The FFD Surveillance Framework: When Compliance Undermines Safety Culture

Intended for: Founders, licensing leads, and QA managers at advanced reactor developers building or scaling a Fitness-for-Duty program, particularly at organizations moving from a handful of staff toward full operating complement.

Executive Summary

10 CFR Part 26 requires nuclear facility licensees to run a Fitness-for-Duty (FFD) program covering drug and alcohol testing, behavioral observation, and fatigue management. Part 53 licensees have an additional, elective option, Subpart M, that goes further than the standard program, up to and including hair specimen testing and, under specified conditions, mandatory continuous video and audio surveillance of personnel. The regulation itself is not the problem. The problem shows up in implementation: when behavioral observation is built as a surveillance function rather than a peer-support function, it quietly damages the trust that safety culture depends on. This post walks through what Part 26 actually requires, what Subpart M adds for Part 53 licensees, where behavioral observation tips from a safety practice into a chilling effect, and what a small advanced reactor team should do differently while building this program for the first time, not after a finding forces a rebuild

What the FFD Regulation Actually Requires

Fitness-for-Duty programs are governed by 10 CFR Part 26, and the core elements most developers need to plan for early are drug and alcohol testing (10 CFR 26.31), behavioral observation (10 CFR 26.33), and fatigue management under Subpart I, including work-hour limitations (10 CFR 26.205) and self-declarations of fatigue (10 CFR 26.209).

Behavioral observation, defined at a basic level, means personnel with unescorted access or who perform safety-related duties are watched by trained coworkers and supervisors for behaviors that could indicate impairment, whether from substances, fatigue, or a mental or physical condition affecting fitness for duty. The regulation does not specify a surveillance apparatus. It specifies trained observation by people who already work alongside the person being observed.

That distinction matters more than it looks like it should.

Part 53 Raises the Stakes: The Elective, More Invasive Subpart M Option

Developers licensing under 10 CFR Part 53 have an additional wrinkle that baseline Part 50 and Part 52 licensees do not: an elective, alternative FFD framework under 10 CFR 26 Subpart M (26.601 through 26.619), built specifically to accommodate Part 53's risk-informed, performance-based structure. A Part 53 licensee can choose Subpart M instead of the standard FFD program, and Subpart M goes further than the baseline program in ways worth understanding before you elect into it.

On drug and alcohol testing, Subpart M permits both oral fluid and hair specimen testing (10 CFR 26.607). Hair testing is not available at all under the standard Part 26 program: the NRC explicitly declined to authorize it in a 2022 rulemaking, calling the idea beyond that rulemaking's scope. Under Subpart M, hair testing is limited to pre-access testing and functions as a supplement to oral fluid or urine results, not a standalone test, but it is real added testing infrastructure a baseline licensee does not have to build.

On behavioral observation, Subpart M is explicit that observation can, and in some cases must, go beyond in-person peer observation. 10 CFR 26.609 requires behavioral observation to be performed visually and in person, and, where operational demands make in-person observation impractical at an operating reactor, requires a live video and audio streaming and capture system instead.

Read that plainly: for some Part 53 licensees, continuous video and audio surveillance of operating personnel is not a hypothetical overreach. It is a regulatory requirement once you elect into Subpart M under the conditions the rule specifies.

The logic behind the rule is understandable. Advanced reactor staffing models are leaner, and leaner staffing means fewer coworkers physically present to observe each other the way a traditional plant's shift complement would. The regulation is filling a real gap. But filling that gap with cameras and hair testing, rather than examining whether the staffing model itself accounted for behavioral observation as a real function, is a tradeoff that should be made deliberately, not adopted by default just because Subpart M made it available.

In my own assessment, this is also, practically, a more expensive program to run than the baseline. Hair testing adds an HHS-certified laboratory pathway on top of the standard testing program. Continuous video and audio streaming requires infrastructure, storage, and monitoring staff of its own. NRC's rule package does not put a dollar figure on this, since Subpart M is elective and the agency does not mandate the choice, but a developer weighing whether to elect into it should weigh the cost of the surveillance infrastructure itself, not just the regulatory box it checks.

Where Behavioral Observation Becomes Surveillance

The regulatory design assumes behavioral observation functions as a peer safety practice: colleagues who know what normal looks like for the people they work with, trained to notice a deviation and escalate it appropriately. That is closer in spirit to the operator walkdown than to a compliance audit. It depends on people paying attention because they are invested in each other's safety, not because they are being watched themselves.

Implementation drifts away from that design in a few predictable ways. Some programs formalize behavioral observation into a reporting quota, which teaches staff to generate observations. Some pair it with disciplinary consequences severe enough that coworkers stop reporting anything short of an obvious emergency, because they do not want to be the reason someone loses their job over a bad week. Some layer it on top of drug and alcohol testing in a way that reads, to the workforce, as one continuous surveillance program rather than two distinct, narrowly scoped requirements.

None of these drift patterns violate the letter of Part 26. All of them work against its purpose.

What "Safety Conscious Work Environment" and "Chilled" Actually Mean

If you are building your first FFD and safety culture program, these two terms come up constantly in NRC guidance and industry literature, and they are worth defining precisely rather than picking up by osmosis.

A Safety Conscious Work Environment, or SCWE, is a specific term of art. The NRC's 1996 policy statement (61 Fed. Reg. 24336) defines it as a work environment where employees are encouraged to raise safety concerns and where those concerns are promptly reviewed, prioritized by potential safety significance, and resolved with timely feedback to the person who raised them. It is not a vibe. It is a described outcome: concerns get raised, get triaged, get answered, and the person who raised them hears back.

A chilled work environment, or chilling effect, is what happens when SCWE breaks down. The NRC describes it as a condition where employees become hesitant to raise safety concerns, either because they fear retaliation or because concerns they raised before went nowhere. When the NRC identifies this at a facility, it can issue what is informally called a chilling effect letter, under Allegation Guidance Memorandum 2012-001, requiring the licensee to demonstrate it is taking concrete action to restore an environment where people will actually speak up. Employee protection against retaliation for raising a safety concern is also independently backed by 10 CFR 50.7, which gives the NRC enforcement authority over licensees, and their contractors, who discriminate against someone for engaging in that protected activity.

Here is why this matters for a surveillance-heavy FFD program specifically: a chilled work environment does not require anyone to say "don't report." It only requires people to reasonably believe that reporting costs more than it is worth. A young company that builds punitive consequences into behavioral observation, without meaning to, can chill its own workforce well before anyone files a complaint or the NRC gets involved.

The Chilling Effect Problem

The NRC's Safety Culture Policy Statement (76 FR 34773, June 2011) names an environment for raising concerns as one of the traits of a positive safety culture: personnel feel free to raise safety concerns without fear of retaliation, intimidation, harassment, or discrimination. A surveillance-heavy FFD implementation works directly against that trait. If reporting a colleague's fatigue or a personal struggle reliably triggers punitive consequences, people stop reporting, not because the underlying condition disappeared, but because the cost of surfacing it became too high.

The industry did not invent this principle independently of the regulator. INPO 12-012, "Traits of a Healthy Nuclear Safety Culture," names the same trait, Environment for Raising Concerns, as one of ten traits across three categories: Individual Commitment to Safety (Personal Accountability, Questioning Attitude, Safety Communication), Management Commitment to Safety (Leadership Accountability, Decision-Making, Respectful Work Environment), and Management Systems (Continuous Learning, Problem Identification and Resolution, Environment for Raising Concerns, Work Processes). INPO's framework predates and directly informed the NRC's own statement, which converged its language with INPO's through NUREG-2165's Safety Culture Common Language effort. When your regulator and your industry's own operating experience organization independently land on the same trait, using the same name, that is not a coincidence to treat lightly.

This is the same dynamic 10 CFR 50.7's employee protection provisions exist to guard against in a different context: a workforce that has learned silence is safer than honesty is a workforce whose safety program is failing quietly, in a way that does not show up until something worse forces it into view.

A surveillance program that treats workers as potential threats is not a safety program. It is a liability management program wearing a safety program's name, and the NRC's own stated traits for a positive safety culture describe exactly why that substitution doesn't hold up.

What Advanced Reactor Developers Get Wrong at Smaller Scale

A ten- or twelve-person team feels this dynamic faster and more sharply than a large utility does. There is no anonymity in a small organization. If behavioral observation reporting is punitive, everyone knows who reported whom within a day, and the chilling effect sets in immediately rather than eroding gradually over years. Founders building their first FFD program often import language and procedures from a large-utility template without adjusting for the fact that a small team cannot absorb the same level of formal, surveillance-styled process without it becoming personal.

The same underlying discipline problem shows up here as it does everywhere else in a young QA program: a program that reads well on paper but was authored without thinking through how it actually gets followed by twelve specific people who all know each other creates real exposure. It is the audit trap wearing a human-factors costume instead of a documentation one.

What Small Teams Should Do Now

Build behavioral observation training around peer support framing from the start, not as a retrofit. Make clear, explicitly and in writing, that the purpose of an observation report is to get a colleague support, not to trigger discipline as a first response. Separate the FFD recordkeeping function required under Subpart N from the day-to-day culture of the team, so that compliance documentation exists without the workforce experiencing it as constant monitoring. Train supervisors specifically in non-punitive observation conversations, since supervisors are usually the ones deciding, in the moment, whether a concern gets escalated in a way that builds trust or destroys it. If you are licensing under Part 53, treat the Subpart M election as a deliberate decision, not a default: weigh whether continuous video and audio observation and hair testing genuinely fit your organization's culture and threat model, rather than adopting them because they are available. And revisit the program at least annually against the Safety Culture Policy Statement's traits, not just against Part 26's checklist, since compliance and culture are measured differently and a program can pass one while failing the other.

Frequently Asked Questions

Q: Does 10 CFR Part 26 require every reactor licensee to run drug testing and behavioral observation?

A: Yes, for individuals granted unescorted access to a facility's protected area or who perform safety-related functions, 10 CFR Part 26 requires a Fitness-for-Duty program including drug and alcohol testing (26.31) and behavioral observation (26.33). The specific scope and implementation can be tailored to the facility, but the core program elements are not optional for covered personnel.

Q: What counts as behavioral observation under the regulation?

A: Trained observation by coworkers and supervisors for behaviors that may indicate impairment or unfitness for duty, whether from substance use, fatigue, or a medical or mental condition. It is meant to function as ongoing peer awareness, not a formal surveillance system, though the regulation itself does not prescribe exactly how observation is culturally implemented.

Q: How does fatigue management under Part 26 work?

A: Subpart I sets work-hour limitations (26.205) and requires provisions for self-declarations of fatigue (26.209), meaning personnel must be able to report their own fatigue without those reports becoming a disciplinary event on their own.

Q: Why would a compliant FFD program still create a safety culture problem?

A: Because compliance measures whether the required elements exist. Safety culture measures whether people trust the organization enough to use those elements honestly. A program can satisfy every citation in Part 26 while still being implemented in a way that discourages the honest reporting the regulation depends on to function.

Q: Is this a bigger risk for small advanced reactor teams than for large utilities?

A: In practice, yes. Anonymity is limited in a ten- or twelve-person organization, so a punitive implementation of behavioral observation is felt immediately and personally, rather than diffusing across a large workforce over time.

Q: What should a developer building its first FFD program prioritize?

A: Get the peer-support framing right before the program launches, not after a chilling effect is already visible. Train supervisors on non-punitive observation conversations, and keep FFD recordkeeping requirements separate from how the day-to-day culture of the team actually operates.

Q: Does this connect to the NRC's Safety Culture Policy Statement?

A: Yes. The Statement (76 FR 34773) names "environment for raising concerns" as one of the traits of a positive safety culture. A surveillance-heavy FFD implementation works directly against that trait, even when it is technically compliant with Part 26.

Q: Is the FFD program the same for every NRC licensee, including Part 53 licensees?

A: No. Part 53 licensees have the option to use an alternative FFD framework under 10 CFR 26 Subpart M, built for Part 53's risk-informed, performance-based structure. Subpart M permits testing methods the standard program doesn't allow at all, like hair specimen testing (26.607), and requires behavioral observation methods that can include mandatory live video and audio surveillance under specified conditions (26.609). Electing into Subpart M is a choice, not a default, and it's worth weighing the cost and cultural impact of that surveillance infrastructure before making it.

Q: What is a Safety Conscious Work Environment (SCWE)?

A: SCWE is a specific NRC term defined in a 1996 policy statement (61 Fed. Reg. 24336): a work environment where employees are encouraged to raise safety concerns and those concerns are promptly reviewed, prioritized by safety significance, and resolved with timely feedback to the person who raised them. It's an outcome the organization has to demonstrate, not an aspiration it can simply claim.

Q: What does it mean for a workplace to be "chilled"?

A: A chilled work environment, or chilling effect, occurs when employees become hesitant to raise safety concerns because they fear retaliation or because concerns raised previously were never addressed. The NRC can issue a chilling effect letter under Allegation Guidance Memorandum 2012-001 requiring a licensee to demonstrate concrete corrective action. It doesn't take an explicit "don't report" policy to cause this; employees only need to reasonably believe that reporting costs more than it's worth.

Sarah Gibboney, P.E., is Founder and Principal Licensing Engineer at Gibboney Nuclear, PLLC, a nuclear licensing consultancy supporting advanced reactor developers through NRC licensing strategy, QA program development, and commercialization readiness. She has 17 years of nuclear industry experience, including co-authoring Construction Permit Applications for TerraPower's Natrium and X-energy's Xe-100 reactors.