After further recent amendments, we now have a clear picture of qualifying premises, events, persons responsible, duties and sanctions. The implications of the Bill merit careful consideration by insurers, brokers and insureds across different types of cover, from public liability and D&O policies to terrorism cover.

Purpose

The overarching purpose of the Bill is to achieve improved security and organisational preparedness across public venues in the UK in the event of a terrorist attack. Those responsible for standard duty premises will need to take steps to reduce the risk of physical harm to individuals. Those responsible for enhanced duty premises and events will additionally need to take preventative steps to reduce vulnerability to terrorist attacks.

Requests for concrete proposals about the regulator have been a frequent refrain and it is now confirmed that the regulator will be the Security Industry Authority (SIA). More recent suggestions that were mooted in recent reviews do not appear to have survived the push for proportionality. However, gone is the suggestion in the Home Affairs Select Committee pre legislative scrutiny report of stage by stage implementation.

What now are the key triggers of which risk managers, brokers and insurers need to be aware?

Qualifying premises

There is effectively a four-stage test. Standard duty premises must:

• Consist of a building or a combination of a building and other land;
• Wholly or mainly (more time than not) be used for one or more uses in Schedule 1;
• Reasonably be expected to have 200 or more individuals present at the same time, from time to time; and
• Not be excluded under Schedule 2.

Factsheets accompanying the Bill illustrate that the combination of a building and land could cover a pub with a beer garden, hotel with grounds used for dining or events, racecourse, zoo or theme park.

Categories of use in Schedule 1 include shops; food and drink (principally consumed on the premises); nightclubs; entertainment activities; sports grounds; recreation, exercise or leisure; libraries, museums and galleries; halls; visitor attractions; hotels; places of worship; health care including hospitals; bus and railway stations; aerodromes; childcare; primary and secondary education; further education; higher education; and public authority facilities. 

Where premises have more than one use, it is the principal use that is relevant. Qualifying premises may be contained within other qualifying premises. For example, a shopping centre may be a qualifying premises as well as an individual retail unit within it.

The Bill in its current form is more flexible about the capacity of premises, as this has been a hot topic throughout the Bill's evolution. A range of methods to calculate capacity are discussed, including safe occupancy calculations for the purposes of fire safety, historic data, fixed seating numbers or ticket sales. Explanatory Notes to the Bill also advise by way of example that the capacity requirement would be met by shops that only hit 200 shoppers during a pre-Christmas peak.

Excluded premises include the Houses of Parliament and other devolved government premises; parks and gardens and other open-air premises used for recreation, exercise or leisure provided they can be entered without a ticket or some other form of entry pass; and premises subject to existing relevant transport security regimes.

Enhanced duty premises are those that will from time to time host 800 or more individuals at the same time. Certain qualifying premises will however be treated as standard duty premises even if they exceed this threshold, including places of worship and childcare, primary and secondary education premises.

The July 2024 Home Office Impact Assessment provides a central estimate that the new duties will apply to 154,600 standard duty premises and 24,300 enhanced duty premises.

Qualifying events

A similar test to enhanced tier premises applies here. The event must:

• Consist of a building, other land or a combination of the two;
• Allow members of the public access to all or part of such premises;
• Reasonably expect 800 or more individuals to be present at the same time, from time to time;
• Not be excluded under Schedule 2; and
• Employ or otherwise engage individuals (e.g. volunteers) to control access to the event, by checking tickets, passes or taking payment. This is referred to in the accompanying factsheets as the 'express permission' criterion.

The Explanatory Notes advise that the above could catch an open-air event, but not an unorganised gathering with no check on any condition of entry.

Persons responsible

The touchstone for responsibility for meeting the requirements below is who has control of the premises in connection with the relevant use. Where there is more than one use, it will be the principal use that is considered.

The Explanatory Notes give examples of an organisation operating a theatre or the company that holds the lease for and operates a shopping centre as being the responsible person. However, it is highly unlikely that a party appointed as a contractor to carry out work at the premises, such as a security guarding company providing staff at a nightclub, would be the responsible person.

For events, the circumstances will need to be considered in more detail. Where a concert is held in a park and the company putting on the event takes control of the area, it will be the responsible person. If, however, it is a stately home putting on a concert in its grounds and it maintains control of the site, it will be the responsible person, even if it contracted out specific aspects such as door security or ticketing. The key takeaway seems to be that responsibility cannot be delegated.

Where a responsible person for an enhanced duty premises or qualifying event is not an individual, it must designate a senior individual (referred to as a DSI in the accompanying factsheet) who exercises functions of management or control. In schedule 1, certain categories of use have the person responsible expressly identified.

Requirements

The requirements for standard duty premises are intended to be simple and not onerous. Those responsible will need to:

• Notify the SIA that they are responsible for the premises; and
• Implement reasonably practicable public protection procedures aimed at reducing the risk of physical harm to individuals if an act of terrorism were to occur at the premises or in the immediate vicinity.

These procedures are exhaustively set out in the Bill and relate to:

• Evacuation
• Invacuation
• Lockdown
• Communication

As part of this process, those working at the premises must be made aware of such procedures. The related factsheet makes clear, however, that the Bill does not require physical alterations or the purchase of equipment at standard duty premises.

For enhanced duty premises and qualifying events, in addition to the above, those responsible need to:

• Implement 'mitigation' measures to reduce the vulnerability of the premises or event to an act of terrorism occurring at the location; and
• Produce a document setting out and assessing the procedures and measures in place and provide it to the SIA. The report will require sufficient detail to enable the SIA to make an initial evaluation, although reference is made to on-site inspections where appropriate.

These measures are again set out in the Bill and relate to:

• Monitoring the premises or event and the immediate vicinity
• Movement of individuals
• Physical safety and security of the premises
• Security of information in relation to the premises or event.

Monitoring may range from circulating awareness raising material to establishing control rooms; movement may range from observing suspicious bags to setting up barriers and CCTV.

Inspection and enforcement

The Bill confers on the SIA a number of investigative and enforcement powers, including compliance notices, restriction notices to shut down premises or events where there is serious non-compliance (for enhanced duty premises or qualifying events only), civil penalties and criminal offences. The regulator will, however, only use its toolkit of powers and sanctions where there is serious and persistent non-compliance.

For standard premises, the maximum amount of a non-compliance penalty is £10,000. For enhanced premises and events, the maximum is £18 million or 5% of worldwide revenue, whichever is greater. In addition, a daily penalty may be applied, up to £500/day for standard premises and £50,000 for enhanced duty premises and qualifying events.

The SIA is required to issue guidance on how it intends to exercise its function and provide advice about the above requirements. The Secretary of State must also provide statutory guidance about the requirements of the Bill.

Implications for the insurance sector

Insurers, brokers and insureds will need to consider the detail of the Bill and its impact on coverage and exclusions in existing property, terrorism, public liability and D&O policies.

The Impact Assessment notes that there could be a positive or negative effect on premium for premises in scope, depending on how businesses are able to demonstrate compliance with the new requirements. For example, there is likely to be a reduction in the level of non-terrorist crime due to the prevention effect of measures such as the installation of CCTV and use of security guards, if such mitigations are taken forward. Certainly, where available for enhanced duty premises and events, underwriters and brokers should be obtaining the information prepared for the SIA as part of the presentation of the risk.

An immediate impact of the Bill is likely to be an increase in awareness of and demand for terrorism insurance (traditionally a first party cover, either as part of or separate to property insurance), as business owners become more aware of the risks associated with the operation of public premises and events. 

Perhaps the more significant impact relates to liability insurance. While it is clearly stated that nothing in the Bill confers a right of action in any civil proceedings, the standards that persons responsible will be expected to meet may be relevant to determining liability, as part of a broader analysis of the scope of any duty of care. This may result in increased demand for public liability cover. 

There are also likely to be increased claims under D&O policies, with the Bill specifying various obligations on DSIs at enhanced duty premises and events and providing for individual liability for senior individuals where their organisation commits an offence.

Looking ahead

Although a substantial quantity of information has now been published in addition to the Bill and Explanatory Notes, it is interesting that there is repeated reference to yet further detailed guidance with case studies being published ahead of the measures coming into force.

The next hearing in the House of Commons will be on 14 October. It can be anticipated that the Bill will be subject to considerable, detailed scrutiny in both Houses of Parliament.

DAC Beachcroft is uniquely placed to provide both overarching commentary and sector-specific guidance. To continue the conversation, please contact one of our subject matter experts.