Martyn's Law standard tier: what's actually required

Last reviewed: 15 July 2026

At the standard tier, Martyn's Law asks for two things: notify the regulator that your premises exists, and have public protection procedures in place, so far as reasonably practicable. No written plan, no risk assessment, no security equipment and no consultant are legally required. Here is exactly what the two duties involve, and the full list of what they don't.

Are you standard tier?

The standard tier covers premises where 200 to 799 people, including everyone working there, can reasonably be expected at the same time, from time to time. That's most decent-sized pubs, village halls, churches, gyms, restaurants and community venues in the country. See who Martyn's Law applies to for the full scope test, and the "from time to time" rule if an occasional big day, rather than a normal week, is what puts you near the line. Not sure? The free checker gives you a straight answer in about two minutes.

Duty 1: notify the SIA

Section 9 of the Act requires a one-time notification to the Security Industry Authority that your premises exists. The detailed timing and information requirements are still to be set by regulations, and the notification portal isn't live yet; see the current timeline for where that stands. There's nothing to submit today, but it's worth knowing this duty is separate from, and simpler than, the procedures duty below.

Duty 2: four public protection procedures

Section 5 of the Act requires you to have appropriate public protection procedures in place, so far as reasonably practicable, to reduce the risk of physical harm if an act of terrorism occurred at your premises or in the immediate vicinity. Four types:

• Evacuation (paras 7.33–7.38): getting people out and away from danger. For a small venue, this usually means knowing your exits, who directs people to them, and where to avoid, not building works.
• Invacuation (paras 7.39–7.40): moving people to a safer place inside, or bringing them in from outside. A pub bringing beer-garden customers indoors and locking the gate is a typical example.
• Lockdown (paras 7.41–7.45): securing the premises to keep danger out. Knowing which doors lock from inside, where the keys are kept, and whether any doors release automatically on a fire alarm.
• Communication (paras 7.46–7.49): alerting everyone quickly and telling them what to do. Short, calm, specific instructions beat a vague announcement or an unexplained alarm.

"So far as reasonably practicable" means proportionate to your venue: the guidance says to weigh what achieves the objective against the cost, time and difficulty of doing it (para 7.20 area). One simple, well-understood procedure beats several complicated ones; the guidance's own example is a bar that wrote multiple evacuation procedures for different attack types, watched staff freeze in a practice because they couldn't tell which to use, and replaced them with one.

The duty people miss: staff must know their role

"…those working at the premises with responsibility for carrying them out… must be made aware of the procedures and their specific role."

Statutory guidance, para 7.51

There is no mandatory training course. But a plan nobody has read doesn't satisfy the Act: the guidance warns that a written procedure which can't be carried out rapidly and effectively "is not sufficient" (para 7.8). Whatever you put in place, keep a record of who has been briefed on what, and when.

What is NOT required at the standard tier

• A written document, genuinely not a legal requirement (para 7.32). The guidance still says you should write your procedures down, because demonstrating compliance at an inspection without documentation is close to impossible. But nobody can lawfully tell you a written plan is mandatory.
• Paid training (paras 7.51, 7.55; the guidance's example is a village hall rightly ignoring a course costing thousands).
• Equipment or building works (para 7.25).
• Buying any product or service, including ours (para 6.7).
• An annual review. Reviewing periodically is recommended good practice, not statute (para 7.29; contrast para 8.5).
• A risk assessment document, a designated senior individual, or submitting anything to the regulator. Those are enhanced tier (800+) requirements. The standard tier notifies the SIA it exists, and that's it.

How you'd demonstrate compliance if inspected

Inspections will usually come with at least 72 hours' written notice (para 9.4), and inspectors can view documents, including electronic ones, take copies, and ask you to explain them (para 9.5). Nothing written is legally required, but this is exactly why the guidance recommends it anyway: a written record is the difference between a calm five-minute conversation and trying to reconstruct your thinking on the spot. A useful test for your preparations: if the letter arrived tomorrow, could you hand over your procedures, your occupancy assessment, and evidence your staff know their roles, within 72 hours?

The real penalties

You may have seen "£18 million fines" in headlines. That figure applies to the enhanced tier only. At the standard tier, the maximum civil penalty is £10,000, with daily penalties of up to £500 for continuing non-compliance with a notice (paras 9.14, 9.16). Breaching a compliance notice at the standard tier is not a criminal offence, unlike the enhanced tier. See the full penalties breakdown for the complete enforcement picture, including the specific conduct offences that apply to anyone regardless of tier.

What to do now

1. Confirm your tier, including staff in your count, and using realistic peaks, not fire capacity.
2. Keep a dated note of how you assessed your numbers. The method must be evidenced (para 4.25).
3. Walk your building and think through the four procedures. Read the free official material on ProtectUK.
4. When you're ready to turn that thinking into a documented, staff-briefed, inspection-ready plan, that's what we're building the service for. See a free template if you'd rather start writing now.

Common questions

Is an annual review required at the standard tier?

No. The guidance is explicit that the Act does not require standard-tier procedures to be kept under review (para 8.5, by contrast with enhanced-tier measures, which must be). Reviewing periodically is described as good practice that "could be carried out annually" (para 7.29), not a legal duty. Do it anyway if anything about your building, staffing or events changes.

Do volunteers count as staff for the 200 threshold?

Yes. The guidance defines "staff" broadly as employees, contractors, volunteers or otherwise (para 4.23). If they could reasonably be on site at the same time as everyone else, they go in your count alongside customers and visitors.

Is staff training mandatory?

No accredited or paid course is required. But the guidance requires that people with a role in your procedures are made aware of them (para 7.51), and warns that a plan nobody can carry out rapidly and effectively "is not sufficient" (para 7.8). A short, clear briefing, kept on record, satisfies this; a paid course is optional, not compulsory.

About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: 15 July 2026. Read the official guidance on GOV.UK.

Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.