Security Industry Regulation 2003

The regulation rests on a set of operational concepts that determine who must be licensed, what evidence and qualifications are required, how certain activities are regulated on the ground, and when statutory exemptions apply.

• Prescribed security activities (s 4). The regulation expands the statutory concept of "security activity" by prescribing acting as a security consultant, selling security equipment, and carrying out surveys and inspections of security equipment. Those activities therefore sit within the licensing and regulatory net established by the Act, subject to any exemptions or specific licensing subclasses the Act prescribes.
• Exempt people and roles (s 6). The regulation enumerates categories of persons and employment contexts that are exempt from the Act or from specific licence requirements. Exemptions are provided both by role (custodial officers, police, sheriffs, fire service officers) and by employment or business context (in-house advisers who do not undertake other security activity for their employer and where the employer does not carry on a security business; employees who install/maintain equipment for their employer in specified circumstances; wholesale-only sellers of equipment; casino employees under the Casino Control Act 2006). There is a distinct exemption for monitoring service operators who provide monitoring to ACT properties from a place outside the ACT and who hold an authority from another State (s 6(3)). The regulation also records the implication that Commonwealth officers are not bound unless regulations or specific provisions make them so (note under s 6).
• Licence classes and documentary requirements (Part 3). The regulation expects particular evidence to accompany licence applications. For master licence applicants (non-locksmiths), membership of an industry association approved by the commissioner is prescribed (s 7). For certain employee licence subclasses, a certificate from an employee organisation confirming attendance at a workplace information session is required (s 7A-7B).
• Training standards and transition rules (s 8, s 9). The regulation contains the detailed table (table 8) describing which nationally recognised qualifications are the prescribed training courses for employee licence subclasses, and which course variants remain accepted as transitional qualifications if completed before 1 July 2020 (s 8(1)-(2)). It separately prescribes training courses for trainer licences (s 9), including the requirement that an applicant proposing to teach a table 8, column 3 course must have satisfactorily completed the qualification (or a course leading to a higher qualification) and must have Certificate IV in Assessment and Workplace Training (s 9).
• Industry association membership (s 9A). The regulation makes membership of an approved industry association a condition of some master licences, grants the commissioner discretion to exempt on conscientious or religious grounds, and sets out that the commissioner approves associations and that approvals are notifiable instruments.
• Workplace information and employee organisation involvement (s 9B, s 7A-7B). Workplace rights and responsibilities relevant to the security industry (examples include minimum wages and employment conditions, termination and workplace safety) are prescribed as the content of workplace information, and the regulation requires employee organisations to provide information sessions and to issue certificates confirming attendance for licence applicants where applicable.
• Crowd control mechanics (Part 4). The regulation treats crowd control as a discrete operational context. It defines the application of Part 4 to each occasion a master licensee provides a person to act as a crowd controller for a place (s 11). It requires allocation of unique identification numbers (s 18), compulsory wearing and visibility of identification by both the master licensee (ensuring the controller wears it) and the crowd controller themselves (s 12), and specific recordkeeping obligations relating to placements and incidents, with preservation periods (s 13-14).
• Privacy and information handling (s 16). Where a master licensee is not otherwise bound by the territory’s TPP 6 or the Commonwealth’s APP 6, the regulation imports APP 6 (use or disclosure of personal information) by operation of s 16(2), and disapplies the Legislation Act s 47(6) in that context (s 16(3)).
• Equipment safety standards (s 17). The regulation requires installed security equipment to comply with any safety standards published by Standards Australia, or jointly by Standards Australia and Standards New Zealand, as in force from time to time, and disapplies Legislation Act s 47(6) in relation to those standards, so the standards operate dynamically as applied instruments.
• Trainer accreditation and RTO link (s 15). Trainers teaching prescribed courses in table 8, column 3 must be employed or engaged by a registered training organisation under the National Vocational Education and Training Regulator Act 2011 (s 15). This ties delivery of certain security training to the national VET regulatory framework.

These concepts determine the regulatory incentives. Membership and training requirements create entry constraints and ongoing obligations; privacy and equipment standards impose compliance costs and require processes for document retention and equipment procurement; crowd control rules allocate responsibilities to masters for supervision, identification and incident recordkeeping. The commissioner for fair trading is the central decision-maker for approvals, ID allocation and exemptions (see s 9A(3)-(4) and s 18(2)).

The regulation’s rules allocate obligations, permissions and decision-making across a set of actors. Each bears specific duties and faces compliance costs under the regulation.

• Master licensees. The regulation places many obligations directly on the holder of a master licence. Master licensees must, for crowd control work, ensure that a crowd controller provided to a place wears a visible identification number and must keep placement records and incident records for three years (s 12-14). Master licence applicants who are not locksmiths must provide evidence of membership of an approved industry association (s 7, s 9A). Master licensees who are not otherwise covered by the territory’s privacy principle TPP 6 or the Commonwealth’s APP 6 are obliged to comply with APP 6 by force of s 16. Master licensees who install security equipment must ensure the equipment complies with relevant Standards Australia/Standards New Zealand safety standards (s 17).
• Employee licence-holders. Persons who hold the various subclasses of employee licences named in the Act and mapped to qualifications in table 8 are affected by the training and first-aid requirements (s 8). Employee licence-holders are subject to the condition that they may only carry out a security activity authorised by the licence while employed by someone who holds a master licence or a master temporary visitor licence (s 9C). This affects labour supply models in the sector: directly-employed employees are accommodated, while the regulation restricts employees performing security activities outside master-licence employment arrangements.
• Crowd controllers. A person provided by a master licensee to act as a crowd controller is both directly covered and indirectly affected: the person must wear the allocated identification number visibly while at the place (s 12(2)), must record start and finish times (s 13(1)(b) and s 13(3)), and must make incident records when nominated in the event of force, ejection or witnessing an assault (s 14(4)-(5)). The commissioner allocates the unique identification number to persons authorised to act as crowd controllers (s 18).
• Licensed trainers and RTOs. Trainers who will teach the prescribed courses must meet the trainer licence training standards set out in s 9 and, for table 8 column 3 courses, must be employed or engaged by a registered training organisation under the National Vocational Education and Training Regulator Act 2011 (s 15). Trainer licence applicants must have completed the relevant qualifications or have a course the commissioner is satisfied leads to a higher qualification, and must hold Certificate IV in Assessment and Workplace Training (s 9).
• Employee organisations. The regulation requires that certain employee licence applications be accompanied by a certificate from an employee organisation confirming that workplace information was provided at an information session (s 7A-7B). Employee organisations thus perform a gatekeeping/information-delivery role: they must provide information sessions and issue certificates on request.
• Applicants for master licences and trainers. Applicants who are not members of an approved industry association must join one unless they obtain a written exemption from the commissioner on conscientious or religious grounds (s 9A(1)-(2)). The commissioner approves industry associations and the approval is a notifiable instrument (s 9A(3)-(4)).
• Employers and contracting entities that engage crowd controllers or security employees. These entities are affected because master licensees must keep placement and incident records and ensure compliance with identification and training obligations (s 13-14). Employers that are not master licensees but use security employees must ensure those employees are employed by a master licence holder (s 9C).
• Persons installing security equipment. Installers must ensure equipment complies with any safety standards published by Standards Australia or jointly by Standards Australia and Standards New Zealand (s 17). Where a business installs equipment for its own premises and is exempt under s 6(1)(i), this may not apply.
• Regulators and the commissioner for fair trading. The regulation places allocation, approval and exemption discretions with the commissioner (s 9A(3)-(4), s 18). The Act and the regulation together create administrative functions for licensing, allocation of identification numbers and notification of approved associations.
• Entities outside the ACT. Monitoring service operators located outside the ACT but providing a monitoring service to ACT property, and who hold authority under another State, are exempt from the requirement to hold a local monitoring service operator licence provided the conditions in s 6(3) are met.

Who does not have to comply is also specified. Custodial officers, police officers, sheriffs and their assistants, fire service officers, certain public servants, casino employees under the Casino Control Act 2006, some in-house advisers and in-house installers/maintainers (subject to conditions), and wholesale-only sellers of security equipment are exempt from the Act or from particular licensing requirements (s 6(1)(a)-(l)). The regulation’s note highlights the position of Commonwealth officers in the context of the Self-Government Act, indicating the Act is not listed in the relevant Commonwealth regulations; that note clarifies that Commonwealth officers such as Defence Force members or protective service officers are not automatically bound by the Act (note under s 6).

Finally, the regulation affects anyone who acquires security services or equipment from the regulated industry because the compliance obligations on licensees shape provider behaviour: training standards, equipment standards, recordkeeping, identification and privacy practices will affect operational costs and service delivery models.

The regulation allocates a number of affirmative duties and prescribes conditions that are attached to licences. Parallel to duties, the regulation grants limited administrative discretions and rights, for example to seek exemptions or have the commissioner approve associations.

Duties on licence-holders and applicants

• Documentary evidentiary duties on applicants. A master licence applicant who is not a locksmith must supply evidence of membership of an industry association approved by the commissioner for fair trading (s 7). Applicants for certain employee licences must include a certificate from an employee organisation stating the applicant received workplace information at an information session (s 7A-7B).
• Training and qualification duties. Applicants for employee licences must have completed the prescribed training course mapped to the licence subclass in table 8 and must hold a current certificate in first aid where specified (s 8). The regulation provides for transitional acceptance of older course variants if completed before 1 July 2020, subject to continued licensure or timely application (s 8(2)). Trainer licence applicants must have satisfactorily completed the qualification they propose to teach (or a course leading to a higher qualification) and must hold Certificate IV in Assessment and Workplace Training (s 9).
• Master licence membership duty. A master licence applicant who is not a locksmith must be a member of an approved industry association; the commissioner may grant written exemption on conscientious or religious grounds (s 9A(1)-(2)).
• Crowd control duties. For each occasion a master licensee provides a person to act as a crowd controller, the master must ensure the crowd controller wears the identification number visibly while at the place (s 12(1)-(2)). The master must keep written placement records for each occasion, including entity name and address, place address, date, crowd controller name/address/licence number/identification number, supervisor name, and start/finish times (s 13(1)(a)(i)-(vi), (b)). Records must be kept for three years (s 13(2)). The master must keep incident records if the crowd controller has used force, ejected someone, or witnessed a physical assault; those records must contain defined details and be kept for three years (s 14(2)-(3)). The master must nominate a crowd controller involved in an incident to make the record, and the nominated crowd controller must make it (s 14(4)-(5)).
• Trainer accreditation duties. A licensed trainer may provide table 8, column 3 courses only if employed or engaged by a registered training organisation under the National Vocational Education and Training Regulator Act 2011 (s 15).
• Confidentiality and privacy duties. Where a master licensee is not otherwise subject to TPP 6 or APP 6, APP 6 applies to the master licensee by force of the regulation, and Legislation Act s 47(6) does not apply in relation to APP 6 (s 16(1)-(3)).
• Equipment standards duty. A licensee installing security equipment must ensure the equipment complies with applicable safety standards published by Standards Australia or jointly with Standards New Zealand, as in force from time to time (s 17(1)-(2)).

Licence conditions and regulatory consequences

• Condition on employee licences. It is a condition of an employee licence that the licensee carry out a security activity authorised under the licence only while employed by someone who holds a master licence or a master temporary visitor licence (s 9C). The regulation explicitly notes that contravention of a licence condition is a ground for occupational discipline and an offence under the Act (note to s 9C referencing Act s 30(1)(d) and s 38). Thus, the condition is enforceable via the Act’s disciplinary and offence framework.
• Notifiable instrumentalisation. The commissioner’s approval of industry associations is a notifiable instrument (s 9A(4)). The allocation of identification numbers to crowd controllers is required upon issue of a licence that authorises crowd control activity (s 18(1)-(2)).

Discretions and administrative rights

• Commissioner discretion on association exemptions. The commissioner may exempt a master licence applicant from the association membership requirement on reasonable grounds of conscientious or religious objection, in writing (s 9A(2)). That creates an administrative pathway for relief but requires a written decision from the commissioner.
• Approval of industry associations. The commissioner decides which entities qualify as approved industry associations (s 9A(3)). The decision is made public via a notifiable instrument (s 9A(4)).

Practical rights arising from the regulation

• Transitional qualification rights. Applicants who completed older courses before 1 July 2020 and satisfy the ongoing licence-holding or application windows in s 8(2)(b)(i)-(ii) can rely on those earlier courses for licence qualification, preserving entitlements for those with prior completion.
• Employee organisation certification. Where an employee organisation provides an information session, it must issue a certificate to the attendee confirming provision of workplace information (s 7B).

Duties and rights mapped to enforcement mechanism

• Recordkeeping obligations are precise and time-limited. The regulation prescribes the content and three-year retention period for both placement and incident records (s 13-14); where an approved Act form exists under Act s 51, that form must be used for incident records (s 14 note).
• Identification and allocation are administrative. The commissioner must allocate a unique identification number to each person issued a licence authorising them to act as a crowd controller (s 18). The physical duty to wear and display that number sits with the master licensee and the crowd controller (s 12).

Overall, the regulation spells out a compliance architecture where training, membership, recordkeeping, identification, equipment standards and privacy practices are principal duties; the commissioner holds the gatekeeping discretions over associations and identification allocations; and employee licence-holders face a substantive employment-tied condition on their licence use.

The regulation itself is an instrument subordinate to the Security Industry Act 2003 and predominantly specifies standards, qualifications, conditions and recordkeeping, rather than prescribing new standalone criminal offences with penalty amounts. Nevertheless, the regulation intersects with the Act’s disciplinary and offence regime and incorporates statutory enforcement levers. The document also sets the framework for administrative enforcement through the commissioner for fair trading.

Penalty units and offence framework

• Penalty unit values. The republication preface states that at the republication date the value of a penalty unit for an offence against this law is $160 for an individual and $810 for a corporation (Legislation Act 2001, s 133). That figure is relevant where an offence under the Act or the regulation refers to penalty units.
• Contravention of licence conditions. The regulation explicitly notes that contravention of a licence condition is a ground for occupational discipline and an offence under the Act (note to s 9C, referencing Act s 30(1)(d) and s 38). Thus, breaches of conditions such as the employee licence employment limitation (s 9C) may be prosecuted or dealt with by occupational discipline under the Act.
• Use of approved forms. For incident records, the regulation notes that if a form is approved under the Act s 51 for the record, the form must be used (s 14 note). Failure to use an approved form where one exists could be an administrative non-compliance that feeds into enforcement action under the Act.

Enforcement actors and mechanisms

• Commissioner for fair trading. The commissioner performs allocation and approval functions, including allocation of identification numbers to crowd controllers (s 18(2)) and approval of industry associations (s 9A(3)-(4)). The commissioner also issues licences (s 18(1) indicates application in the case of crowd controllers). Enforcement action for licence-related offences, disciplinary proceedings and administrative sanctions under the Act will ordinarily be pursued or overseen by the relevant regulatory authority, which the regulation identifies as the commissioner for fair trading.
• Recordkeeping oversight. The regulation requires precise recordkeeping (s 13-14) with a three-year retention period. These are documentary obligations that create a paper trail for compliance checks and for discipline or enforcement where records are incomplete, absent or falsified.
• Privacy and confidentiality compliance. By applying APP 6 to master licensees who are not otherwise covered by territory TPP 6 or Commonwealth APP 6 (s 16), the regulation introduces obligations concerning use and disclosure of personal information. Breach of APP 6 obligations attracts privacy regulatory processes under the Privacy Act where APP 6 applies, including complaint pathways to the Office of the Australian Information Commissioner, and possible civil or administrative remedies under the Privacy Act (though the regulation itself does not specify penalty amounts for APP breaches; APP enforcement is governed by the Privacy Act and its enforcement mechanisms).
• Equipment standards compliance. The requirement that installed security equipment complies with current Standards Australia or joint Standards Australia/New Zealand safety standards (s 17) creates a grounds for enforcement action where installations do not meet applicable standards; the regulation disapplies Legislation Act s 47(6) in relation to those standards, meaning the standards operate as applied instruments.

Limitations and specifics in enforcement detail

• The regulation does not list specific penalty amounts for each contravention it prescribes; it references the Act’s disciplinary framework for contraventions of licence conditions and sets general compliance duties. Enforcement therefore largely proceeds under the Act’s offence and discipline mechanisms. The regulation’s preface sets the penalty unit values in force for offences against the law at the republication date but does not map specific breaches to penalty units within the regulation text.
• Administrative discretion and notifiable instruments. Approvals of industry associations are made by the commissioner and are recorded as notifiable instruments (s 9A(3)-(4)). The disclosure of such approvals and their content will affect which master licence applicants must join which associations; enforcement can arise if an applicant fails to meet those documentary membership requirements under s 7.

Practical enforcement implications

• A contravention of a licence condition such as the employee licence employment restriction (s 9C) has both disciplinary and criminal enforcement potential under the Act. That condition is clear and enforceable through the Act’s mechanisms.
• Non‑compliant training evidence or absence of required certificates from employee organisations on application (s 7A-7B) may result in refusal to issue a licence or later discipline if misrepresentation is found.
• Crowd control failures such as not wearing or providing identification, or failing to keep or produce required incident records, are gaps that enforcement bodies can identify through audits and investigations; prosecution or discipline will depend on Act provisions and regulatory decisions.

In sum, the regulation supplies the concrete duties and records that enforcement under the Act will rely upon. The regulation points practitioners and licensees to the Act for the primary enforcement regime (discipline and offences) and supplies administrative structures,commissioner approvals, identification allocation and notifiable instruments,that govern operational compliance.

The regulation expressly cross-references and incorporates provisions from a number of Commonwealth and ACT statutes and instruments. Those cross-references determine legal interactions, compliance breadth, and the territorial reach of particular obligations.

Direct statutory cross-references within the regulation

• Security Industry Act 2003. The regulation is made under the Act and repeatedly references Act provisions (see headings: many items are ",Act, s X"). It prescribes matters required or enabled by the Act, such as prescribed training courses (Act, s 21(1)(a)(iii)), prescribed information to accompany applications (Act, s 17(3)), conditions on licences (Act, s 52(2)(f)(i)), and identification numbers (Act, s 41 and s 42) (see s 7, s 7A, s 8, s 9C, s 12).
• Legislative Assembly Precincts Act 2001. The regulation uses the term "Assembly precincts" as defined in that Act (s 6(4) note), which determines the scope of the public servant exemption in s 6(1)(f).
• Electronic Transactions Act 2001. The regulation draws on the Electronic Transactions Act definition of "information system" for the exemption in s 6(1)(j) (s 6(4) note).
• National Vocational Education and Training Regulator Act 2011 (Cwlth). Section 15 requires trainers of table 8, column 3 courses to be employed or engaged by a registered training organisation under that Commonwealth Act and cites section 3 of that Act (s 15).
• Information Privacy Act 2014 (ACT) and Privacy Act 1988 (Cwlth). Section 16 creates an interaction between territory privacy principles and Commonwealth APPs. Where a master licensee is not covered by TPP 6 or APP 6, the regulation applies APP 6 to the master licensee as if it were an organisation; Legislation Act s 47(6) does not apply in relation to APP 6 (s 16).
• Standards Australia / Standards New Zealand publications. Section 17 applies safety standards published by Standards Australia or jointly with Standards New Zealand as in force from time to time and disapplies Legislation Act s 47(6) in relation to those standards, so the standards are applied dynamically.

Interpretative and administrative interactions

• The Legislation Act 2001. The regulation uses the Legislation Act to define the legal status of notes and the dictionary and to disapply s 47(6) in particular parts (s 3 note, s 16(3), s 17(2)). The regulation also uses Legislation Act definitions by reference (s 2 note).
• Notifiable instruments and the Legislation Act. The commissioner’s approval of industry associations is made a notifiable instrument (s 9A(4)), which triggers the notification and tabling rules in the Legislation Act for notifiable instruments.
• Interaction with Commonwealth authorities and Crown immunity. The regulation contains an explanatory note under s 6 explaining that Commonwealth officers such as Defence Force members and protective service officers are not bound by the Act because the Act is not listed in the schedule to the Australian Capital Territory (Self‑Government) Regulations 1989 (Cwlth). That note addresses the constitutional interaction between ACT law and Commonwealth Crown immunity.

Operational and compliance interactions that practitioners must note

• Privacy compliance overlay. Where a master licensee is not otherwise covered by TPP 6 or APP 6, the regulation imports APP 6 and makes it applicable. This means privacy obligations are not solely a territory matter; a master licensee must ensure compliance with APP 6 as applied by the regulation, bringing APP enforcement regimes into play (s 16).
• Training and national VET system. The tie to registered training organisations and the National VET Regulator Act integrates security industry training into the national VET framework. Trainers must be attached to RTOs to deliver certain courses (s 15) and qualifications named in table 8 are nationally recognised VET qualifications (s 8, table 8).
• Standards as applied instruments. By requiring equipment to meet Standards Australia or joint Australia/New Zealand standards as in force from time to time and disapplying Legislation Act s 47(6), the regulation makes contemporary technical standards binding on installers (s 17). Practitioners must track current standards rather than a static version published in the regulation.
• Transitional qualification rules and temporal deadlines. Section 8’s transitional rule for older courses creates temporal dependencies that interact with licencing status on and after 1 July 2020 and applications before 1 July 2021. Where practitioners rely on old qualifications, they must confirm compliance with the timing and continuous-licence conditions in s 8(2) rather than assuming perpetual acceptance.
• Interaction with the Act’s enforcement regime. The regulation’s conditions and recordkeeping requirements feed into the Act’s disciplinary and offence provisions. For example, contravening the employee licence condition is a ground for discipline under the Act (note to s 9C).

What the regulation does not do

• The regulation does not purport to create new civil causes of action or to override the Act’s enforcement procedures; it primarily prescribes standards, documentary requirements and operational duties. It delegates key administrative discretions to the commissioner but leaves primary enforcement (offences and occupational discipline) to the Act’s mechanisms. The regulation also does not provide independent Rules of evidence or trial processes; it supplies documentary and training prerequisites that will be relevant in enforcement settings.

In sum, the regulation is designed to operate tightly with the Act, the national VET framework, privacy legislation, Australian/New Zealand technical standards and the Legislation Act’s instrument frameworks. Practitioners must navigate multiple regimes simultaneously: licensing rules under the Act as informed by the regulation, nationally recognised training and RTO requirements, privacy obligations as applied, and standards that are dynamically incorporated.

The regulation’s endnotes provide a chronological legislative history of amendments, republications and consequential changes since its original commencement. The history demonstrates the regulation has been repeatedly updated to reflect policy and administrative changes. Key points drawn from the endnotes include:

• Origination and early republications. The Security Industry Regulation 2003 was originally notified as SL2003-30 on 2-3 September 2003 and has been republished multiple times (R1 onwards). The legislative history in endnote 3 records the original notification and early effective dates.
• Statute Law Amendment and consequential Acts in 2003-2005. The regulation was amended by the Statute Law Amendment Act 2003 (No 2) A2003-56 (sch 3 pt 3.23) and the Emergencies Act 2004 A2004-28, and by Justice and Community Safety Legislation Amendment Act 2004 (No 2) A2004-32, among others (endnote 3 lists these instruments and commencement dates). Those instruments effected early statutory alignments.
• Amendments relating to custody, corrections and youth detention. Subsequent amendments reflect interactions with corrections and youth detention legislation. For example, references to custodial officers, corrections officers and youth detention officers were introduced and adjusted in the period 2006-2008, with instruments such as the Sentencing Legislation Amendment Act 2006 A2006-23 and the Corrections Management Act 2007 A2007-15 affecting content (see endnote 3).
• Training and VET-related amendments. Changes to training requirements and trainer accreditation have been introduced over time. The Training and Tertiary Education Legislation Amendment Act 2007 A2007-12 and the Training and Tertiary Education Amendment Act 2014 A2014-48 appear in the history, reflecting how the regulation was adapted to align with the national VET framework (endnote 3, R10-R12, R20).
• Security Industry Amendment Acts and Regulations. The Security Industry Amendment Act 2010 A2010-33 and Security Industry Amendment Act 2011 A2011-37, as well as subordinate instruments such as Security Industry Amendment Regulation 2012 (No 1) SL2012-20 and later Security Industry Amendment Regulation 2020 (No 1) SL2020-25, amended the regulation at various points, including changes to the prescribed activities, training tables and other operational provisions (endnote 3).
• Red Tape Reduction and Justice & Community Safety amendments. Between 2016 and 2017 a number of amendments aimed at streamlining or adjusting provisions were made via the Red Tape Reduction Legislation Amendment Act 2016 A2016-18 and the Red Tape Reduction Legislation Amendment Act 2017 A2017-17, among others (endnote 3).
• Recent amendments prior to and including 2021. The registration shows SL2020-25 (Security Industry Amendment Regulation 2020 (No 1)) was notified 30 June 2020 and came into full effect on 1 July 2020 (endnote 3). The Justice and Community Safety Legislation Amendment Act 2021 A2021-3 (pt 19) and Security Industry Amendment Regulation 2021 (No 1) SL2021-2 were notified in early 2021, with remainder provisions commencing 19 March 2021 (endnote 3).
• Republication chronology. The endnotes list successive republications R1 through R27, with effective dates and the last amendment made by notation; R27 corresponds to the republication effective 19 March 2021 and last amended by SL2021-2 (endnote 5).

The amendment history shows iterative changes across multiple policy themes: inclusion and refinement of prescribed activities, alignment with national VET qualifications and trainer accreditation, recordkeeping and privacy adjustments, and streamlined administrative requirements. The endnotes provide the instrument-level detail for each change, including commencement dates and the amending instrument, which is the correct source to consult for precise textual amendments over time (see endnotes 3 and 4 for the full list and particulars).

Practitioners should consult the specific amending instruments listed in endnote 3 and the amendment history in endnote 4 for clause-level changes where necessary. The republication notes that the Parliamentary Counsel’s Office prepared the republication as authorised and that editorial amendments under the Legislation Act may appear; the republication includes a consolidated text up to 19 March 2021.

The republished regulation and its endnotes do not identify any reported litigation, judicial determinations, or case law interpreting the Security Industry Regulation 2003. The legislative text and endnotes provide statutory and administrative history but do not include or reference judicial decisions.

Practical consequences of the absence of litigation references in the instrument:

• No precedent from the regulation text itself. Because the regulation does not refer to cases, practitioners cannot rely on precedent embedded in the regulation’s text. Any judicial interpretation or litigation relating to the regulation and the Act would need to be found in external reported decisions, which are not provided in this document.
• Enforcement and disputes will engage the Act’s processes and general administrative law. Where disputes arise over licence refusals, discipline, identification allocation, association approvals, exemption refusals or privacy obligations applied by the regulation, those matters will be addressed under the Security Industry Act 2003 and under general ACT administrative law and procedural frameworks. The regulation’s text evidences the duties and discretions, but case law would be required to clarify contested applications of those provisions.
• Monitoring for future case law is necessary. Given the regulation’s interaction with training, privacy (APP 6), standards published by Standards Australia, and employment-related licence conditions, disputes that test the boundaries of these interactions may arise before ACT tribunals or courts. Practitioners should monitor tribunal and court decisions for interpretive guidance on, for example, the scope of the master licence association requirement (s 9A), the application of APP 6 as applied by s 16, the scope of recordkeeping duties in Part 4, and the enforcement of licence conditions under the Act (notes to s 9C referencing Act s 30 and s 38).

Absent authoritative judicial materials in the republication, the regulation sets the statutory starting point for compliance, with enforcement and interpretation to be fleshed out by administrative decisions and future litigation under the Act. For any contested application or prosecution, the applicable Act provisions and the administrative record will be the basis for adjudication.

The regulation’s text contains several provisions that can produce practical compliance pitfalls, timing traps and operational frictions for licensees, applicants, trainers and employers. The following are concrete issues and the statutory mechanisms that create risk.

1. Transitional qualification timing rules (s 8(2))

• Risk: The acceptance of older courses (table 8, column 3) relies on completion before 1 July 2020 and on either continuous holding of a relevant licence since 1 July 2020 without a break longer than 12 months (s 8(2)(b)(i)) or making application to the commissioner before 1 July 2021 (s 8(2)(b)(ii)). If an applicant completed an older course before 1 July 2020 but later ceased to hold the licence for more than 12 continuous months, they may lose transitional entitlement.
• Mechanism: Temporal cutoff and continuity requirement are strict; documentation will be required to show completion dates and continuous licensure.

2. Employee licence employment condition (s 9C)

• Risk: Employee licence-holders can lawfully carry out security activities only while employed by a master licence holder or a master temporary visitor licence holder. This condition expressly forbids self-employment in many contexts and complicates gig/contractor arrangements where the worker is not directly employed by a master licensee.
• Mechanism: The condition is enforceable and breach is a ground for discipline and an offence (note to s 9C). Practitioners must structure labour arrangements to ensure a master licensee is the employer for the activity.

3. Industry association membership requirement and commissioner exemption (s 9A)

• Risk: Non‑locksmith master licence applicants must be members of an approved industry association. Applicants who object on conscientious or religious grounds must apply to the commissioner for a written exemption, which is discretionary.
• Mechanism: The commissioner approves associations and records approvals as notifiable instruments (s 9A(3)-(4)). Applicants cannot unilaterally decline membership; they must obtain a written exemption.

4. Employee organisation certificate requirement (s 7A-7B)

• Risk: Certain employee licence applications require a certificate from an employee organisation verifying workplace information attendance. If an applicant cannot obtain the certificate (for example, because no local employee organisation provided the session), licence application may be delayed or refused.
• Mechanism: The regulation places an evidentiary burden on the applicant and an issuance duty on employee organisations (s 7B).

5. Trainer accreditation and RTO tie-in (s 15)

• Risk: Licensed trainers may only offer certain courses if they are employed or engaged by a registered training organisation (RTO). Independent trainers who are not affiliated with an RTO cannot lawfully provide table 8, column 3 courses.
• Mechanism: RTO employment/engagement is a mandatory precondition for delivering specified courses; practitioners must secure RTO relationships.

6. Privacy obligations under APP 6 applied by regulation (s 16)

• Risk: Master licensees who are not otherwise bound by TPP 6 or APP 6 will nonetheless be subject to APP 6 as applied by the regulation. Some master licensees (for example small businesses that believed territory privacy principles did not bind them) may face new compliance burdens and potential complaints or regulatory action under the Privacy Act framework as applied by the regulation.
• Mechanism: The regulation imports APP 6 and disapplies Legislation Act s 47(6) in relation to APP 6, making APP 6 directly applicable (s 16).

7. Equipment standards operate dynamically (s 17)

• Risk: Equipment must comply with Standards Australia or joint standards as in force from time to time. Because the regulation disapplies Legislation Act s 47(6) for those standards, the legal requirement maps to the current standard editions without separate notifiable instruments, potentially making it harder to track which version applies.
• Mechanism: Dynamic incorporation means installers and licensees must actively monitor current standards and certify compliance to the then-current safety standard.

8. Recordkeeping, incident reporting and nomination duties (s 13-14)

• Risk: The regulation requires precise placement records and incident records with defined content and a three-year retention period. For incidents involving force, ejection or witnessed assault, the master must nominate a crowd controller to make the record and that nominated controller must make it (s 14(4)-(5)). Failure to nominate or to make the record opens the master licensee to compliance scrutiny.
• Mechanism: Operationally, masters must ensure systems (paper or electronic) capture start/finish times, supervise and verify records, and ensure nominated controllers understand their duties.

9. Identification number allocation and visibility (s 12, s 18)

• Risk: The commissioner allocates unique identification numbers to persons authorised to act as crowd controllers (s 18). Both the master and the crowd controller must ensure the number is worn and clearly visible while at the place (s 12). Loss, transfer, or failure to display the identification number creates immediate regulatory exposure.
• Mechanism: The unique number is an administrative identifier; masters must maintain an internal system to match identification numbers with persons and placements.

10. Wholesale sellers exemption nuance (s 6(1)(l))

• Risk: A person selling security equipment only by wholesale is exempt from the Act (s 6(1)(l)), but direct-to-public sellers are not exempt. Businesses that operate mixed wholesale and retail channels must segment activities or obtain licences accordingly.
• Mechanism: The exemption is narrow and activity-place dependent; business models must be structured to match exemption conditions.

These "gotchas" are concrete, statutory-based compliance risks that arise directly from the regulation’s provisions. They translate into operational requirements: documentation systems, training and first-aid maintenance, employer-employee contractual design, RTO relationships for trainers, proactive privacy processes, and active monitoring of standards.

A practical compliance checklist and recommended steps follow. Each recommendation maps to specific regulatory provisions and addresses the operational mechanics the regulation mandates.

1. Licence application documentation and membership

• For master licence applications (non-locksmiths), obtain and file evidence of membership of an industry association that is approved by the commissioner (s 7, s 9A(1)). If a prospective applicant has a conscientious or religious objection to membership, apply to the commissioner for a written exemption and retain the written decision (s 9A(2)).
• Track the commissioner’s notifiable instrument(s) listing approved industry associations (s 9A(4)). Maintain copies of the relevant notifiable instrument(s) as part of the application file.

2. Training, qualifications and first aid

• Map each employee licence subclass to the prescribed training course in table 8 and ensure staff have the correct nationally recognised qualification and current certificate in first aid where required (s 8, table 8).
• For trainers, ensure trainer licence applicants hold Certificate IV in Assessment and Workplace Training and have satisfactorily completed the qualification they propose to teach (s 9).
• For trainers teaching table 8 column 3 courses, ensure they are employed or engaged by an RTO registered under the National VET Regulator Act 2011 (s 15). Secure formal engagement or employment agreements with the RTO and retain evidence of the RTO registration.

3. Transitional qualification proof

• If relying on older course variants completed before 1 July 2020, obtain and retain documentary proof of completion and verify that you either held the relevant licence on 1 July 2020 and have not ceased to hold it for a continuous period of more than 12 months, or that you applied to the commissioner for the licence before 1 July 2021 (s 8(2)(a)-(b)).

4. Employee organisation workplace information and certificates

• If an employee licence application requires a certificate from an employee organisation, arrange attendance at an employee organisation’s workplace information session and obtain the certificate (s 7A-7B). Retain the certificate in the applicant’s file.
• Employee organisations: maintain processes for delivering prescribed workplace information (s 9B examples include minimum wages, employment agreements, termination and workplace safety) and for issuing certificates to attendees (s 7B).

5. Employee licence employment condition and labour arrangements

• Structure employment arrangements so that employee licence-holders carry out security activities only while employed by a master licence-holder or a master temporary visitor licence-holder (s 9C). Where using contractors, ensure the contractor arrangement is legally an employment relationship with a master licensee or arrange for the worker to hold a licence only while employed by a master licensee.
• Maintain clear written employment contracts and records confirming the employment relationship for each period of security activity.

6. Crowd control identification, visibility and records

• Upon issuance of a licence authorising crowd control, ensure the commissioner allocates a unique identification number to the licence-holder and record the number in the personnel file (s 18).
• Ensure crowd controllers wear the identification number clearly visible while at the place, and put in place supervisory checks to verify compliance each shift (s 12).
• Maintain written placement records for every occasion a crowd controller is provided to a place, including the entity and place addresses, date, controller name/address/licence/ID number, supervising person (if any), and actual start and finish times; have crowd controllers record their start and finish times when on duty (s 13(1)(a)(i)-(vi); s 13(1)(b); s 13(3)). Retain records for at least three years (s 13(2)).
• If a qualifying incident occurs (use of force, ejection or witnessing an assault), ensure an incident record is made with the statutory content (s 14(2)). The master must nominate one crowd controller who was involved to make the record, and that nominated controller must make it (s 14(4)-(5)). If an approved Act s 51 form exists, use it (s 14 note).

7. Privacy and personal information handling

• Review whether the master licensee is bound by the ACT TPPs or Commonwealth APP 6. If not bound, APP 6 will apply under s 16(2); apply APP 6 as if the master licensee were an organisation. Implement APP 6-compliant policies on use and disclosure of personal information, including collection, retention, access, correction and disclosure controls (s 16).
• Document privacy policies and staff training, and maintain records of disclosures and reasons consistent with APP 6.

8. Equipment installation and standards compliance

• Where installing security equipment, ensure procurement and installation comply with applicable safety standards published by Standards Australia or jointly by Standards Australia and Standards New Zealand, as in force from time to time (s 17(1)). Because the regulation applies the most recent versions, subscribe to standards updates and maintain records demonstrating conformity with the current standard at the time of installation.
• Keep test and inspection certificates, procurement records, and commissioning documents on file as evidence of compliance.

9. Trainer and RTO arrangements

• For licensed trainers, confirm employment or engagement agreements with an RTO, evidence of the RTO’s registration under the National VET Regulator Act 2011, and maintain records of the trainer’s qualifications and Currency of Competence (s 15).
• Ensure training materials and assessment meet the VET package and RTO requirements, and maintain records of attendance and competency assessments.

10. Commissioner approvals, notifiable instruments and exemptions

• For matters requiring commissioner approval (approved industry associations) or written exemptions (conscientious or religious objection to membership), prepare formal written applications, retain copies of decisions and monitor the commissioner’s notifiable instruments to ensure association approvals are current and publicly available (s 9A(3)-(4)).
• If relying on a monitoring service operator exemption (s 6(3)), retain documentary evidence of the other State authority that authorises the monitoring service operator and of the place-of-service arrangements showing the monitoring service is provided from a place outside the ACT.

11. Record management systems and retention

• Implement document retention systems that ensure placement and incident records are preserved for at least three years from creation (s 13(2), s 14(3)). Ensure backup and secure storage compatible with privacy obligations under APP 6 where applicable.
• Ensure forms used comply with any Act s 51 approved forms; if forms are approved for incident records, adopt and use them (s 14 note).

12. Audit readiness and internal controls

• Establish internal audit procedures to check training currency, first aid certificates, licence employment condition compliance, membership evidence, association certificates, RTO engagement status, identification display and record completeness.
• Allocate responsibility within the master licence-holder organisation for compliance oversight, designate a records custodian for Part 4 materials, and maintain a compliance file for each employee and crowd controller.

These compliance actions map directly to specific regulatory requirements and reduce risk of enforcement action. Practitioners should maintain contemporaneous documentation to demonstrate compliance with the regulation’s duties (s 7-9C, s 12-18). For contentious matters such as exemptions or association approvals, preserve written correspondence with the commissioner and treat such correspondence as part of the administrative record.

Where applicable, consult the Security Industry Act 2003 for the Act-level licensing, discipline and offence framework referenced in the regulation; the regulation prescribes the operational details and the Act supplies enforcement and licensing machinery.