Preparing for enforcement: the role of the SIA and what inspections may look like

The Home Office has been consistent about the SIA's intended posture: support, advise and guide responsible persons first, with enforcement reserved for cases of serious or persistent non-compliance.^[3] Since summer 2025 the Home Office and SIA have been running sector webinars and publishing guidance to help premises prepare.^[2]

That posture matters for planning. The realistic risk for a venue making a good-faith effort is not an ambush fine; it is being unable to show what it has done. Almost everything the regime asks for is evidenced by ordinary records: a capacity assessment, written procedures, briefing logs and, for the enhanced tier, the compliance document.

Where the SIA does need to act, the Act gives it a graduated set of civil powers:^[3]

• check_circleCompliance notices: a formal requirement to remedy specified failures within a set period.
• check_circleRestriction notices: for enhanced duty premises and qualifying events, a power to restrict how the premises or event operates until failures are addressed.
• check_circleMonetary penalties: up to £10,000 for standard duty premises, and up to £18 million or 5% of worldwide revenue, whichever is greater, for enhanced duty premises and qualifying events.
• check_circleDaily penalties: where non-compliance with a compliance or restriction notice continues after a penalty becomes payable, up to £500 per day at the standard tier and up to £50,000 per day at the enhanced tier.

The regime is primarily civil, and for standard duty premises non-compliance with the core duties is not a criminal matter. The Act does create criminal offences for the most serious cases, including failure to comply with a compliance or restriction notice in relation to enhanced duty premises or qualifying events, and providing false or misleading information to the regulator.^[3]

For organisations, this is the practical reason the designated senior individual duty in the enhanced tier deserves board-level attention rather than delegation to the bottom of a job description.

The SIA has not yet published its detailed inspection methodology, so anything specific about visit formats is provisional.

What can be said with confidence is what the regulator will be assessing, because the duties define it. For a standard tier venue: that the SIA was notified, that the four public protection procedures (evacuation, invacuation, lockdown and communication) are in place so far as reasonably practicable, and that staff with a role in them know what to do.^[2] For an enhanced tier venue: all of that, plus public protection measures across monitoring, movement of individuals, physical security and information security, and a current compliance document that has been provided to the SIA.^[2]

A reasonable working assumption is that conversations with the regulator will run along those lines: who is your responsible person, how did you assess your capacity, show me your procedures, how do staff learn them, and, at the enhanced tier, walk me through your compliance document. Venues that can answer from records rather than memory will have short conversations.

Whichever tier you are in, a small set of documents covers almost every question the regime can ask:

• check_circleYour capacity assessment: the number you reached, the method, and the data behind it.
• check_circleIdentification of the responsible person, and at the enhanced tier the designated senior individual.
• check_circleThe four written procedures, version controlled and dated. See how to write them.
• check_circleStaff briefing and training records with names and dates.
• check_circleReview history: when procedures were last reviewed and what changed.
• check_circleEnhanced tier only: the compliance document and the record of providing it to the SIA.

Commencement is expected from 2027, and no date has been confirmed.^[3] That window is the cheapest compliance resource you will ever get. Establishing the records above now, while there is no deadline pressure, turns the eventual start of enforcement into a non-event.

Vigil keeps all of this evidence in one place: procedures, briefing logs, review reminders and an audit trail designed around what the SIA will ask for. See pricing, or start with our guide to whether the law applies to you.