What a Good Deployment Looks Like

Rather than a summary, a description of the arrangement these notes point toward.

The design

The least capable system that answers the question. Detection where detection suffices, counting where counting suffices, identification only with a written justification.

Aggregation at source. Person-level data computed and discarded on the device; only counts and events transmitted.

Edge processing with frames never leaving the site, unless there is a stated reason otherwise.

Exclusions configured in the camera — welfare facilities, break areas, adjacent property — not filtered downstream.

Cameras placed for the task, with a survey behind the placement and the blind zones mapped and stated.

The evidence

Performance measured on your own site, against independently collected ground truth.

Recall and precision reported separately, at a stated threshold, by condition.

Subgroup performance measured where people are involved, with the evaluation set composition stated.

The alert rate computed and within an agreed operator budget.

Re-evaluated quarterly, with results recorded so a trend exists.

The governance

A register with purpose, tier, basis, assessment, notice, retention, access, owner and review date, per deployment.

An impact assessment for anything people-facing, written before deployment, with the proportionality reasoning and the rejected alternatives.

A notice that answers "are you watching me" honestly, before the analysed area, in the languages people use.

Consultation where employees are involved, with a written response.

A purpose limitation in writing, tested by a request and held.

The operation

Role-separated access: live view, retrospective search, export, configuration, administration.

Every access logged with a reason, reviewed periodically, including a clean result.

Retention per data category, enforced by automated deletion, verified including backups.

Human review before any consequence to a person, with context, easy override, and a measured override rate that is not zero.

A contest route with a named person and a response time.

Monitoring of the system itself: counts, confidence distributions, image statistics, camera health.

The honesty

The outcome measure reported alongside the detection count, so a system being avoided is visible.

Interim measures recorded as interim, with a date for the physical control they stand in for.

Null and negative results reported, including pilots that concluded no.

Limitations written into the report rather than mentioned in conversation.

An annual review asking whether you would deploy this today, given what you now know.

What it produces

Reliable answers to a small number of questions.

A record you can defend to a regulator, an auditor or someone who asks what you know about them.

A workforce and a public that were told the truth and can check it.

None of this requires an unusual budget, and all of it requires deciding what the system is for before deciding what to buy.

What it costs to run

Ongoing, once installed, and it is smaller than most expect.

A named owner with allocated time, which is the real requirement.

A quarterly evaluation against ground truth.

A monthly look at the monitoring trends.

An annual review of the register, notices and permissions.

Lens cleaning on a schedule, which is the highest-return maintenance action and is nobody's job by default.

None of this is a large commitment, and all of it separates a working control from a system providing assurance that is not there.

Measuring the deployment itself

Six questions, asked annually, that describe whether the arrangement works.

Can you say what every camera analyses, in minutes?

Has the system been evaluated against ground truth this year?

Is the alert volume within what operators can handle?

Has the purpose limitation been tested by a request and held?

Does the notice match what the system actually does?

Would you deploy this today?

A no to any of these names the work to do next, which is more useful than a maturity score.