It can be both. Under the Terrorism (Protection of Premises) Act 2025 the shopping centre and the shop inside it are assessed separately, and each can be in scope in its own right.

Most shopping centres will be in scope, because 200 or more individuals can reasonably be expected on site from time to time. If your individual retail unit can also reasonably expect 200 or more people inside it, the unit needs its own public protection procedures, and they have to dovetail with the centre’s.

Retailers inside shopping centres often start from the position that they have no compliance issue at all, because the centre is somebody else’s building. Understandable, and it does not hold.

The scope test is applied to a premises. A centre passes it on its combined footfall. A unit inside that centre is a premises too, and it is assessed on the people reasonably expected inside it — not on the people in the mall outside its shutter.

So the centre may be in scope while your unit is not, or both of you may be. What there is no version of is the centre’s answer deciding yours.

The count is everyone reasonably expected inside your unit from time to time, your own people included: shop floor and stockroom staff, concession staff, contractors in for a refit, anyone working an event.

Larger format stores, anchor units and flagship sites clear 200 on an ordinary Saturday. A smaller unit may only approach it on a launch or sale weekend, and the number to work from is the peak you can reasonably foresee. If you are reaching for a capacity figure to get there, capacity and expected attendance are different numbers.

As a tenant, you cannot adopt the centre’s procedures and treat that as your compliance. The duty for your unit stays with the responsible person for your unit, and if you are inspected it is your procedures that have to be evidenceable.

As a centre, your procedures do not discharge the duty of the businesses trading inside you. No lease clause, licence to occupy or service charge line moves a statutory duty from one responsible person to another. The reassuring half of that is that nobody can be left holding a neighbour’s compliance either.

Your procedures have to work in conjunction with the centre’s rather than separately, so that whichever procedure is enacted can run seamlessly. For most units the customer route out is the mall, which makes this a geography problem before it is a paperwork one:

• What does the mall do while you are deciding what your unit does? If the centre evacuates through the frontage you were about to secure, both decisions were defensible and the combination is not.
• Who makes the call in the mall, and how does it reach your till? Centre control, the public address system and your own team need a path between them that works in the first minute.
• What does the shutter mean in each procedure? Coming down is a lockdown action and a barrier to an evacuation at the same time. The procedure has to say which situation calls for which.

A large centre may fall into the enhanced tier, in which case it will have public protection measures in the conversation as well as procedures. Your unit at 200 to 799 expected attendance is standard tier, and standard tier is procedures.

Co-ordinating with an enhanced tier neighbour does not import enhanced tier obligations onto your unit. Your duty stays the four procedures — evacuation, invacuation, lockdown and communication, as four distinct items. The general version of this requirement is the co-ordination duty.

Procedures have to be in place so far as is reasonably practicable for your premises. That is not a size test. It weighs the likely effectiveness of a procedure against the burden of putting it in place, taking account of the nature and use of the premises, its location, its visitor profile, the resources available and the mitigation already there. Being the smaller tenant does not remove the questions.

Nothing is submitted to the regulator for approval at standard tier, and you have to be able to evidence your procedures if you are inspected.

Our Am I in Scope? tool asks for the attendance you expect and returns your scope position. Settling it in your own time means the conversation with centre management happens before either side is in a hurry.

Prova Risk builds all four procedures around your unit, records the co-ordination points with the centre you trade in, and holds the training and exercise records in a single compliance document you can put in front of a regulator. £399 per year per site. If you hold units across several centres, start with Martyn’s Law for multi-site organisations.

• The co-ordination duty for shared and co-located premises
• Who the responsible person is
• “Our store could hold 950 but never does” — capacity vs expected attendance
• “Retail already runs fire evacuations” — why that is not enough
• Martyn’s Law for multi-site organisations
• The Martyn’s Law timeline for retail
• Martyn’s Law hub