Martyn's Law has two tiers, and the tier decides how much you have to do. Which one applies depends on how many people may be on your premises at the same time. It is the first decision every responsible person has to make, and the one the regulator is most likely to ask about.
The short version
Fewer than 200 people: not in scope.
200 to 799 people: standard tier.
800 or more people: enhanced tier.
Large ticketed public events are treated separately as qualifying events. See our guide to events.
How to count
The test is the number of people reasonably expected to be present at the same time, from time to time. That is not your average day, and it is not a worst-case fantasy. It is your busiest realistic occasion.
- Count everyone. Customers and visitors, plus staff, contractors, performers and volunteers.
- Use your busiest times. Christmas, match days, functions, open days, sales and events.
- Include the whole premises. Every area the public uses, including outdoor areas that form part of the site.
- Start from a documented figure. The capacity in your fire risk assessment is a sensible starting point, and the Home Office has published guidance on methods for assessing numbers.
- Write down how you got there. If the regulator asks, the reasoning matters as much as the number.
Standard tier: what it means
Standard tier premises must have public protection procedures in place, so far as is reasonably practicable, and make sure staff know them. There are four:
- Evacuation: getting people out safely.
- Invacuation: bringing people inside to a safer place.
- Lockdown: securing the premises to keep a threat out.
- Communication: raising the alarm and telling people what to do.
There is no legal requirement at standard tier to install physical security or to produce a formal compliance document. Writing your procedures down is still sensible, because it is the easiest way to show what you have done. The responsible person must also notify the Security Industry Authority (SIA) once its notification process opens.
Enhanced tier: what it adds
Enhanced tier premises need everything at standard tier, plus public protection measures that reduce vulnerability, so far as is reasonably practicable. These cover four areas:
- Monitoring the premises and its surroundings.
- Movement: controlling how people enter, leave and move around.
- Physical safety and security of the premises.
- Security of information, such as floor plans and security arrangements.
The procedures and measures must be documented, with an assessment of how they reduce the risk of harm, and the document sent to the SIA. The SIA has said it will provide templates. Where the responsible person is an organisation, it must designate a senior individual to oversee compliance.
Exceptions that change the answer
- Schools and other relevant education premises, and places of worship, stay in the standard tier however many people attend.
- Some premises are excluded from the Act altogether, under Schedule 2.
- Events are treated separately. A large ticketed event at premises that are not already enhanced tier can be a qualifying event with enhanced requirements.
Proportionate, not maximal
The Home Office statutory guidance is clear that the duties do not depend on how likely an attack is at your site. They ask what would help if one happened. "Reasonably practicable" means weighing what a step would achieve against its cost, time and difficulty, so a volunteer-run hall and a national chain will rightly do different things.
Common mistakes
- Counting an average day instead of the busiest realistic one.
- Forgetting staff, contractors and volunteers.
- Ignoring functions and events that push numbers past a threshold.
- Assuming standard tier means buying equipment.
- Deciding the tier but not recording why.
Penalties
For standard tier premises, the SIA can impose penalties of up to £10,000. For enhanced tier premises and qualifying events, the maximum is £18 million or 5% of worldwide revenue, whichever is higher. Further penalties can apply while a failure continues. The SIA has said it will advise and support first.
Keeping up to date. The duties are expected to come into force in spring 2027, with the date confirmed in advance. ProtectUK carries the official Martyn's Law guidance, scope flowcharts and updates, and GOV.UK has the SIA's guidance for responsible persons.
How we can help. A Martyn's Law Readiness Review works out your realistic peak numbers, settles your tier with the reasoning recorded, and gives you a written, prioritised plan for what that tier requires.
Not sure which tier you are in?
Book a free 30-minute consultation. We will help you work out whether Martyn's Law applies, which tier you are in and what a proportionate first step looks like.
Request a free 30-min call ↗This article is general information, not legal advice. It reflects the Terrorism (Protection of Premises) Act 2025, the Home Office statutory guidance published on 15 April 2026 and SIA guidance as at October 2026. Check the latest position on ProtectUK or GOV.UK, or speak to us, before relying on it for your own premises. Last updated October 2026.
