Martyn’s Law Requirements: What Each Tier Must Actually Do

The requirements under Martyn’s Law split cleanly in two. Standard tier premises have to have procedures. Enhanced tier premises and qualifying events have to have procedures and measures. Nothing else in the Terrorism (Protection of Premises) Act 2025 is a general duty, and the distinction between a procedure and a measure is the thing worth getting straight first.

A procedure is something people do. A measure is something you put in place. The standard tier asks only for the first, and it does so deliberately, because the point of the lower tier is that a village hall or a mid-sized shop can comply without buying anything.

If you have not yet worked out which tier you are in, start with whether Martyn’s Law applies to your premises, because the requirements below only make sense once you know which side of 800 you sit on.

Standard tier requirements: four procedures

For premises where 200 to 799 individuals are reasonably expected at the same time, the duty is to have appropriate public protection procedures in place, so far as is reasonably practicable. There are four.

• Evacuation. How you get everybody out, by which routes, and who checks that the building is clear. If you already run fire drills you have this one, though the trigger and the assembly point may differ.
• Invacuation. How you bring people in, or move them to a safer internal space, when the danger is outside. This is the one most premises have never thought about, and it is not the same as a fire evacuation run backwards.
• Lockdown. How you stop somebody getting in: which doors, which shutters, who holds the keys, and how quickly it can be done by whoever is on shift at the time.
• Communication. How you tell people what is happening and what to do. That covers staff, the public, anyone with a hearing or sight impairment, and how you communicate when the public address system is the wrong tool.

What the standard tier does not require is worth stating just as plainly. There is no requirement to carry out a formal terrorism risk assessment, to install equipment, to employ security staff or to document the procedures in a particular format. The duty is that the procedures exist and that the people who would have to carry them out know what they are.

Enhanced tier requirements: procedures plus measures

At 800 or more, everything above still applies, and public protection measures are added on top. The Act groups those under four headings, and expects them to be appropriate to the premises rather than lifted from somebody else’s plan.

• Monitoring. Keeping an eye on the premises and the ground immediately around them, and having a way for what somebody notices to reach a person who can act on it.
• Movement of individuals. How people enter, circulate and leave, including queues. A queue outside a controlled entrance is a crowd outside the protection, which is why queue design sits in this heading rather than in customer service.
• Physical safety and security. The fabric of the place: entrances, barriers, glazing, doors, and any protected space people would be moved to during an invacuation.
• Security of information. Not publishing your own vulnerabilities. Plans, layouts and procedures go to the people who need them rather than onto a public website.

Enhanced tier also carries duties the standard tier does not: a documented statement of the procedures and measures, a named responsible person, and an obligation to keep the arrangements under review rather than writing them once.

Qualifying events have the same enhanced requirements

An event counts separately from the venue holding it. Where 800 or more people are expected, the public has access and entry is controlled by a ticket, an invitation, a payment or a list, the event carries enhanced tier requirements in its own right, even at premises that would otherwise be standard tier or out of scope altogether.

In practice that means a field, a car park or a closed street can bring enhanced duties with it for the duration of the event, and the organiser rather than the landowner is usually the one holding them.

Who enforces the requirements

The Security Industry Authority. The SIA can issue a compliance notice telling you to put something right within a set period, a restriction notice limiting how the premises may be used, and a penalty notice, including daily penalties while the breach continues. The most serious failures are criminal offences.

When do the requirements start

The Act received Royal Assent on 3 April 2025 and provides for at least 24 months before the substantive duties take effect, so April 2027 is the earliest date they bite. The Home Office published statutory guidance in April 2026 so that organisations could use the intervening period to prepare. Nothing is enforceable in the meantime, which makes this the cheap window to get it done.

A note on wording: duty or tier

The Act and the statutory guidance both say standard tier and enhanced tier. A great deal of material published while the Bill was in Parliament says standard duty and enhanced duty, including the titles of the NEBOSH qualifications and some of our own older articles. They describe the same two categories. If a document you are reading uses duty rather than tier, it is not out of date on substance, only on vocabulary.

Where to start, in order

• Settle your tier. Count everyone who could be present at the same time on your busiest recurring occasion, staff included, and write down how you reached the number.
• List your events separately. Any one expecting 800 or more with controlled entry is assessed on its own.
• Write the four procedures. Evacuation, invacuation, lockdown, communication, in language the person on shift at eight o’clock on a Saturday can follow.
• Walk them. A procedure nobody has practised is a document, not a procedure.
• If you are enhanced tier, then work through the four measure headings and record what you have decided and why.
• Put a review date on it and keep it off the public website.

Training that covers the requirements

NEBOSH wrote two qualifications against the two tiers, and they are separate qualifications rather than two levels of one.

• NEBOSH National Certificate in Protecting Standard Duty Premises from Terrorism, for premises in the lower tier.
• NEBOSH National Certificate in Protecting Enhanced Duty Premises and Events from Terrorism, for enhanced tier premises and for event organisers.
• Counter terrorism training for venues, events and public premises, if you want the wider picture before choosing.

Read the source

The Terrorism (Protection of Premises) Act 2025 is on legislation.gov.uk and the Home Office statutory guidance is on GOV.UK. ProtectUK, run by Counter Terrorism Policing, carries the operational guidance and free e-learning. Treat this page, and any other summary, as a way in rather than the last word.