**Updated May 2026** — This article reflects the Section 27 statutory guidance published on 15 April 2026, including the four formal categories of public protection measures for the enhanced tier (monitoring, movement, physical safety and security, and security of information), the confirmed penalty regime, and the narrative-style "compliance document" expected from enhanced-tier responsible persons.
This article is part of our comprehensive guide to Martyn's Law. For an overview of the legislation, who it applies to, implementation timelines, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Under Martyn's Law (the Terrorism (Protection of Premises) Act 2025), publicly accessible premises and events expecting 200 or more people must meet new security obligations. These requirements are divided into two tiers, standard and enhanced, based on capacity. Understanding the distinction is critical for determining your organisation's responsibilities.
Standard tier (200–799 people)
Premises and events expecting between 200 and 799 individuals fall under the standard duty tier (nalc.gov.uk). The focus here is on basic preparedness and awareness. Key obligations include:
Notification and registration: The responsible person must notify the Security Industry Authority (SIA) that they control the premises or event (nalc.gov.uk).
Risk assessment: Conduct a proportionate assessment of the potential terrorist threat and identify vulnerabilities (nalc.gov.uk).
Training and awareness: Provide basic security awareness training for staff and volunteers so they can recognise suspicious behaviour and respond appropriately (nalc.gov.uk).
Emergency procedures: Develop simple, low‑cost plans to protect people in the event of an attack, such as identifying safe routes, locking doors, and closing shutters (protectuk.police.uk).
Standard‑tier premises are not required to install physical security systems, such as metal detectors or CCTV. The goal is to ensure that staff know what to do during an incident and that there are clear procedures to minimise harm without imposing excessive costs on smaller venues.
**Standard tier penalty.** Financial penalties of up to £10,000 apply for non-compliance, plus daily penalties for continuing breaches once the duty is in force.
Enhanced tier (800+ people)
Premises or events where 800 or more people may be present fall into the enhanced duty tier (nalc.gov.uk). They must meet all standard‑tier requirements and implement additional measures:
**Four formal categories of public protection measures (April 2026 guidance):** the responsible person must consider monitoring (e.g. CCTV, observation arrangements), movement (control of access, queuing, vehicle management), physical safety and security (barriers, glazing, layout) and security of information. Measures may be implemented through people, policies and processes, and/or physical mitigations — there is no single prescribed solution.
Physical security measures: Enhanced venues may need to introduce bag searches, CCTV or other monitoring, and vehicle checks to reduce vulnerability (protectuk.police.uk). These measures should be proportionate and based on the venue's risk assessment.
**Senior responsible individual:** A senior individual must be designated where the responsible person is an organisation. Statutory responsibility cannot be delegated, and the senior individual is personally exposed to criminal liability of up to two years' imprisonment for breaches involving consent, connivance or neglect.
Comprehensive emergency planning: Enhanced‑tier premises must have more detailed plans covering evacuation, communication and coordination with emergency services. Staff should be trained in specific roles and response protocols.
**The compliance document is a narrative, not a checklist.** The April 2026 guidance is explicit that the document required from enhanced-tier responsible persons must explain what is in place, why each measure is expected to reduce harm, and where the chosen approach differs from what would normally be expected, why. The earlier "produce a security plan" framing is now noticeably stronger.
Notification and documentation: Enhanced venues must notify the regulator (SIA) and maintain documentation demonstrating compliance, including risk assessments, training records and security procedures.
**Enhanced tier penalties.** Civil penalties up to £18m or 5% of worldwide revenue (whichever is higher), daily penalties for continuing breaches, restriction notices that can prevent a venue opening or an event proceeding, and personal criminal liability for designated senior individuals.
These extra obligations reflect the greater risk posed by large crowds and the potential impact of incidents in venues such as stadiums, concert halls, and large festivals.
Why the distinction matters
The tier system is designed to ensure that security measures are proportionate to the scale of the venue or event. Smaller venues may not have the resources or need for advanced physical security, whereas larger venues can pose more attractive targets and require additional safeguards. Understanding which tier you fall into allows you to:
Allocate resources wisely: Focus investments on measures that match your risk profile. Standard‑tier venues can prioritise staff training and simple emergency procedures, while enhanced‑tier venues budget for surveillance systems and bag searches.
Assign responsibilities: Identify a responsible person for each venue or event and, for enhanced venues, appoint a senior individual to oversee compliance.
Plan: The Act allows at least 24 months' notice before enforcement (protectuk.police.uk). Commencement is now consistently being signalled as Spring 2027 (likely April 2027), subject to formal Parliamentary confirmation. Use this time to evaluate your capacities, update procedures, and, if necessary, procure technology such as CCTV, public‑address systems and mass notification solutions.
Practical tips for compliance
Verify your capacity: Determine how many people your venue can host at peak times, including staff. This will establish whether you are in the standard or enhanced tier.
Document your plans: Keep written records of risk assessments, training sessions, evacuation plans and any security measures implemented. The regulator (insight-security.com) may review these documents.
Engage stakeholders: Involve venue owners, event organisers, security staff and local police when developing and testing emergency procedures. Collaboration ensures that everyone understands their role.
Consider scalable technology: For enhanced venues, explore integrated security solutions, such as surveillance cameras, access control systems and digital signage, to improve situational awareness and communication.
Conclusion
The distinction between the standard and enhanced tiers under Martyn's Law hinges on capacity and risk. Standard‑tier venues (200–799 people) must focus on awareness, training, and simple protective measures (protectuk.police.uk). Enhanced‑tier venues (800+ people) need additional physical security and a more formal compliance structure (protectuk.police.uk). By understanding the requirements for your tier and planning accordingly, you can ensure public safety and meet the obligations of this new legislation.
For more comprehensive information about Martyn's Law, including who it applies to, implementation timelines, special considerations for education settings, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Frequently Asked Questions
Q.What is the difference between standard and enhanced tier under Martyn's Law?
The standard tier covers premises and events expecting 200–799 people and focuses on basic preparedness — risk assessments, staff training, simple emergency procedures and notifying the Security Industry Authority. The enhanced tier covers venues expecting 800 or more people and adds requirements such as the four formal categories of public protection measures (monitoring, movement, physical safety and security, and security of information), a designated senior individual with personal criminal liability, comprehensive emergency planning and a narrative-style compliance document. Enhanced-tier penalties are also significantly higher — up to £18m or 5% of worldwide revenue, vs up to £10,000 in the standard tier.
Q.Do standard-tier venues have to install CCTV or metal detectors?
No. Standard-tier premises are not required to install physical security systems such as metal detectors or CCTV. The standard tier focuses on awareness, training and procedural readiness so that staff know what to do during an incident. Physical security infrastructure is only mandatory for enhanced-tier venues, based on their risk assessment.
Q.How is venue capacity calculated under Martyn's Law?
Capacity refers to the total number of people reasonably expected on the premises at the same time, including staff, volunteers and attendees. The April 2026 statutory guidance (Supplementary Document A) formalises acceptable methods: fire safety safe-occupancy figures, historic attendance data or any other justified method. It is not the building's maximum legal occupancy but the actual number expected during peak times or events. Operators should document the method used and the assumptions behind it.
Q.What additional obligations apply to enhanced-tier venues?
Enhanced-tier venues must meet all standard-tier requirements plus designate a senior individual (who carries personal criminal liability and whose responsibility cannot be delegated), conduct documented risk assessments, address the four formal categories of public protection measures (monitoring, movement, physical safety and security, and security of information), develop comprehensive emergency plans, and produce a narrative-style compliance document for the SIA explaining what is in place and why.
Q.Can a venue's tier change?
Yes. Tier classification depends on the number of people reasonably expected at the venue at any one time. A venue that normally operates as standard tier may temporarily fall under enhanced obligations if it hosts an event expecting 800 or more attendees. Operators should reassess capacity for each event and adjust procedures accordingly.
