We introduce safety in implementation theory as robustness of players' welfare to unexpected deviations by others. Specifically, we define a (fi,!)-safe strategy profile to be one at which a deviation by any fi players can result in at most ! victims, and define a victim to be a player who attains an outcome within his least preferred K outcomes, where K is set by the designer. We discuss three notions of implementation: Nash implementation with all Nash equilibria being safe, implementation in safe equilibria, and double implementation in safe and Nash equilibria. Strong safe implementation is the most desirable notion; we show that it is restrictive when no other assumptions are made, but that mild behavioral assumptions unrelated to safety can achieve strong safe implementation from double implementation. We give conditions that are necessary for implementation in safe equilibria and sufficient under mild preference restrictions. We then address double implementation and, allowing for simple transfers, we give conditions that are both necessary and sufficient for double implementation. We prove a "no guarantees" result showing that absolute safety (fi˘ ni1 and !˘ 0) can lead to non-existence of Nash equilibria in a wide range of environments making safe implementation with guarantees impossible. We show that, in general, safety leads to restrictions in every player's freedom and to a loss in efficiency. We illustrate the design of a safe mechanism in an example of hiring candidates with multidimensional quality.