Event safety: a complete guide for responsible promoters (2026)

An attendee passes out on the dance floor. Another group pushes against a barrier that was never designed to withstand lateral pressure. A storm rolls in that wasn't in the forecast and the marquees start to give way. The bar farthest from the main stage is left unstaffed because everyone has gone to reinforce the entrances. It's eleven o'clock on a Saturday night in July, and you're the one responsible for making sure all of this is resolved without anyone getting hurt.

Event safety isn't a form you fill out to get the license. It's the invisible structure that holds up everything else: the attendee experience, the viability of the business, your legal liability and your professional reputation. A serious incident destroys in minutes what you've built over years. And the worst part is that most serious incidents were avoidable with planning, training and protocols that someone decided were "good enough" without ever reviewing them.

In this guide we're going to walk through event safety, from Spanish regulations to the specific operational protocols you need to have ready. No empty theory: real ratios, checklists, and the mistakes that promoters with years of experience still keep making.

Regulatory framework in Spain: what the law requires of you

The regulation of safety at public entertainment and recreational activities in Spain moves between national and regional legislation, creating a regulatory patchwork that every promoter must understand depending on where they operate.

The national baseline: RD 2816/1982 and updates

The General Regulation for the Policing of Public Entertainment and Recreational Activities (Royal Decree 2816/1982) remains the national reference, although it's now decades old. It establishes the general principles on safety conditions, capacity, fire protection measures, sanitary facilities and the organizer's responsibilities.

In practice, however, application depends largely on the autonomous communities. Since 1982, powers over public entertainment have been progressively transferred, and each community has developed its own legislation. This means a festival in Catalonia faces different requirements from one in Andalusia or in the Community of Madrid, not only in administrative procedures but in safety ratios, notification deadlines and required documentation.

Regional legislation: the differences that matter

The Community of Madrid's Law 17/1997 on public entertainment, Catalonia's Decree 112/2010, the Valencian Community's Law 14/2010 and their equivalents in other communities set specific requirements you must know in detail if you operate in that territory.

The most relevant differences between communities affect: the deadlines for submitting the responsible declaration or authorization request (between 10 and 30 business days depending on the community), the minimum security staff ratios (ranging from 1 steward per 150 to 1 per 250 attendees), the requirement for a security director above a certain capacity (generally 5,000 people, but it varies), and the specific requirements for self-protection plans.

The Self-Protection Plan under the NBE

For events with a capacity over 2,000 people, or fewer if held in venues that require it, it is mandatory to draw up a Self-Protection Plan in accordance with Royal Decree 393/2007 (Basic Self-Protection Standard). This document isn't a formality: it's your roadmap in case of emergency and the document the authorities will review if something goes wrong.

The Self-Protection Plan must include: a detailed description of the site and its access points, identification of risks (natural, technological, due to crowding), available protection resources, an emergency response plan with defined roles, an evacuation plan with routes and meeting points, and integration with the municipality's civil protection plans.

Drawing up the safety plan: step by step

An effective safety plan isn't written the week of the event. You start working on it the moment you confirm the date and the venue, and you refine it as you nail down the format, the expected capacity and the program.

Event-specific risk assessment

Every event has a different risk profile. An electronic music concert with 8,000 people in an enclosed venue doesn't carry the same risks as an open-air food festival with 3,000 family attendees. The assessment must consider factors such as the demographic profile of the audience (age, alcohol consumption habits), the configuration of the space (enclosed vs. open venues, flat terrain vs. slopes), foreseeable weather conditions, the presence of pyrotechnics or other special effects, the duration of the event (a 4-hour event vs. a 3-day festival) and the track record of incidents at previous editions or similar events.

Classify each identified risk by probability (high, medium, low) and impact (catastrophic, serious, moderate, minor) and prioritize mitigating those that combine high probability with serious or catastrophic impact. Don't try to mitigate every risk equally: resources are finite, and distributing them evenly means serious risks don't get enough attention.

Designing the security setup

The security setup defines how many people you need, with what profile, in which positions and with what protocols. This design must stem from the risk assessment and the venue layout, not from the inertia of "what we put in place last year."

Define zones with different risk levels. The higher-risk zones (the stage pit, high-density bar areas, main entrances) need more staff and more qualified staff. The lower-risk zones (rest areas, parking lots) can be covered with a lower ratio. Each zone must have an identified supervisor who reports to the security director.

Coordination with public services

Communication with Local Police, Civil Protection, SAMUR/firefighters and medical services is neither optional nor a mere formality. These services need to know your safety plan, your capacity forecasts, your traffic plan, your own resources and your communication channels far enough in advance to prepare their own deployment.

The pre-event coordination meeting (generally convened by the municipality's Safety Board) is your opportunity to validate your plan with the professionals who will lead the response if something gets out of hand. Bring your updated Self-Protection Plan, the venue layout with access and evacuation points marked, the contact details of your security team and any relevant information about specific risks.

Security staff ratios: how many people you need

One of the most frequent questions among promoters is how much security staff to hire. The answer depends on multiple factors, but there are indicative ratios that serve as a starting point.

Access controllers

For access control, the usual ratio is 1 controller per validation lane, plus one supervisor per 4-5 lanes. If you use QR validation, each lane processes between 150 and 250 people per hour. If you use NFC wristbands, between 300 and 500. Calculate the door-opening window, divide your expected capacity by that time, and you'll have the required throughput. Then divide the throughput by the per-lane capacity and you'll have the number of lanes (and controllers).

For an event of 5,000 people with a 2-hour door-opening window and QR validation, you need a throughput of 2,500 people/hour. At 200 people/hour/lane, that's 12-13 access lanes and therefore 13 controllers plus 3 supervisors. If you want to dig deeper into how to size your access points, check out our guide to access control for events.

Interior security staff

Inside the venue, the recommended ratio ranges from 1 security guard per 200 to 1 per 500 attendees, depending on the type of event. Events with alcohol sales, a young crowd and nighttime hours require higher ratios (1:200). Family-oriented daytime events without alcohol allow lower ratios (1:400-500).

In addition to the licensed security guards, you need auxiliary staff (access controllers, safety stewards) to manage flows, identify crowding zones and channel evacuations. This staff doesn't replace the security guards but extends coverage for prevention and guidance tasks.

Security director

For events with more than 5,000 attendees (a threshold that varies by autonomous community), it is mandatory to have a security director licensed by the Ministry of the Interior. This figure is ultimately responsible for operational safety decision-making during the event and is the primary point of contact with public services.

Even if your event doesn't reach the mandatory threshold, having someone who performs the security director functions is an investment in peace of mind and effectiveness. Someone with the authority and training to decide when to evacuate, when to close an entrance, when to call for reinforcements and when to escalate to public services.

Emergency protocol: what to do when something fails

Having an emergency protocol is useless if no one knows it, if it hasn't been rehearsed, and if the communication channels fail under pressure. The protocol must be simple, known by everyone involved and tested before the event.

Types of emergency and activation levels

Define at least three activation levels: alert (an anomalous situation that requires attention but no immediate action), partial emergency (a situation that affects one zone and requires coordinated action) and general emergency (a situation that affects the entire event and may require evacuation).

For each level, define who decides on activation (security director, promoter, zone supervisor), which channels are used (radio, PA system, visual signals), what actions are executed (reinforcing a zone, partial closure, evacuation) and who notifies public services.

Evacuation protocol

Evacuation is the most extreme action and the one that can generate the most chaos if it isn't well planned. Your evacuation plan must include: primary and alternative evacuation routes for each zone of the venue, signposted meeting points communicated to the public at the start of the event, estimated evacuation time (calculated with pedestrian flow models, not wishful thinking), staff assigned to each emergency exit, a system for communicating with the public (PA system, screens, staff on foot), and coordination with emergency services for the arrival of ambulances and firefighters.

A frequent mistake is designing the evacuation on the layout without considering that the emergency exits are blocked by food trucks, that the alternative route crosses an unlit loading area, or that the meeting points are in a zone that floods in the rain. Physically walk every evacuation route before the event and fix whatever you find.

Communication during the emergency

Communication is where most plans fail. Under pressure, the walkie-talkies get saturated, people talk over each other, messages get distorted and decisions get lost. Establish a strict communication protocol: a dedicated radio channel for emergencies used only by the security director and zone supervisors, messages with a fixed structure (who you are, where you are, what's happening, what you need), and mandatory confirmation of receipt.

For communication with the public, prepare pre-recorded PA messages for the most likely scenarios (evacuation due to weather, evacuation due to a technical incident, shelter-in-place instructions). Clear messages, in Spanish and in English if the event has an international audience, with concrete instructions ("walk towards the nearest exit, marked with green lights") and without phrasing that triggers panic.

Capacity management: real-time control

Capacity isn't just a maximum number you can't exceed. It's a dynamic variable you must monitor in real time to anticipate density problems, redistribute flows and make informed operational decisions.

Legal capacity vs. operational capacity

Legal capacity is the maximum the venue's license allows. Operational capacity is the number you decide to sell, and it should be lower than the legal one. The difference gives you margin to absorb irregularities (gate-crashers, uncounted complimentary tickets, staff and suppliers) and to offer a comfortable experience instead of one on the edge of overcrowding.

A common ratio is to set operational capacity at between 85% and 95% of legal capacity, depending on the type of event. Events with high internal mobility (festivals with multiple stages) can get closer to the legal limit because people spread out. Events with a fixed main area (a concert in a venue) need more margin because density concentrates.

Real-time monitoring

Knowing how many people are inside the venue at any given moment requires a counting system that actually works, not an estimate from the security team that looks around and says "seems like a lot of people." Turnstiles and access readers with digital validation give you an exact count of entries. If you also control exits (with turnstiles or counters), you have the net capacity in real time.

If your ticketing system offers you a real-time capacity dashboard, use it as an operational tool, not just as an interesting figure. Set up automatic alerts when capacity exceeds 80% and 90% of the operational limit, and define actions for each threshold: at 80%, reinforce entrances and prepare partial closures; at 90%, slow down entry and notify the security director; at 100%, close entrances and manage the queue outside.

Density management by zone

Total capacity can be within safe limits and, even so, a specific zone can be dangerously saturated. The area in front of the main stage, the aisles between bars and the access to restrooms are the usual spots of excessive crowding.

If your venue has distinct zones (stages, themed areas, VIP zones), monitor the capacity of each zone separately. Use security staff or, in permanent facilities, cameras with counting software, to detect crowds before they become problems. When a zone exceeds the safe threshold, the options are: temporarily close access to that zone, redistribute the crowd with active communication ("the secondary stage starts in 5 minutes") or, in extreme cases, halt the activity in that zone until the density drops.

Medical setup: first aid and beyond

The medical setup isn't a bureaucratic requirement: it's the difference between a fainting spell resolved in minutes and a medical emergency that gets complicated by a lack of care.

Sizing the setup

Regulations set minimums that vary by autonomous community, but as a general reference you need at least one first-aid post per 5,000 attendees, equipped with consumable supplies, a stretcher, an automated external defibrillator (AED) and staff trained in first aid. For events over 10,000 attendees, a fully equipped (medicalized) ambulance on site is recommended.

The indicative minimum medical staffing is: 1 emergency medical technician (EMT) per 2,500 attendees and 1 physician on site for events over 5,000 people. These figures are minimums: if the event has a high-risk profile (extreme temperatures, alcohol, intense physical activity), you should increase them.

Medical attention points

The location of the medical post matters as much as its equipment. It must be accessible from any point in the venue in under 3 minutes, visible and signposted, with direct access for ambulances if evacuation to a hospital is necessary.

For large events, distribute secondary attention points (first-aid kits with basic staff) in high-density zones and reserve the main post for cases that require full equipment. The secondary points resolve 80% of cases (dizziness, minor cuts, mild heatstroke) without saturating the main post.

Attention protocol: the first few minutes

The medical attention protocol at events has a peculiarity compared with hospital care: access. Reaching the person who needs attention in the middle of a crowd is often more difficult than the care itself. Define access routes for the medical team that are kept clear at all times (don't use them as a thoroughfare for the public), establish a direct communication system between security and medical staff (a shared radio channel) and train the security staff to identify situations that require medical attention and to call for help before they escalate.

Crowd management: the science of moving crowds

Managing crowds isn't just putting security at the doors. It's designing the flow of people so that density distributes itself, bottlenecks are minimized and risky situations are prevented before they happen.

Flow design

The venue must have a logical sense of circulation that the public can follow intuitively, without needing signage on every corner. Entrances and exits must be in different zones to avoid counterflows (people entering and leaving through the same spot). Bars, restrooms and rest areas must be distributed to decentralize flows, not concentrate them in a single point.

A classic mistake is placing the restrooms at the end of a dead-end alley: the public goes in, queues and exits through the same spot, colliding with those arriving. Solution: locate the restrooms in zones with two access points or in a circuit (you enter on one side and exit on the other).

Signage

Signage saves lives, but only if it's visible, clear and unambiguous. Every emergency exit must be visible from any point in the venue under reduced lighting conditions. Wayfinding signage (where the stage, restrooms, bars and information points are) reduces wandering and questions to staff, who can focus on safety tasks.

Use signage at different heights: at ground level (illuminated arrows for evacuation), at eye level (information signs) and elevated (banners or screens visible from a distance). At nighttime events, all safety signage must be illuminated or reflective.

Barriers and fencing: protection vs. trap

Barriers and fences protect the public from falls, delimit zones and channel flows. But a poorly placed barrier can turn into a trap: if people pile up against a fence that won't give, the pressure can cause crushing. The historic tragedies at major events almost always involve rigid barriers that prevented the natural dispersal of the crowd.

Use barriers that can be opened or removed quickly in case of emergency. Fence systems with quick-opening gates and "herringbone" designs that create decompression pockets are preferable to continuous fences with no escape. And never, under any circumstances, close off an evacuation route with a barrier the public can't open from the inside.

Insurance and civil liability

Mandatory civil liability insurance

Every public event in Spain must have a civil liability insurance policy that covers the damages attendees, staff and third parties may suffer. The minimum amount varies by autonomous community and by capacity, but as a general reference the minimums range from 300,000 to 600,000 euros for events of up to 5,000 people, and from 600,000 to 1,200,000 euros for larger events.

These are legal minimums. A professional promoter should take out significantly higher coverage, because a serious injury at an event can lead to claims that far exceed the minimums. Consult a broker specialized in events who can tailor the policy to your specific risk profile.

The organizer's responsibility

As the event's organizer, you are responsible for the safety of attendees from the moment they enter until they leave the venue. This responsibility isn't fully delegated by hiring a security company or a medical service: you remain ultimately responsible for ensuring the safety plan is followed and that the resources are adequate.

Documentation is your best defense. Keep records of coordination meetings, risk assessment reports, contracts with security suppliers, insurance certificates, prior inspection reports and any communication with the authorities. If an incident occurs, the question won't only be "what happened" but "what had you done to prevent it."

Post-event safety report

What it must include

After each event, prepare a safety report that captures: recorded incidents (type, time, zone, resolution), response times of the security and medical teams, maximum capacity reached and its evolution over time, actions by public services if any, the state of the safety equipment (extinguishers used, damaged signage, displaced barriers) and observations from the security staff on points for improvement.

Lessons learned

Every incident, however minor, contains a lesson. A fainting spell from heatstroke at 3:00 PM in a shadeless zone suggests you need awnings or misting fans. A dangerous pile-up in front of the stage at the moment the headliner comes on suggests you need more breaks or a decompression barrier. An excessive queue at the entrance because it was raining and the QR codes wouldn't scan properly suggests you need marquees over the access lanes. Check out our guide on queue-free check-in to optimize these flows.

Document these lessons in a format that makes them consultable for the next edition. A promoter who makes the same mistake twice is paying for a lesson they had already learned.

Conclusion

Event safety is an investment you only notice when it's missing. Nobody leaves a festival saying "what a well-managed emergency evacuation that was," but everyone leaves saying "what a disaster of an organization" when the queues were endless, the density was suffocating or an incident ruined the experience.

Your job as a responsible promoter is to make safety invisible to the attendee and fully under control for you. That requires detailed planning, trained staff, rehearsed protocols and the humility to review what went wrong at each edition so it doesn't happen again. Tools like Futura Tickets, with features for real-time capacity management and digitalized access control, make the technological part easier. But the human part, the safety culture, depends solely on you and the decisions you make before the doors open.