Preparing Your Organisation for the Terrorism Protection of Premises Act 2025
With secondary legislation and implementation guidance for the Terrorism Protection of Premises Act 2025 expected throughout 2026, responsible persons for qualifying premises and events need to start preparing now. This article outlines the practical steps organisations should be taking.
The Terrorism Protection of Premises Act 2025 received Royal Assent last year, marking the culmination of a long campaign for stronger protective security requirements at public venues and events. While the primary legislation is now on the statute book, the practical implementation phase is just beginning. Secondary legislation, detailed guidance, and the establishment of enforcement mechanisms are all expected to progress throughout 2026. For organisations responsible for qualifying premises and events, the window to prepare is now.
Understanding Your Obligations
The Act establishes a tiered framework based on premises capacity. The standard tier applies to premises with a capacity of 200 or more, while the enhanced tier applies to those with a capacity of 800 or more. Each tier carries different obligations, though both require responsible persons to take meaningful steps to reduce vulnerability to terrorist attacks and improve preparedness.
For standard tier premises, the requirements focus on reasonably practicable procedures to reduce vulnerability and ensure preparedness. This includes measures such as staff awareness training, lockdown procedures, and basic protective security assessments. Enhanced tier premises face additional requirements, including the development of a formal security plan and more structured protective security arrangements.
Why You Should Not Wait for Final Guidance
It is tempting to wait until all the secondary legislation and detailed guidance has been published before taking action. This would be a mistake for several reasons.
First, the core principles of good protective security are well established and do not depend on the specific details of implementing regulations. Understanding threats, assessing vulnerabilities, implementing proportionate measures, and training staff are fundamental practices that every responsible organisation should already be pursuing.
Second, the experience of organisations that waited until the last moment to comply with the FCA and PRA operational resilience deadline in March 2025 provides a cautionary example. Those that delayed found themselves under enormous pressure to implement changes quickly, often resulting in superficial compliance rather than genuine capability. The same pattern is likely to repeat with this legislation.
Third, building a genuine protective security culture takes time. Staff training, procedural development, and the embedding of new ways of working cannot be achieved overnight. Organisations that start now will be in a far stronger position when the compliance requirements are finalised.
Practical Steps to Take Now
Determine whether your premises qualify. Review the capacity of your premises against the thresholds set out in the Act. Remember that capacity refers to the maximum number of people who can be present at any one time, including staff, visitors, and customers.
Identify the responsible person. The Act places obligations on specific individuals and entities. Establish clarity about who within your organisation holds this responsibility and ensure they understand the implications.
Conduct a baseline security assessment. Even without the detailed guidance, you can assess your current protective security arrangements against established good practice. NaCTSO provides freely available guidance that remains relevant and useful.
Review your staff training. Consider how many of your staff have received any form of protective security awareness training. ACT (Action Counters Terrorism) awareness training is freely available and provides a solid foundation. For those with specific security responsibilities, more structured qualifications in counter terrorism protective security and preparedness provide a comprehensive grounding.
Develop or review lockdown procedures. If your premises do not have lockdown procedures, develop them. If they do, test them. A lockdown procedure that has never been exercised is of limited value when it is needed.
Engage with local counter terrorism security advisors. Counter Terrorism Security Advisors (CTSAs) are available to provide free, confidential advice to organisations about protective security. Building a relationship with your local CTSA now will provide valuable support as you prepare for compliance.
The Broader Security Context
The Terrorism Protection of Premises Act does not exist in isolation. It forms part of a broader shift towards greater accountability for protective security across the UK. Organisations should consider their obligations under this Act alongside other relevant requirements, including health and safety legislation, fire safety regulations, and sector-specific security standards.
The Act also reflects a growing recognition that effective protective security is not solely the responsibility of the police and security services. It requires a partnership approach in which organisations that operate public spaces take proportionate responsibility for the safety of those who use them.
Building Capability, Not Just Compliance
The most effective organisations will approach the Terrorism Protection of Premises Act not as a compliance burden but as an opportunity to build genuine protective security capability. This means going beyond the minimum requirements to create an organisational culture in which security awareness is embedded in everyday operations.
Oakwood delivers specialist training and consultancy in counter terrorism protective security and preparedness. To discuss how we can help your organisation prepare for the new legislative requirements, please visit our contact page or explore our full range of courses at Oakwood Risk Training.
Related services
More insights
Keep reading.
Related thinking from the Oakwood team.
Managing Insider Risk in the Modern Organisation: A Strategic Perspective
Insider risk has overtaken external attack as the dominant security concern for many UK organisations in 2026. This article examines why insider threats have grown, what an effective insider risk programme looks like and how security leaders can build a programme that is both ethically defensible and operationally effective.
Crowded Places Security: Building a Strategy That Goes Beyond Compliance
With the Terrorism Protection of Premises Act 2025 reshaping responsibilities for crowded places across the UK, organisations are being forced to re-examine how they protect public-facing sites. This article sets out how to move beyond minimum compliance and build a crowded places security strategy that is operationally credible and proportionate to the threat.
Converged Security: Why an Integrated Approach to Physical, Cyber and Personnel Risk Is Now Essential
The traditional separation between physical security, cyber security, and personnel security has become a strategic liability. This article examines why converged security operating models are now essential for organisations facing hybrid threats and how UK security leaders are restructuring their functions in 2026.