Martyn's Law splits premises into two tiers by how many people may be present: standard at 200 to 799, enhanced at 800 or more. Both tiers must notify the Security Industry Authority and have public protection procedures. Only the enhanced tier must document those procedures and hand the document to the regulator. That distinction is the one most coverage gets wrong.
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, with an implementation period of at least 24 months before the requirements bite. That puts commencement at around April 2027 at the earliest. It is far enough away that nobody is panicking, and close enough that the organisations who start now will not have to.
Which tier are you in?
Scope is driven by the number of individuals who may be present, not by floor area, staff headcount or turnover. That wording matters, because a venue that averages 150 people but can hold 400 is judging itself on the wrong number.
| Tier | Capacity | Core duties |
|---|---|---|
| Out of scope | Under 200 | The Act does not apply |
| Standard | 200 to 799 | Notify the SIA; have appropriate public protection procedures. No requirement for physical security measures. |
| Enhanced | 800 or more | As standard, plus appropriate measures to reduce vulnerability, plus document the procedures and measures and provide that document to the SIA. |
What the standard tier has to do
Less than most people assume. Standard tier premises notify the SIA that they exist, and put in place appropriate public protection procedures that could reasonably be expected to reduce the risk of physical harm if an act of terrorism occurred at or near the premises.
The official ProtectUK guidance is explicit that there is no requirement to put physical security measures in place in the standard tier. Nobody is being asked to install bollards. The emphasis is on simple, low-cost procedures that staff actually know: what to do, where to go, who to tell.
What the enhanced tier has to do
Everything above, plus two additions. Enhanced tier premises must put in place appropriate measures reducing both the vulnerability of the premises to an attack and the risk of physical harm. And they must document the public protection procedures and measures in place, or proposed to be put in place, and provide that document to the Security Industry Authority.
That is a statutory documentation duty with a named recipient. It is not a policy folder that sits on a shelf; it is a document that goes to a regulator, and by implication one that has to be kept current as the premises, the layout and the staff change.
If documentation is only required at enhanced tier, why does it matter at standard?
Because the standard tier still has to have appropriate procedures, and there is a practical difference between having something and being able to show it.
A procedure that lives in one duty manager's head is not really a procedure. It cannot be trained against, it cannot be reviewed, it cannot be handed over, and it leaves the building when that person does. If the SIA, an insurer, a local authority licensing team or a corporate client asks what your procedures are, "we all know what to do" is not an answer anyone accepts.
So the honest position is this: documenting is a legal duty at enhanced tier and a practical necessity at standard tier. We would rather say that plainly than imply a requirement that does not exist.
Who is the responsible person?
The duties fall on the person responsible for the premises or event, broadly the person or organisation with control over them. Where a building has multiple occupiers, or an event runs in a venue somebody else owns, working out who holds the duty is one of the first questions to settle rather than one to discover later. The published Home Office factsheets are the place to confirm it for your own arrangement.
What good evidence looks like
Whichever tier applies, the organisations that will find commencement straightforward are the ones who can answer four questions quickly:
- What are our procedures, in their current version? One authoritative copy, not four drafts across three inboxes.
- Who has been trained, and when? Attendance records tied to the version of the procedure they were trained on.
- When did we last review it, and what changed? A dated history rather than a file with an unreliable modified date.
- Can we produce all of it on request? In minutes, by whoever happens to be on shift.
None of that is exotic. It is the same problem every regulated sector has, which is why food manufacturers preparing for a BRCGS audit and NHS organisations applying retention schedules end up describing their difficulties in almost identical words. The standard differs. The records problem does not.
Where to start, 18 months out
Two things, neither of which depends on the final guidance:
- Establish your tier honestly, on the number of people who may be present. If you are near 800, find out now which side of the line you are on, because the enhanced tier is a materially bigger piece of work.
- Get what you already have into one place. Most venues have more written down than they think, scattered across fire procedures, licensing paperwork, staff handbooks and email. Consolidating it is the slow part, and it is the part you can do today.
For venues in hospitality this sits alongside the records you already keep. Our guide to document management for hotels, restaurants and multi-site groups covers how those obligations tend to stack up, and a document management system is how most organisations stop them living in inboxes.
Sources: tier thresholds, the duties on each tier and the documentation requirement follow ProtectUK's Martyn's Law overview, the Terrorism (Protection of Premises) Act 2025 collection and the Home Office factsheets on gov.uk. Commencement had not been set at the time of writing.
Premises documentation is not the only duty of this shape. Workflow automation for compliance covers how the evidence gets produced without anyone chasing it, and the construction golden thread is the same obligation applied to buildings.
