Martyn's Law standard tier: what is actually required, and what is not

Search for the standard tier and you will get a confident summary at the top of the page. On 14 September 2026 Google's AI Overview for "martyn's law standard tier" listed "Registration: notify the Security Industry Authority" as a key requirement, and its Overview for "martyn's law risk assessment" said the standard tier must "conduct a basic terrorism risk assessment". Several Overviews give a single month as the date everything starts.

Each of those claims is checked below against the Home Office's statutory guidance, issued under section 27 of the Terrorism (Protection of Premises) Act 2025 and published on 15 April 2026. Every paragraph number is that guidance's own. Where the guidance uses "must" it means a legal requirement; where it uses "should" it means something strongly recommended but not required (§7.1). That distinction is the whole point of this page.

Claim 1: "The standard tier must carry out a terrorism risk assessment"

Not what the guidance says. The standard tier duty, in section 5 of the Act, is to have public protection procedures in place. The guidance describes the procedures chapter as a process of working out what is appropriate for your premises (§7.20–7.26), and it names four kinds of procedure: evacuation, invacuation, lockdown and communication. Nowhere in that chapter is a risk assessment named as a document you have to produce.

The word "assessment" does appear in the guidance, but in the enhanced tier. Section 7 of the Act requires enhanced tier premises and qualifying events to prepare a document that includes an assessment of how their procedures and measures reduce risk (§8.57). That is an enhanced tier duty and it does not reach down to the standard tier.

Thinking carefully about what could happen at your premises is obviously sensible, and it is how you decide which procedures are appropriate. But if someone tells you the law requires a standard tier venue to commission or complete a "terrorism risk assessment", ask them for the paragraph. There is not one.

Claim 2: "You must register with the SIA"

True in law, not yet in force, and there is nothing to do today. The Act does contain a notification duty, and the regulations that define what has to be notified were made on 9 July 2026. The guidance's own position is that the Secretary of State sets the timescales and the information required by regulations (§7.64). What does not yet exist is a way to do it: the SIA's notification portal is not open, and the notification requirement comes into force only when the relevant section of the Act does.

So the honest version of this claim is: a notification requirement exists in law, the SIA's portal is not yet open, and you do not need to notify until the law comes into force. Anyone offering to "register you with the SIA" today is offering something that cannot currently be done.

Claim 3: "You must submit your procedures to the SIA"

Not for the standard tier. The document that goes to the SIA is the section 7 document, and section 7(2) applies only to the responsible person for enhanced tier premises or qualifying events (§8.57). It is that document which has to be provided to the SIA and provided again within 30 days of a revision (§8.60). A standard tier venue has no statement to write and nothing to submit.

What the guidance says about writing things down at the standard tier is worth reading in full, because it is often misquoted:

"Within the standard tier requirements, there is no legal requirement to prepare a document stating the procedures in place and an assessment of how they may be expected to reduce the risk of physical harm if an act of terrorism were to occur. However, the responsible person should prepare a document like this to provide a basis for ensuring the procedures can be effectively understood and communicated to staff. It may also be difficult to demonstrate compliance with the Act, for example in the event of an inspection by the SIA, if the procedures are not documented in some form. Templates will be developed which are optional and indicative." (§7.32)

Read that with §7.1's key beside it. "No legal requirement" is the law. "Should prepare" is a strong recommendation. The Home Office is also promising free templates, and it has said publicly that no third-party product is endorsed by it or by the SIA. Writing your procedures down is a good idea for exactly the reasons the paragraph gives. It is not a submission.

Claim 4: "It all comes into force in a fixed month next year"

The Act is not yet in force, and no commencement date has been set. What the SIA has said, on GOV.UK, is that it expects the Act to come into force in spring 2027 and will confirm the exact date ahead of time. That is an official expectation, attributed to the regulator, and it is the most that can honestly be said. A specific month you will see repeated online is a reading of the Home Office's earlier statement that implementation would take at least 24 months from April 2025. It is commentary, not a commencement order.

There is a second, quieter error in the "everything lands on one date" framing. The section 5 duty is a continuing one. Nothing falls due on commencement day and nothing expires after it. What changes on that day is that the duty becomes enforceable. The procedures either exist and work by then, or they do not.

Claim 5: "You will need new equipment, CCTV or a consultant"

None of those is a standard tier requirement. The guidance is explicit that existing doors, locks, shutters and barriers can be used to implement a lockdown, and that there is no requirement to purchase specific equipment (§7.25). Public protection measures, which is the part of the Act that talks about monitoring, movement control, physical security and information security, is section 6, and section 6 applies to the enhanced tier only (§6.8). If a supplier tells you the standard tier requires a physical security upgrade, they are describing the enhanced tier, or nothing in the Act at all.

Consultants are in the same position. The guidance is written so that the person who runs the premises can do this work themselves. There is no duty to buy advice, and the free official material on ProtectUK and GOV.UK is the primary source for everything on this page.

What the standard tier actually requires

Stripped of the additions, the duty is this:

• Have public protection procedures in place, so far as is reasonably practicable (§7.4), for the four situations the guidance names: evacuation, invacuation, lockdown and communication.
• Make them appropriate to your premises, by thinking through what would work in your building with your staff (§7.20–7.26). This is where the honest version of "assess your risk" lives: it is thinking, not a form.
• Make sure the people who would carry them out know what to do (§7.28). Staff roles, and whether the procedure can be put into effect quickly, are what the guidance asks you to consider.
• Write them down, even though you do not have to (§7.32), because that is how staff learn them and how you show an inspector what exists.

Everything else on the list above, the risk assessment, the submission, the equipment, the adviser, belongs either to the enhanced tier or to nobody.

What this means for your venue

If you run a pub, a café, a village hall, a shop, a gym or any other premises that sometimes holds 200 or more people, the work is smaller than the internet makes it sound and it is entirely within your own control. Decide what your staff would do in each of the four situations. Check it would actually work in your building. Tell the staff. Write it down. Review it when something changes.

Komply helps you do exactly that: it checks whether the Act applies to your premises, walks you through the procedures against the guidance's own paragraphs, and turns the gaps into an action plan and a written record. It makes a venue ready. Only the SIA can say whether a venue meets the law, and the SIA is not yet open for business.

One caution that applies to this page as much as to any other: the SIA has said it will publish its own guidance on how it will regulate, and the Home Office has promised templates. When either arrives, the practical detail above may change. The paragraph references will not, and they are the thing to check.