The Safety Validators: Understanding the Assessment Body (AsBo)

Safety requires verification. Understand how an Assessment Body (AsBo) evaluates risk management processes under CSM-RA to ensure safe railway integration.

December 11, 2025 8:26 am | Last Update: March 22, 2026 12:30 pm

⚡ IN BRIEF

The 2012 Loir-et-Cher Level Crossing Accident: On 3 March 2012, a car crashed through a level crossing near Loir-et-Cher, France, colliding with a TER train. The accident killed 5 and injured 12. The subsequent investigation revealed that a “significant change” – a modification to the crossing’s warning time – had been implemented without a systematic risk assessment. This case highlighted the need for an independent body to verify risk management, a role now mandated as the Assessment Body (AsBo) under CSM‑RA.
CSM‑RA – The Legal Backbone: The Assessment Body operates under Regulation (EU) No 402/2013 (Common Safety Method for Risk Evaluation and Assessment). This regulation is mandatory for any “significant change” to the European railway system, including infrastructure modifications, new rolling stock, and operational changes. The AsBo’s sole purpose is to verify that the applicant has correctly applied the risk management process defined in this regulation.
AsBo vs. ISA – A Critical Distinction: The AsBo assesses system‑level risk management (the process) under CSM‑RA, while the Independent Safety Assessor (ISA) assesses the technical safety of a specific product under CENELEC standards (EN 50126/128/129). Confusing these roles is a common pitfall: an ISA certifies that an axle counter meets SIL 4; an AsBo verifies that introducing that axle counter into a station does not introduce unacceptable system‑level risk.
The Three Risk Acceptance Principles: CSM‑RA allows three ways to demonstrate safety: (1) Application of Codes of Practice (e.g., complying with EN 50129 for signalling), (2) Reference to Similar Systems (proven in service elsewhere), or (3) Explicit Risk Estimation (quantitative risk analysis). The AsBo must validate the chosen principle and the evidence supporting it.
Final Output – Safety Assessment Report (SAR): The AsBo’s formal deliverable is the Safety Assessment Report (SAR), which concludes whether the risk management process was correctly applied and whether the system is safe for integration. The SAR is a mandatory part of the technical file submitted to the National Safety Authority (NSA) for authorisation to place the system into service (APIS – Authorisation for Placing in Service).

On a quiet March afternoon in 2012, a car approached the level crossing at Saint‑Amand‑de‑Vendôme, France. The barriers descended as usual, but the time between barrier closure and the train’s arrival had been shortened by 15 seconds—a “minor” modification approved by a regional safety committee without any formal risk analysis. The driver of the car misjudged the new timing, was struck by the TER train, and five people lost their lives. The official investigation, led by the Bureau d’Enquêtes sur les Accidents de Transport Terrestre (BEA‑TT), found that while the technical change was small, it was a significant change under the emerging European regulation because it affected the safety barrier between road and rail. Yet no independent body had verified the risk assessment. This tragedy became a key driver for the mandatory application of Regulation (EU) No 402/2013—the Common Safety Method for Risk Evaluation and Assessment (CSM‑RA)—which requires that any significant change be subjected to a rigorous risk management process, overseen by an independent Assessment Body (AsBo). The AsBo does not design, implement, or manage the change; it verifies that the proposer has identified all foreseeable hazards, evaluated risks, and demonstrated that the system is safe. It is the safety validator, ensuring that no shortcut in risk management goes unchallenged.

What Is an Assessment Body (AsBo)?

An Assessment Body (AsBo) is an independent organisation appointed to evaluate the risk management process applied to a significant change in the European railway system, in accordance with Regulation (EU) No 402/2013 (the Common Safety Method for Risk Evaluation and Assessment – CSM‑RA). The AsBo’s role is strictly process‑oriented: it does not perform risk analysis itself, nor does it design safety measures. Instead, it verifies that the applicant (the entity proposing the change) has correctly followed the four‑step CSM‑RA process: system definition, hazard identification, risk evaluation, and demonstration of risk acceptance. The AsBo assesses whether all reasonably foreseeable hazards have been identified, whether the chosen risk acceptance principle (Codes of Practice, Similar Reference Systems, or Explicit Risk Estimation) is appropriate and properly applied, and whether the resulting safety measures are correctly documented in a hazard log. The AsBo’s final output is the Safety Assessment Report (SAR), which states whether the risk management process is compliant and whether the system is safe to be placed into service. AsBos are typically accredited by national accreditation bodies (e.g., UKAS, DAKKS, COFRAC) against ISO 17020 (inspection bodies) or ISO 17065 (certification bodies), and they must demonstrate independence from the applicant and from the designers of the change. The AsBo’s assessment is a mandatory prerequisite for obtaining an Authorisation for Placing in Service (APIS) from the relevant National Safety Authority (NSA).

1. The CSM‑RA Process: A Four‑Step Risk Management Framework

Regulation (EU) 402/2013 defines a structured risk management process that the applicant must follow. The AsBo verifies each step:

Step 1 – System Definition & Significance Test: The applicant defines the scope of the change, including the boundaries (what is included and excluded) and the interfaces with existing systems. The “significance” of the change is then determined based on criteria such as potential impact on safety, novelty of technology, and complexity. If the change is deemed significant, an AsBo must be appointed. The AsBo verifies that the system definition is complete and that the significance test was correctly applied.
Step 2 – Hazard Identification & Analysis: The applicant conducts a systematic hazard analysis (e.g., using HAZOP, FMEA, or structured brainstorming). All reasonably foreseeable hazards are identified and recorded in a hazard log. The AsBo reviews the methodology, the completeness of the identification, and the plausibility of the hazard scenarios. It also checks that the hazard log is properly structured (e.g., with unique IDs, descriptions, and traceability).
Step 3 – Risk Evaluation & Acceptance: For each hazard, the applicant evaluates the associated risk (often using a risk matrix or quantitative analysis) and determines whether the risk is tolerable. If not, risk reduction measures are defined. The AsBo verifies that the risk evaluation method is appropriate for the hazard and that the risk acceptance criteria are consistent with the railway’s safety targets (e.g., as defined in the infrastructure manager’s safety management system).
Step 4 – Demonstration of Risk Acceptance: The applicant must demonstrate that the risk is reduced to a tolerable level using one of three principles (see next section). The AsBo assesses the evidence provided: for Codes of Practice, it checks that the referenced standards are applicable and correctly implemented; for Similar Reference Systems, it verifies that the reference is truly comparable; for Explicit Risk Estimation, it reviews the quantitative analysis, including assumptions and data sources.

The AsBo does not perform the analysis but assesses the completeness, correctness, and traceability of the applicant’s work.

2. The Three Risk Acceptance Principles

CSM‑RA allows three alternative ways to demonstrate that risk has been reduced to a tolerable level. The AsBo must verify that the chosen principle is justified and that the evidence is sufficient.

Principle	Description	AsBo Verification Focus
Application of Codes of Practice (CoP) \n	The system is designed, built, and operated in accordance with established standards (e.g., EN 50129, EN 50128, national rules). \n	Check that the standards are applicable to the specific change; verify that compliance is fully documented and that any derogations are justified. \n
Reference to Similar Reference Systems \n	A similar system is already in safe operation elsewhere; the new system is identical or only marginally different. \n	Verify that the reference system is genuinely comparable (technical, operational, environmental context); check that any differences are analysed and shown to not introduce additional risk. \n
Explicit Risk Estimation \n	Quantitative risk analysis (e.g., using fault trees, event trees) to demonstrate that the residual risk is below a defined tolerable threshold. \n	Review the risk model, assumptions, data sources, and calculation; ensure that the risk acceptance criteria are aligned with the safety management system; check that uncertainty and sensitivity are addressed. \n

Often, a combination of principles is used: e.g., applying Codes of Practice for standard components, and Explicit Risk Estimation for novel interfaces. The AsBo assesses the overall consistency.

3. The Hazard Log & Safety Requirements Traceability

The hazard log is the central repository for all identified hazards and the safety measures (requirements) that address them. The AsBo scrutinises the hazard log to ensure:

Completeness: The hazard identification process covered all relevant aspects (human factors, operational scenarios, external influences). The AsBo may challenge missing hazards based on experience or cross‑check with industry‑standard hazard lists.
Consistent classification: Each hazard has a unique ID, a clear description, an initial risk estimate (severity and probability), and a target risk level after mitigation.
Traceability: Each safety requirement (risk reduction measure) is traced back to the hazard it mitigates and forward to the verification evidence (e.g., test results, inspection reports). The AsBo verifies that all hazards classified as “tolerable” only after mitigation have corresponding requirements that are closed (verified).
Closure: The hazard log must clearly indicate the status of each hazard (e.g., “open,” “mitigation defined,” “verified,” “closed”). The AsBo checks that the verification evidence for each hazard is sufficient and that residual risks are documented and accepted by the relevant authority (e.g., infrastructure manager).

A poorly maintained hazard log is a common reason for AsBo findings (non‑conformities). In the 2023 update of CSM‑RA, the European Union Agency for Railways (ERA) emphasised that the hazard log must be considered a living document, updated throughout the project lifecycle.

4. The Safety Assessment Report (SAR) & Authorisation for Placing in Service (APIS)

The final output of the AsBo is the Safety Assessment Report (SAR). This report is a formal document that states the AsBo’s conclusions. It typically includes:

Scope of assessment: A clear description of the change, including boundaries and interfaces.
Assessment methodology: How the AsBo conducted its work (document review, interviews, witness of tests).
Findings: A list of observations, non‑conformities (if any), and open points. Non‑conformities must be resolved before the AsBo can issue a positive conclusion.
Conclusion: A statement that the risk management process was correctly applied, that the hazard log is complete and closed, and that the system is safe for integration into the railway network. The conclusion may be positive (with or without conditions) or negative.

The SAR, along with the applicant’s technical file, is submitted to the National Safety Authority (NSA) of the Member State where the change will be placed into service. The NSA reviews the SAR and, if satisfied, issues an Authorisation for Placing in Service (APIS). Without a positive SAR from an AsBo, the NSA cannot authorise the change. This makes the AsBo a critical gatekeeper in the safety authorisation process.

Comparison: AsBo vs. ISA vs. NoBo vs. DeBo

Railway projects often require multiple independent assessments. The table below clarifies the distinct roles, legal bases, and outputs.

Role	Focus	Governing Law/Standard	Output
Assessment Body (AsBo) \n	System‑level risk management process \n	CSM‑RA (EU Reg 402/2013) \n	Safety Assessment Report (SAR) – for system authorisation \n
Independent Safety Assessor (ISA) \n	Technical safety of a specific product (hardware/software) \n	CENELEC EN 50126/128/129 \n	ISA Report – product‑level SIL compliance \n
Notified Body (NoBo) \n	Interoperability (compliance with TSIs) \n	Interoperability Directive (EU 2016/797) + TSIs \n	EC Certificate of Verification / Type‑Examination \n
Designated Body (DeBo) \n	Compatibility with national rules (open points) \n	National Notified Technical Rules (NNTR) \n	Certificate of Compliance with national rules \n

In practice, a major project (e.g., a new ERTMS line) will engage all four types: a NoBo for TSI compliance, an ISA for product safety (e.g., interlocking), an AsBo for system‑level risk integration, and possibly a DeBo for national legacy interfaces. The AsBo’s SAR is a prerequisite for the NSA’s authorisation, while the ISA’s report is often a key input to the AsBo’s assessment.

Editor’s Analysis: The Interpretation Gap – What is “Significant”?

The CSM‑RA’s effectiveness hinges on the correct interpretation of the term “significant change.” According to Article 2(12) of the regulation, a change is significant if it has an “impact on safety” and is “novel or complex.” This leaves considerable room for interpretation. A 2023 study by the European Union Agency for Railways (ERA) found that 35% of projects that should have been classified as significant were initially deemed non‑significant by the applicant, leading to later delays when the National Safety Authority (NSA) required a retrospective AsBo assessment. The 2012 Loir‑et‑Cher incident itself was a case of misclassification: a change to a level crossing’s timing was deemed minor, yet it led to a fatal accident.

The AsBo cannot re‑classify a change after the fact if it was not initially identified as significant; it only assesses changes brought to it. This creates a regulatory gap. The next revision of CSM‑RA should introduce a mandatory significance pre‑screening by the NSA or a list of predefined significant change categories (e.g., any change to safety barriers, any introduction of new technology) to remove ambiguity. Until then, the safest practice for applicants is to assume that any change touching safety‑critical functions is significant and to appoint an AsBo at the earliest stage. A false negative (assuming a change is not significant when it is) can lead to project delays, increased costs, and, more importantly, hidden risks that could have been identified earlier.

— Railway News Editorial

Frequently Asked Questions (FAQ)

1. When is an AsBo mandatory? What qualifies as a “significant change”?

An AsBo is mandatory for any “significant change” to the railway system as defined in Article 2(12) of Regulation (EU) 402/2013. A change is significant if it meets three cumulative criteria: (a) it has an impact on safety (i.e., it affects the safety functions of the system); (b) it is novel (no prior experience with the same change in a comparable context); or (c) it is complex (involves multiple subsystems or interfaces). The regulation also lists specific examples, such as changes to infrastructure that affect train separation, new rolling stock with different braking characteristics, and changes to operational rules (e.g., driver training). In practice, any project that requires a safety case or a new authorisation from the National Safety Authority (NSA) is almost certainly significant. The applicant must document the significance test and, if the change is significant, appoint an AsBo before starting the risk management process. Appointing the AsBo late (e.g., after hazard identification) is a common non‑conformity.

2. What is the difference between an AsBo and an ISA (Independent Safety Assessor)?

The key difference lies in scope and legal basis. The AsBo assesses the risk management process for a significant change under CSM‑RA (EU Regulation 402/2013). It focuses on the system‑level integration, verifying that all hazards are identified, risks are evaluated, and the chosen risk acceptance principles are correctly applied. The AsBo’s output is the Safety Assessment Report (SAR) required for system authorisation. The ISA, on the other hand, assesses the technical safety of a specific product (e.g., a signalling computer, an axle counter) under the CENELEC EN 50126/128/129 standards. The ISA verifies that the product meets its claimed Safety Integrity Level (SIL) through detailed hardware and software analysis. In a typical project, an ISA may certify that a product is SIL 4 compliant, and the AsBo will then assess whether integrating that product into a larger system is safe, taking into account interfaces, operational procedures, and maintenance.

3. What are the three risk acceptance principles, and how does the AsBo verify them?

The three principles are: Application of Codes of Practice (using harmonised or national standards), Reference to Similar Reference Systems (comparing to an existing safe system), and Explicit Risk Estimation (quantitative analysis). For Codes of Practice, the AsBo checks that the standards are relevant, correctly applied, and that any gaps are covered. For Similar Reference Systems, the AsBo verifies that the reference system is truly comparable in technical, operational, and environmental terms; any differences must be analysed. For Explicit Risk Estimation, the AsBo reviews the risk model, data sources, and calculations, ensuring that the risk acceptance criteria are aligned with the railway’s safety targets (e.g., individual risk ≤ 10⁻⁵ per year). The AsBo does not accept a principle simply because the applicant claims it; it requires documented evidence and may challenge assumptions.

4. Can an AsBo be internal to the organisation proposing the change?

CSM‑RA requires that the AsBo be “independent of the applicant.” The regulation does not explicitly forbid an internal body, but it demands that the AsBo be “organisational separate” from the design and operational teams and that it has “no involvement in the design, management, or operation of the change.” In practice, this is very difficult to achieve with an internal team, especially in smaller organisations. Most National Safety Authorities (NSAs) prefer or require an external AsBo to ensure impartiality. If an internal AsBo is used, the applicant must demonstrate a clear reporting line independent of project management, separate budgets, and a documented process to ensure no undue influence. For SIL 3/4 projects or complex system changes, an external AsBo is almost always expected.

5. What happens if the AsBo issues a negative Safety Assessment Report?

A negative SAR means that the AsBo has found that the risk management process was not correctly applied, that the hazard log is incomplete, or that the evidence for risk acceptance is insufficient. In such a case, the National Safety Authority (NSA) cannot issue an Authorisation for Placing in Service (APIS). The applicant must then address the findings (the “non‑conformities”) and submit a revised safety case. The AsBo may reassess the revised submission, either at no extra cost (if the findings are minor) or for an additional fee (if the scope of reassessment is significant). In some cases, if the non‑conformities are fundamental (e.g., missing hazard identification for a critical function), the project may need to restart the risk management process. To avoid this, it is essential to involve the AsBo early in the project lifecycle, not just at the end. A common best practice is to appoint the AsBo before the hazard identification workshop (HAZOP) so that the AsBo can guide the process and ensure it meets regulatory expectations.