The Terrorism (Protection of Premises) Act 2025 marks a significant shift in how the UK manages the threat of terrorism in publicly accessible spaces.
The Act guarantees a more consistent, proactive approach to public protection and organisational preparedness by introducing new legal duties for those responsible for certain premises and events.
The Act draws on principles similar to existing health and safety legislation, providing a framework that businesses and event organisers are already familiar with. This article outlines the key requirements of the Act, who it applies to, and what actions must be taken to comply, providing a smooth transition and understanding of the Act's principles.
Who does this apply to?
This Act applies to those responsible for premises and public events, as defined in the legislation (see below). Those responsible for certain premises and events must take appropriate action to reduce the risk of harm to their workers and the public.
When did it change?
The Act received Royal Assent on 3 April 2025. It is expected that the implementation period will be at least 24 months, when the requirements will be commenced by regulations.
What does it mean?
This Act introduces a new duty requiring appropriate action to be taken to strengthen public safety, with requirements reflecting the size of the venue and the activity taking place. It is intended to improve protective security and organisational preparedness across the UK. The Act mandates that those responsible for certain premises and events take steps to prepare for potential terrorist attacks and reduce the risk of physical harm to individuals if an act of terrorism occurred at the premises or in the immediate vicinity. In addition to this, certain larger premises and events must also take steps to reduce the vulnerability of the premises to terrorist attacks.
Whilst some premises and events proactively consider the risk posed by acts of terrorism, there is no consistency across the UK. Historically counter-terrorism protective security and preparedness have often fallen behind other legally required activities, such as health and safety. To address this inconsistency, the Act places public protection on a legal footing like other regimes, whilst making it clear who is responsible at qualifying premises and events, and what they are required to do.
Overview
The Act establishes a tiered approach linked to the activity that takes place at premises or an event and the number of individuals it is reasonable to expect may be present on the premises at the same time. The requirements vary accordingly, acknowledging that larger venues and events may be impacted to a greater extent by an attack and should be expected to do more.
Subject to other conditions, to be qualifying premises, 200 or more individuals (including staff) must, from time to time, be reasonably expected to be present at the same time in connection with one or more uses specified in the Act (Schedule 1).
Where 800 or more individuals (including staff) may be reasonably expected at the premises from time to time, they will be enhanced duty premises unless the Act provides otherwise. Qualifying premises that do not meet this threshold will be standard duty premises.
One of the conditions to be a qualifying event is that 800 or more individuals (including staff) may reasonably be expected to present at the same time at some point during the event. Events beneath this threshold are not in scope.
Qualifying premises
Premises will be in scope – that is, premises at which the requirements must be fulfilled – if they are “qualifying premises”.
Premises are qualifying premises if:
- The premises consist of at least one building or of a combination of a building and other land (“building” includes part of a building or a group of buildings).
- They are wholly or mainly used for one or more uses set out in Schedule 1 to the Act (e.g. for the sale of food and drink for consumption on the premises).
‘Wholly or mainly used’ means the premises are either:
- only used for an activity in Schedule 1 or where the premises has multiple uses, it is mainly used for the purposes listed in Schedule 1.
- The premises meet the thresholds for individuals present at the premises. The Act requires an assessment of the number of individuals who can be reasonably expected to be in attendance at premises and events. This assessment (alongside the other qualifying factors) will determine whether premises or events are qualifying premises and whether they are standard duty premises or enhanced duty premises (see below).
- The premises are not excluded by virtue of Part 1 of Schedule 2 to the Act (excluded premises). These include, but are not limited to, parliaments and devolved administrations and transport premises that are already subject to relevant existing legislative requirements to consider and mitigate threats.
There are two categories of qualifying premises, each with their own requirements:
- “enhanced duty premises” are qualifying premises if it is reasonable to expect that from time to time 800 or more individuals may be present on the premises at the same time in connection with one or more uses specified in Schedule 1
- “standard duty premises” are all other types of qualifying premises (that is, those that can be reasonably expected to host between 200 and 799 individuals from time to time).
Enhanced duty premises and qualifying events
Those responsible for enhanced duty premises and qualifying events are required to have in place public protection procedures. These are procedures to be followed by individuals working on the premises or at the event if there is reason to suspect that an act of terrorism is occurring, or is about to occur on the premises, at the event or in the immediate vicinity. Procedures include:
- Evacuating individuals.
- Moving individuals to a place where there is less risk of physical harm.
- Preventing individuals entering or leaving the premises or event.
- Providing information to individuals on the premises or at the event.
They are also required to have in place, so far as is reasonably practicable, appropriate public protection measures. These are measures that further the objectives of reducing the vulnerability of the premises or event to acts of terrorism or reducing the risk of physical harm to individuals, thereby providing better protection from acts of terrorism.
The types of measures are listed in the Act and include for example monitoring the premises or event and the immediate vicinity.
Standard duty premises
Those responsible for standard duty premises are required to have in place, so far as is reasonably practicable, appropriate public protection procedures.
These are procedures that may be expected to reduce the risk of physical harm to individuals if an act of terrorism occurred at the premises or in the immediate vicinity.
They are procedures to be followed by people working at the premises where they suspect an act of terrorism is occurring, or is about to occur, at the premises or in the immediate vicinity.
The types of procedure are listed in the Act. The requirements for these smaller premises are focused on activities to enact policies and procedures that are expected to be simple and low cost. The aim of these requirements is to improve staff preparedness and responses. The Act does not require physical alterations to premises or the purchase of equipment for the purpose of having these procedures in place.
A group of buildings
There are many premises which consist of “a group of buildings” used for Schedule 1 use/uses. Common examples include buildings (and associated land) at a university campus or a hospital complex. Factors which define a group of buildings are likely to include if they are in close geographical proximity, and the responsible person is the same for the buildings in the group (or the majority of those buildings).
Premises within premises
There are examples of premises that are in scope of the Act which have multiple units within them, which may be qualifying premises in their own right. For example, a shopping centre or an entertainment complex.
If shops within shopping centres (and similar examples of smaller units within buildings) meet the scope criteria of the Act, they themselves are qualifying premises in addition to the shopping centre (or other larger building). Those responsible for such connected qualifying premises may be required to co-ordinate their activities, where necessary to ensure that the procedures/measures they have in place meet the requirements.
Qualifying events
Events that satisfy the following four criteria fall within scope of the Act:
- The event must take place at premises caught within section 3(1)(a) of the Act. For example, it must take place in a building (which includes part of a building or group of buildings), on land (such as a field, park, or farmland), or at premises that consist of a combination of the two (such as a sportsground with a clubhouse).
- Host at least 800 attendees at the same time (including staff). This threshold does not need to be met throughout the duration of the event. For example, a day festival with 500 people reasonably expected on site until 6pm, followed by 1,000 or more expected later, would meet this requirement.
- Have specific entry conditions. The event must have measures in place to check that attendees satisfy a condition of entry. This is the requirement that, to enter the event, members of the public have paid, have a ticket or pass, or are members or guests of a club, association or similar body. Whilst this provision applies to paid-for events, it also encompasses free events where there is a specific check on entry. Events arranged by other types of body, for example corporate events arranged by a company for their employees, do not satisfy the last condition to check members of the public are members or guests. Weddings or other private events with invitations also do not meet this requirement.
- Be accessible to members of the public. An event will only fall within scope of the Act if members of the public have access to all or part of it. Events are not in scope where individuals are attending in a personal or private capacity – for example an office party attended by employees and invited customers. These are not considered publicly accessible for the purposes of the Act and are not in scope.
Exclusions
Excluded premises, as listed in Schedule 2, include:
- Legislatures and devolved administrations (e.g. Parliament, Scottish Parliament, etc.).
- Parks, gardens, etc.
- Transport security.
Excluded events, as listed, include:
- Events to be held on certain excluded premises.
- Events at place of worship, schools, etc.
Responsible person
A person will be subject to the main requirements of the Act if they are responsible for qualifying premises or events. This will be determined on the basis of whether or not the person has control over the premises in connection with an activity that is within the scope of the Act (the “relevant Schedule 1 use” of the premises). Such a person may be an individual but, it is anticipated, will typically be a company or other organisation.
For qualifying premises, the responsible person is the person who has control of the premises in connection with their Schedule 1 use (e.g. the use of a venue as a sports ground or a hotel). The responsible person will usually be the premises operator, e.g. if a person leases a building for retail use as a shop and is in control of the building for that use, they will be the responsible person.
Where there is more than one Schedule 1 use (e.g. a church that also has a creche), the relevant person will be the person in control of the premises in connection with whichever of the Schedule 1 uses is the principal use.
For qualifying events, the responsible person is the person who has control of the premises for the purposes of the event. In this case, the circumstances of the event will need to be considered to determine who the responsible person is. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park and has control of that area for the purposes of that concert, the company putting on the event will be the responsible person. The responsible person must ensure that the requirements of the Act are met.
Co-ordination and co-operation
Section 8 of the Act sets out requirements around co-ordination and co-operation. If more than one person (including more than one company or organisation) is responsible for qualifying premises or a qualifying event, they must, so far as is reasonably practicable, co-ordinate with each other in complying with the Act’s requirements. This applies if qualifying premises form part of other qualifying premises.
The persons responsible for each of those premises must, so far as is reasonably practicable, co-ordinate with each other in complying with any requirement imposed on any of them by or under this Part. In terms of co-operation, this applies if a person is not responsible for enhanced duty premises or a qualifying event but has control to any other extent of the premises or the premises at which the event is to be held.
That person must co-operate with the person responsible for the premises or event.
Assessment of numbers
An assessment of the number of individuals expected to be present is required (this was formerly known as ‘capacity calculations’).
The Act requires an assessment of the number of individuals who can be expected to be in attendance at premises and events. It will be necessary to determine the greatest number of individuals reasonably expected to be present at the same time.
This assessment (alongside the other qualifying factors) will determine whether premises or events are qualifying premises or qualifying events (that is, in scope) and, for qualifying premises, whether they are standard duty premises or enhanced duty premises.
Schedule 1 uses
The categories of use set out in Schedule 1 to the Act are:
- shops etc.
- food and drink
- entertainment and leisure activities
- sports grounds
- libraries, museums and galleries
- halls etc.
- visitor attractions
- hotels etc.
- places of Worship
- health care
- bus stations, railway stations etc.
- aerodromes
- childcare
- primary and secondary education
- further education
- higher education
- public authorities
Whether a premises is mainly used for Schedule 1 purposes is determined by consideration of what the premises are mainly used for. For example, the garden of a stately home may be qualifying premises if it is mainly used as a visitor attraction (rather than as a private garden).
Other provisions
The Act also makes provision for the following areas:
- Investigations and enforcement – the Security Industry Association will be the regulator, with functions relating to inspections and enforcement as well as providing guidance and advice to promote compliance.
- Monetary penalties – for example, the SIA will be able to issue non-compliance penalties up to a maximum of £10,000 for standard duty premises and £18m or 5% of worldwide revenue for enhanced duty premises or qualifying events.
- Offences – it will be a criminal offence to provide false or misleading information to the SIA or intentionally obstruct or impersonate an authorised inspector.
- Failure to comply with a compliance or restriction notice issued in relation to enhanced duty premises or a qualifying event will be an offence.
- General provisions (e.g. guidance, disclosure of information, means of giving notices, etc.).
The Act makes provision for the Secretary of State to provide statutory guidance as to how requirements of the Act may be complied with. This guidance will aim to assist duty-holders in understanding and fulfilling their duties under the Act.
What's changed?
The Act makes amendments to the Licensing Act 2003 and the Licensing (Scotland) Act 2005, mandating that all new licence applicants applying for a premises licence in England, Wales and Scotland will be required to supply two plans to the Local Licensing Authority in support of the application.
The first plan will be a detailed plan for the Local Licensing Authority’s use, whilst the second plan – which is the new component of this provision – will be a less detailed plan that will be made available for public inspection. The aim of this is to prevent sensitive information in premises plans being made available to the public, where this is considered necessary to reduce the risk of this sensitive information potentially being used to assist terrorist activity.
Email healthandsafety@skaltd.co.uk or call 01427 420 402 if you have any questions and #oneoftheteam will be happy to help.
