The standard tier, explained properly

Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, creates two tiers of duty. The standard tier covers premises where between 200 and 799 people, including everyone working there, can reasonably be expected to be present at the same time, from time to time. That's most decent-sized pubs, village halls, churches, gyms and restaurants and community venues in the country.

The duties are expected to commence in Spring 2027. Here is what they actually involve, no more, no less.

The core duty: four procedures

Section 5 of the Act requires you to have appropriate public protection procedures in place, so far as reasonably practicable, to reduce the risk of physical harm if an act of terrorism occurred at your premises or in the immediate vicinity. Four types:

• Evacuation: getting people out and away from danger (paras 7.33–7.38).
• Invacuation: moving people to a safer place inside, or bringing them in from outside (paras 7.39–7.40).
• Lockdown: securing the premises to keep danger out (paras 7.41–7.45).
• Communication: alerting everyone quickly and telling them what to do (paras 7.46–7.49).

"Appropriate" means appropriate to your venue: its layout, staffing and use. The guidance is explicit that one simple, well-understood procedure beats several complicated ones: its own example is a bar that wrote multiple evacuation procedures for different attack types, watched staff freeze in a practice because they couldn't tell which to use, and replaced them with one.

The duty people miss: staff must know their role

"…those working at the premises with responsibility for carrying them out… must be made aware of the procedures and their specific role."

Statutory guidance, para 7.51

There is no mandatory training course. But a plan nobody has read doesn't satisfy the Act: the guidance warns that a written procedure which can't be carried out rapidly and effectively "is not sufficient" (para 7.8). Whatever you put in place, keep a record of who has been briefed on what, and when.

What is NOT required at the standard tier

• A written document, genuinely not a legal requirement (para 7.32). The guidance still says you should write your procedures down, because demonstrating compliance at an inspection without documentation is close to impossible. But nobody can lawfully tell you a written plan is mandatory.
• Paid training (paras 7.51, 7.55; the guidance's example is a village hall rightly ignoring a course costing thousands).
• Equipment or building works (para 7.25).
• Buying any product or service, including ours (para 6.7).
• An annual review. Reviewing periodically is recommended good practice, not statute (para 7.29).
• A risk assessment document, a designated senior individual, or submitting anything to the regulator. Those are enhanced tier (800+) requirements. The standard tier notifies the SIA it exists, and that's it.

The real penalties

You may have seen "£18 million fines" in headlines. That figure applies to the enhanced tier only. At the standard tier, the maximum civil penalty is £10,000, with daily penalties of up to £500 for continuing non-compliance with a compliance notice (paras 9.14, 9.16). Breaching a compliance notice at the standard tier is not a criminal offence (unlike the enhanced tier).

The Act's few criminal offences attach to conduct, not tier. The ones that could touch any venue: knowingly or recklessly giving the SIA false or misleading information (section 25), failing to comply with an information notice, and intentionally obstructing an inspector (guidance figure 16). Whatever you document, make it true.

How inspections will work

The regulator is the Security Industry Authority (SIA). Inspections will usually come with at least 72 hours' written notice (para 9.4), and inspectors can view documents, including electronic ones, take copies, and ask you to explain them (para 9.5). A useful test for your preparations: if the letter arrived tomorrow, could you hand over your procedures, your occupancy assessment, and evidence your staff know their roles, within 72 hours?

What to do now

1. Confirm your tier, including staff in your count, and using realistic peaks, not fire capacity.
2. Keep a dated note of how you assessed your numbers. The method must be evidenced (para 4.25).
3. Walk your building and think through the four procedures. Read the free official material on ProtectUK.
4. When you're ready to turn that thinking into a documented, staff-briefed, inspection-ready plan, that's what we're building the service for.

Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.