Martyn's Law: what it is, who it applies to, and what you actually have to do

Is my premises in scope?

The test is not your licensed capacity and not your floor area. It is the number of people, staff included, that it is reasonable to expect to be present at the same time, from time to time. If that number is 200 or more, and the premises is one of the uses the Act lists (shops, pubs, restaurants, halls, places of worship, schools, sports and leisure venues, visitor attractions, hotels, offices open to the public and others), it is in scope.

Two groups are treated differently. Places of worship, and early years, primary, secondary and further education settings, sit in the standard tier at any capacity. Higher education does not get that treatment and tiers normally. A short list of premises is excluded altogether: the UK and devolved legislatures, certain transport premises that already sit under an aviation, rail or port security regime, and open-access parks.

If you are not sure, the free scope check asks the same questions the Act does and gives you a straight answer. Check your venue's scope.

Which tier am I in?

200 to 799 people reasonably expected at the same time is the standard tier. 800 or more is the enhanced tier (§5.36). A premises of 200 to 799 that hosts a ticketed, publicly accessible event where 800 or more are expected stays a standard tier premises, and the event itself carries enhanced duties (§5.34).

A single unexpected busy day does not move you up a tier. The guidance says a standard tier premises that unexpectedly exceeds 800, where that could not reasonably have been expected and is not expected to recur, remains standard tier (§4.33). What matters is what you reasonably expect, and that includes any occasion you can foresee: a busy trading day, a private hire, an event you put on yourself.

What does the standard tier require?

One thing: public protection procedures, in place so far as is reasonably practicable (§7.4). The guidance names four: evacuation, invacuation (moving people to a safer place inside), lockdown and communication. It asks you to work out what is appropriate for your premises (§7.20–7.26), to make sure the people who would carry the procedures out know their roles (§7.28), and it recommends, without requiring, that you write them down (§7.32).

It does not require a terrorism risk assessment, it does not require new equipment (§7.25), and it does not require you to submit anything to the regulator. Those claims are common and they are wrong, and the guide below takes each one back to the paragraph.

Standard tier: what is actually required, and what is not

What does the enhanced tier add?

Everything the standard tier requires, plus two things. First, public protection measures under section 6 of the Act: steps that reduce the premises' vulnerability, in four areas the guidance names as monitoring, movement of people, physical safety and security, and security of information. Section 6 applies to the enhanced tier only (§6.8). Second, a written document under section 7 that states the procedures and measures in place and assesses how they reduce risk (§8.57). That document is provided to the SIA once it is first prepared, and again within 30 days of any revision (§8.60).

Where the responsible person is an organisation rather than an individual, which the guidance says it usually will be (§6.2), the enhanced tier also asks for a designated senior individual to hold the duty inside that organisation.

Who is responsible?

The Act puts the duty on the “responsible person”: whoever has control of the premises in connection with its qualifying use. For a pub that is usually the operator, not the freeholder; for a village hall it is usually the management committee; for a school it is the proprietor or trust. The guidance expects this to be an organisation or company more often than a named individual (§6.2). Where a premises is let, or shared, the question is who controls it for the use that brings it into scope, and that can be a genuinely difficult question. A dedicated guide on it is in preparation.

When does it start, and what do I have to send anyone?

Martyn’s Law is not yet in force. The SIA expects it to come into force in spring 2027 and will confirm the exact date.

A specific month gets repeated online as if it were the law. It is not. It is a reading of the Home Office's statement that implementation would take at least 24 months from April 2025. The regulator's own published position is the one above, and it will confirm the date.

On sending anything: the notification requirement exists in law but the SIA’s portal is not yet open, and you do not need to notify until the law comes into force. The standard tier submits no document to the SIA at any point; the section 7 document is an enhanced tier duty (§8.57, §8.60).

What will it cost you?

For the standard tier, the honest answer is time rather than money. The guidance is written to be done in-house by the person who runs the premises. There is no requirement to purchase equipment (§7.25), no requirement to buy advice, and the Home Office has said it will publish optional templates (§7.32). The free material on ProtectUK and GOV.UK is the primary source for everything on this page.

Komply is a paid tool that sits on top of that free route: it checks whether the Act applies, walks you through the four procedures against the guidance's own paragraphs, and turns the gaps into an action plan and a written record. It makes a venue ready. It does not, and cannot, tell you that you meet the law; only the SIA can do that. The price is on the home page, beside the free scope check, so you can see both before deciding.