Martyn's Law for Hotels and Hospitality

Hotels, pubs, restaurants, bars and event venues will fall within Martyn's Law where 200 or more people, including staff, may reasonably be expected to be present at the same time. The duty turns on capacity at peak use, not on an average quiet afternoon.

The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent on 3 April 2025. It is expected to come into force in Spring 2027, after an implementation period of at least 24 months, so there is no legal duty to comply until commencement.

There are two tiers. Standard duty premises (200 to 799) must put public protection procedures in place. Enhanced duty premises and qualifying events (800 or more) must do more, including a compliance document provided to the regulator.

The regulator is the Security Industry Authority (SIA). Penalties run from a maximum of £10,000 for standard duty premises to £18 million or 5% of qualifying worldwide revenue for enhanced premises and qualifying events.

The starting point for any hospitality operator is the legislation itself. You can read the Terrorism (Protection of Premises) Act 2025 and the section 27 statutory guidance, which was published on 15 April 2026.

Why Hospitality Is Different

Hospitality sites rarely have a single, fixed capacity. A hotel might run a 60-cover restaurant on a Tuesday and a 400-guest wedding on a Saturday, and a pub might hold a quiet midweek crowd one night and a packed function the next.

Martyn's Law looks at how many people may reasonably be expected at the same time, assessed against peak use. A venue that is comfortably below 200 most of the week can still be in scope because of the events it hosts.

Mixed-use spaces add to the picture. A single building may contain a bar, a restaurant, function rooms and bedrooms, and you need to understand how those areas combine when assessing the number of people present.

1. Assessing Capacity in a Hospitality Setting

Capacity for Martyn's Law counts everyone who may reasonably be expected to be present at the same time. That includes staff, not just paying customers, so front of house, kitchen, housekeeping, management and contractors all count towards the total.

For a hotel, that means guests in bedrooms, diners in the restaurant, drinkers in the bar, delegates in conference rooms and the whole team working the floor, counted together at the busiest realistic point.

Peak use and occasional events

Capacity should be assessed against peak use rather than a typical day. An otherwise standard-duty venue can be pushed into a higher tier by occasional higher-attendance events, such as a New Year function, a festival weekend or a large private hire.

If a wedding, a conference or a ticketed event regularly brings 800 or more people on site at once, that occasional peak is what determines your tier for that event, even if your day-to-day numbers sit far below it. Work through the detail in our capacity assessment guide.

Function and event spaces

Function suites, marquees, courtyards and event spaces need to be counted alongside the rest of the premises when they are in use. Where you host standalone ticketed events for 800 or more people, you may also be looking at the qualifying events rules, which our events and festivals guide covers in full.

2. Standard Duty: Procedures for the 200 to 799 Tier

Most independent hotels, pubs and restaurants in scope will sit in the standard tier. Standard duty (section 5) requires appropriate and reasonably practicable public protection procedures across four areas. These are expected to be simple and low cost, with no requirement to buy equipment.

• Evacuation: how you move guests and staff out of the premises and away from danger, including from upper floors, function rooms and outdoor areas.
• Invacuation: moving people to safety inside the premises where leaving is not the safer option, for example holding guests in a secure part of the building.
• Lockdown: how you secure the premises to keep a threat out or contain it, covering doors, entrances and service access.
• Communication: how you alert staff and guests and pass on instructions quickly across a busy, noisy venue.

For hospitality, the practical challenge is applying these to a moving population during busy periods, when a venue is full, the bar is loud and shifts are changing. Our standard tier procedures guide sets out what each of the four areas means in practice.

3. Enhanced Duty: Larger Hotels and Major Event Venues

Larger hotels, conference centres and major hospitality venues that expect 800 or more people at the same time fall into the enhanced tier. Enhanced duty (section 6) adds public protection measures on top of the standard procedures, across four categories.

• Monitoring the premises: keeping watch over the site and its approaches.
• Movement of individuals: managing how people enter, move through and leave the venue.
• Physical safety and security: the physical features that protect people on site.
• Security of information: protecting information that could be useful to an attacker, such as floor plans and event details.

Enhanced premises must also designate a senior individual responsible for compliance and prepare a compliance document. That document records the procedures and measures in place and assesses how they reduce vulnerability and the risk of harm, and it must be provided to the SIA. Our enhanced tier compliance document guide explains what it must contain.

Standard vs Enhanced Duty for Hospitality

Requirement	Standard duty (200 to 799)	Enhanced duty (800 or more)
Public protection procedures (s.5)	Required	Required
Public protection measures (s.6)	Not required	Required
Designated senior individual	Not required	Required
Compliance document to the SIA	Not required	Required
Maximum penalty	£10,000 (up to £500 per day)	£18 million or 5% of qualifying worldwide revenue (up to £50,000 per day)

What Hospitality Venues Must Do

1. Assess your peak capacity, counting staff as well as guests, across every part of the site in use at the same time.
2. Map your busiest realistic scenarios, including functions, peak weekends and occasional large events, to find your tier.
3. Identify any events that could push the premises to 800 or more and check the qualifying events position.
4. Write public protection procedures for evacuation, invacuation, lockdown and communication that work in your specific layout.
5. Brief all staff, including seasonal and agency workers, so they know how to act during a busy shift.
6. Prepare a compliance document and designate a senior individual if you are in the enhanced tier.
7. Review your assessment whenever your spaces, capacity or event programme changes.

Common Errors to Avoid

• Counting only customers and forgetting that staff count towards the threshold.
• Assessing capacity on a quiet day rather than against peak use.
• Overlooking function rooms, marquees and outdoor areas when they are in use at the same time.
• Assuming an occasional large event does not matter because the venue is usually well below 200.
• Treating a generic template as enough rather than writing procedures for your actual layout and staffing.
• Leaving seasonal and agency staff out of briefings during the busiest periods.

Enforcement and Penalties

The SIA can use compliance notices, restriction notices and monetary penalties. For standard duty premises the maximum penalty is £10,000, with daily penalties of up to £500.

For enhanced duty premises and qualifying events the maximum is £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000. The SIA's draft section 12 enforcement guidance is out for consultation, closing at 11:59pm on Friday 12 June 2026.

How Policy Pros Can Help

Policy Pros writes the capacity assessments, public protection procedures and compliance documents that hospitality venues need, built around how your site actually operates. Our Martyn's Law compliance documentation service turns the legislation into documents you can put in front of the SIA.

For the wider context, start with our Martyn's Law 2027 compliance guide, then work through the capacity assessment guide and the events and festivals guide if you host large functions. This work sits naturally alongside your emergency evacuation policies and health and safety policies.