You haven't done anything about Martyn's Law yet. That's fixable, starting today.
Last reviewed:
Something has just made Martyn's Law urgent for you today, whether that is a licensing renewal question, an insurer's form, a trade-press headline, or a peer mentioning it at an event, and you have not actually done anything about it yet. That is fixable, and the timing does not matter nearly as much as what happens next.
At the standard tier, the law requires two things: notify the SIA once you are the responsible person, and have four types of public protection procedure in place so far as reasonably practicable (s.5(3)). No written plan is legally required (para 7.32), no paid training, no equipment, and no consultant (para 6.7). Starting late is entirely recoverable, and there is a sensible order to work through from here.
What's actually required, and what you've probably been told
A useful habit for reading anything about Martyn's Law, including this page, is keeping "the law requires", "the guidance recommends" and "we suggest" separate. A lot of what circulates online blurs the three together.
- The law requires: notifying the SIA once you're the responsible person, and having evacuation, invacuation, lockdown and communication procedures in place so far as reasonably practicable.
- The guidance recommends: writing your procedures down, even though no document is legally required (para 7.32), and reviewing them periodically, even though there's no statutory review duty (para 7.29).
- We suggest: everything else on this page, timing, ordering, how to brief people. None of it is the law; it's what a sensible response looks like.
If you have been told you need a terrorism risk assessment, that is not accurate at the standard tier. See do you need a risk assessment. If someone has mentioned CCTV or bag searches, see does Martyn's Law require CCTV. If it is mandatory accredited training you were told about, see what training is actually required. The full requirements are in the standard tier explained.
Where to start today
These three steps do not need a whole day, and they do not finish the job either. They just turn "I haven't started" into "I know where I stand", which is most of what makes this feel manageable.
- Run the free checker. It takes two minutes, needs no email, and gives you your tier along with a plausible counting method. Check your tier now.
- Establish who your responsible person is. It is whoever controls the premises for its use, not necessarily whoever owns the building. See who the responsible person is.
- Walk your building once with the four procedures in mind. Think through how you would actually evacuate, invacuate, lock down, and tell everyone what is happening, and note what you would genuinely do rather than what an ideal version would do.
That is a real, honest start on the actual legal requirement, not homework before "the real work" begins. What comes next, turning that walk into procedures that would actually hold up, is where the real thinking happens, and it is worth giving that its own time rather than rushing it into the same session.
This week
Turn what you noted on your walk into settled procedures. That takes real thought, because a procedure that would not actually hold up under pressure is not much use to anyone, and it is worth taking the time to get each one right. What is likely to take longer, though, is making sure everyone with a role actually knows their part, which is the explicit expectation in the guidance (para 7.51). That depends on rotas, shift patterns and who is actually working which day, not just on you, and it is why this step tends to spread across several days rather than finishing in one sitting. Briefing does not need a formal course or a signed-off syllabus. A short conversation with each person, covering what they would do and who they would tell, satisfies the expectation. Keep a simple note of who you have briefed and when, because it becomes your evidence later.
Set a reminder to revisit your procedures periodically. This is not a legal duty, but it is the guidance's own recommendation (para 7.29's "although not a statutory requirement" framing), and a sensible one, given that teams and layouts change over time.
What can wait
- SIA notification, if the portal is not yet live. You cannot submit something that does not exist yet. See the current notification status.
- Any spending on physical security, including CCTV, barriers or bag searches. None of it is required at the standard tier, whatever a salesperson tells you.
- Perfect documentation. It is helpful for showing an inspector what you have done, but it is not mandated. A rough couple of pages you will tidy up later beats waiting for a polished version that never gets written. See whether a written plan is required.
Am I too late? Will I be fined straight away?
Before the Act's duties commence, expected in spring 2027, nobody is legally behind yet. Once they do, the standard-tier process is civil, not criminal. It tops out at £10,000, plus up to £500 a day for continuing non-compliance with a notice (paras 9.14, 9.16). A penalty can, in principle, be issued directly rather than only after an ignored notice (para 9.12), so "I'll get a warning first" is not a safe assumption. But a sudden fine is not the realistic picture either, for a venue that is simply getting started. If criminal offences come up in anything you read, remember what the guidance itself says. Standard-tier non-compliance with a compliance notice "is not a criminal offence" (figure 16). See the full penalties picture for the numbers.
Start with the two-minute step that makes everything else concrete. Check your tier for free.
Common questions
Do I need a consultant to catch up?
No. The guidance states plainly that "it is not mandatory to use third-party products or services to comply with the Act's requirements" (para 6.7). See when a consultant genuinely helps if you're weighing it up regardless.
Is there an official free option?
Yes. ProtectUK runs free ACT e-learning, and the Home Office has said optional, indicative templates are coming (para 7.32). We always point you to genuinely free official resources, not just our own.
How long will this actually take?
For most standard-tier venues, the genuine work can take from a few days to a week, not the weeks or months many people assume. See how long Martyn's Law compliance takes for the honest breakdown.
What if I get inspected before I'm finished?
Being behind is recoverable, and honesty about what's still in progress is the right response to an inspector. See your plan for the 72 hours before an inspection.
About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: . Read the official guidance on GOV.UK.
Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.