The regulator is describing itself as supportive first
The draft sets out a supportive, proportionate and risk-based approach to the use of the SIA's powers. That language matters. It signals that the early enforcement posture is likely to be about bringing organisations into compliance rather than making examples of them, and that engagement before commencement will count for something.
It does not mean the powers are soft. Compliance notices, restriction notices and monetary penalties are all available, and at the enhanced tier the ceiling is the greater of £18 million or 5 per cent of qualifying worldwide revenue. But the sequencing described in the draft suggests those are the end of a road, not the start of one.
What this means for how you should be preparing
If the regulator is going to be interested in whether you turned your mind to the problem, then the document that matters is not the procedure. It is the assessment that produced the procedure, and the record showing when it was done, on what basis, by whom, and when it will next be reviewed.
That is a low bar for an organisation that has done the work properly and an unreachable one for an organisation holding a template it bought in 2025.
Three things worth doing before the final guidance lands
First, fix your capacity basis. Everything downstream depends on the tier, and the tier depends on a number most organisations have calculated wrongly. Second, establish in writing who holds the responsible person duty at each premises, particularly where premises are hired out. Third, run one exercise, however informal.
The document that matters is not the procedure. It is the assessment that produced it.
What we are watching for in the final guidance
The notification mechanism and the portal are the practical unknowns. How that process works, and how much lead time organisations get before notification opens, will shape the first six months after commencement more than anything in the guidance text.