The Act builds around a small number of defined and consequential concepts. A surface transport operation is central to the regime: it means an activity or system for transporting passengers by high occupancy vehicles or goods by high payload vehicles (s 8). The Act defines high occupancy vehicles as designed to carry 10 or more seated adults including the driver, and high payload vehicles as vehicles with payloads of more than 20 tonnes (s 8). A security‑identified surface transport operation (SISTO) is any surface transport operation declared by the chief executive under section 11 to be a SISTO (s 9). The text of s 11 is not included in the material supplied, but s 9 identifies the dependency: the Act’s planning and enforcement requirements attach only when the chief executive declares a surface transport operation a SISTO.
Risk management plan and SISTO entity are functional terms of art in the Act. A “risk management plan” is the required management instrument a SISTO entity must prepare under Part 3 (ss 15-17, 19-28). The Schedule , referred to in s 7 , contains further definitions used throughout the Act (the Schedule text is not reproduced here). The Act repeatedly uses “SISTO entity” to denote the person carrying on the SISTO who holds the statutory duties to prepare, implement, audit, review, amend and test the plan (e.g. ss 15, 19, 20, 22, 24, 25, 27). The Act does not reproduce the Schedule content here, so the precise legal meaning of “SISTO entity” and any corporate forms that it may encompass must be taken from the schedule.
Standards and subordinate instruments are another main concept. Section 16 requires the plan to be prepared in accordance with an AS/NZS standard providing for counter‑terrorism risk management prescribed under regulation; where that standard does not cover a matter, AS/NZS ISO 31000:2009 is the fallback. Section 25 refers to a “prescribed standard” for exercises, which means a standard prescribed under regulation or, if none, a named Emergency Management Australia manual. Section 18 authorises the chief executive to make and give guidelines about preparing risk management plans; those guidelines, if consistent with the AS/NZS standard, are sufficient for compliance with s 16(1). The Act therefore mixes mandatory obligations with delegated rulemaking and guidance instruments that will materially define compliance cost and substance.
Authorised officers and their powers form a further conceptual pillar. The chief executive appoints authorised officers (s 29) and may set conditions and limits on their powers (s 30). Authorised officers carry identity cards (s 31), must produce or display those cards before exercising powers against a person (s 32), and have specific entry powers (s 36 for places; s 38 for prescribed vehicles). After entry, they may inspect, copy, record, take equipment in, and require help and information; they can require name/address (ss 41-45). Many of these powers are subject to notice, consent, public place or other limits, and to statutory protections such as the reasonable‑excuse construct (see ss 36-39, 42-45).
Compliance lifecycle concepts are embedded , prepare, implement, audit, review, amend, test and certify. The risk management plan must have specific content (risk assessment, mitigation, incident procedures, roles, contact details, training and auditable records) (s 17). Implementation must occur “as soon as possible” and responsible persons must be identified and compelled to comply (s 19). Annual audits, annual testing by exercise, and five‑year reviews or earlier under trigger events are mandatory (ss 20, 25, 22). Records of audits, reviews and exercises must be kept for three years and produced on demand (ss 21, 23, 26, 45). An annual certificate, in an approved form, summarising these activities must be lodged by 1 September or another date set by the chief executive (s 27).
Penalty units and enforcement thresholds are integral to the compliance design. Breaches attract monetary penalties expressed as penalty units: the maximum penalties specified are 60 penalty units for failing to prepare and give a plan (s 15) and for certain failures to test or respond to directions (s 25), 50 penalty units for failures to implement, to take reasonable steps to secure compliance, to audit annually, to keep records and to review and amend plans after review triggers (ss 19-24), 40 penalty units for refusing to give name/address when required (s 44), and 10 penalty units for failing to return an identity card (s 35). The actual monetary amount depends on the statutory value of a penalty unit applicable at the time; that value is outside the Act text supplied.
Interplay with other safety and emergency statutes is explicit. The Act is designed to be additional to other safety laws and to coordinate with emergency and disaster plans under the Work Health and Safety Act 2011 and Disaster Management Act 2003 and potential exercise of Public Safety Preservation Act 1986 powers (s 6; s 17(2)(f)). The Act requires coordination of the risk management plan with relevant emergency and disaster plans and notification and cooperation with Queensland Police Service in a security incident (s 17(2)(d)-(e)).
Finally, the Act sets administrative levers and discretion at the chief executive level: declaration of SISTOs (s 9 referencing s 11), power to make guidelines (s 18), appointment and limitation of authorised officers (ss 29-30), approved form for annual certificate and dates for lodgement (s 27), and directions to participate in exercises (s 25(2)). Those levers shape operational coverage and the intensity of oversight.