An attendee faints in the pit. A group pushes against a barrier that was never designed to withstand lateral pressure. A storm that wasn't in the forecast rolls in and the marquees start to give way. The bar furthest from the main stage is left without staff because everyone has gone to reinforce the entrances. It's eleven o'clock on a Saturday night in July, and you are responsible for making sure all of this is resolved without anyone getting hurt.
Event security isn't a form you fill in to get your licence. It's the invisible structure that holds everything else up: the attendee experience, the viability of the business, your legal liability and your professional reputation. A serious incident destroys in minutes what you've built over years. And the worst part is that most serious incidents were avoidable with planning, training and protocols that someone decided were "fine as they are" without reviewing them.
In this guide we walk through event security, from Spanish regulation to the specific operational protocols you need ready. No empty theory: real ratios, checklists and the mistakes that promoters with years of experience still make.
What security regulations does the law require in Spain?
Regulation of security at shows and recreational activities in Spain sits between national and regional legislation. The result is a regulatory patchwork that every promoter must know for wherever they operate.
The national baseline: RD 2816/1982 and later updates
The General Regulation on Public Shows and Recreational Activities (Reglamento General de Policía de Espectáculos Públicos y Actividades Recreativas, Real Decreto 2816/1982) remains the national reference, even though it is decades old. It sets out the general principles on safety conditions, capacity, fire protection, sanitary facilities and the organiser's responsibilities.
In practice, though, application depends largely on the autonomous communities. Since 1982, powers over shows have gradually been transferred, and each community has developed its own rules. A festival in Catalonia therefore has different requirements from one in Andalusia or the Community of Madrid, not only in administrative procedures but also in security ratios, notification deadlines and required documentation.
Regional regulations: the differences that matter
Law 17/1997 on shows in the Community of Madrid, Decree 112/2010 in Catalonia, Law 14/2010 in the Valencian Community and their equivalents elsewhere set specific requirements you need to know in detail if you operate in that territory.
The most relevant differences between communities concern: deadlines for submitting the declaration of responsibility or authorisation application (between 10 and 30 working days depending on the community), minimum security staffing ratios (from 1 steward per 150 to 1 per 250 attendees), whether a security director is required above a certain capacity (generally 5,000 people, but it varies), and the specific requirements for self-protection plans.
The Self-Protection Plan under the NBE
For events with a capacity above 2,000 people, or below that if they are held in venues that require it, you must draw up a Self-Protection Plan under Real Decreto 393/2007 (the Basic Self-Protection Standard, Norma Básica de Autoprotección). This document is not a formality. It is your roadmap in an emergency, and the document the authorities will review if something goes wrong.
The Self-Protection Plan must include: a detailed description of the site and its access points, identification of risks (natural, technological, and those arising from crowds), available protection measures, an emergency action plan with defined roles, an evacuation plan with routes and assembly points, and integration with the municipality's civil protection plans.
If your event takes place outside Spain, the requirements are different. See the guide to capacity and safety at events in Germany (VStättVO), the one on the event permit in the Netherlands (evenementenvergunning), and what Martyn's Law in the United Kingdom requires.
How do you draw up a security plan step by step?
An effective security plan isn't written the week of the event. You start working on it the moment you confirm the date and the venue, and you refine it as you pin down the format, the expected capacity and the programme.
A risk assessment specific to the event
Every event has a different risk profile. An electronic music concert with 8,000 people in an enclosed venue doesn't carry the same risks as an outdoor food fair with 3,000 family attendees. The assessment should consider factors such as the demographic profile of the audience (age, alcohol consumption habits), the layout of the space (enclosed vs. open, flat vs. sloping ground), foreseeable weather conditions, the presence of pyrotechnics or other special effects, the duration of the event (a 4-hour event vs. a 3-day festival) and the record of incidents at previous editions or similar events.
Classify each risk you identify by likelihood (high, medium, low) and impact (catastrophic, serious, moderate, minor), and prioritise mitigating those that combine high likelihood with serious or catastrophic impact. Don't try to mitigate every risk equally: resources are finite, and spreading them evenly means the serious risks don't get enough attention.
Designing the security deployment
The security deployment defines how many people you need, with what profile, in which positions and under which protocols. This design should start from the risk assessment and the venue plan, not from the inertia of "what we did last year".
Define zones with different risk levels. Higher-risk zones (the stage pit, high-density bar areas, main entrances) need more staff, and more qualified staff. Lower-risk zones (rest areas, car parks) can be covered at a lower ratio. Each zone must have an identified person in charge who answers to the security director.
Coordination with public services
Communication with the Local Police, Civil Protection, SAMUR/fire services and medical services is neither optional nor a mere formality. These services need to know your security plan, your capacity forecasts, your traffic plan, your own resources and your communication channels well in advance so they can prepare their own deployment.
The prior coordination meeting (usually convened by the municipality's Security Board, Junta de Seguridad) is your chance to validate your plan with the professionals who will lead the response if something gets out of hand. Bring your updated Self-Protection Plan, the venue plan with access and evacuation points marked, the contact details of your security team and any relevant information on specific risks.
Plan on the assumption that an authorisation can fall through at the last minute. In July 2026, the Belgian municipalities of Boom and Rumst and the provincial governor banned fireworks and any pyrotechnics on the first weekend of Tomorrowland on the advice of the fire service, with the region on an orange fire-risk alert. On the second weekend, large aerial fireworks were not authorised either. We covered it in our piece on the permit that fell five days before. If any element of your production depends on a permit that is conditional on weather risk, have the alternative and the message to the public ready before you need them.
How much security staff does an event need?
One of the most common questions promoters ask is how much security staff to hire. The answer depends on many factors, but there are indicative ratios that work as a starting point.
Access stewards
For access control, the usual ratio is 1 steward per validation lane, plus one supervisor for every 4-5 lanes. How many people each lane processes per hour depends on the technology (QR or NFC wristbands), on bag checks and on the team's experience, so measure it in a rehearsal at your venue. Work out the door-opening window, divide your expected attendance by it, and you have the throughput you need. Then divide that throughput by the capacity per lane and you have the number of lanes (and stewards).
For example, for a 5,000-person event with a 2-hour door window you need a throughput of 2,500 people/hour. If each lane processes 200 people/hour in your rehearsal, that's 12-13 access lanes and therefore 13 stewards plus 3 supervisors. If you want to go deeper on sizing your entrances, see our access control guide for events.
Security staff inside the venue
Inside the venue there is no single national ratio: the minimum number of security guards is set by the autonomous community's entertainment rules, usually by capacity band and type of venue, and is specified in each event's authorisation. Above that minimum, risk decides: events that sell alcohol, draw a young crowd and run at night need more staff than daytime family events without alcohol. Ask the authority that licenses the event and your security company for the required figure in writing.
In addition to licensed security guards, you need auxiliary staff (access stewards, security hosts) who manage flows, spot build-up areas and channel evacuations. These staff do not replace security guards, but they extend coverage for prevention and guidance tasks.
Security director
For events with more than 5,000 attendees (a threshold that varies by autonomous community), you must have a security director accredited by the Ministry of the Interior. This person has final responsibility for operational security decisions during the event and is the main point of contact with public services.
Even if your event doesn't reach the mandatory threshold, having someone who performs the security director's functions is an investment in peace of mind and effectiveness. Someone with the authority and training to decide when to evacuate, when to close an entrance, when to call for reinforcements and when to escalate to public services.
What should the emergency protocol include?
An emergency protocol is useless if nobody knows it, if it hasn't been rehearsed and if the communication channels fail under pressure. The protocol must be simple, known to everyone involved and tested before the event.
Types of emergency and activation levels
Define at least three activation levels: alert (an anomalous situation that needs attention but not immediate action), partial emergency (a situation affecting one zone that requires coordinated action) and general emergency (a situation affecting the whole event that may require evacuation).
For each level, define who decides activation (security director, promoter, zone manager), which channels are used (radio, public address, visual signals), which actions are carried out (zone reinforcement, partial closure, evacuation) and who informs public services.
Evacuation protocol
Evacuation is the most extreme action and the one that can generate the most chaos if it isn't well planned. Your evacuation plan must include: primary and alternative evacuation routes for each zone of the venue, assembly points that are signposted and announced to the public at the start of the event, estimated evacuation time (calculated with pedestrian flow models, not wishful thinking), staff assigned to each emergency door, a system for communicating with the public (public address, screens, staff on foot), and coordination with emergency services for the arrival of ambulances and fire engines.
A common mistake is designing the evacuation on the plan without considering that the emergency doors are blocked by food trucks, that the alternative route crosses an unlit loading area, or that the assembly points are in an area that floods when it rains. Walk every evacuation route in person before the event and fix what you find.
Communication during the emergency
Communication is where most plans fail. Under pressure, walkie-talkies get saturated, people talk over each other, messages get distorted and decisions get lost. Set a strict communication protocol: a radio channel reserved for emergencies, used only by the security director and zone managers; messages with a fixed structure (who you are, where you are, what is happening, what you need); and mandatory confirmation of receipt.
For communicating with the public, prepare pre-recorded announcements for the most likely scenarios (evacuation due to weather, evacuation due to a technical incident, shelter-in-place instructions). Messages should be clear, in Spanish and in English if the event has an international audience, with specific instructions ("please walk to the nearest exit, marked with green lights") and without expressions that cause panic.
How do you manage capacity in real time?
Capacity isn't just a maximum number you can't exceed. It's a dynamic variable that you must monitor in real time to anticipate density problems, redistribute flows and make informed operational decisions.
Legal capacity vs. operational capacity
Legal capacity is the maximum allowed by the venue's licence. Operational capacity is the number you decide to sell, and it should be lower than the legal figure. The difference gives you room to absorb irregularities (gate-crashers, uncounted guest passes, staff and suppliers) and to offer a comfortable experience rather than one at the edge of overcrowding.
Operational capacity should stay below legal capacity, and the margin depends on the type of event. Events with high internal mobility (festivals with multiple stages) can get closer to the legal figure because people spread out. Events with a fixed main area (a concert in a hall) need more margin because density is concentrated.
Real-time monitoring
Knowing how many people are inside the venue at any moment requires a counting system that genuinely works, not an estimate from a security team that looks around and says "there seem to be a lot of people". Turnstiles and access readers with digital validation give you an exact count of entries. If you also control exits (with turnstiles or counters), you have net capacity in real time.
If your ticketing system offers a real-time capacity dashboard, use it as an operational tool, not just an interesting data point. Configure automatic alerts for when attendance exceeds 80% and 90% of the operational limit, and define actions for each threshold: at 80%, reinforce entrances and prepare partial closures; at 90%, slow down entry and inform the security director; at 100%, close entrances and manage the queue outside.
Density management by zone
Total attendance can be within safe limits and a particular zone can still be dangerously overcrowded. The area in front of the main stage, the corridors between bars and the access to toilets are the usual points of excessive build-up.
If your venue has distinct zones (stages, themed areas, VIP areas), monitor the capacity of each zone separately. Use security staff or, in permanent installations, cameras with counting software, to detect build-ups before they become problems. When a zone exceeds the safe threshold, the options are: temporarily close access to that zone, redistribute the crowd with active communication ("the second stage starts in 5 minutes") or, in extreme cases, halt the activity in that zone until density drops.
What medical provision does the event need?
Medical provision isn't a bureaucratic requirement. It's the difference between a faint that is resolved in minutes and a medical emergency that gets worse for lack of care.
Sizing the provision
Regulations set minimums that vary by autonomous community, but as a general reference you need at least one first-aid post per 5,000 attendees, with consumable supplies, a stretcher, a semi-automatic defibrillator (AED) and staff trained in first aid. For events above 10,000 attendees, an advanced life support ambulance at the venue is recommended.
There is no single national figure for minimum medical cover: the regional rules and the self-protection plan set it according to capacity and the event's risk, and the licensing authority reviews it. If the event has a high risk profile (extreme temperatures, alcohol, intense physical activity), size it above that minimum.
Medical points
The location of the medical post matters as much as its equipment. It must be reachable from any point in the venue in under 3 minutes, visible and signposted, with direct access for ambulances if a hospital transfer is needed.
For large events, distribute secondary points (first-aid stations with basic staff) in high-density areas and reserve the main post for cases that require full equipment. Secondary points handle 80% of cases (dizziness, minor cuts, knocks, mild heat exhaustion) without overloading the main post.
Care protocol: the first minutes
Medical care at events has one peculiarity compared with hospital care: access. Reaching the person who needs help in the middle of a crowd is often harder than the treatment itself. Define access routes for the medical team that are kept clear at all times (don't use them as a thoroughfare for the public), set up a direct communication system between security and medical staff (a shared radio channel) and train security staff to identify situations that need medical attention and to call for help before they escalate.
When a specific ambulance is required, depending on capacity and type of event, is covered in the guide When is an ambulance mandatory at an event?.
What is crowd management and how is it applied?
Managing crowds isn't just putting security on the doors. It's designing the flow of people so that density is spread out, bottlenecks are minimised and risk situations are prevented before they happen.
Flow design
The venue must have a logical direction of circulation that the public can follow intuitively, without needing signs on every corner. Entrances and exits should be in different areas to avoid counterflows (people coming in and going out the same way). Bars, toilets and rest areas should be distributed to decentralise flows, not concentrate them in one place.
A classic mistake is putting the toilets at the end of a dead-end alley: people go in, queue and leave the same way, colliding with those arriving. The solution is to locate toilets in areas with two access points or in a loop (you enter on one side and leave on the other).
Signage
Signage saves lives, but only if it is visible, clear and unambiguous. Every emergency exit must be visible from any point in the venue in low-light conditions. Wayfinding signage (where the stage, toilets, bars and information points are) reduces wandering and questions to staff, who can then focus on security tasks.
Use signage at different heights: at floor level (illuminated arrows for evacuation), at eye level (information signs) and raised (banners or screens visible from a distance). At night-time events, all safety signage must be illuminated or reflective.
Barriers and fencing: protection vs. trap
Barriers and fences protect the public from falls, delimit zones and channel flows. But a badly placed barrier can become a trap: if people build up against a fence that doesn't give way, the pressure can cause crushing. The historic tragedies at large events almost always involve rigid barriers that prevented the crowd from dispersing naturally.
Use barriers that can be opened or removed quickly in an emergency. Fencing systems with quick-release gates and "herringbone" layouts that create decompression pockets are preferable to continuous fences with no escape. And never, under any circumstances, close an evacuation route with a barrier that the public cannot open from the inside.
What insurance and liability are mandatory?
Mandatory public liability insurance
Every public event in Spain must have public liability insurance covering damage that attendees, staff and third parties may suffer. The minimum amount is set by each autonomous community, usually by capacity band, so there is no single figure for the whole of Spain: check it in your community's entertainment rules and in the event authorisation.
These are legal minimums. A professional promoter should take out significantly higher cover, because a serious injury at an event can generate claims that far exceed the minimums. Consult a broker who specialises in events and can tailor the policy to your specific risk profile.
The organiser's liability
As the event organiser, you are responsible for the safety of attendees from the moment they enter until they leave the venue. This responsibility is not fully delegated when you hire a security company or a medical service: you remain ultimately responsible for ensuring the security plan is followed and the resources are adequate.
Documentation is your best defence. Keep minutes of coordination meetings, risk assessment reports, contracts with security providers, insurance certificates, reports from prior inspections and any communication with the authorities. If an incident occurs, the question won't just be "what happened" but "what had you done to prevent it".
Non-profit associations have their own particularities; they are covered in the guide to insurance for cultural associations that organise events.
Why write a post-event security report?
What it should include
After every event, write a security report covering: recorded incidents (type, time, zone, resolution), response times of the security and medical teams, peak attendance reached and how it evolved over time, actions by public services if there were any, the condition of safety equipment (extinguishers used, damaged signage, displaced barriers) and security staff observations on points for improvement.
Lessons learned
Every incident, however minor, contains a lesson. A heat-related faint at 3 p.m. in an area without shade suggests you need awnings or misting systems. A dangerous build-up in front of the stage when the headliner played suggests you need more breaks between acts or a decompression barrier. An excessive queue at the entrance because it was raining and the QR codes weren't scanning well suggests you need canopies over the access lanes. See our guide on queue-free check-in to optimise these flows.
Document these lessons in a format that makes them easy to consult for the next edition. A promoter who makes the same mistake twice is paying for a lesson already learned.
And what does Futura Tickets offer in this area?
In its operational guide, Futura Tickets recommends configuring capacity alerts at 80% and 95% of each zone's capacity, so the security team receives the warning before reaching the operational limit you set for the venue. At the entrances, the Futura Tickets app validates a QR code in 1-2 seconds and an NFC wristband in under 1 second, which reduces the queues that complicate an evacuation. Futura Tickets RFID/NFC wristbands and cards take payments 100% offline, in under a second, even if the network goes down, so access control and restricted-zone control keep working during a connectivity outage. And on GDPR liability, with Futura Tickets the attendee database is 100% the organiser's: emails and phone numbers are delivered in full, which matters if you need to locate attendees after an incident.
Conclusion
Event security is an investment you only notice when it's missing. Nobody leaves a festival saying "how well the emergency evacuation was handled", but everyone leaves saying "what a disastrous organisation" when the queues were endless, the density was overwhelming or an incident ruined the experience.
Your job as a responsible promoter is to make security invisible to the attendee and fully under your control. That takes detailed planning, trained staff, rehearsed protocols and the humility to review what went wrong at each edition so it doesn't happen again. Tools like Futura Tickets, with real-time capacity management and digitised access control, make the technology side easier. But the human side, the safety culture, depends entirely on you and the decisions you make before the doors open.