Martyn's Law checklist: step-by-step readiness guide

The checklist at a glance

If you run a venue where 200 or more people can reasonably be expected to be present at the same time, this is the order to work in. Each phase is explained in detail below, with the specific questions to answer and the evidence to keep.

1. Confirm you are in scope: who the responsible person is, what the premises are used for, how many people can be present and which tier applies.
2. Gather the information you will need to notify the Security Industry Authority (SIA).
3. Write your four public protection procedures: evacuation, invacuation, lockdown and communication.
4. Brief and train staff so they know the procedures and their own role.
5. Test the procedures, fix what does not work, and keep simple records.
6. Set a review date and a trigger list for changes that mean you must look again.

Phase 1: Confirm you are in scope and which tier

Get this right first, because everything else follows from it. The statutory guidance and its supplementary document A explain the tests in full. Use our free tier checker for a quick answer, then work through the points below and record your reasoning.

1. Identify the responsible person. This is whoever controls the premises for their main use, which is usually a company or organisation rather than an individual. Hirers of your venue do not normally become the responsible person. See who is the responsible person.
2. Check the use. The premises must be wholly or mainly used for a use listed in Schedule 1 of the Act, such as retail, food and drink, entertainment, sport, visitor attractions or hotels.
3. Work out how many people can reasonably be expected to be present at the same time, from time to time. Include staff, contractors and volunteers, not just customers. Include outdoor seating areas that form part of the premises.
4. Choose and record your counting method. The official methods are fire safety occupancy, historic attendance data, fixed seating or standing positions, ticket or registration limits, licence capacity restrictions, or another justified method. See how to calculate capacity.
5. Check exclusions and special cases. Some premises are excluded and some, such as places of worship and most schools, are always treated as standard tier even at 800 or more. Read exemptions and special cases before deciding.
6. Decide the tier: 200 to 799 is standard tier, 800 or more is enhanced tier. If you sometimes host ticketed events for 800 or more, read qualifying events.
7. Map anyone you share the building with. If your premises sit inside larger premises (a shopping centre, a hotel with a separately run bar), you must co-ordinate with the other responsible persons, so far as reasonably practicable.

Evidence to keep: a one-page note of the responsible person, the use, the figure, how you calculated it and the date. The SIA will ask for the figure and how it was calculated when you notify.

Phase 2: Prepare your SIA notification

Notification will be made through an SIA online portal on GOV.UK, which opens when the notification duty commences. There is no fee. Home Office guidance published in July 2026 says responsible persons for existing qualifying premises will have three months from commencement to notify. After that, you must notify within 28 days of becoming or ceasing to be responsible, and within 28 days of any notified information becoming inaccurate.

You can collect almost everything now. Based on the Home Office notification guidance, have these ready:

• The responsible person's name, registered name, trading names and contact details (phone, email, postal address and postcode).
• Company or charity number, if registered.
• Details of anyone else with any control of the premises, and anyone you must co-ordinate with.
• The premises address and postcode, the Schedule 1 use, and the addresses of every building if the premises are a group of buildings.
• Whether the premises form part of larger premises, and if so their name and address.
• Whether you have permanent or temporary seating in adjoining areas, including on the pavement outside.
• The greatest number of people reasonably expected at the same time, and how you calculated it.
• Your website and any social media accounts used to advertise the premises.
• Any alcohol licence, entertainment licence or sports ground safety certificate, with its description, dates and issuing authority.
• Whether you are responsible for other qualifying premises or events.

If someone else (a manager, agent or consultant) will submit on your behalf, keep a written record of who is authorised, when and how. Legal responsibility stays with the responsible person. Knowingly or recklessly giving false or misleading information is an offence. Our guide to notifying the SIA covers the detail.

Phase 3: Build your four public protection procedures

This is the heart of the standard tier duty. The aim is a short set of actions staff can take quickly if they suspect an attack is happening, or is about to happen, at the premises or in the immediate vicinity. The statutory guidance warns against complexity: one simple procedure per type, which staff adapt to where the threat is, beats several attack-specific versions that cause hesitation.

Before writing anything, walk the site with these questions from the guidance:

• Layout and location: entrances, exits, back-of-house routes, rooms that can be secured, windows, and what is outside (a busy street, a queue, a shared courtyard).
• People: peak numbers, who is on shift, and who has authority to start each procedure.
• Existing equipment: locks, shutters, internal doors, PA or music system, radios, phones.
• How you will call 999, who makes the call and what they will say.
• How procedures combine, for example invacuate the pavement, then lock down, then evacuate by the rear when safe.
• Neighbours: shared exits or safe areas that could overcrowd if everyone uses them at once.

Then answer these questions for each procedure:

If you decide a procedure is not appropriate or reasonably practicable, record why. The guidance gives the example of an outdoor event with no indoor space, where invacuation is not possible. Our guide to public protection procedures goes deeper on each one.

Phase 4: Brief and train your staff

There is no statutory requirement for specific counter-terrorism training. But staff who carry out the procedures must be made aware of them and their role, and given the understanding and tools to act. The guidance is clear that a written procedure staff cannot carry out rapidly does not meet the duty.

1. Make a short staff version: a one-page briefing, quick reference sheet or credit-card-sized prompt card.
2. Brief every team member on what to do, by role. Managers and supervisors need to know how to start a procedure, not just follow one.
3. Add the procedures to induction for new starters, agency staff and volunteers.
4. Ask staff to complete the free ACT Awareness e-learning on ProtectUK, which covers suspicious activity, suspicious items, bomb threats and marauding attackers.
5. Train everyone to spot and report suspicious behaviour and items quickly. The guidance treats this awareness as part of the duty, so far as reasonably practicable.
6. Brief security staff on your site procedures even if they hold an SIA licence, because licence training is not site-specific.

See free training and resources for every official course and what each is good for, and staff training requirements for the legal position.

Phase 5: Test, record and review

Testing turns a document into a plan people can follow. It does not need to be dramatic. A 20-minute walk-through at the start of a shift, asking "what would you do if...", finds most gaps.

• Run a tabletop discussion with managers for each procedure at least once before the duties start.
• Do a practical walk-through: who locks which door, how long it takes, where the keys are.
• Test your alert: can the message be heard in every area over music and noise?
• Prepare a grab bag or incident kit, as the guidance suggests, with emergency contacts, a staff list and floor plans, stored where the duty manager can reach it.
• Keep a simple log of briefings, training completions, tests and what you changed as a result.
• Review at least annually, and whenever the layout, use, capacity, opening hours or management changes.

For standard tier there is no legal duty to produce a written assessment of your procedures. The guidance still says you should, because it helps staff understand them and it may be difficult to show compliance at an SIA inspection without it. Read record keeping and evidence and testing and drills.

Enhanced tier and qualifying events: the add-on

If you are enhanced tier (800 or more) or run a qualifying event, complete everything above, then add the following. Penalties at this tier can reach £18 million or 5% of qualifying worldwide revenue, whichever is higher, so most operators take specialist advice.

• Designate a senior individual if the responsible person is a company or other organisation. They must have responsibility for managing its affairs. See designated senior individual.
• Assess and put in place public protection measures, so far as reasonably practicable, covering monitoring, movement, physical safety and security, and security of information.
• Deliver measures through people, policies and physical mitigations, for example trained staff, a bag search policy, CCTV or hostile vehicle mitigation where proportionate.
• Prepare a compliance document stating your procedures and measures, with an assessment of how they reduce the risk of harm and the vulnerability of the site.
• Send the document to the SIA as soon as reasonably practicable, and any revision within 30 days.
• For qualifying events, notify the SIA within 14 days of the event date first being publicised.

Start with enhanced tier duties and public protection measures. If you need a specialist, our enhanced tier page explains how we can introduce one.

Common mistakes and what good looks like

• Copying the fire plan. Fire assembly points can become targets. Terrorism evacuation usually means dispersing, and should not normally use the fire alarm.
• Counting customers only. Staff, contractors and volunteers count towards the 200 and 800 thresholds.
• Writing for the inspector, not the staff. Long documents nobody has read fail the "rapidly and effectively" test.
• Ignoring outside. The pavement, queue and terrace are often where people are most exposed.
• Buying expensive courses that promise compliance. The guidance itself gives an example of a venue rightly deciding a costly course was unnecessary.
• Forgetting neighbours. Shared exits and safe rooms need agreeing in advance.

Good looks like this. For example, a 350-capacity bar might have a two-page procedure document, a laminated card behind the bar, every staff member through ACT Awareness, a named duty manager on each shift who can start a lockdown, two tested lockdown routines (front door and terrace), and a log showing a briefing every quarter.

What to do next

Start with Phase 1 this week: confirm your tier using the free checker and note your capacity figure and method. Then pick a quiet day to walk the site and draft your procedures. Sector guides such as pubs and bars, restaurants and cafes and hotels cover venue-specific details.

If you would rather work from ready-made templates, our Martyn's Law packs give you procedure documents, staff briefing cards and a record log to complete for your site, with packs opening on 15 January 2027.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025: statutory guidance (Home Office)
• Guidance: Notification requirement (Home Office)
• Non-statutory supplementary document A: methods for assessing the reasonable expectation of individuals present
• Martyn's Law factsheet (Home Office)
• Martyn's Law myth buster (Home Office, via ProtectUK)