Every retail site has a fire evacuation plan, and it works. Under the Terrorism (Protection of Premises) Act 2025 you also need a public protection procedure that enables evacuation in a terrorism incident, and that is a different document.

The difference is directional. A fire evacuation gets everybody out of every exit as quickly as possible. A terrorism evacuation has to direct people away from the danger and out of safe exits, not just every exit — because pushing everyone through every door may push some of them into the path of a would-be assailant.

A fire evacuation plan empties a building through every available exit, as fast as it can. That is the correct design. Fire does not follow anybody, so every door leads away from it and the only variable worth optimising is speed.

Retail does this well. Routes are signed, drills happen, seasonal staff get inducted, the fire file is in order. That is a genuine asset going into this work, and why the sector tends to assume the box is ticked.

An assailant moves. Once that is true, “every available exit” may include the one the danger is standing in, or the mall it walks down.

So the instruction that is right for a fire becomes the wrong one here. You do not want to push everybody out of every exit as quickly as possible. You need a mechanism to direct people away from the danger and out of safe exits. Which exits those are depends on where the danger is, so the procedure holds more than one answer.

A terrorism evacuation asks questions a fire plan never had to:

• Which routes lead away from the threat, for each place the threat could be? A store with a mall frontage and a back-of-house service corridor has two answers, and they are opposite answers depending on where the danger is.
• Can your team use the alternative route under pressure? Service corridors, goods lifts and fire doors customers never see are only useful if staff can get people through them without hunting for a key.
• How does the instruction reach a customer who does not know your building? Shoppers are strangers to the site. “This way, follow me” from trained staff does more than a tone and a sign.

The fire plan is not wrong and it is not out of date. It is answering a different question. What it is not is automatic compliance with the Act.

Existing fire, health and safety and incident policy is a sound starting point, and reviewing it against this duty beats starting from a blank page. Much of what a store already has — routes, exits, trained staff, a habit of drilling — carries straight over.

A premises in scope needs procedures for four situations, as four distinct items:

• Evacuation — moving people out of the premises, away from danger, through safe exits rather than every exit.
• Invacuation — moving people to a place within the premises where there is less risk of physical harm, used when the danger is close by outside.
• Lockdown — securing the premises so nobody enters or leaves, used when the danger is already inside or at the threshold.
• Communication — how everyone on site is told which of the other three is running.

For a unit inside a centre there is one more layer: the customer exit is the mall, and the mall belongs to somebody else’s procedures. That is why a unit inside a shopping centre has to make its procedures dovetail with the centre’s. An evacuation through the frontage assumes the centre is not securing it.

The duty is that procedures are in place so far as is reasonably practicable for your premises. That is not a size test. It weighs the likely effectiveness of a procedure against the burden of putting it in place, taking account of the nature and use of the premises, its location, its visitor profile, the resources available and the mitigation already there.

A single-frontage unit and a department store with twelve exits produce documents of very different lengths. Both have to show they asked the same questions. The full definition of an evacuation procedure is set out here. Nothing is submitted for approval at standard tier, and you have to be able to evidence your procedures if inspected.

The practical version of this is a review rather than a rewrite. Take the exits you already know, ask which you would use for each position of the threat, and write down the answers along with who decides and how people are told.

Prova Risk builds all four procedures around your site, holds the training and exercise records against them, and produces a single compliance document you can put in front of a regulator. £399 per year per site.

• What counts as an evacuation procedure under Martyn’s Law
• A shop inside a shopping centre: mine or the landlord’s problem?
• Martyn’s Law for retail
• The four public protection procedures
• Martyn’s Law vs health and safety and fire legislation
• Does my existing health and safety policy cover Martyn’s Law?
• Martyn’s Law hub