Enhanced tier duties under Martyn's Law

The short answer

If 800 or more people, including staff, may be present on your premises at the same time from time to time, your premises are 'enhanced duty premises' under section 2 of the Terrorism (Protection of Premises) Act 2025. Qualifying events carry the same duties. The enhanced tier asks you to do more than prepare to respond to an attack: you must also consider how vulnerable your premises or event are, and reduce that vulnerability where it is reasonably practicable.

The duties are expected to come into force in spring 2027. Check your tier with our free tier checker. If you are likely to be enhanced tier, read on, then see our enhanced tier page.

The full list of enhanced tier duties

The procedures duty is the same as at the standard tier, but the Home Office guidance expects more complex procedures for larger sites, aligned with your measures. It also points out that while section 5 does not itself require procedures to be kept under review, section 6 does require review of measures, and in practice you should review both.

Public protection measures

Section 6 lists four types of measure, relating to:

• monitoring the premises or event and the immediate vicinity
• the movement of people into, out of and within the premises or event
• the physical safety and security of the premises
• the security of information about the premises or event

Measures have two objectives: to reduce the vulnerability of the premises or event to terrorism, and to reduce the risk of physical harm if an attack happens. The Home Office guidance says measures can be delivered through people (trained staff), policies and processes (such as a bag search policy) and physical mitigations (such as CCTV or hostile vehicle mitigation). They should work as a whole system. For example, there is little point searching bags at the main entrance if side doors are open without checks.

The guidance asks you to consider your vulnerability to specific attack methods: marauding attacks, vehicle as a weapon, improvised explosive devices, fire as a weapon and hazardous substances. You do not need separate measures for each, but you should think through how each could affect your site. Our guide to public protection measures sets out practical examples for each category.

The reasonably practicable test

The duties to have procedures and measures in place are qualified by 'so far as is reasonably practicable'. The compliance document and senior individual duties are not. The Home Office describes this as proportionality: you weigh what a procedure or measure would achieve against the cost, time and difficulty of putting it in place, taking account of the nature of your premises or event and the resources available to you.

In practice, this is a two-step judgement the guidance spells out:

1. Decide what is appropriate: what would suit your premises, given the layout, use, numbers, location and likely attack methods.
2. Decide how far each appropriate measure can be put in place, so far as is reasonably practicable. It is not all or nothing: a scaled or phased version may be right.

The guidance gives examples. A community rugby club that cannot afford bollards protecting a ticket queue moves match day entry to a rear gate that a single removable bollard can protect. A hotel that cannot afford blast-resistant glazing now plans it into a wider refurbishment, with interim mitigations. A nightclub covers a CCTV blind spot with random patrols until a planned upgrade.

The compliance document

Section 7 requires a document containing:

• a statement of the public protection procedures in place
• an assessment of how those procedures may be expected to reduce the risk of physical harm
• a statement of the public protection measures in place or proposed
• an assessment of how those measures may be expected to reduce vulnerability and the risk of harm
• any further information the Secretary of State specifies in regulations

The Home Office guidance adds detail. Statements should cover each procedure and measure, its policies, how and when it is used, and who makes decisions during an attack. Where a measure is not reasonably practicable to put in place now, you should set out the plan for it, why it is deferred and what interim mitigations apply. If your approach differs materially from what relevant guidance would usually suggest for your type of premises, explain why. Training records are described as a necessary element.

The Act does not prescribe a format. The SIA has said it will share templates before the law takes effect, and the Home Office says templates will be optional. Anyone informed and capable can write the statements and assessments; a third party should have evidenced experience and competence, but the responsible person stays legally accountable.

Treat the document as sensitive. The guidance says it should be held securely, balancing access for those who implement it against the risk of it reaching someone with hostile intent.

Providing the document to the SIA and keeping it current

You must send a copy to the SIA as soon as reasonably practicable after it is first prepared, and before the end of 30 days beginning with the day of any revision. When you notify the SIA, the senior individual (or responsible person) must confirm they understand these duties. The SIA has not yet published how documents will be submitted, so check its guidance nearer the time.

The guidance suggests reviewing the document:

• periodically (annually is suggested as one option, depending on circumstances)
• after a significant change to operations, functions or Schedule 1 use
• after a significant change in the number of people reasonably expected
• after a significant change to the structure or layout of the premises, event or immediate vicinity

For example, a 1,500-capacity arena that adds a new external queuing area would revisit its monitoring and movement measures, update the document, and send the revised version to the SIA within 30 days.

People: the senior individual, co-ordination and co-operation

Where the responsible person is a company, charity, club or other organisation, it must designate an individual concerned in its management or control as having responsibility for ensuring compliance. The Home Office says this must be someone senior, not a lower-level employee. See our guide to the designated senior individual.

Section 8 adds two relationships. If more than one person is responsible, or your premises sit within or contain other qualifying premises, responsible persons must co-ordinate so far as is reasonably practicable. And anyone who is not the responsible person but has some control of enhanced tier premises or an event, such as a freeholder or landowner, must co-operate with you. The guidance's example is a gallery wanting concrete planters, where the freeholder must consider the request so far as is reasonably practicable.

Staff training is not a standalone legal requirement, but the guidance is blunt: if no one working at the premises knows how to carry out a measure, the measure is not properly in place. Note any licences other law requires, such as SIA licences for door supervisors and CCTV operators.

Enforcement at the enhanced tier

The stakes are higher than at the standard tier. The SIA can issue restriction notices only to enhanced tier premises and qualifying events, limiting use, opening times or numbers, or stopping an event, for up to six months at first, which the SIA can extend. Maximum penalties are £18 million or 5% of qualifying worldwide revenue, whichever is higher, with daily penalties of up to £50,000 for continuing breach of a compliance or restriction notice. Failing to comply with an enhanced tier compliance notice is a criminal offence. See penalties and enforcement.

Common mistakes and what good looks like

• Copying a generic plan across sites. The guidance repeatedly warns against a one-size-fits-all approach.
• Listing measures without assessing how they reduce risk. The assessment is a legal requirement, not an extra.
• Forgetting the immediate vicinity, such as queues, drop-off points and smoking areas.
• Buying equipment without policies, training and contingencies for when it fails.
• Publishing detailed site plans online while writing a security of information policy.

Good looks like a short, site-specific document that a new duty manager could follow, with a clear rationale for every choice, a dated review log and evidence of training and drills. Our packs are designed for standard tier venues; for enhanced tier sites we can introduce you to a specialist.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025 (sections 2 and 5 to 10)
• Home Office: Terrorism (Protection of Premises) Act 2025 statutory guidance
• Home Office factsheet: Enhanced duty requirements
• SIA: Understanding Martyn's Law and the SIA's role as regulator