There is a sentence that gets said on job sites and in homeowner forums with complete confidence and it is wrong in a way that occasionally kills people: "it's on a breaker, so it's protected." The breaker is protecting something. It is not protecting the person holding the tool.
This is the most useful distinction in the entire code and it is also the one most consistently blurred, including by people who have been licensed for twenty years. Overcurrent protection and ground-fault protection for personnel are two different systems, aimed at two different failures, operating at current levels three orders of magnitude apart.
What a breaker is actually watching
A 20-amp breaker is a device that opens when the current through it exceeds a threshold for long enough. Its job, defined across Article 240, is to keep the conductor from carrying more current than the conductor can dissipate as heat. The protected asset is the wire, the insulation and the building around them. That is the whole design intent.
The number that hurts a person is nowhere near 20 amperes. Current through the chest in the low tens of milliamperes is enough to cause loss of muscular control, and not much more than that is enough to stop a heart. A person can be receiving a lethal shock while the branch circuit sits at a fraction of its rating and the breaker, functioning perfectly, does absolutely nothing. It has no way to know the difference between current going through a load and current going through a body, because from the breaker's point of view there is no difference.
The breaker asks how much current is flowing. The GFCI asks where it is going. Only the second question has anything to do with you.
What the GFCI does instead
A ground-fault circuit interrupter measures the current going out on the ungrounded conductor and the current coming back on the grounded conductor and compares them. In a healthy circuit they match. If they do not match, the missing current has found another path back to the source — through a grounded surface, through wet concrete, through a person — and the device opens. A Class A GFCI is built to trip on a difference in the range of a few milliamperes, which is below the level at which a person loses the ability to let go.
That is a fundamentally different measurement, and it explains every behavior people find confusing about GFCIs. It explains why one will trip with nothing plugged in, if there is enough leakage on a long damp run. It explains why the breaker upstream stays closed while the GFCI downstream trips. And it explains why "I bonded it, so it's safe" is only half an argument: bonding and grounding, covered in Article 250, give fault current a low-impedance path back so the overcurrent device can clear a hard fault quickly. They are what makes the breaker work. They are not a substitute for the device that watches for current leaving the circuit.
The locations where GFCI protection is required in dwellings and elsewhere are listed in 210.8, and that list has expanded in nearly every code cycle. The current article text is reachable through NFPA free access, which needs a free account. Arc-fault protection under 210.12 is a third device answering a third question — it looks for the current signature of an arcing fault, which is a fire problem, not a shock problem. Three devices, three jobs, no overlap.
There is a corollary that matters on service calls. A circuit that has never tripped a breaker tells you nothing about whether it is safe to touch. An open equipment grounding conductor, a bootleg ground, a neutral-to-ground connection made downstream of the service — none of those will operate an overcurrent device on their own, and all of them can put voltage on a metal surface that a person will eventually contact. The breaker has no opinion about any of it.
The same logic explains why energized work is treated the way it is. The device protecting the conductor you are working on is not protecting you from the conductor. That is what the de-energizing and verification steps exist for, and it is why "it's only a twenty-amp circuit" is not a risk assessment.
The numbers behind the distinction
This is not a theoretical hierarchy. The Electrical Safety Foundation International puts the fatality rate for electricians at 2.89 per 100,000 full-time workers, against 0.11 across all occupations — more than twenty-five times the baseline. Their 2011–2024 dataset records 2,070 electrical fatalities out of 70,276 workplace deaths overall, with contact with overhead power lines accounting for 49 percent and unexpected contact with energized equipment another 20 percent.
The Bureau of Labor Statistics counted 142 fatal injuries from exposure to electricity in 2024, up from 130 in 2023. NIOSH's monograph on worker deaths by electrocution analyzed 224 individual fatality investigations, and the case files behind it are open reading for anyone who wants the specifics. The circuits in those narratives were, overwhelmingly, functioning exactly as designed at the moment somebody died on them.
Why the confusion persists
Partly it is language. "Protection" is used for both functions and nobody specifies which. Partly it is the panel, where a GFCI breaker and a standard breaker sit in the same slot, look nearly identical and get installed by the same hand. And partly it is that the failure mode is invisible: a house with no GFCI protection anywhere works fine for decades, right up until someone stands in the wrong puddle.
The version worth teaching an apprentice is short. Overcurrent devices protect conductors. Bonding and grounding make overcurrent devices work. GFCIs protect people. AFCIs protect against a specific kind of fire. When you catch yourself saying a circuit is safe, say which of those four you actually mean.
The grounding and bonding half of that sentence is the part most people learn last and least well; NEC Bonding and Grounding Requirements works through the fault-current path in detail if that is the piece that has never fully clicked.