KEY POINTS
- Every person responsible for qualifying premises or a qualifying event must notify the Security Industry Authority (SIA), whatever the tier.
- The detail is set by the Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026, which start when the notification duty is commenced, expected in spring 2027.
- Premises already in scope at commencement get three months to notify. After that, the deadline is 28 days for premises and 14 days for qualifying events.
- You must also notify when you stop being responsible, and within 28 days (premises) or 14 days (events) when anything you told the SIA stops being accurate.
- Notifications go through an SIA online portal that is still being built. You can gather the information now.
The short answer
If you are the responsible person for premises or an event in scope of Martyn's Law, you must tell the SIA. This applies to standard tier premises (200 to 799 people), enhanced tier premises (800 or more) and qualifying events. It is a legal duty under section 9 of the Terrorism (Protection of Premises) Act 2025, and it is the first thing the regulator will expect from you.
The Act set out the duty in outline. The practical rules came later, in the Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026 (SI 2026/793), made on 9 July 2026. The Home Office published guidance on the notification requirement on 14 July 2026. Both apply only once the duty is commenced, which is expected in spring 2027. Until then there is nothing to submit, and the Home Office notification guidance says the SIA should not be notified about events that took place before commencement.
Not sure whether you are in scope at all? Start with our free tier checker and the guide to who the responsible person is.
Who must notify, and who can press submit
The duty sits with the responsible person: the individual, company or organisation with control of the premises for their Schedule 1 use, or control of the premises for a qualifying event. If more than one person is responsible, each of them has the duty, although they can act jointly.
The regulations let a notification be made by the responsible person or by someone they have authorised, such as an employee, managing agent or consultant. The Home Office guidance is clear that this does not move the legal duty: responsibility stays with the responsible person. It recommends keeping a written record of who you authorised, when and how.
Notification is triggered by three things:
- becoming responsible for qualifying premises or a qualifying event (including being responsible on the day the duty starts)
- ceasing to be responsible, for example when you sell a business, surrender a lease or hand a site back after an event
- information you previously notified ceasing to be accurate while you remain responsible
Deadlines in the notification regulations
Regulation 3 of the 2026 regulations sets the 'required time' for each type of notification. The clocks are counted in days beginning with the trigger day.
| Situation | Deadline |
|---|---|
| Responsible for qualifying premises on commencement day | Within three months beginning with commencement day |
| Become responsible for premises during the first three months | By the end of the three months, or within 28 days of becoming responsible if that is later |
| Become responsible for premises after the first three months | Within 28 days of becoming responsible |
| Cease to be responsible for premises | Within three months of commencement or 28 days of ceasing, whichever is later |
| Qualifying event first publicised on or before commencement day | Within 14 days beginning with commencement day |
| Qualifying event first publicised after commencement day | Within 14 days of the date it is first publicised |
| Cease to be responsible for a qualifying event | Within 14 days of ceasing |
| Notified information becomes inaccurate (premises) | Within 28 days of it first becoming inaccurate |
| Notified information becomes inaccurate (event) | Within 14 days of it first becoming inaccurate |
For events, 'first publicised' means the date of the event is first made available to the public to advertise it, by you or with your authority, through any medium. That includes telling only members or guests of a club or association. In practice, the 14-day clock can start the moment you announce a date on social media or open ticket sales, so build notification into your event launch checklist.
What information you will need
The Schedule to the regulations lists the information in four parts. Part 1 applies to everyone. Part 2 is added for premises, Part 3 for enhanced tier premises and qualifying events, and Part 4 for events.
All premises and events (Part 1):
- names and contact details (phone, email, postal address) of each responsible person and anyone who must co-ordinate with you
- for companies, the registered name and any trading names, plus any company number or registered charity number
- anyone else who has any control of the premises or event, and their relationship to you
- details of the person submitting, if that is not the responsible person
- the postal address and postcode of the premises or event site
- whether you are responsible for other qualifying premises or events
- the greatest number of people reasonably expected to be present at the same time, and the method used to calculate it
- websites and social media accounts you or others with control use to advertise the premises or event
- alcohol, entertainment and sports ground safety licences or certificates held, applied for or notified, with dates and issuing authority
Premises (Part 2): confirmation the premises qualify, the relevant Schedule 1 use, whether the premises are a group of buildings (how many, and each address), details of any larger premises you sit within and whether those are also qualifying premises, and whether there is any permanent or temporary seating next to the premises, including on the pavement or road.
Enhanced tier premises and qualifying events (Part 3): the name, contact details, position and date of designation of the designated senior individual, and confirmation that they (or the responsible person, if there is none) understand the duty to prepare a compliance document, send it to the SIA as soon as reasonably practicable and send any revision within 30 days.
Events (Part 4): confirmation the event qualifies, dates and times of the event and of first admission, a brief description, any larger event it forms part of, whether the venue is qualifying premises, whether the same event has run before (when, where, under what name and who was responsible), whether it will be repeated, and the date and format of first publicity.
The SIA can also ask for further information that is reasonably necessary for its functions, such as more detail about anyone with control of the premises.
How notification will work in practice
You must use the online portal the SIA is building, unless the SIA directs otherwise. The Home Office guidance says the portal will be available on GOV.UK when the duty is commenced, and that the SIA may accept another method if the portal is unavailable or a person cannot use it because of accessibility needs. The SIA has said it will invite volunteers to test the portal from early 2027.
Notification is not a fee-paying registration and nothing in the Act or regulations describes a certificate or approval. It tells the regulator who you are, where you are and how big you are, so it can plan its compliance work. The SIA's stated approach includes desk-based assessment and on-site inspection, so expect your notification to be read.
Preparing now: a practical routine
Most of the work is gathering facts you already hold. For example, a 450-capacity pub that is part of a small group might prepare like this:
- Confirm who the responsible person is. For a tenanted pub, the Home Office guidance (as corrected in August 2026) says the tenant who controls the pub is the responsible person, even where the brewery or pub company holds the premises licence. Check your lease and how control works in practice rather than assuming.
- Record the occupancy figure and how you worked it out, using one of the methods in the Home Office supplementary guidance. Keep the evidence, because the SIA can ask for it.
- List every licence and certificate, with dates and issuing authority.
- List websites and social media accounts used to promote the venue.
- Note any pavement seating, beer garden or other adjoining seating.
- Decide who will submit, and record their written authority.
- Put a calendar reminder for the three-month window once the commencement date is announced.
Multi-site operators should build one register covering every site, with a named owner for each. One central spreadsheet with the Schedule fields as columns makes the first submission and later updates far easier.
Keeping your notification up to date
The duty does not end with the first submission. Regulation 6 requires you to send revised details whenever something you notified stops being accurate. That includes information a previous responsible person gave, so a new operator taking over a venue should check what is already on file. Common triggers include:
- a change of company name, trading name or contact details
- a new or changed alcohol or entertainment licence
- a refit or layout change that alters your occupancy figure, especially one that moves you between tiers
- a new designated senior individual
- a new website or social media account used for advertising
- a change in who else has control, such as a new landlord or managing agent
Failing to notify, or to update, is a breach of a requirement in section 9. The SIA can respond with a compliance notice or a penalty notice of up to £10,000 for standard tier premises, with higher maximums for enhanced tier premises and events. See our guide to penalties and enforcement for how this works.
Common mistakes to avoid
- Assuming the landlord or freeholder will notify for you. Control, not ownership, decides who is responsible.
- Using the fire safety maximum occupancy without thinking. The figure to give is the greatest number reasonably expected at the same time, including staff, with your method.
- Forgetting the 14-day event clock starts at first publicity, not at the event.
- Not notifying when you leave. The outgoing responsible person has their own duty.
- Treating notification as the whole job. It sits alongside the duty to have public protection procedures in place.
If you want the facts gathered in one place, our packs include a notification information sheet alongside your procedures, so you are ready when the portal opens.
Frequently asked questions
Do standard tier premises have to notify the SIA?
Yes. Notification under section 9 applies to everyone responsible for qualifying premises or a qualifying event, including standard tier premises where 200 to 799 people may be present at the same time.
Can I notify the SIA now?
No. The notification duty and the 2026 regulations only apply from commencement, which is expected in spring 2027. The SIA portal is still being built. You can gather the information now so you are ready.
How long will I have to notify once the law starts?
Premises that are already in scope on commencement day have three months. After that, new responsible persons for premises have 28 days. Qualifying events must be notified within 14 days of being first publicised, or within 14 days of commencement if publicised before it.
Can a consultant or managing agent notify for me?
Yes. The regulations allow a person authorised by the responsible person to submit. The legal duty stays with the responsible person, so keep a written record of the authority and check what was submitted.
Is there a fee to notify the SIA?
Neither the Act nor the notification regulations set a fee for notification. Check the SIA's guidance when the portal opens.
Sources
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.