Yes. Schools are not exempt from the Terrorism (Protection of Premises) Act 2025, and the vast majority will be in scope. The test is the same one every other premises applies: a use listed in Schedule 1, and 200 or more individuals reasonably expected on site from time to time.

The harder half of the answer is what happens next. A school in scope has to have public protection procedures in place for a terrorist incident specifically, and the policies most schools already hold were written to answer different questions.

Two things have to be true. The premises has to be used for a purpose listed in Schedule 1 of the Act, and 200 or more individuals have to be reasonably expected on site from time to time.

That second number is where schools most often misread their position, because the count is everyone on site rather than everyone visiting. Pupils, teaching staff, support staff, volunteers and visitors all sit inside the same 200. A school of 100 pupils can pass the threshold on an ordinary day, and will almost certainly pass it on a nativity night or a parents evening.

Schools are among the most heavily proceduralised organisations in the country. There is a fire plan, a safeguarding policy, a critical incident plan, a health and safety policy, and in many cases a lockdown drill that predates this legislation entirely.

So the assumption that the site must already be compliant is a reasonable one to arrive at. It just does not hold. None of those documents was written against the duty the Act creates, and none of them satisfies it by default. They are a sound starting point, and reviewing them against the Act is the sensible first step.

The clearest example is the one school leaders recognise immediately. A fire evacuation plan is designed to get everybody out through every single available exit, as fast as possible.

That is the correct design for a fire. Fire does not follow anybody, so every door leads away from it and opening all of them is the right answer.

In the context of a terrorist incident it can be problematic. Directing people through every exit may push staff and pupils into the pathway of an oncoming attacker. The fire plan is not at fault here — it is answering a question about a threat that stays still. A terrorism evacuation has to be able to move people away from an assailant, which can mean deliberately not using a route.

A premises in scope needs public protection procedures covering four situations, and they remain four distinct items:

• Evacuation — moving people out of the premises, away from danger, which is not necessarily through every exit.
• Invacuation — moving people to a place within the premises where there is less risk of physical harm, used when a threat is close by outside.
• Lockdown — securing the premises so that nobody enters or leaves, used when the threat is already inside or on the threshold.
• Communication — how everyone on site is told which of the other three is running.

The second thing schools find genuinely difficult is demonstrating what is reasonably practicable for their own premises, given the resource available and the number of people on site.

That test is not a size test. It weighs the likely effectiveness of a procedure against the burden of putting it in place, taking account of the nature and use of the premises, its location, its visitor profile, the resources available and the mitigation already there.

In practice a single-building primary and a split-site secondary will produce procedures of very different lengths. Both have to be able to show they asked the same questions. Nothing is submitted to the regulator for approval at standard tier, but a school has to be able to evidence its procedures if it is inspected.

The first task is settling the scope position, then working out which of the existing documents can be built on and which gaps have to be filled from scratch. Doing that this year means the school sets its own pace and can exercise the procedures properly before compliance is expected in April 2027.

Prova Risk works out what is reasonably practicable for your site, builds all four public protection procedures around it, holds the training and exercise records, and produces a single compliance document you can put in front of a regulator. £399 per year per site.

• “Our school never has 200 visitors” — the 200-person threshold for schools
• Who is legally responsible for Martyn’s Law at a school
• 1,500 people on site: are schools in the enhanced tier?
• Martyn’s Law for schools: evacuation and lockdown plans
• Does my existing health and safety policy cover Martyn’s Law?
• The Martyn’s Law timeline for schools
• Martyn’s Law hub