Last updated: 14 September 2026

Martyn's Law tiers explained: Standard and Enhanced Tier duties for UK premises

Martyn's Law — the Terrorism (Protection of Premises) Act 2026 — splits premises into two tiers by capacity: Standard Tier covers venues expecting 200–799 people at once, while Enhanced Tier covers venues and events with 800 or more. Enhanced Tier carries heavier documented duties and far steeper penalties than Standard.

Key Takeaways

• Standard Tier applies to premises where it is reasonable to expect between 200 and 799 people present at the same time, according to the British Safety Council (2026).
• Enhanced Tier applies to premises and events with a capacity of 800 or more individuals, per Skills for Health (2026).
• Standard duty premises face a maximum penalty of £10,000, with daily penalties up to £500, while Enhanced duty premises face fines of up to £18 million or 5% of worldwide revenue, whichever is greater, according to Policy Pros (2026).
• The Terrorism (Protection of Premises) Act 2026 received Royal Assent on 3 April 2026, confirmed by North Yorkshire Partnerships (2026).
• The Act is expected to come into force in Spring 2027, following a minimum 24-month implementation period, per Policy Pros (2026).

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2026, a statute that introduces legal duties on operators of qualifying public premises and events to prepare for the possibility of a terrorist attack. It is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena attack, and the campaign that drove it onto the statute book was led by his mother, Figen Murray OBE, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The Act received Royal Assent on 3 April 2026, according to North Yorkshire Partnerships (2026). It does not apply immediately. There is an implementation period of at least 24 months, so the Act is expected to come into force in Spring 2027, per Policy Pros (2026). On 15 April 2026, the Home Office published statutory guidance under section 27 of the Act, according to Home Office / GOV.UK (2026) — the document businesses now use to work out which tier they fall into.

Figen Murray called the guidance publication "another significant milestone for the Martyn's Law campaign" that will "provide the clarity for venues and events within scope to begin to implement proportionate measures set out within Martyn's Law." Security Minister Dan Jarvis has said Martyn's Law "will help to save lives by making sure venues are ready to act if the worst happens."

How does the two-tier system work?

Martyn's Law uses a single test — the maximum number of people who could reasonably be present at the same time — to sort premises and events into one of two tiers, Standard or Enhanced. The Security Industry Authority (SIA), the same regulator that licenses door supervisors and CCTV operators under the Private Security Industry Act 2001, has been named as the regulator responsible for enforcing both tiers.

Capacity is not average daily footfall. It is based on how many people could be present — public and staff combined — at the premises' busiest realistic moment, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. A community hall that occasionally hosts a 250-person wedding reception, even if its typical Tuesday footfall is 30 people, is assessed on that peak, not the average.

Standard Tier: 200 to 799 people

Standard Tier applies to premises where it is reasonable to expect between 200 and 799 people present at the same time, according to the British Safety Council (2026). This is the larger population of qualifying premises in the UK — pubs, small retail units, community centres, gyms, places of worship and similar venues that regularly host more than a couple of hundred people but rarely approach four figures.

Standard Tier duties are, by design, low-cost and procedural rather than paper-heavy. Per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams, operators need public protection procedures — things like evacuation, invacuation (moving people to safety inside the building) and lockdown plans — plus a designated responsible person and basic staff awareness. There is no statutory requirement for a documented risk assessment at Standard Tier, though sensible operators keep one anyway.

Enhanced Tier: 800 or more people

Enhanced Tier applies to premises and events with a capacity of 800 or more individuals, per Skills for Health (2026). This covers shopping centres, stadiums, arenas, large nightclubs, major visitor attractions and qualifying temporary events — music festivals, large sporting fixtures, outdoor gatherings — where organisers must assess tier status against expected peak attendance rather than a fixed building capacity.

Enhanced-tier sites must maintain a documented risk assessment that is kept current, not a one-off exercise, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. Enhanced duties layer additional obligations on top of Standard: named public protection measures (not just procedures), evidence of staff training, and closer cooperation with the SIA as regulator, including inspection and information requests.

"A checklist that just lists paperwork misses the point. Martyn's Law compliance means knowing your capacity, having a named responsible person, and training staff to run a lockdown or invacuation without waiting for instructions. Write it down, walk it through with the night team, and test it for real — a checklist nobody's practised is just a document waiting to fail." — Mo Hassan, Founder, Pulse

Standard Tier vs Enhanced Tier: a side-by-side comparison

The table below summarises the practical differences business professionals need to plan around — capacity, duties and penalties.

What are the penalties for getting a tier wrong?

Getting your tier wrong carries real financial consequences, and the gap between the two is large by design. Standard duty premises face a maximum penalty of £10,000, with daily penalties up to £500, according to Policy Pros (2026). Enhanced duty premises and qualifying events face a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties up to £50,000, per the same source.

That difference matters commercially, not just legally. A venue that under-declares its capacity to stay in Standard Tier — say, a 750-capacity events space that regularly sells 850 tickets for its biggest nights — is exposed to Enhanced Tier enforcement the moment the SIA inspects and finds the real peak attendance. The SIA published draft section 12 enforcement guidance for consultation, which closed at 11:59pm on Friday 12 June 2026, per Policy Pros (2026), setting out how it intends to use these powers in practice.

The English Football League has already signalled support for the direction of travel.

Who assesses which tier applies — and how do you prove it?

The responsible person named under the Act — usually a senior operator, venue manager or estates lead — is who assesses tier status, and they do it by estimating the maximum reasonable capacity of the premises or event, including staff. This is not a one-off desk exercise. Capacity can change: a retail unit that expands, a community hall that starts hosting larger functions, a stadium that adds temporary seating for a one-off concert, can all move a site from Standard into Enhanced without anyone updating the paperwork.

This is where the practical problem starts for security and FM teams: proving the protection procedures actually happened, not just that a policy document exists. Pulse Operations built its compliance runway around exactly this gap — SIA licensing, BS 7858 screening (the British Standard for pre-employment vetting in security), DBS checks, right-to-work records, training records, statutory building compliance and Martyn's Law assessments all tracked on one expiries runway at /compliance, so a responsible person can show evidence rather than assertion when the SIA comes asking.

Priority First — the founding team's own London security & FM operation, and the environment Pulse was built inside before being offered to other operators — runs a 16-building central London residential estate where the client asked a direct question: can you prove every building gets its patrols, every night? Each building was set up as its own site in Pulse with its own checkpoints and evidence trail, and the estate has run 4,100+ recorded patrols since going live in March 2026 — roughly 250–280 per building — with 100% of checkpoint completions photo-verified, against what had previously been one vague "round complete" per night. The same principle — verifiable evidence over a policy document — is exactly what Enhanced Tier's documented risk assessment demands.

Enhanced Tier's documentation burden: in-house vs a compliance platform

Enhanced Tier's requirement for a current, maintained risk assessment creates an ongoing administrative load that many estates and venues underestimate. There are broadly two ways to handle it.

In-house, spreadsheet-based tracking keeps cost low up front but relies on someone remembering to update the risk assessment, chase training refreshers, and pull evidence together manually if the SIA requests it. This works while one person owns it — and breaks the moment they leave, or the moment three sites need coordinating at once.

A dedicated compliance runway puts SIA licences, BS 7858 renewal dates, training certificates and the Martyn's Law risk assessment itself on a single expiries timeline, with gaps visible before they become a finding. Per Pulse Operations's guide, How to win your next security tender, publicly accessible venues are already being asked about Martyn's Law readiness at the tender selection-questionnaire stage — a pass/fail gate a bidder either clears or doesn't, regardless of how good the rest of the proposal is. Enhanced Tier operators bidding for contracts will increasingly need to produce this evidence on demand, not promise it exists.

Your Martyn's Law tiers checklist

• Estimate your premises' or event's maximum reasonable capacity, including staff, not average footfall.
• Confirm whether that figure places you in Standard Tier (200–799) or Enhanced Tier (800+).
• Appoint and name a designated responsible person for Martyn's Law duties.
• Draft public protection procedures for Standard Tier, or public protection measures plus a documented risk assessment for Enhanced Tier.
• Train staff on evacuation, invacuation and lockdown, and walk it through with the night team — don't just file it.
• Re-check your capacity assessment whenever the premises' use, layout or event scale changes.
• Keep evidence of training, drills and reviews, not just the policy document itself.
• Track your readiness against the Spring 2027 implementation timeline rather than waiting for enforcement to start.

FAQ

What are the two tiers under Martyn's Law?

Martyn's Law creates two tiers: Standard Tier and Enhanced Tier, split by the maximum number of people reasonably expected at a premises or event at one time. Standard Tier covers 200–799 people, per the British Safety Council (2026), while Enhanced Tier covers 800 or more, per Skills for Health (2026).

What is the difference between Standard Tier and Enhanced Tier?

Standard Tier requires public protection procedures — evacuation, invacuation and lockdown plans — and a named responsible person, with no statutory mandate for a written risk assessment. Enhanced Tier adds public protection measures plus a mandatory, kept-current documented risk assessment, and carries dramatically higher penalties for non-compliance.

Does Martyn's Law apply to venues under 200 people?

No. Premises where it is reasonable to expect fewer than 200 people present at the same time fall outside Martyn's Law's scope entirely, since Standard Tier only begins at 200 people, according to the British Safety Council (2026). Very small venues are not required to comply, though many still adopt basic procedures as good practice.

What are the penalties for non-compliance in each tier?

Standard duty premises face a maximum penalty of £10,000, with daily penalties up to £500, per Policy Pros (2026). Enhanced duty premises and qualifying events face a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties up to £50,000, per the same source.

Who enforces Martyn's Law and the tier requirements?

The Security Industry Authority (SIA) is the regulator responsible for enforcing Martyn's Law. The SIA published draft section 12 enforcement guidance for consultation, which closed at 11:59pm on Friday 12 June 2026, per Policy Pros (2026), setting out how enforcement powers will be applied across both tiers.

When does Martyn's Law come into force?

The Terrorism (Protection of Premises) Act 2026 received Royal Assent on 3 April 2026, according to North Yorkshire Partnerships (2026). There is a minimum 24-month implementation period, so the Act is expected to come into force in Spring 2027, per Policy Pros (2026).

Do staff count towards a venue's capacity for tier assessment?

Yes. Capacity is based on how many people could be present — public and staff together — not average daily footfall, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. A venue must include its own workforce numbers when estimating whether it sits in Standard or Enhanced Tier.

What documentation is required for Enhanced Tier premises compared to Standard Tier?

Enhanced Tier requires a documented risk assessment that is kept current, not a one-off exercise, alongside named public protection measures and evidence of staff training. Standard Tier requires public protection procedures and a designated responsible person, but does not statutorily mandate a written risk assessment, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

Getting Martyn's Law-ready with Pulse Operations

Working out your tier is the easy part; proving your public protection procedures actually happened on the night is where estates and venues get caught out. Pulse Operations's compliance runway keeps Martyn's Law assessments alongside SIA licensing, BS 7858 screening, DBS checks and training records on one expiries timeline, so a designated responsible person can produce evidence, not a policy binder, when the SIA asks.

The same photo-verified evidence model already runs across Priority First's multi-site London portfolio — including a 16-building central London estate that moved from one nightly "round complete" report to 4,100+ individually verified patrols since March 2026, with every checkpoint completion 100% photo-verified. That's the same standard of proof Enhanced Tier's documented risk assessment demands: not an assertion, a record.

If you manage a Standard or Enhanced Tier premises and want to see how the compliance runway and photo-verified patrols work together, book a look at Pulse's compliance module or get in touch for a quote through pulse-operations.co.uk — pricing is published openly, per operative, with no sales deck required.

Related Reading

• Martyn's Law for Outdoor Events: 2026 UK Guide
• Martyn's Law Training Course: 2026 Buyer's Guide
• Martyn's Law Online Training: 2026 UK Compliance Guide