The Act delivers on the Government’s commitment to strengthen the security of public premises and events, following the tragic events of the Manchester Bombing in May 2017. 

The Act aims to improve security and preparedness by requiring those responsible for certain premises/events to consider how they would respond in the event of a terrorist attack. This includes the introduction of a regulator through a new function of the Security Industry Authority (“SIA”). The regulator’s responsibility will be to support, advise and guide those responsible for premises, and ensure that the responsibilities are met. 

Counter Terrorism Policing notes that there have been 15 domestic terror attacks in the UK since March 2017, with security services having disrupted 43 late-stage plots. It is not possible to predict where an attack may occur in the UK, or the type of premises that may be affected, so it is important that business and premises are prepared in case they are targeted.

The Act introduces a tiered approach, directly linked to the capacity of a premises and the number of people anticipated to be present at the same time. 

There are two categories that could fall within the scope of the Act:  premises and events. 

Qualifying Premises 

There are four criteria that qualify premises to fall within the scope of the Act: 

1. there is at least one building (or the premises are in a building);
2. the premises are wholly or mainly used for one or more of the uses specified at Schedule 1 to the Act (for example, shops, nightclubs, theatres, sports venues, hotels, places of worship etc);
3. it is reasonable to expect that at least 200 individuals may be present at least occasionally; and 
4. the premises are not excluded under Schedule 2 to the Act (for example, certain transport premises and premises occupied by Parliament are excluded).

Qualifying Event

There are five criteria that qualify an event to fall within the scope of the Act: 

1. it will take place at premises within section 3(1)(a) of the Act (including land with no buildings) that are not enhanced duty premises;
2. the relevant premises are accessible to members of the public for the purpose of the event;
3. it is reasonable to expect that there will be at least 800 individuals present for the event at some point during it;
4. there will be measures to check entry (i.e. ticket checks); and
5. the event is not excluded under Schedule 2 to the Act (for example, an event held at an excluded premises, or an event that is to be held at premises wholly used for worship, childcare, primary or secondary education or further education). 

Premises 

For qualifying premises, the responsible person will be whoever has control of the premises in connection with their relevant Schedule 1 use.

Where there is more than one Schedule 1 use, it will be the person in control of the premises in connection with whichever Schedule 1 use is the principal use. 

Events 

For qualifying events, the responsible person is whoever has control of the premises at which the event will be held, for the purpose of the event. 

The specific circumstances of the event will determine who the responsible person is. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park for the purposes of that concert, the company putting on the event will be the responsible person. 

It is important to note that even if an organisation has been contracted to handle parts of an event (for example, door security or ticketing), the responsible person will remain the person responsible for the site. 

Standard duty premises are those where it is reasonable to expect that between 200 and 799 individuals may be present at the same time, at least occasionally (note: this includes staff). 

The responsible person will be required to: 

1. notify the SIA of their premises; and
2. have in place, as far as reasonably practicable, appropriate public protection procedures to be followed by people working at the premises, if an act of terrorism were to occur there or in the immediate vicinity.

Public protection procedures are intended to reduce the physical harm being caused to individuals and could include evacuation, invacuation, locking down, and communicating with individuals on the premises. 

These requirements are centred around low-cost, simple activities. There is no requirement to put in place physical measures. 

Enhanced duty premises and qualifying events are those where it is reasonable to expect that 800 or more individuals may be present on the premises at least occasionally, or attend an event at the same time. 

On top of the requirements for standard duty premises, the person responsible for enhanced duty premises and qualifying events will be required to: 

1. have in place appropriate public protection measures that could be expected to reduce
   1. the vulnerability of the premises or event to an act of terrorism and 
   2. the risk of physical harm being caused to individuals if an attack was to occur there; and
2. document the public protection procedures and measures in place and provide this document to the SIA. This should include an assessment of how the public protection procedures and measures reduce vulnerability and the risk of harm and, where the responsible person is not an individual, the name of a senior individual with the responsibility for ensuring that the responsible person complies with these requirements.

The SIA will seek to support, advise and guide those responsible for premises and events in meeting the requirements of this legislation. 

Where there are instances of serious or persistent non-compliance the SIA will take enforcement action. This includes compliance notices, monetary penalties and restriction notices. There are also criminal offences. The SIA must prepare statutory guidance about how it will discharge its functions under the Act, which must be approved by the Home Secretary before it is published.