°Ç¸ç³Ô¹Ï

This factsheet explains the requirements that apply to enhanced duty premises (more commonly known as enhanced tier premises) and qualifying events under the Terrorism (Protection of Premises) Act 2025 ^{[footnote 1]}

Further information on the premises or events that may be in the enhanced tier can be found in the scope (premises) factsheet, the scope (events) factsheet and chapters 4 and 5 of the statutory guidance.

As explained in the standard duty requirements factsheet, the requirement for the responsible person to ensure appropriate public protection procedures are in place, so far as is reasonably practicable, applies to all qualifying premises and qualifying events. These procedures will help those in scope to prepare for action to be taken in the event of an attack or a suspected attack.

Due to the greater number of people present at premises and events in the enhanced tier, responsible persons must also ensure that appropriate public protection measures are in place, so far as is reasonably practicable. The objectives of the public protection measures are to reduce the premises or events’ vulnerability to a terrorist attack and to reduce the risk of physical harm, if a terrorist attack were to take place.

The requirements for enhanced tier premises and qualifying events are:

1. Notification

The responsible person must notify the Security Industry Authority (SIA) when they become responsible for the premises or event, when they cease to be responsible, and when information previously notified becomes inaccurate.

Regulations and associated guidance will set out the required time and format for notifying the SIA, and what information must be provided in that notification.

2. Designate a senior individual

Where the responsible person for enhanced tier premises or a qualifying event is an organisation rather than an individual, the responsible person must designate a senior individual.

The senior individual is someone who has responsibility for managing the affairs of the responsible person or relevant body, or has control of the responsible person or relevant body. A lower-level employee who has limited responsibilities and influence is unlikely to be a senior individual in the sense required by section 10 of the Act. It will be for each individual company or organisation to decide which member of staff is appropriate to be the senior individual and that they are of sufficient seniority and have appropriate influence to ensure compliance with the Act.

The main function of the senior individual is to ensure that, so far as it is in their power, the responsible person complies with the Act’s requirements. The senior individual can delegate actions to others, such as a security manager. However, they cannot delegate their overall responsibility for ensuring compliance and should have overall responsibility on behalf of the responsible person.

The senior individual is not personally liable for a responsible person’s failure to meet the requirements for the purposes of receiving a penalty notice. However, if a company or other organisation has committed a criminal offence under the Act, senior personnel (such as people in senior management positions, including the senior individual) may also be prosecuted for the offence if it can be proved that the offence was committed with their consent or connivance, or occurred because of their neglect.

Public protection procedures and measures

Public protection procedures

The responsible person for enhanced tier premises and events must ensure that appropriate public protection procedures are in place at the premises or event, so far as is reasonably practicable.

Public protection procedures are actions, planned in advance, that can be implemented by relevant individuals to keep people safe in the event of a suspected or actual terrorist attack.

They are procedures to be followed by people working at the premises or event where they suspect an act of terrorism is occurring, or is about to occur, at the premises, the event, or in the immediate vicinity.

The four types of procedures that must be in place, as appropriate and so far, as is reasonably practicable, are: 

When considering the public protection procedures in place, the responsible person must consider what is appropriate and reasonably practicable for their premises in relation to each public protection procedure. This will involve consideration of the nature of the premises and resources available. The Act does not require physical alterations or to purchase of specific equipment relating to putting public protection procedures in place. However, it may be that in certain circumstances it is reasonably practicable to do so, and this will depend on the context of the qualifying premises or event.

As part of ensuring that appropriate public protection procedures are in place, people working at the premises or event must be made aware of the procedures so that they can be ready to put them into practice. For example, it would not be sufficient to have an evacuation procedure in place if no one working at the premises or event understood how to follow it.

Public protection measures

Public protection measures are different to public protection procedures in that they seek to reduce the vulnerability of premises or events to a terrorist attack as an additional way of reducing the risk of physical harm caused by an attack. They may take the form of processes, actions carried out by people, or physical mitigations.

For enhanced tier premises and qualifying events, the responsible person must ensure that appropriate public protection measures are in place, so far as is reasonably practicable.

‘Appropriate’ means ensuring procedures are suitable, taking account of the context of the premises or event and avoiding a one-size-fits-all approach. To then establish what is reasonably practicable and therefore proportionate, it is necessary to consider the objectives of the public protection procedures balanced against the cost, time and difficulty involved in implementing them. The effect of all measures together should be considered to form an accurate understanding of how vulnerabilities will be reduced and the impact of a terrorist attack potentially mitigated.    

The measures in place will vary between different types of qualifying premises and events and may be implemented through people (e.g. training), processes (e.g. a bag search policy) or physical measures (e.g. CCTV).

The four types of measures are: 

Measures may be implemented through:

• People: for example, members of staff who are briefed, instructed or trained to implement the measures;
• Policies or processes: these are principles setting out the expectation for the measures, (for example, a bag search process is underpinned by policies on the size of bags permitted and prohibited items;); or
• Physical mitigations: these will impact on the infrastructure of the premises or event and reduce their vulnerability to a terrorist attack, (for example, hostile vehicle mitigation measures or CCTV system).

Further information about public protection procedures and measures can be found in chapters 7 and 8 of the statutory guidance.

Appropriate and reasonably practicable

The responsible person must consider what is appropriate and reasonably practicable in relation to each public protection procedure and measure.

‘Appropriate’ means ensuring procedures are suitable, taking account of the context of the premises or event and avoiding a one-size-fits-all approach. To then establish what is reasonably practicable and therefore proportionate, it is necessary to consider the objectives of the public protection procedures and measures balanced against the cost, time and difficulty involved in implementing them.

Ultimately, what is appropriate and reasonably practicable will be a consideration at each of the individual premises and qualifying events in scope. The particular procedures and measures in place at one location may not be appropriate and reasonably practicable at another.

For example, procedures and measures will differ at a cinema where it can be reasonably expected that there will be no more than 1,000 individuals (including staff) present at any one time from those at a stadium seating 20,000 individuals. Procedures and measures should be tailored to the specific circumstances of the premises or event. For example:

A 1,200-capacity theatre may take forward the following activities in relation to implementing their public protection procedures and measures:

• developing and implementing plans for public protection procedures and ensuring that they are routinely rehearsed
• ensuring that inductions and probation periods for new staff include awareness training packages for all those working at the theatre in roles relating to safety, security and counter-terrorism
• developing policies for perimeter and entry checks as well as queue management and ticket checks
• using internal radio systems and mobiles for communication between relevant individuals working at the theatre
• introducing interim tabletop activities and walk-through scenarios that are designed and led by designated individuals
• employing a mixture of salaried and contracted door staff to sufficiently protect ingress and egress areas
• developing policies for suspicious or restricted items including bag checks and storage
• having effective CCTV with an adequately staffed monitoring and control room

This list is non-exhaustive and subject to change over time.

Effective procedures and measures

Public protection procedures and measures should be communicated to all those who need to be aware of them, i.e. the people who must implement them effectively in response to a suspected incident. This may include employees, volunteers and contractors as well as those hiring premises. 

How these people are made aware of the procedures and measures in place will depend on the particular circumstances of the premises or event (including the nature of use and types of people working there) and available resources. For example, the responsible person may require relevant employees to attend instructional training.

There is no statutory requirement in the Act for the responsible person or staff to carry out specific training. However, as part of ensuring that public protection procedures and measures are in place and can be implemented effectively, those working at the premises with responsibility for carrying them out (as identified by the responsible person) must be made aware of the procedures, measures and their specific role. They also need to be provided with the understanding, experience and tools required to carry them out effectively.

Documenting compliance

The responsible person for enhanced tier premises or a qualifying event must document their compliance with the Act. Further information will be provided by the SIA on how to do so. The information required by the Act is:

• A statement setting out the public protection procedures that are in place;
• A statement setting out the public protection measures that are in place or will be put in place;
• An assessment as to how the public protection procedures and measures are expected to reduce the risk of physical harm, were a terrorist attack to occur, as well as an assessment of how the public protection measures are expected to reduce the vulnerabilities to a terrorist attack.

The document must be kept up to date and must be provided to the SIA as soon as reasonably practicable after it is prepared for the first time and within 30 days of any revision.