Do you need software or a consultant for Martyn's Law?

The regulator's own position first, then the three routes a venue can take, with what each one adds and what none of them can take off your hands.

Komply sells software for Martyn's Law, so it is fair to read this page with some suspicion. That is why it starts with what the regulator says. It sets out the free route first. And it is plain about what software, including ours, cannot do.

What the guidance and the regulator say

The Home Office's statutory guidance, issued under section 27 of the Terrorism (Protection of Premises) Act 2025, deals with outside help in one paragraph:

"It is not mandatory to use third-party products or services to comply with the Act's requirements. However, the responsible person may contract relevant services to assist in meeting their obligations under the Act if they deem it necessary, helpful or appropriate (for example, a security provider, contractor and/or consultant who can advise on vulnerabilities, and appropriate public protection procedures or measures)." (§6.7)

The responsible person is the person or organisation in control of the venue. The same paragraph goes on to say that the responsible person stays liable (legally responsible). They should also be satisfied that any support they buy is "suitable to meet their requirements, properly resourced and effectively delivered" (§6.7).

ProtectUK, the counter terrorism policing website, says the same. It says the government's intent is that those responsible for premises and events in scope "can comply with the Act without needing to buy specialist services in respect of compliance." It also says: "Please be aware neither the Home Office nor the SIA endorses any third-party products offered by the private sector."

The Security Industry Authority (SIA), which will regulate the Act, says: "Neither the SIA nor the Home Office is able to endorse or recommend specific companies or services for compliance with this legislation, as it would be inappropriate for a government agency to do so."

That includes Komply. Nobody selling in this market is endorsed by the Home Office or the SIA. Anyone who suggests otherwise is telling you something the regulator has publicly said is not true.

Route 1: do it yourself with the free official material

What it involves. For a standard tier venue (broadly, one that can reasonably expect 200 to 799 people at the same time), the duty is to have public protection procedures in place (what your staff do if an attack happens), so far as is reasonably practicable (§7.4). The guidance names four: evacuation, invacuation, lockdown and communication. Evacuation is getting people out. Invacuation is moving people inside to a safer place. Lockdown is securing the building to stop people getting in. Communication is telling people what is happening. What is "reasonably practicable" is weighed against your own circumstances:

"In determining what is reasonably practicable, the responsible person should consider the specific circumstances and nature of the qualifying premises or event, including the resources available to them – for example, financial resources and staffing levels." (§7.23)

There is no requirement to buy equipment either: "There is no statutory requirement in the Act to make any physical alterations or to purchase specific equipment relating to putting public protection procedures in place." (§7.25)

Where the material is. The statutory guidance and its supplementary documents (extra documents that go with it) are on GOV.UK. For good practice beyond the legal minimum, the guidance points to the same free sources: "visit ProtectUK, NPSA or see supplementary document C" (§8.55). NPSA is the National Protective Security Authority. It is careful about their status: "there is no statutory requirement to put in place the recommendations from this additional material" (§1.5). Templates are on the way too: "Templates will be developed which are optional and indicative" (§7.32).

What it costs. Time, mainly yours and your managers'. You read the guidance, walk round the building, agree what staff would do, tell them, and write it down.

Who it suits. A single standard tier venue, run by someone with a few hours to read and think. This is the route the guidance is written for.

Route 2: a consultant or security adviser

What they add. Experience. The guidance's own example is a contractor who can advise "on vulnerabilities, and appropriate public protection procedures or measures" (§6.7). A good adviser has seen many buildings. They can spot what you would miss in your own.

What they cannot do. Take the duty off you. Under §6.7, the responsible person stays liable whatever they buy. They are expected to check that the help is suitable and is actually delivered. A report on a shelf does not mean your staff know what to do.

What it costs. Whatever is agreed. Ask for a fixed scope (exactly what they will do) and a fixed price. Ask which paragraphs of the guidance each recommendation rests on.

Who it suits. Enhanced tier premises and qualifying events. The enhanced tier is the higher tier, above standard. There, the Act also asks for public protection measures (steps that make the venue less vulnerable to attack) and a written document. It also suits sites complicated enough that an outside eye is worth paying for. It is rarely needed for a straightforward standard tier venue.

Route 3: software

What it adds. Structure and a record. Good software takes you through the guidance one question at a time. It shows you where the gaps are and turns them into a list of things to do. It keeps your answers and evidence in one place you can show someone later. When the official templates arrive, they will be blank forms. Software fills in its document from your own answers.

What it cannot do. It cannot certify you. It cannot submit anything to the SIA for you. It cannot promise that you meet the law. Once the Act is in force, only the SIA can assess that. Software is also only as good as the answers you give it.

What it costs. A subscription. Komply's current prices are on the home page, next to the free scope check, so you can see both before you decide anything.

Who it suits. Venues that want to be walked through it, rather than start from a blank page. Venues that want a record kept for them. And anyone running more than one site who wants each one set up the same way.

Five questions to ask anyone selling you help

Whichever route you are thinking about, these questions sort useful help from expensive noise:

1. "Which paragraph of the guidance says that?" Every real requirement has one. Our guide to what the standard tier actually requires goes through five claims that do not.
2. "Are you saying you are endorsed by the Home Office or the SIA?" If the answer is yes, walk away. Neither of them endorses (backs) any product.
3. "Can you register me with the SIA today?" Nobody can. The notification portal is not open yet. The requirement applies only once it comes into force. Our page on when Martyn's Law comes into effect has the details.
4. "Do I need to buy equipment?" Not at the standard tier (§7.25). Any physical change is a judgement about what is reasonably practicable for your building. It is not a shopping list.
5. "What happens to the duty if I hire you?" The right answer is that it stays with you (§6.7). An adviser who says otherwise is overselling.

The short version

You can meet Martyn's Law on your own, for nothing but your time. You use the guidance and the free material it points to. A consultant can add experience, and is most useful at the enhanced tier. Software can add structure and a record. None of them can take the responsibility off you. None of them is endorsed by the government.

Komply is a paid tool that sits on top of the free route. It makes a venue ready and keeps the record. It does not, and cannot, tell you that you meet the law. Only the SIA can do that, once the Act is in force.