Those responsible for an enhanced duty premises or qualifying public events must:
notify the regulator of their premise or event;
take ‘reasonably practicable’ measures that will reduce the risk of a terrorist attack occurring or physical harm being caused. The reasonably practicable test is utilised in other regulatory regimes e.g. Health and Safety, and will enable organisations to tailor their approach to the nature of the premises, and their activities and resources;
keep and maintain a security document, aided by an assessment of the terrorism risk, which must also be provided to the regulator; and
if the responsible person is a body corporate, they must appoint an individual as the designated senior individual for the premise or event.
If enhanced duty premises and qualifying public events do not comply with these requirements, the regulator will be able to issue a maximum fixed penalty of the higher of £18 million or 5 per cent of worldwide revenue.