Martyn’s Law readiness
If your premises can hold 200 people or more, you will have a statutory duty to assess terrorism risk and act on it. Start by finding out which tier you are in — it takes about fifteen seconds.
Which tier applies to you
Capacity is the deciding factor, and it is the thing operators most often get wrong. The test is the maximum number of people who may be present at the same time, staff included — not your average gate, and not your seated capacity if people also stand.
The greatest number of people who may be present at the same time — staff included. Not your typical attendance.
Standard duty
At a maximum occupancy of 200–799, these premises fall within the standard tier. The duty centres on procedures and awareness rather than physical measures: what your people do in the first minutes, and whether they have been trained to do it.
- Notify the regulator that the premises are in scope
- Put public protection procedures in place — evacuation, invacuation, lockdown and communication
- Ensure relevant workers are made aware of the procedures and their part in them
- Keep the assessment current as the premises and threat picture change
- Terrorism risk assessment written against current threat methodology
- Public protection procedures document covering all four required responses
- Staff awareness brief, delivered on site or as a package you can run yourself
- Evidence pack demonstrating the duty has been discharged
- Twelve-month review reminder
Indicative only. Tier determination depends on how capacity is properly calculated for your premises, which is the first thing we establish on the call. This tool is not a substitute for the assessment itself or for legal advice.
What the duty actually requires
| Requirement | Standard duty | Enhanced duty |
|---|---|---|
| Maximum occupancy | 200–799 | 800+ |
| Notify the regulator | Yes | Yes |
| Public protection procedures | Yes — evacuation, invacuation, lockdown, communication | Yes |
| Public protection measures | Not required | Yes — monitoring, physical security, information security |
| Documented assessment to the regulator | Not required | Yes |
| Designated responsible person | Recommended | Yes |
| Staff awareness | Yes | Yes, with role-specific training |
Thresholds and duties moved during the Act’s passage through Parliament, and secondary legislation may refine them further. The figures on this page were last checked against published guidance in 2026-08. We confirm the current position against SIA guidance at the start of every engagement, and we will tell you if it has changed.
How an assessment runs
Scoping call
30 minutes, no chargeEstablish maximum occupancy properly, confirm the tier, identify anything unusual about the premises, and agree scope. You get a written summary whether or not you instruct us.
Site survey
Half to full dayOn-site walkthrough covering approach and perimeter, access control, queuing and congregation points, sightlines, internal circulation, and the places where an assessment usually finds something the operator had stopped noticing.
Threat and vulnerability assessment
Off siteCredible attack methodologies for premises of your type, hostile reconnaissance exposure, and vulnerability analysis against each. Written against current threat methodology, not a generic template.
Procedures and measures
Off sitePublic protection procedures covering evacuation, invacuation, lockdown and communication. For enhanced-duty premises, protective measures prioritised with indicative cost so you can sequence spend.
Handover and training
Half day on siteBrief your team on what changes and why. Train your designated responsible person. Leave you with the evidence pack and a review schedule.
Why this is not a template exercise
You can buy a Martyn’s Law document pack online for a couple of hundred pounds. It will contain a generic risk matrix, a fire-evacuation plan with the word terrorism substituted in, and nothing specific to your site.
A terrorism risk assessment is a different discipline. It asks which attack methodologies are credible against premises of your type, where the hostile reconnaissance opportunities are, how your queuing and congregation points behave under stress, and which of your existing procedures would actively make things worse. Answering those questions is what an intelligence assessor does.
It also has to survive being read after something happens. If your assessment is a template, that will be apparent to an inspector, an insurer, or a coroner.
Not sure whether you are in scope?
That is the most common reason people call. Thirty minutes, no charge, and a one-page written summary of where you stand — including if the answer is that the duty does not reach you.
Book a readiness call