Does Martyn’s Law Apply to Your Premises?

Martyn’s Law applies to your premises if you reasonably expect 200 or more people to be there at the same time, and the premises are used for one of the activities listed in the Act. Below 200, it does not apply. From 200 to 799 you are in the standard tier. At 800 or more you are in the enhanced tier, and the duties are heavier.

That is the whole test in two sentences, but the detail matters, because the count is not your fire capacity figure and the activity list is narrower than “anywhere the public can walk in”. This page walks the decision through in the order the legislation asks it.

Where the thresholds come from

The legislation is the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. The Home Office published statutory guidance in April 2026. Both use the words standard tier and enhanced tier. You will still see standard duty and enhanced duty in older articles, including some of ours, because those were the terms used while the Bill was going through Parliament. They mean the same thing.

• Standard tier: between 200 and 799 individuals reasonably expected at the same time, from time to time.
• Enhanced tier: 800 or more individuals reasonably expected at the same time, from time to time.

“From time to time” is doing real work in that wording. It is not your average day. If your numbers reach the threshold on a match day, a trading peak or an annual event, that is enough to bring you into scope.

Four tests for qualifying premises

The Act does not ask whether the public can get in. It asks four questions, and premises are in scope only if the answer to all four is yes.

• Is it a building, or a building with land around it that is used with it?
• Is it wholly or mainly used for one of the activities in Schedule 1 of the Act? That list covers places such as shops, food and drink venues, entertainment and leisure, sports grounds, libraries and museums, hotels and other visitor accommodation, healthcare, education, places of worship, public authority buildings and transport hubs.
• Do you reasonably expect the relevant number of individuals to be present at the same time, from time to time?
• Is it outside the exclusions in Schedule 2?

Two points catch people out. The first is wholly or mainly used: an office block with a coffee shop in the lobby is an office block, not a food and drink venue. The second is that the count is of everybody present, staff included, not just customers or visitors.

Qualifying events are counted separately

An event can pull you into the enhanced tier even when the venue itself would not be. An event qualifies when all of the following are true.

• It takes place at premises with a defined boundary, whether that is a building, a field or a closed street.
• The premises are not already enhanced tier in their own right.
• Members of the public have access.
• 800 or more individuals are reasonably expected at the same time.
• There is some control on entry, whether that is a ticket, an invitation, a payment or a list.
• The location is not excluded.

So a town square with open access and no entry control is not a qualifying event, while the same square fenced and ticketed for a festival of 1,000 people is.

What is excluded

Schedule 2 takes a set of premises out of scope entirely. Broadly that covers places already regulated elsewhere or where the duty would sit oddly, including certain transport premises covered by existing security regimes, Parliament, and premises used as a private dwelling. If you think you may be excluded, check Schedule 2 itself rather than a summary, including this one.

Standard tier: what you actually have to do

The standard tier is deliberately light. There is no requirement to buy equipment, employ security staff or carry out a formal risk assessment. What is required is that appropriate public protection procedures are in place, so far as is reasonably practicable, covering four things.

• Evacuation. Getting people out of the premises.
• Invacuation. Bringing people in, or moving them to a safer part of the building, when outside is the more dangerous place to be.
• Lockdown. Securing the premises against someone trying to get in, which means doors, shutters and who has the keys.
• Communication. Telling people what is happening and what to do, quickly, including anyone who cannot hear an alarm.

In practice, for most standard tier premises this is a written procedure, a named person responsible for it, and a team that has been walked through it. If you already run fire evacuation drills, you have most of the muscle memory. What you probably do not have yet is the invacuation and lockdown half.

Enhanced tier: everything above, plus measures

Enhanced tier premises and qualifying events do all of the above, and then put public protection measures in place as well. The Act groups those under four headings.

• Monitoring. Watching the premises and the area around them, and noticing what does not fit.
• Movement. Controlling how people get in, move around and leave, including queues, which are a risk in themselves.
• Physical safety and security. The building itself: barriers, glazing, doors, protected spaces.
• Security of information. Not making a plan of your own vulnerabilities publicly available.

Enhanced tier also carries documentation duties and a named responsible person, and the Act expects the measures to be proportionate to the premises rather than lifted from a template.

Who enforces it

The Security Industry Authority is the regulator. The SIA can issue compliance notices requiring you to put something right within a set period, restriction notices limiting how the premises may be used, and penalty notices, including daily penalties while non-compliance continues. The Act also creates criminal offences for the most serious failures.

When does it start

Not yet. The Act provides for at least 24 months between Royal Assent and the substantive duties taking effect, so the earliest they bite is April 2027, and the Home Office has said the implementation period is there to let organisations prepare. The statutory guidance was published in April 2026 for the same reason. Nobody is being caught out in the meantime, but the preparation window is the point of it.

Working out your tier, in order

• Establish what the premises are wholly or mainly used for, and check that against Schedule 1.
• Check Schedule 2 in case you are excluded.
• Work out the realistic maximum number of people present at the same time, staff included, on your busiest recurring occasion rather than an average day.
• Under 200, no duty. 200 to 799, standard tier. 800 or more, enhanced tier.
• Separately, list any event you host where 800 or more people are expected and entry is controlled. Those are assessed as qualifying events in their own right.
• Write down how you reached the number. When the SIA asks, the reasoning is what you will be showing them.

Where to read the source

Do not take a summary as the last word, including this one. The Act is on legislation.gov.uk and the Home Office statutory guidance is on GOV.UK. ProtectUK, run by Counter Terrorism Policing, carries the operational guidance and free e-learning.

Training that covers the duty

NEBOSH built two qualifications directly against the two tiers. They are separate qualifications, not two levels of the same one, and the right choice follows the tier you landed on above.

The NEBOSH National Certificate In Protecting Standard Duty Premises From Terrorism qualification is designed for organisations responsible for standard duty premises.

The NEBOSH National Certificate In Protecting Enhanced Duty Premises And Events From Terrorism qualification is designed for organisations managing enhanced duty premises or qualifying events.

If you are not sure which tier applies to you, work through the six steps above first. Picking the qualification before you have settled the tier is how people end up on the wrong course.