The duty of care gap: what venue operators are legally liable for

The law is not vague about this

Venue operators in the UK carry a clear, documented legal responsibility for the safety of everyone on their premises. This isn't a grey area. It's written into multiple pieces of legislation, and the obligations stack on top of each other.

The Licensing Act 2003 establishes four licensing objectives. One of them is the prevention of crime and disorder. Another is public safety. Every premises licence holder in England and Wales operates under these objectives. When an incident occurs, whether it's an assault, a spiking, or a crowd crush, the licensing authority's first question is whether the operator took reasonable steps to meet those objectives.

The Health and Safety at Work Act 1974 goes further. Section 3 requires employers to conduct their business in a way that ensures, so far as is reasonably practicable, that persons not in their employment are not exposed to risks to their health or safety. That covers every customer who walks through the door. It's not advisory. It's a statutory duty.

And if the worst happens, the Corporate Manslaughter and Corporate Homicide Act 2007 creates criminal liability for organisations whose gross failure in managing health and safety results in death. The threshold is high, but the consequences are severe: unlimited fines and mandatory publicity orders that name the convicted organisation.

The gap between knowing and proving

Most venue operators understand they have a duty of care. The problem is in how they demonstrate it. There's a significant gap between knowing that incidents could happen and being able to prove you took reasonable steps to prevent them.

Consider a straightforward scenario. A customer is assaulted in a bar at 11pm on a Saturday. The police investigate. The licensing authority reviews the premises. They ask: what measures did you have in place to prevent this?

The operator lists the usual answers. Door staff. CCTV. An incident log. Staff training. These are the minimum requirements, and every venue has them. The problem is that none of these measures are proactive. Door staff check IDs. CCTV records footage. Incident logs document events after they've happened. Training tells staff what to do when something goes wrong.

None of these things demonstrate that the venue was actively trying to prevent the incident before it occurred. They demonstrate awareness, not action. And in a legal context, that distinction matters enormously.

What "reasonable steps" actually means

The legal standard in duty of care cases is reasonableness. Did the operator do what a reasonable, competent operator would have done in the circumstances? This standard moves with the times. What was reasonable in 2015 is not necessarily reasonable in 2026.

Courts consider what technology and methods were available. If a proven method exists to reduce a specific type of risk, and an operator chose not to use it despite it being affordable and practical, that weakens their position significantly.

This is exactly how workplace safety law evolved in construction and manufacturing. Once hard hats existed and were proven to reduce head injuries, employers who didn't mandate them were found to have fallen below the standard of reasonable care. The same logic applies to venue safety technology.

AI behavioural detection is reaching the point where it represents a demonstrable improvement over passive CCTV. It doesn't just record what happened. It identifies risks in real time and alerts staff to intervene. For a venue facing a duty of care claim, the difference between "we had cameras" and "our system detected and flagged the threat, and staff responded within 45 seconds" is the difference between a defensible position and a vulnerable one.

CCTV alone is not a safety measure

This is the point most operators miss. CCTV is a recording tool. It captures evidence. It does not prevent incidents. A camera pointing at a dance floor does not stop someone from being assaulted on that dance floor. It records the assault so that it can be reviewed later.

That has value. Post-incident investigation is important. But when a licensing authority or a court asks what you did to prevent the incident, pointing at your camera system is like pointing at your smoke alarm and claiming it prevents fires. The smoke alarm tells you the fire has started. The sprinkler system puts it out. Most venues have the alarm but not the sprinkler.

AI detection systems that sit on top of existing cameras change the function of those cameras. They turn passive recording infrastructure into active monitoring infrastructure. The cameras stay the same. The footage is still captured. But now the system is also watching for specific threats, in real time, and raising alerts before incidents escalate.

Martyn's Law: what's coming in April 2027

The Terrorism (Protection of Premises) Act, known as Martyn's Law, introduces new legal requirements for venue operators. Named after Martyn Hett, who was killed in the Manchester Arena bombing in 2017, the law applies to premises and events that meet certain capacity thresholds.

For standard duty premises (capacity 200-799), operators must implement reasonably practicable procedures to reduce vulnerability to and the impact of a terrorist attack. This includes evacuation procedures, staff training, and security awareness.

For enhanced duty premises (capacity 800+), the requirements are stricter. Operators must conduct a terrorism risk assessment, implement measures to reduce risk, and appoint a designated senior individual with responsibility for compliance.

The Act is expected to come into force in April 2027, with an implementation period to follow. But the smart operators are preparing now. Because when enforcement begins, the question won't be "did you know about Martyn's Law?" It will be "what did you put in place, and when did you start?"

AI-powered crowd monitoring, threat detection, and real-time alerting directly address the requirements of both the standard and enhanced duty tiers. They demonstrate that the venue has invested in active prevention measures, not just reactive procedures.

Insurance and the duty of care connection

Insurers evaluate risk based on the measures a venue has in place. The more proactive and documented those measures are, the lower the assessed risk. This creates a direct financial link between duty of care compliance and operating costs.

Venues that can demonstrate AI-powered detection, documented response times, and a track record of prevented incidents present a fundamentally different risk profile to underwriters. They're not just claiming to be safe. They have data that shows it.

This isn't theoretical. Hotels and large venues using AI detection systems are already reporting measurable reductions in both incident frequency and insurance premiums. The data trail these systems generate, timestamped alerts, response logs, incident outcomes, gives insurers exactly the kind of evidence they need to justify lower rates.

Closing the gap

The duty of care gap is the space between what operators know they should be doing and what they can prove they're doing. Traditional security measures fill part of that gap. Door staff, CCTV, training, and policies are all necessary. But they are increasingly insufficient on their own.

The legal standard of "reasonable steps" is not static. It evolves with available technology and industry practice. As AI detection systems become more widely adopted, the bar for what constitutes reasonable care will rise. Operators who adopt early are ahead of the curve. Those who wait will eventually find themselves explaining why they didn't use tools that were available, affordable, and proven to reduce risk.

The liability doesn't disappear when you don't think about it. It's there every night your doors are open. The question is whether you can demonstrate, with evidence, that you took it seriously.