Before you spend a single hour on procedures, answer the first question: does the Act apply to you at all? Plenty of organisations are preparing for duties they do not have — and a few assume they are outside scope when they are not.
Two things decide it
For premises: what the building is used for, and how many people can reasonably be expected to be there at the same time. For events: whether there is an entry check, and how many people can reasonably be expected to attend.
The thresholds
- Premises, 200–799 people: standard tier (para. 4.26).
- Premises, 800 or more: enhanced tier (para. 4.26).
- Qualifying events: a single threshold of 800 or more (para. 5.17). There is no standard tier for events.
The numbers include your staff. Not just the public — everyone who could reasonably be expected to be present at the same time (para. 4.23 and 5.17–5.18). This is where most self-assessments go wrong: a venue that counts 780 visitors and forgets 90 crew is an enhanced tier venue.
Events: the perimeter test
An event only qualifies if people are checked on entry — by ticket, invitation, membership or payment — at a site with, in the guidance’s words, “a well-defined and secure perimeter” (para. 5.22).
That has three consequences worth knowing:
- Open streets and pavements are not in scope (para. 5.41). A free city-centre event with no entry check is outside the Act.
- Mixed events are assessed part by part (para. 5.40). The guidance names carnivals specifically: a ticketed arena inside an otherwise open event can qualify while the surrounding streets do not.
- The perimeter has to be real. A line on a site plan is not a secure perimeter.
Transport is more nuanced than most summaries suggest
You will read that transport hubs are simply exempt. That is too blunt. Stations are a Schedule 1 use and are only excluded to the extent that they are already covered by existing transport security legislation (Schedule 2 para. 4; guidance para. 4.35 and 5.27). If part of a station is not covered by that legislation, the exclusion does not automatically follow.
The point most summaries get wrong
Notification to the SIA applies to both tiers (para. 7.64). It is the documentation duty that is enhanced-tier only. If you have read that standard tier venues have nothing to send to the regulator, that is incorrect.
What being in scope actually asks of you
Standard tier: the four public protection procedures — evacuation, invacuation, lockdown and communication (section 5(3)). Enhanced tier: those procedures plus public protection measures, a documented assessment submitted to the SIA, and a designated senior individual (para. 8.1, 8.57).
Communication is the procedure that runs through all of the others. Our page on the communication procedure sets out what the guidance actually asks.
Frequently asked questions
Do I count capacity or expected attendance?
The test is how many people it is reasonable to expect to be present at the same time — not the theoretical maximum on a fire certificate, and not your average day.
Does a free festival with wristband entry count?
Payment is not the test. An entry check at a defined and secure perimeter is (para. 5.22). A free event with wristband control at a fenced site can qualify; the same event with open access does not.
We run several events a year at different sizes. Do we assess each one?
Yes. Qualification is assessed per event against the 800 threshold (para. 5.17).
Do we have to buy anything to meet the requirements?
No. The guidance is explicit: “It is not mandatory to use third-party products or services to comply with the Act’s requirements” (para. 6.7).
Where responsibility sits
Legal responsibility rests with the responsible person and cannot be handed over. The guidance is direct about it: the responsible person cannot delegate their legal responsibility to a contracted service provider, although they may delegate tasks (para. 6.1). CrowdCows supports that work. We do not take it over, and nothing we supply is required, approved or endorsed by the Home Office, the SIA or NaCTSO.
All paragraph references are to the Terrorism (Protection of Premises) Act 2025 statutory guidance (Home Office, published 15 April 2026, updated 18 May 2026).
Next: does Martyn’s Law require you to buy equipment? · the timeline and what to do when
