Do you need a Martyn's Law risk assessment?

The short answer

Not in the form most people expect. The Terrorism (Protection of Premises) Act 2025 does not impose a general requirement on standard tier premises to commission or carry out a formal terrorism risk assessment, unlike fire safety law, which requires a fire risk assessment. Nor does it require you to pay anyone to assess your premises. What section 5 of the Act requires is that the responsible person ensures appropriate public protection procedures are in place, so far as is reasonably practicable. Those are procedures for evacuation, invacuation, lockdown and communication.

You cannot decide what is appropriate for your building without looking at it carefully, though. The Home Office statutory guidance says the responsible person must consider how to make the procedures appropriate to the premises, and that this should include an assessment of the layout, the use, the numbers present, the staff and the equipment available (paragraph 7.26). So in practice, when people say "Martyn's Law risk assessment", the sensible meaning is: a structured look at your premises, written down, that explains the procedures you have chosen and why.

As good practice, standard tier premises may find these records useful: how you worked out your numbers and tier (the guidance says your method must be evidenced), a short site walk-through, your written procedures, the reasons for any procedure you decided was not appropriate or reasonably practicable, staff briefing records and a review log. None of these is a statutory form, but the guidance says you should document your procedures and that compliance may be hard to show without them (paragraphs 4.25, 7.24 and 7.32).

The enhanced tier is different. For premises where 800 or more people may be present and for qualifying events, section 6 requires the responsible person to assess and keep under review the public protection measures that are appropriate, and section 7 requires a written document containing statements and assessments of the procedures and measures, kept up to date and provided to the SIA.

The duties are not yet in force. They are expected to start in spring 2027, after an implementation period of at least 24 months from Royal Assent on 3 April 2025, but no commencement date has been announced. If you are not sure whether your premises are in scope, use the free tier checker first.

What the law actually requires, tier by tier

The standard tier covers premises where 200 to 799 people can reasonably be expected to be present at the same time, from time to time. The enhanced tier covers 800 or more. Some premises, including places of worship, early years settings, schools and further education settings, are always standard tier once they reach 200, even above 800. See standard vs enhanced tier for the detail.

The key words for the standard tier come from paragraph 7.32 of the statutory guidance. It says there is no legal requirement to prepare a document stating the procedures and an assessment of how they may reduce the risk of physical harm. But it says the responsible person should prepare one, and that it may be difficult to demonstrate compliance, for example during an SIA inspection, if the procedures are not documented in some form.

For the enhanced tier, section 7 of the Act is specific. The document must contain a statement of the procedures, an assessment of how they may be expected to reduce the risk of physical harm, a statement of the measures in place or proposed, and an assessment of how those measures may be expected to reduce vulnerability and risk. It must be kept up to date and a copy given to the SIA, with revisions provided within 30 days.

What the guidance tells you to assess

Paragraphs 7.26 to 7.28 of the statutory guidance are, in effect, the closest thing the law has to a risk assessment checklist for procedures. They apply to every tier. The guidance says your assessment should consider:

• the nature of the premises, including location and layout
• what the premises are used for
• the number of people reasonably expected to be present at the same time, and the types of staff (employees, volunteers, security staff, contractors)
• how planned actions change depending on whether the attack is inside or outside
• different attack methods
• existing equipment, structures and apparatus, such as doors, locks, areas that can be secured and public address systems
• other premises nearby and their procedures

It then asks you to think through who decides and who has authority to start each procedure, how and by whom the emergency services are alerted, how the procedures work together, how the situation is reassessed as it unfolds, how staff will learn their role, and how procedures will be tested.

There is no requirement to score threats or predict whether your venue will be targeted. The Act assumes an attack could happen anywhere. The guidance does point to free resources if you have no existing process for assessing vulnerability: ProtectUK's risk management basics and the National Protective Security Authority's protective security risk management guidance.

What a sensible standard tier assessment contains

For a standard tier venue, a good "Martyn's Law risk assessment" is really a short site assessment plus your written procedures. A useful structure:

1. Premises details: address, responsible person, uses, opening pattern and the capacity figure you used to confirm your tier, with how you worked it out.
2. Site assessment: entrances and exits, doors and how they lock, rooms that could be secured, how you can alert people, outside areas and the immediate vicinity, such as a queue or pavement.
3. People: typical staffing on a quiet day and at peak, who is in charge on each shift, and any visitors who may need help to move.
4. The four procedures: for each one, when it would be used, who decides, what each role does, and how it links to the others.
5. Reasonably practicable decisions: what you considered and why you did or did not adopt it. The guidance says it could be helpful to record the rationale where a procedure is not appropriate.
6. Staff awareness: how staff are briefed, the prompt card they carry, and refresher dates.
7. Testing and review: when you will walk through or test the procedures, and when the document will next be reviewed.

For example, a 350-capacity bar might find that its rear fire exit opens onto a shared yard, that only the manager can lock the front shutter, and that the music system is the fastest way to stop the room. Those findings shape the procedures far more than a generic threat score would. That example is illustrative only.

Premises that are always standard tier but very large, such as a big school or place of worship, should look at the extra considerations the guidance sets out for larger premises in paragraphs 8.2 to 8.6. The guidance says this may be appropriate for larger or more complex standard tier premises.

What an enhanced tier assessment contains

At the enhanced tier, assessment is written into the Act. Section 6 says the responsible person must assess and keep under review the public protection measures that are appropriate, and put them in place so far as reasonably practicable. Measures relate to four things: monitoring the premises and immediate vicinity, the movement of people into, out of and within the premises, physical safety and security, and the security of information. The compliance document must then cover both procedures and measures.

The guidance says any individual can make the statements in the document, provided they are informed and capable. If a third party completes them, they should have relevant experience and competence that can be evidenced, and the responsible person remains legally accountable (paragraph 8.62). The Act does not prescribe a format, although the Secretary of State can specify further content by regulations (section 7(1)(e)).

In practice, an enhanced tier document is likely to include a vulnerability assessment of the site, a statement of each procedure and each measure, an explanation of how each is expected to reduce harm or vulnerability, the reasoning where a measure was considered and not adopted, training records (which the guidance treats as a necessary element of the document, paragraph 8.53), and a review schedule. If your premises are 800 or more, read enhanced tier duties and our page on specialist support for the enhanced tier.

How it relates to your fire risk assessment

They are separate legal regimes and one does not satisfy the other. Your fire risk assessment is still very useful: it gives you a floor plan, exit routes, an occupancy figure and a culture of drills. The occupancy figure can be one way of estimating numbers for your tier, as long as you include staff.

But the responses differ. Fire evacuation usually means everyone out to an assembly point. In a terrorist attack, gathering a crowd outside may put people at risk, and invacuation or lockdown may be safer. Lockdown must be planned so it never undermines fire escape. You can combine the work, such as one site walk and one training calendar, but keep the reasoning distinct. See Martyn's Law vs fire risk assessment.

DIY, pack or consultant?

The guidance says it is not mandatory to use third-party products or services to comply. You may use them if you find them helpful, but you remain liable and should be satisfied that any support is suitable and properly delivered.

Whichever route you choose, someone who knows the building has to walk it and make the decisions. For a fuller comparison, read do I need a consultant?.

Red flags when buying a Martyn's Law risk assessment

Martyn's Law is new, and some marketing has run ahead of the law. Be cautious if a provider:

• Sells a "Martyn's Law compliance certificate". There is no official certificate, and no provider can certify that you comply. Compliance is judged by the SIA.
• Claims to be approved, accredited or endorsed by the Home Office or the SIA for Martyn's Law. We are not aware of any such approval scheme, and the guidance does not describe one.
• Says you must buy their product or course to comply. The guidance says third-party products, services and paid training are not mandatory. It even gives the example of a village hall that rightly decides a course costing thousands of pounds is unnecessary.
• Offers to take on your legal responsibility. The responsible person stays accountable even when helped by a third party.
• Tells a standard tier venue it must install equipment. The guidance says there is no statutory requirement to make physical alterations or buy equipment, although some changes may be reasonably practicable.

What to do next

1. Confirm your tier with the free checker and note how you worked out your numbers.
2. Walk the building with the questions from paragraph 7.26 in mind and write down what you find.
3. Write your four procedures, using public protection procedures as a guide.
4. Brief staff, then test the procedures with a short walk-through or tabletop exercise.
5. Keep your notes, procedures, briefing records and test log together, ready for notification and any SIA inspection.

If you would like to see what a finished standard tier document looks like, you can view our sample documents. Our packs turn your answers about your own premises into that document, but the decisions and the legal responsibility stay with you.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025, section 7 (legislation.gov.uk)
• Home Office: Terrorism (Protection of Premises) Act 2025 statutory guidance
• Home Office: statutory guidance PDF with correction slip
• SIA: Understanding Martyn's Law and the SIA's role as regulator