Last updated: 16 September 2026

Martyn's Law enhanced tier requirements: what qualifying premises must do

Martyn's Law enhanced tier requirements apply to premises and events where 800 or more people may reasonably be expected to be present at the same time, per TLT LLP. These sites must produce a documented public protection procedure, appoint a designated senior individual, and face fines up to £18 million for non-compliance.

Key Takeaways

• Pulse Operations notes the enhanced tier threshold is 800 or more people reasonably expected at the same time, against 200-799 for standard tier, per TLT LLP.
• Pulse Operations notes enhanced tier headcounts include staff, contractors and volunteers, not just ticket sales or licensed capacity, per Martyn's Law Plan.
• Pulse Operations notes enhanced duty non-compliance penalties reach up to £18 million or 5% of worldwide revenue, whichever is greater, with daily penalties up to £50,000, per Policy Pros.
• The Act received Royal Assent on 3 April 2026, with an implementation period of at least 24 months meaning requirements are expected to bite from spring 2027, per ProtectUK / Home Office.
• Failing to comply with a penalty notice is a criminal offence, carrying an unlimited fine and/or up to two years' imprisonment, per Lexology.

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2026, a statute that places legal duties on those responsible for qualifying public premises and events to prepare for the possibility of a terrorist attack. It is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena attack, and the campaign that drove it onto the statute book was led by his mother, Figen Murray.

The Act received Royal Assent on 3 April 2026, with an implementation period of at least 24 months before requirements come into force, expected in spring 2027, per ProtectUK / Home Office. It creates two tiers of duty: standard and enhanced. Pulse Operations covers the full picture — history, tiers, duties and a readiness checklist — in its guide, Martyn's Law: a readiness guide for security & FM teams, which is a useful starting point before working through the detail below.

Figen Murray has been explicit that watering down enhanced tier duties was never an option: "Someone suggested the enhanced tier should be tried and tested first. A big No to that from me as this would mean rolling out a red carpet for terrorists to attack our softer targets."

What defines an enhanced tier premises capacity threshold?

An enhanced tier premises is a qualifying site or event where 800 or more individuals may reasonably be expected to be present at the same time, per TLT LLP. This sits above the standard tier band, which covers 200 to 799 people, per the same source.

The count is not ticket sales or fire-certificate capacity. It includes staff, contractors and volunteers on site — not just members of the public who paid for entry, per Martyn's Law Plan. A conference centre with 750 delegates and 60 event staff crosses into enhanced tier even though the booking system only shows 750 names.

Operators must judge capacity on the maximum number who could reasonably be present, including peak moments such as a headline act or a busy Saturday, rather than average daily footfall. Per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams, capacity is based on how many people could be present — public and staff — not typical footfall. That distinction catches out venues that assume they're "usually" under 800.

Which venues and events fall into the enhanced tier?

Enhanced tier duties apply to large stadiums, arenas, festivals, major retail and leisure destinations, and any event where the reasonably expected attendance reaches 800 or more. Shopping centres, large places of worship during major services, conference venues, and multi-building estates with high combined footfall are all candidates.

The threshold is assessed per premises or event, not per organisation, so a single operator can run some sites under standard tier and others under enhanced tier simultaneously. A landlord with a large mixed-use development — retail, residential, and a plaza used for events — needs to assess each qualifying area separately against the 800-person test.

Pulse Operations has seen this complexity first-hand. On a landmark West London mixed-use development, Priority First — the founding team's own London security & FM operation, inside which Pulse was built before being offered to other operators — manages retail, residential, plant rooms and service yards across one of the area's best-known streets. Proving which areas were actually checked, and when, matters just as much for Martyn's Law readiness as it does for basic patrol assurance: 152 checkpoints across the site are now photo-mandatory, with 540+ patrols logged in the first five months live (production data, July 2026).

How does enhanced tier differ from standard tier in obligations?

Enhanced tier obligations go beyond the standard tier's "low-cost, common-sense" preparedness and require a documented, maintained risk assessment plus a formal public protection procedure. Standard tier premises (200-799 people) must still consider what to do in an attack — training staff, having basic procedures for lockdown and evacuation — but the paperwork burden is deliberately light.

Enhanced tier premises must go further: a written risk assessment kept current rather than produced once and filed away, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. They must also appoint a designated senior individual accountable for compliance and be prepared to demonstrate physical and procedural measures to the regulator on request.

Who enforces Martyn's Law and what are the penalties?

The Security Industry Authority (SIA) — the Home Office arm's-length body already licensing door supervisors and security officers — is the designated regulator for Martyn's Law compliance. The SIA launched a public consultation on its draft section 12 statutory guidance on 15 April 2026, running until 12 June 2026, per GOV.UK.

Enhanced tier non-compliance carries the heaviest exposure in UK premises regulation. Fines can reach £18 million or 5% of worldwide revenue, whichever is greater, with daily penalties up to £50,000, per Policy Pros. Standard tier duty holders face a lower ceiling — a maximum £10,000 fine with daily penalties up to £500, per the same source.

Beyond civil penalties, ignoring an enforcement notice altogether becomes a criminal matter. Failure to comply with a penalty notice is a criminal offence, punishable by an unlimited fine and/or up to two years' imprisonment, per Lexology. That criminal backstop is what separates Martyn's Law from most facilities or health and safety enforcement regimes, where civil penalties are usually the endpoint.

"Enhanced tier isn't just a bigger version of standard tier — it expects a documented public protection procedure, not a folder of good intentions. That means evacuation and invacuation plans your staff have actually rehearsed, a clear chain of decision-making, and evidence you can show a regulator without scrambling to write it up after the fact. Treat it as how you already run the site, written down properly." — Mo Hassan, Founder, Pulse

What documentation must enhanced tier premises maintain?

Enhanced tier premises must maintain a documented public protection procedure covering evacuation, invacuation (moving people to safety within the building rather than out of it), lockdown and communication with emergency services. This procedure needs to be a live document, tested and updated, not a static PDF produced once for a file audit.

Supporting records typically include the site risk assessment, evidence of staff training and drills, incident logs, and proof that physical measures — CCTV coverage, bag checks, access control — are actually in place and working, not just specified in a policy. When the SIA's final section 12 operational guidance lands after its 2026 consultation, exact documentation formats will firm up, but the direction is already clear: evidence over assertion.

This is where compliance tooling earns its place. Pulse Operations's compliance runway brings SIA licensing, BS 7858 screening records, DBS checks, right-to-work evidence, training expiries, statutory building compliance and Martyn's Law assessments onto one expiries runway — so a designated senior individual can see what's due, what's overdue and what's evidenced, rather than chasing folders across departments.

What are the estimated costs of enhanced tier compliance?

Enhanced tier compliance costs vary widely by site complexity, but the core spend typically covers risk assessment work, physical security measures, staff training and ongoing documentation upkeep. There is no official published cost benchmark yet, since the SIA's section 12 guidance was still in consultation as of mid-2026, so any figure quoted by a supplier should be treated as an estimate, not a fixed tariff.

For a mid-size enhanced tier venue, a typical range of considerations includes: a professional risk assessment (a one-off or annually refreshed cost), incremental CCTV or access control upgrades where gaps exist, recurring staff training and drill time, and the administrative overhead of keeping documentation current. Compare that against the downside: a maximum enhanced tier penalty of £18 million or 5% of worldwide revenue, per Policy Pros, makes even a substantial compliance budget look proportionate.

Pulse Operations's own operational data offers a comparison point on the record-keeping side specifically. Across live sites in the trailing 90 days to July 2026, 96.2% of checkpoints carried a watermarked photo (officer, site, GPS, time) as the completion record, per Pulse Operations's benchmark data — consistent with the direction Martyn's Law is pushing operators toward: verifiable evidence rather than a signed-off policy nobody can prove was followed on the night.

Common mistakes businesses make with enhanced tier compliance

The most frequent misconception is assuming ticket sales or licensed capacity define the threshold, when the true test includes staff, contractors and volunteers on site, per Martyn's Law Plan. A 780-ticket venue with 40 staff on shift is over the 800-person line and enhanced tier, not standard tier.

Other common errors include:

• Treating the risk assessment as a one-off document rather than something kept current as the site, layout or events change.
• Assuming a single site-wide assessment covers everything, when multi-building estates or mixed-use developments may need per-area capacity checks.
• Confusing Martyn's Law duties with existing licensing conditions, health and safety law, or fire safety obligations, and assuming one covers the other.
• Waiting for the spring 2027 commencement date to start preparing, when the 24-month implementation window from Royal Assent was explicitly given to allow time to get ready, per ProtectUK / Home Office.
• Having no designated senior individual named and accountable, leaving no clear owner when the SIA asks who is responsible for compliance.

Estate-scale operators face a sharper version of this problem: a prestige central-London estate managed by Priority First runs 16 buildings on one nightly patrol round. Before Pulse, the estate could not see delivered-versus-contracted activity without ringing the office — a gap that would make demonstrating enhanced tier evidence to a regulator just as hard as demonstrating basic patrol coverage. Since going live in March 2026, the estate's patrols have moved from one vague "round complete" note to 4,100+ logged patrols, roughly 250-280 per building, all photo-verified, visible in the client portal without a phone call.

Your enhanced tier compliance checklist

• Calculate your true headcount including staff, contractors and volunteers, not just ticket sales, against the 800-person threshold.
• Assess each qualifying area separately if you operate a multi-building or mixed-use site.
• Draft a documented risk assessment and set a review cycle to keep it current.
• Write a public protection procedure covering evacuation, invacuation, lockdown and emergency communication.
• Appoint a designated senior individual accountable for Martyn's Law compliance.
• Train staff and run drills, keeping evidence of both.
• Audit your physical measures — CCTV, bag checks, access control — against what your procedure claims.
• Track expiries and evidence on one system rather than across scattered folders and inboxes.

FAQ

What is the enhanced tier threshold under Martyn's Law?

The enhanced tier applies where 800 or more individuals may reasonably be expected to be present at the same time, per TLT LLP. This is higher than the standard tier band of 200-799 people.

Does the 800-person count include staff, not just visitors?

Yes. The enhanced tier headcount includes staff, contractors and volunteers on site, not just ticket sales or licensed capacity, per Martyn's Law Plan. A venue can cross into enhanced tier through staffing numbers alone.

When does Martyn's Law come into force?

The Terrorism (Protection of Premises) Act 2026 received Royal Assent on 3 April 2026, and the Government intends an implementation period of at least 24 months, with requirements expected to come into force in spring 2027, per ProtectUK / Home Office.

Who regulates Martyn's Law?

The Security Industry Authority (SIA) is the designated regulator. It launched a public consultation on its draft section 12 statutory guidance on 15 April 2026, running until 12 June 2026, per GOV.UK.

What are the penalties for enhanced tier non-compliance?

Enhanced duty premises face fines up to £18 million or 5% of worldwide revenue, whichever is greater, plus daily penalties up to £50,000, per Policy Pros. Ignoring a penalty notice altogether is a criminal offence carrying an unlimited fine and/or up to two years' imprisonment, per Lexology.

Do standard tier premises face the same penalties?

No. Standard duty premises face a maximum £10,000 fine with daily penalties up to £500, per Policy Pros — substantially lower than the enhanced tier's exposure.

What documentation does an enhanced tier premises need?

Enhanced tier sites need a documented, current risk assessment and a formal public protection procedure covering evacuation, invacuation, lockdown and communication with emergency services. Supporting evidence — training records, drill logs, incident records and proof physical measures are actually in place — should back up the written procedure.

Preparing your sites for Martyn's Law with Pulse Operations

Enhanced tier compliance hinges on evidence, not intent — a risk assessment, a rehearsed procedure and records that prove staff training, drills and physical measures actually happened, on the date they were supposed to. That is precisely the gap Pulse Operations's compliance runway closes, sitting alongside SIA licensing, BS 7858 screening, DBS and right-to-work checks on one expiries view so nothing is discovered missing when the SIA asks.

Pulse Operations was built inside Priority First, the founding team's own London security & FM operation, where photo-verified checkpoints and a tamper-evident daily occurrence book were developed to solve exactly this kind of proof problem before Martyn's Law existed as a statute. If your enhanced tier premises needs a system that turns "we have a policy" into "here is the evidence," get in touch with Pulse Operations for a walkthrough of the compliance runway or book a look at how it works.

Related Reading

• Martyn's Law for Outdoor Events: 2026 UK Guide
• Martyn's Law Training Course: 2026 Buyer's Guide
• Martyn's Law Online Training: 2026 UK Compliance Guide