For a state-run, local authority maintained school, the responsible person under the Terrorism (Protection of Premises) Act 2025 is generally the board of governors. They will almost certainly delegate the work to the head teacher — but the head teacher is not the legally responsible person.

There is genuine nuance here, and it is worth settling before anyone starts drafting procedures, because it decides who has to be able to answer for them.

The Act works with a defined term: the responsible person. That can be an individual or an entity. It is whoever has control of, or legal responsibility for, the site in the context of its primary use.

Two things follow from that. The answer is not found by looking for the most senior name available, and for a great many organisations it is not a person at all. The general definition is covered in full in who the responsible person is; what follows is how it resolves for schools.

Where a school is state run and maintained by the local authority, legal responsibility for the site in the context of its primary use generally sits with the governing body. So the board of governors is the responsible person.

That is an entity rather than an individual, which is the ordinary answer for an organisation with a governing body rather than an unusual one. It means the duty belongs to the board collectively.

In practice, a governing body will almost certainly delegate this to the head teacher, and that is the sensible arrangement. The head knows the building, the staff, the calendar and where the pinch points are. Somebody has to walk the site, draft the procedures, run the exercises and brief the team.

Delegation moves tasks. It does not move responsibility. If a delegated task quietly does not happen, the position of the board is exactly what it was before. The duty never transfers to the person who was asked to help.

That reframes what a governing body needs from this. The useful question is not whether the head has it in hand. It is whether the board can see what is in place and would be able to evidence it.

Pupil referral units sit differently again. For a PRU, it is the local authority that is responsible for ensuring all the public protection procedures are in place.

Worth checking explicitly rather than assuming the pattern from the maintained school above, because the practical consequence is different: the people running the unit day to day are working to a duty held elsewhere in the authority.

If the school is part of a multi-academy trust, the responsible person is the trust itself rather than the individual school or its local governing body. That case has its own consequences across a group of schools and is worked through in who is responsible in a multi-academy trust.

Whoever holds the duty has to ensure that the public protection procedures required of the premises are in place so far as is reasonably practicable: evacuation, invacuation, lockdown and communication, as four distinct items. That standard is not a size test — it weighs likely effectiveness against burden across the nature and use of the premises, its location, its visitor profile, the resources available and the mitigation already there.

Nothing is submitted to the regulator for approval at standard tier. The school does, however, have to be able to evidence the procedures if it is inspected, which is precisely the visibility problem a delegated arrangement creates.

Prova Risk lets the head teacher and the site team do the work while the governing body keeps sight of all of it, and produces a single compliance document showing what is in place. £399 per year per site.

The school question splits by how the school is governed. The clip below covers the other case.

• Who is responsible in a multi-academy trust
• Who the responsible person is under Martyn’s Law
• Does Martyn’s Law apply to schools?
• What you actually tell the SIA
• What “so far as is reasonably practicable” actually means
• The Martyn’s Law timeline for schools
• Martyn’s Law hub