Martyn's Law Compliance Documentation
We write the public protection procedures, compliance documents and capacity assessments that the Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, requires of premises and events in scope.
The Act received Royal Assent on 3 April 2025 and is expected to come into force in Spring 2027, after an implementation period of at least 24 months. The section 27 statutory guidance was published on 15 April 2026, and the Security Industry Authority (SIA), the new regulator, is consulting on its enforcement approach.
If you are responsible for premises where 200 or more people may be present, you have time to prepare now, before the duty bites. We turn the legislation into the documents you will need to evidence compliance.
New to the regime? Start with our full Martyn's Law compliance guide, or jump to the capacity assessment guide and the Martyn's Law FAQ.
What Martyn's Law Requires
The Act creates two tiers of duty based on how many people, including staff, may reasonably be expected at the premises or event at the same time.
- Standard duty premises (200 to 799): put in place appropriate public protection procedures across four areas defined in section 5: evacuation, invacuation (moving people to safety inside), lockdown, and communication. These are expected to be simple and low cost, with no requirement to buy equipment.
- Enhanced duty premises and qualifying events (800 or more): in addition, put in place public protection measures across the four areas in section 6 (monitoring the premises, the movement of individuals, physical safety and security, and security of information), designate a senior individual responsible for compliance, and prepare a compliance document recording the procedures and measures and providing it to the SIA.
Most education settings remain in the standard tier regardless of capacity.
Standard vs Enhanced Duty at a Glance
| Item | Standard duty (200-799) | Enhanced duty (800+) |
|---|---|---|
| Public protection procedures (s.5) | Required | Required |
| Public protection measures (s.6) | Not required | Required |
| Designated senior individual | Not required | Required |
| Compliance document to the SIA | Not required | Required |
| Maximum non-compliance penalty | £10,000 (£500 per day) | £18 million or 5% of worldwide revenue (£50,000 per day) |
What You Get
We produce the written documentation that demonstrates a premises or event has met its duty. Depending on your tier, that includes:
- A capacity assessment establishing whether you fall into the standard or enhanced tier, using fire safety occupancy limits, peak attendance and site data.
- Public protection procedures covering evacuation, invacuation, lockdown and communication, written for your specific premises and staff.
- Public protection measures for enhanced premises across the four statutory categories.
- An enhanced-tier compliance document recording your procedures and measures and the assessment of how they reduce vulnerability and the risk of harm, ready to provide to the SIA.
- Staff guidance so that the people on site know how to act if an attack occurs.
Every document is written for your premises, not pulled from a generic template. That is the difference between a document that demonstrates compliance and one that does not.
Why Act Now
Commencement is expected in Spring 2027, but the work to assess capacity, write procedures and prepare a compliance document takes time, and the cost of getting it wrong is significant. Enhanced duty premises face penalties of up to £18 million or 5% of qualifying worldwide revenue.
The SIA's draft enforcement guidance is out for consultation until 11:59pm on Friday 12 June 2026, which gives a clear picture of how the regulator will operate. Preparing your documentation now means you are ready well ahead of the deadline rather than scrambling against it.
How Policy Pros Can Help
Policy Pros writes practical, premises-specific compliance documentation. Martyn's Law sits alongside your wider safety and security obligations, so we align it with your health and safety policies, your emergency evacuation policies and your risk management policies.
For organisations that also need to evidence information and physical security, our IT security and assurance work complements the security-of-information measures the enhanced tier requires.
To scope the documents your premises or event needs, get in touch for a quote.
Frequently Asked Questions
Is Martyn's Law in force yet?
Not yet. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but there is an implementation period of at least 24 months. Commencement is expected in Spring 2027, and there is no legal requirement to comply until the Act comes into force.
What is the difference between standard and enhanced tier?
Standard duty applies to premises where 200 to 799 people, including staff, may be present at the same time. Enhanced duty applies at 800 or more. Standard tier requires public protection procedures only; enhanced tier also requires public protection measures, a designated senior individual and a compliance document provided to the SIA.
What counts towards the 200 capacity threshold?
The number of individuals who may reasonably be expected to be present at the same time, including staff, not just customers or visitors. Occasional higher-attendance events can bring premises into scope, so capacity should be assessed against peak use.
What are the penalties for non-compliance?
For standard duty premises the maximum penalty is £10,000, with daily penalties up to £500. For enhanced duty premises and qualifying events the maximum is £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties up to £50,000.
Do I need a compliance document?
A compliance document is a requirement for enhanced duty premises and qualifying events (800 or more people). It records the public protection procedures and measures in place and assesses how they reduce vulnerability and the risk of harm, and it must be provided to the SIA. Standard duty premises do not need one.
