Practice 03 · Autonomy & certification
Engineering evidence is not the same thing as a certifiable argument. This is where IEC 61508 evidence and AI safety evidence become a structured safety case a customer, insurer or certification body can actually evaluate — and, where the AI itself needs its own certificate, where you get one.
Scope
UL 4600 and UL 3115 address the gap between having safety evidence and proving safety to someone who wasn't in the room when it was produced.
The test. If the robot is genuinely safe but nobody outside your engineering team could independently verify that from your documentation, the gap is here — not in IEC 61508 and not in your model evaluation.
IEC 61508 gives you a SIL figure. AI safety evaluation gives you a set of performance and robustness numbers against a task envelope. Both are necessary. Neither, on its own, tells a reader why the combination is acceptable, what it assumes, or what remains unproven. That connective structure — claim, argument, evidence — is a separate discipline, and it is usually the first thing missing when a robot that has clearly been engineered carefully still fails a customer's due-diligence review.
UL 4600 was written to be technology-agnostic on purpose: a safety case built from explicit claims about the system, arguments for why those claims hold, and evidence supporting the arguments. It applies as well to a delivery robot or an AMR fleet as it does to a self-driving car, and it does not prescribe how you built the robot — only how you show that what you built is safe enough, and what is still open.
Published in October 2025, UL 3115 is an outline for the safety of AI-based products specifically — both AI-embedded products such as autonomous robots, and pure digital AI products. It functions as a universal safety layer for AI features, complementing hardware and electrical safety rules rather than replacing them, and it maps its criteria onto ISO, IEC and NIST frameworks so evidence built for one recognises the others.
In practice, UL 3115 certifies the AI component; UL 4600 argues the product as a whole. A robot with a certified AI perception stack still needs a product-level safety case — and a product-level safety case is far easier to write when the AI evidence inside it already has a recognised shape.
The practical consequence. Teams that treat certification as a paperwork exercise at the end of development consistently discover the gaps too late — a claim with no evidence, an assumption nobody wrote down, a test that proves less than the report implies. Structuring the case from the start turns it into a live map of what's actually done.
How they fit together
They are not sequential gates you pass once — but for a robot with a meaningful AI component, UL 3115 evidence typically becomes one of the strongest pieces of evidence inside the UL 4600 case.
The AI-embedded or digital AI component is evaluated against UL 3115's safety criteria, cross-mapped to ISO, IEC and NIST frameworks — producing a certified, recognised piece of evidence about the AI specifically.
The UL 3115 certificate, the IEC 61508 functional safety case and every other relevant piece of evidence are assembled into one claim-argument-evidence structure covering the whole robot — with an explicit residual risk statement.
Deliverables
A safety case is only as strong as its weakest linked claim. We build the structure so every claim actually traces to evidence that supports it.
Signals
Connections
This practice sits at the end of the chain. It doesn't generate new engineering evidence — it consumes what the other two branches produce and turns it into a case.
SIL verification, hardware fault metrics and the functional safety case become claims and evidence inside the product-level safety case — but only once they're expressed as claims a non-specialist reader can evaluate, not just a compliance report.
Dataset coverage, evaluation results and calibrated uncertainty become the evidence behind every AI-related claim — and, where UL 3115 certification is pursued, the basis for a certificate that strengthens the case rather than sitting outside it.
Not "is the robot safe" — could someone who has never met your engineering team read your case and reach the same conclusion, from the evidence alone.