Martyn’s Law: The Number That Decides Which Tier You Are In
TL;DR: Martyn’s Law is expected to come into force in spring 2027, and it turns a headcount into a legal threshold. If you can reasonably expect 200 to 799 individuals at the same time you are standard tier, 800 or more and you are enhanced tier, and the figure must include your staff. The statutory guidance published on 15 April 2026 says the method you use must be evidenced and must satisfy the regulator. Nothing in the Act requires any technology. What it requires is a number you can defend.
Last updated: 29 July 2026
On this page
Key takeaways
- Martyn’s Law received Royal Assent on 3 April 2025. The requirements are not yet enforceable and are expected to commence in spring 2027.
- Standard tier is 200 to 799 individuals reasonably expected at the same time. Enhanced tier is 800 or more.
- The figure must include staff, and that means employees, contractors, volunteers and anyone else working there.
- Whatever method you use, the guidance says it “must be evidenced and must satisfy the SIA”.
- Standard tier duties are four procedures: evacuation, invacuation, lockdown and communication. No physical measures are required.
- Maximum penalties run to £10,000 for standard tier and the greater of £18 million or 5% of qualifying worldwide revenue for enhanced tier, with daily penalties of £500 and £50,000.
What is Martyn’s Law, and when does it start?
Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It requires those responsible for certain public premises and events to take reasonably practicable steps to be ready to keep people safe if an attack happens, and it received Royal Assent on 3 April 2025 with an implementation period the Home Office describes as at least 24 months.
The current position is easy to misread. Section 27 of the Act was commenced on 10 April 2026 purely so that statutory guidance could be published on 15 April 2026. The substantive duties are still not in force. The Security Industry Authority, which will regulate the regime, says on GOV.UK that “it is expected that the Act will come into force in spring 2027”.
So there is roughly a year and a half of runway, and the Martyn’s Law guidance exists precisely so that responsible persons can use it. The SIA’s own final section 12 guidance and its consultation report are due in autumn 2026, which is the next date worth putting in a diary.
The number that decides your tier
Everything under Martyn’s Law hangs off one figure: the number of individuals it is reasonable to expect may be present at the same time. Between 200 and 799 puts you in the standard tier under section 2(2). At 800 or more you are in the enhanced tier under section 2(3). Below 200 you are out of scope entirely.
The guidance is specific about how that figure is reached. Paragraph 4.23 says a reasonable method should be used to calculate the greatest expected number at the premises at the same time, and that “this figure must include staff working at the premises”. Staff is defined broadly, covering employees, contractors, volunteers and others.
Paragraph 4.24 points at the acceptable inputs: the busiest trading or visiting times, historic ticketing or attendance data, or fixed seating and standing positions. Then paragraph 4.25 adds the sentence that changes the character of the exercise. Whatever method you choose, “it must be evidenced and must satisfy the SIA”, and the regulator can compel you to explain how the assessment was carried out using the information gathering powers in Schedule 3.
That is where a lot of premises will find a gap. A fire safety maximum occupancy is a capacity, a ceiling on how many bodies the building can lawfully hold. Martyn’s Law asks for an expectation, the greatest number you actually expect. Those are different numbers, and for a venue sitting anywhere near 200 the difference decides whether you have duties at all.
Which premises are in scope
The headcount only matters if the premises is wholly or mainly used for one of the uses listed in Schedule 1 to the Act. Schedule 1 is the second gate in Martyn’s Law, and it is checked before the number. There are seventeen of them, and the list is broader than the nightlife-and-stadiums framing the coverage tends to use.
- Shops, and food and drink premises
- Entertainment and leisure activities, and sports grounds
- Libraries, museums, galleries and archives
- Halls for hire, exhibition halls and conference centres
- Visitor attractions, and hotels, hostels and holiday parks
- Places of worship
- Health care premises
- Bus, railway, coach and tramway stations, and aerodromes
- Childcare, primary and secondary education, further education and higher education
- Public authority premises used by visiting members of the public
Note what that catches. A hospital, a university building, a conference centre and a large depot canteen are all as much in scope as a music venue. Manufacturing and warehousing are not Schedule 1 uses in themselves, so a factory floor is outside the regime, but a visitor centre or a large staff restaurant on the same site may not be.
What the standard tier requires
Less than most people assume. Martyn’s Law at standard tier is a paperwork and planning obligation, not a capital one. Section 5 requires the responsible person to ensure appropriate public protection procedures are in place, and the Act names four of them. There is no requirement to install anything, build anything or buy anything at standard tier.
- Evacuation. Getting people away from danger by moving them out of the premises or event, or part of it.
- Invacuation. Moving people away from danger to a place inside where there is less risk.
- Lockdown. Securing the premises to prevent individuals entering or leaving.
- Communication. Alerting people to danger and giving them instructions.
Procedures must be appropriate to the specific context, and the standard throughout is reasonably practicable, which the guidance glosses as proportionate: what can be done, weighed against cost, time and difficulty. It also states plainly that nobody is expected to take actions that would compromise their own safety.
What the enhanced tier adds
At 800 or more, Martyn’s Law requires everything above plus public protection measures under section 6, which is where physical and systemic controls enter. The Act groups them into four areas: monitoring, movement, physical safety and security, and security of information.
The objective is stated in two parts and both matter. Measures must reduce the risk of physical harm if an attack occurred, and reduce the vulnerability of the premises to an attack in the first place. That second objective pulls in access control, crowd movement design and how carefully site information is handled.
What it costs to get it wrong
The SIA enforces Martyn’s Law through compliance notices under section 13 and restriction notices under section 14, backed by monetary penalties. Section 18 sets the maximums, and the gap between the tiers is the largest of any recent UK regime of this kind.
| Contravention | Standard tier | Enhanced tier or qualifying event |
|---|---|---|
| Maximum penalty | £10,000 | £18 million, or 5% of qualifying worldwide revenue, whichever is greater |
| Maximum daily penalty | £500 | £50,000 |
| Failing to attend and answer questions | £5,000 | |
Read the enhanced tier row again. It is not a fixed ceiling, it is a revenue-linked floor of £18 million, which is the same design the Cyber Security and Resilience Bill uses for cyber failures. The drafters have decided that for large organisations a flat cap stops being a deterrent, and that decision is spreading across UK regulation.
On inspections, the SIA says it will normally give 72 hours’ notice, but it can ask a court for a warrant to enter without notice in some circumstances.
What Martyn’s Law does not require
This part needs saying clearly, because a lot of vendor material implies otherwise. Martyn’s Law does not mandate any technology. There is no requirement in the Act to fit cameras, counters, barriers or alarms. The standard tier duties are procedural, and the enhanced tier duties are outcome-based rather than product-based. Anyone selling a box as a compliance requirement is overstating it.
What Martyn’s Law does do is make two things load-bearing that most premises currently treat casually. The first is the number itself, which now has to be defensible to a regulator rather than roughly right. The second is knowing how many people are actually inside when you invoke a procedure, because evacuation, invacuation and lockdown all depend on it and none of them works well against an estimate.
That is where continuous counting earns its place, on evidence rather than on compliance. A venue that has twelve months of people counting data can show the regulator a distribution rather than an assertion, including the peak hours that decide the tier. Our guide to people counting sensors covers the accuracy bands, and the cost breakdown sets out what a multi-door site actually pays over three years. Where a camera line is the right answer rather than a beam, see AI cameras.
For premises sitting near either threshold, that record cuts both ways, and honestly so. It may show you are comfortably under 200 and have no duties. It may show a Saturday peak that puts you in the enhanced tier. Either answer is better than guessing, and only one of them is a nasty surprise during an inspection.
Five steps before spring 2027
- Decide whether you have a Schedule 1 use at all. Martyn’s Law never reaches a premises without one. Manufacturing is not one. A visitor centre, canteen, conference suite or training facility on the same site might be.
- Work out the number, and write down the method. The method is what the SIA will ask about, not just the result. Include staff, contractors and volunteers.
- Sanity-check it against real data. If your only figure is a fire safety capacity, you have a ceiling rather than an expectation. A season of counts on the sensors you already run is a stronger answer.
- Draft the four procedures now. Evacuation, invacuation, lockdown and communication cost nothing but thinking time, and standard tier needs no hardware.
- Watch autumn 2026. The SIA’s final section 12 guidance lands then, and it will shape what “satisfy the SIA” means in practice.
Frequently asked questions
When does Martyn’s Law come into force?
It is expected in spring 2027, and the exact date will be confirmed beforehand. The Act received Royal Assent on 3 April 2025 and statutory guidance was published on 15 April 2026, but the substantive requirements are not yet enforceable. There is no obligation to notify the SIA until commencement.
How do I work out whether I am in the 200 to 799 tier?
Calculate the greatest number of individuals you reasonably expect at the premises at the same time, including staff, contractors and volunteers. Acceptable inputs include your busiest trading or visiting times, historic ticketing or attendance data, and fixed seating or standing positions. The method must be evidenced and must satisfy the SIA.
Does Martyn’s Law require CCTV or people counting?
No. Martyn’s Law mandates no specific technology at either tier. Standard tier duties are procedures only. Enhanced tier adds measures covering monitoring, movement, physical safety and security, and security of information, but it describes outcomes rather than products, and what is reasonably practicable varies by site.
Is a factory or warehouse in scope of Martyn’s Law?
Not for its industrial use. Schedule 1 lists seventeen categories and manufacturing and storage are not among them. However, a site can contain qualifying premises, such as a visitor centre, a conference suite or a public-facing retail or food outlet, and those are assessed on their own use and their own expected numbers.
Who enforces Martyn’s Law?
The Security Industry Authority, through a new regulatory function. It can issue compliance notices, restriction notices and monetary penalties, and it can require a responsible person to explain how their capacity assessment was carried out. Inspections normally come with 72 hours’ notice, though a court warrant can allow entry without it.
The threshold is the compliance decision
Most regulations start with a duty and work back to who owes it. Martyn’s Law starts with a number and works forward, so the most consequential piece of work is the one nobody is selling: calculating, honestly and with evidence, how many people are in the building on your busiest hour.
Do that before spring 2027 and everything after it is manageable. For the wider occupancy picture see our desk occupancy sensors page and the hybrid workplace guide, for venue-scale deployments see IoT for sports venues, and for the retrofit question see wireless versus wired sensors.
Need a defensible occupancy figure before the regulator asks for one? Talk to Indiott about counting accuracy, multi-entrance sites and what a twelve month record looks like in practice.
Next step
Get a priced kit list for your site
Answer three quick questions and tell us where to send it. An engineer replies within one working day with the parts, the prices and the lead time.
Rather talk it through? Call 023 9223 3611
Received. An engineer has it.
You will hear back within one working day with the parts, the prices and the lead time. A confirmation is on its way to your inbox.
If it is urgent, call 023 9223 3611.
