The Enhanced tier: requirements for venues of 800+ capacity

Enhanced duty premises carry all the standard tier obligations: notifying the Security Industry Authority (SIA), and having public protection procedures in place, so far as reasonably practicable, for evacuation, invacuation, lockdown and communication.^[1] Our guide to the standard tier covers these in detail; everything below is additional.

The defining enhanced tier duty is to have public protection measures in place, so far as reasonably practicable, that could reduce the premises' vulnerability to an act of terrorism and the risk of physical harm if one occurred. The Act groups these measures into four categories:^[1]

• check_circleMonitoring: measures relating to monitoring the premises and the area around them, for example CCTV coverage, staff vigilance routines or search and screening arrangements appropriate to the venue.
• check_circleMovement of individuals: measures controlling how people enter, leave and move around the premises, such as queue management, entry checks or controlled exit routes.
• check_circlePhysical safety and security: measures relating to the physical safety and security of the premises, for example safety glass, locks, barriers or hostile vehicle mitigation where proportionate.
• check_circleSecurity of information: measures to manage information about the premises that could assist an attacker in planning, such as floor plans, security rosters or CCTV layouts.

The enhanced tier does not impose a fixed checklist of equipment. Each measure is judged against what is reasonably practicable for the particular premises, weighing the reduction in vulnerability against cost, time and effort.^[2] A 900-capacity conference venue and a 60,000-seat stadium will both be enhanced tier, but what is proportionate for each looks very different. The discipline the Act asks for is an honest assessment of your vulnerabilities and a considered decision, recorded in writing, about which measures you take and why.

Enhanced duty premises must prepare a document recording their public protection procedures and measures, including how they reduce vulnerability and risk of harm, and provide it to the SIA.^[2] This is the central piece of enhanced tier evidence: it is how the regulator assesses whether your judgements are reasonable, and it needs to be kept current as the premises, its use and its risks change.

In practice the document should record your capacity assessment, your four procedures, the measures you have adopted in each of the four categories, the reasoning behind what you decided was reasonably practicable, and who is responsible for keeping it all up to date.

Where the responsible person for enhanced duty premises is not an individual, for example a company or a trust, it must designate a senior individual to be responsible for ensuring compliance.^[2] The guidance expects this to be someone genuinely involved in the management or control of the premises, not a nominal appointment. For most operators this will be a director, general manager or head of operations, and the appointment should be recorded in the compliance document.

Enforcement at the enhanced tier carries substantially more weight than at the standard tier. The SIA will be able to issue non-compliance penalties of up to £18 million or 5% of worldwide revenue, whichever is greater, for enhanced duty premises and qualifying events, with daily penalties of up to £50,000 where non-compliance continues.^[3] Certain serious failures relating to enhanced duty premises, such as failing to comply with a compliance or restriction notice, can also amount to criminal offences.^[3]

The SIA's stated posture remains support first, with enforcement reserved for serious or persistent non-compliance.^[3] Our article on preparing for SIA enforcement covers the regulator's toolkit in detail.

The duties are not yet in force and commencement is expected from 2027, but the enhanced tier has the most work to do during the implementation period.^[3] A sensible programme:

• check_circleConfirm the tier with a documented capacity assessment, and identify the responsible person and the designated senior individual.
• check_circleDraft and test the four public protection procedures. See how to write your procedures.
• check_circleAssess vulnerability across the four measure categories and decide what is reasonably practicable for your site.
• check_circleBuild the compliance document as you go rather than retrofitting it at the end.
• check_circleTrain staff against the procedures and keep records of completion.

Vigil's Enhanced plan generates multi-role procedure sets, runs staff drills and maintains the documentation the SIA will expect. See pricing for details.