: complete guide, Types of permit to work, Confined space permit guide, LOTO versus permit to work, Fire alarm system types and components, Permit to work integration with a CMMS.

Primary sources: NFPA , US OSHA , UK HSE , ISO .