Martyn's Law Standard Tier: A Step-by-Step Compliance Guide for Venues with 200-799 Capacity

and will launchAuthor: Chris Brown
Published: 10/02/2026
Last Updated: 10/02/2026
Reading Time: 12 minutes

If your venue has a capacity between 200 and 799 people, you fall within the Standard Tier of Martyn's Law. You have until April 2027 to comply. That sounds like plenty of time. It is not as much as you think.

This guide walks you through exactly what you need to do, in what order, using resources that are entirely free. The Government has been explicit that Standard Tier compliance should not require expensive consultants, specialist products, or physical alterations to your premises. What it requires is thought, planning, and ensuring your staff know what to do if the worst happens.

If you have not yet read our plain English overview of Martyn's Law, start there: Martyn's Law: A Plain English Guide for UK Hospitality Venues. This article assumes you know what the law is. It focuses on how to comply with it.

Before You Start: Confirm You Are in Scope

The Standard Tier applies to premises where it is reasonable to expect between 200 and 799 people to be present at the same time, from time to time. That figure includes everyone: customers, staff, contractors, delivery drivers, and visitors.

Three questions to answer honestly:

What is your realistic maximum occupancy? Not your theoretical fire safety limit, but the number of people who are actually on your premises during your busiest periods. If you run a pub that seats 120 but hosts live music nights where attendance reaches 250, including staff, you are in scope.

Does your outside space count? Yes. Beer gardens, hotel grounds used for dining or events, and other associated outdoor areas are part of your premises under the Act. A restaurant with 150 indoor covers but a courtyard that brings the total past 200 is in scope.

Are you listed in Schedule 1? The Act covers specific types of premises. For hospitality, this includes restaurants, cafes, pubs, bars, nightclubs, hotels, entertainment venues, and visitor attractions. If you serve food and drink for consumption on the premises, or provide accommodation, entertainment, or leisure activities, you are almost certainly covered.

If the answer to all three is yes, you are a Standard Tier venue and the rest of this guide applies to you.

Source: Terrorism (Protection of Premises) Act 2025, Schedule 1; Home Office Factsheet, April 2025

Step 1: Identify Your Responsible Person

Every qualifying premises must have a Responsible Person. This is not a new hire or a specialist role. It is the individual or organisation that has control of the premises in connection with its qualifying use.

For most hospitality venues, this is straightforward:

• Pubs: The landlord or tenant who operates the venue
• Restaurants: The owner or operating company
• Hotels: The management company or proprietor
• Venues within larger buildings: The operator of the venue space, though you may need to coordinate with the building owner

If the Responsible Person is a company rather than an individual, there is no requirement at Standard Tier to appoint a Designated Senior Individual. That obligation only applies to Enhanced Tier venues.

What you need to do: Decide who your Responsible Person is. Write it down. This is the person who will be accountable for compliance and who will register with the SIA when the registration system opens.

Source: GOV.UK Standard Duty Requirements Factsheet

Step 2: Register with the Security Industry Authority

When the Act comes into force, you must notify the SIA that you are responsible for qualifying premises. The SIA is currently building the systems and processes to handle this registration. They expect to be ready by early spring 2027.

You do not need to register now. You cannot register now; the system is not yet available. But you should be ready to do so as soon as it opens.

What you need to do: Keep an eye on the SIA's Martyn's Law page for announcements about when registration opens. Make sure you have the following details: your venue name, address, capacity, and the identity of your Responsible Person.

You must also notify the SIA if you cease to be the Responsible Person, for example, if you sell the business or the lease transfers.

Source: SIA Regulatory Role Publication, November 2025examples the Government

Step 3: Develop Your Public Protection Procedures

This is the core of Standard Tier compliance. You must have procedures in place that could reasonably be expected to reduce the risk of physical harm to people at your premises if a terrorist attack occurred there or nearby.

The Act specifies four categories of procedure. Here is what each one means in practice, with examples the Government has published.

Evacuation

How would you evacuate people from the building quickly and safely?

You almost certainly already have a fire evacuation procedure. Martyn's Law asks you to think about whether that procedure works in a terrorism scenario, where the threat may not be in the same place as a fire, and where the area outside the building may itself be dangerous.

For a 200-capacity pub, this might mean: identifying two exit routes (the main entrance to the street and a rear door to the car park or alley), assigning a staff member to direct people, and knowing when not to evacuate (if the threat is outside).

For a 400-seat restaurant, the Government's own example suggests one route through the main entrance to the public pavement and another through a side door to an alley, with designated staff who know which route to use depending on the location of the threat.

What you need to do: Map your exit routes. Identify who directs the evacuation. Consider scenarios where your normal fire exit route might not be safe.

Invacuation

How would you move people to a safer location inside the building if leaving is not safe?

This is the procedure most venues have not considered. If an attack is occurring outside your premises, the safest course of action may be to move people deeper into the building rather than sending them outside.

For a 200-capacity pub, this might mean moving customers away from the windows and into an internal area, such as a back room, cellar, or corridor with no exterior walls.

For a 400-seat restaurant, the Government suggests: bringing people into the main restaurant area and, if needed, into staff areas away from the frontage.

What you need to do: Walk your premises. Identify which areas are furthest from external walls and windows. These are your invacuation points. If your venue is a single room with no internal retreat, acknowledge this in your procedures. The Act uses the phrase "so far as reasonably practicable." If invacuation is not feasible given your layout, document why and focus on the procedures that are feasible.

Lockdown

How would you secure the premises to prevent a threat from entering?

The Government has been clear that Standard Tier venues do not need sophisticated lockdown systems. For a small venue, lockdown can be as simple as someone locking the front door.

For a 200-capacity shop (the Government's published example), the factsheet states: "a sophisticated process would not be required. As such, it is sufficient for a nominated person to simply use the lock on the front door in the event of an attack occurring outside."

For a 400-seat restaurant, the Government suggests: "nominated individuals knowing when (i.e. when their shift manager instructs them to) and how to quickly lock and barricade doors, close window shutters and turn off lights."

What you need to do: Identify every external door and accessible window. Decide who locks what, and ensure they can do so quickly. If your doors have bolts or shutters, check that they work. Consider whether you can control who enters the building in an emergency without installing new equipment.

Communication

How would you alert staff and customers, and contact emergency services.

This covers two things: how you inform people in your venue about what is happening, and how you contact the police.

For a 200-capacity shop, the Government example suggests: "setting out the above procedures in a one-page summary and circulating with relevant individuals who work at the shop."

For a 400-seat restaurant, the example includes: "ensuring staff know who will enact procedures (shift manager) and planning how to communicate with customers present at the restaurant, in the event of an attack occurring."

What you need to do: Decide how you would alert your team during an incident. In a small venue, this might be communicated verbally. In a larger venue, you might use a radio system, a PA, or a pre-agreed code word. You also need a way to contact 999 and to know what to tell them. Write this down.

Source: GOV.UK Standard Duty Requirements Factsheet; ProtectUK Standard Tier Guidance

Step 4: Write It Down

Your procedures do not need to be lengthy. The Government's own examples suggest a one-page summary is sufficient for smaller venues.

What matters is that the procedures are documented, specific to your premises, and accessible to the people who need to follow them. A laminated A4 sheet in the staff area covering all four procedures is better than a 30-page policy document no one reads.

Your document should include:

• Your venue name and address
• Your assessed capacity
• Your Responsible Person
• Your evacuation routes and who directs them
• Your invacuation points and when to use them
• Your lockdown procedure and who secures which doors
• Your communication plan: who alerts staff, how customers are informed, who calls 999
• The date the procedures were written and when they will be reviewed

The Government recommends reviewing your procedures annually.

A note on the SIA's expectations: The SIA has stated that its role is to "provide advice on and ensure compliance with the regulatory requirements, supporting those responsible for qualifying premises to meet their obligations." The early approach is expected to be guidance-led rather than enforcement-led. If your procedures are reasonable, documented, and communicated to staff, you are on the right track.

Source: SIA Regulatory Role Publication

Step 5: Train Your Staff

Your procedures are only useful if your staff know they exist and understand what to do.

The Act does not require your team to become security experts. It requires awareness: staff who have read the procedures, know what to do in each scenario, and have practised enough that they will not freeze in the moment.

Free training available now:

ACT Awareness e-Learning is a free online course provided by Counter Terrorism Policing through ProtectUK. It takes approximately 45 minutes and covers how to recognise suspicious activity, what to do if you suspect an attack, and how to respond during an incident. It is designed for anyone working in public-facing roles and is directly relevant to hospitality staff. Completion certificates are available for download.

Access it at: protectuk.police.uk/catalogue

SCaN (See, Check, Notify) is a complementary module focused on recognising hostile reconnaissance, meaning someone scoping out your venue before an attack. It teaches staff what to look for and how to report concerns.

ACT in a Box is a facilitated exercise resource that lets you rehearse your team's response. It creates scenarios tailored to your venue type and lets you walk through your procedures in a safe environment.

What you need to do: Get your Responsible Person and shift managers through ACT Awareness as a starting point. Then, brief all staff on your specific venue procedures. You do not need to run a formal training course. A 15-minute briefing at a team meeting, with the one-page procedure document, is a reasonable starting point.

The Government's restaurant example suggests: "new members of staff are provided a short awareness briefing on the restaurant's procedures at induction (alongside health and fire safety inputs)."

Make this part of your induction process, and you have built compliance into your normal operations.

Source: ProtectUK Training Catalogue; GOV.UK Getting Training and Advice on Counter-Terrorism

Step 6: Get Free Expert Support

You do not need to hire a consultant. The Government has repeatedly stated this. But you can get free, expert help from people whose job it is to support venues like yours.

Counter Terrorism Security Advisers (CTSAs) are specialist police officers attached to your local force. They provide free security advice to venues and businesses, including site surveys and tailored recommendations. They are not there to inspect or enforce. They are there to help.

Contact your local police force and ask to speak with your regional CTSA. Alternatively, visit ProtectUK and use their contact resources.

ProtectUK is the national platform managed by the National Counter Terrorism Security Office. It provides guidance documents, risk assessment templates, campaign toolkits, and training resources, all free.

The Home Office will publish statutory guidance before the Act comes into force. This guidance is being designed to be accessible and will not require specialist expertise to follow. It has not been published yet, but when it is, it will be the definitive reference for what compliance looks like.

A warning about third-party services: Both the Home Office and the SIA have issued clear statements that they do not endorse any third-party products or providers claiming to ensure Martyn's Law compliance. The ProtectUK website states explicitly: "Premises and events do not need to spend money on consultants to be compliant with the legislative requirements." If someone tells you that you cannot comply without buying their service, that contradicts what the Government says.

Source: ProtectUK Martyn's Law Page; SIA Regulatory Role Publication

A Realistic Timeline

Here is a practical schedule for getting compliant before April 2027. You do not need to do everything at once.

Now (February 2026):

• Confirm your capacity and whether you are in scope
• Identify your Responsible Person
• Complete ACT Awareness e-Learning (45 minutes)

Spring 2026:

• Walk your premises with the four procedures in mind
• Draft your one-page procedure document
• Brief your team at a regular staff meeting

Summer 2026:

• Run a tabletop exercise using ACT in a Box
• Contact your local CTSA for a free site visit if you want expert input
• Review and update your procedures based on what you learned

Autumn 2026:

• Add Martyn's Law procedures to your staff induction process
• Check the SIA website for registration updates

Early 2027:

• Review the statutory guidance when published
• Adjust your procedures if needed
• Register with the SIA when the system opens

April 2027:

• The Act comes into force. You are compliant.

This is not a last-minute rush. It is a series of small, manageable steps spread across fourteen months. Each step builds on the last.

What the Penalties Look Like

For Standard Tier venues, non-compliance penalties are:

• A fixed penalty of up to £10,000
• A daily penalty for continued non-compliance of up to £500 per day
• The SIA can issue compliance notices requiring you to take specific actions
• In serious cases, the SIA can issue restriction notices that could limit or temporarily stop your venue's operations

Providing false or misleading information to the SIA, or obstructing an inspection are criminal offences.

These are significant penalties for any hospitality business operating on tight margins. But the purpose of the SIA's regulatory role is to support compliance, not to punish venues making genuine efforts. If you have documented procedures, trained staff, and are engaging with the process, you are in a very different position from a venue that has done nothing.

Source: Home Office Factsheet, April 2025

What This Is Really About

It is easy to approach this as a compliance exercise, and on one level, it is. You have legal obligations. You need to meet them.

But the reason those obligations exist is that 22 people were killed at a concert. Families were destroyed. A mother spent years campaigning to ensure venues considered what they would do if it happened on their premises.

The Standard Tier requirements are not burdensome. They ask you to think about how you would get people out, how you would keep them safe inside, how you would lock the doors, and how you would tell people what was happening. These are reasonable things for any venue to have considered.

Doing this properly does not just protect you from a fine. It could protect the people who trust you with their safety every time they walk through your door.

How VenueLinQ Can Help

VenueLinQ is a compliance and operations platform built for UK hospitality venues. For Martyn's Law specifically, it provides:

• Guided procedure builder that walks you through creating evacuation, invacuation, lockdown, and communication plans tailored to your venue
• Staff acknowledgement tracking, so you have evidence that every team member has read and understood the procedures
• Incident logging that creates the audit trail that the SIA may ask for during inspections
• Compliance dashboard showing what you have completed and what still needs attention

VenueLinQ is currently in beta and will launch in March 2026. Founding members get early access and locked-in pricing.

Download our free Martyn's Law Readiness Checklist to assess where your venue stands today.

Join the founding member waiting list to be first in line when the platform launches.

Sources and Further Reading

1. Terrorism (Protection of Premises) Act 2025 - legislation.gov.uk
2. Home Office Factsheet - homeofficemedia.blog.gov.uk
3. Standard Duty Requirements Factsheet - GOV.UK
4. SIA Regulatory Role - GOV.UK
5. ProtectUK Martyn's Law Hub - protectuk.police.uk/martyns-law
6. ProtectUK Standard Tier Guidance - protectuk.police.uk
7. ACT Awareness e-Learning - protectuk.police.uk/catalogue
8. NPSA Evacuation, Invacuation and Lockdown Guidance - npsa.gov.uk
9. Getting Training and Advice on Counter-Terrorism - GOV.UK
10. ProtectUK Free Training Resources - protectuk.police.uk

VenueLinQ helps UK hospitality venues manage compliance and daily operations. Built by someone who understands what compliance failure looks like, not a marketing team that Googled "Martyn's Law."