If your venue, stadium, shopping centre or event can reasonably expect 800 or more people at the same time, Martyn’s Law puts you in the enhanced tier. That means that not only do you have to prepare your staff on how to respond to an attack, but also consider how to reduce your premises’ vulnerability to an attack, record what you have done in a document for the regulator, as well as naming a senior individual who is accountable for compliance.
The following guide explains what the enhanced duty actually means. It covers who is in scope, the five core obligations, penalties, and a practical way to prepare before the law comes into force.
In brief
• The enhanced duty applies to premises where it is reasonable to expect 800 or more people (including staff) at the same time, from time to time, and to ticketed public events of 800 or more.
• It includes everything in the standard duty, plus public protection measures, a compliance document provided to the Security Industry Authority (SIA), and a designated senior individual.
• The Act is not yet in force. The regulation is expected from spring 2027.
• Places of worship, schools, childcare and further education stay in the standard tier however large they are.
• Maximum penalties for the enhanced tier are up to £18 million or 5% of worldwide revenue, whichever is greater.
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It is named after Martyn Hett, who was killed in the 2017 Manchester Arena attack. The Act creates two tiers of duty. The standard duty applies to premises expecting 200 to 799 people. The enhanced duty applies at 800 or more, and to qualifying events. The Home Office guidance uses the terms standard tier and enhanced tier interchangeably with these.
SIA (Security Industry Authority) is the regulator. There is no legal duty to comply until the Act is commenced, but the Home Office is clear that those in scope should start preparing now.
The enhanced duty has two aims. The first, shared with the standard tier, is to reduce the risk of physical harm to people if an attack happens. The second, for the enhanced tier only, is to reduce the vulnerability of the premises or event to an attack in the first place. The Act assumes an attack could happen anywhere, so you do not need to show that your venue is a likely target to be in scope.
For background, see our guides to what Martyn’s Law is and which sectors it applies to.
Premises fall in the enhanced tier when they meet all the criteria for qualifying premises and it is reasonable to expect 800 or more individuals to be present at the same time, from time to time. There are four main points:
The guidance gives examples that show how this works:
Situation | Likely tier |
A nightclub usually expects fewer than 800 but hosts five or six larger nights a year | Enhanced – the larger nights happen from time to time |
A shop usually peaks at 450, then has one unexpected surge to 800+ after a product goes viral | Standard – the surge could not reasonably be expected and is not expected to recur |
A stadium usually expects 600 per match, but plans a one-off testimonial for 1,000 | Standard premises, but the testimonial is a qualifying event |
A shopping centre where 800+ people can be present across the centre and its units | Enhanced for the operator. Individual units are assessed separately |
A university campus that can expect 800+ people at once | Enhanced – higher education is not subject to the special consideration for schools |
An event is a qualifying event, and subject to enhanced duty requirements, when all of the following are true:
• It takes place at premises that are a building, other land, or both.
• It is not held at premises that are already enhanced tier premises.
• It is accessible to the public.
• It is reasonable to expect 800 or more people (including staff) at the same time at some point during the event.
• There are checks on entry, such as tickets, passes or membership, behind a defined perimeter.
This catches events such as festivals and ticketed concerts in fields or parks. Private events that the public cannot attend, such as a wedding or a staff party, are not in scope. Neither is a charity run where the payment relates to participation rather than entry to the area.
Places of worship, childcare, and primary, secondary and further education premises are always standard tier if they can expect 200 or more people, even when they reach 800. Events held at these premises cannot be qualifying events. Some premises are excluded altogether, including Parliament and devolved legislatures, some transport premises already covered by other security legislation, and open-air parks and recreation grounds without entry controls.
Not sure which tier you fall into? Our Martyn’s Law FAQ covers the common questions, and our counter-terrorism consultants can help you assess and evidence your figure.
Enhanced tier premises and qualifying events must meet every standard tier requirement and add to them. The five core obligations are below.
The person responsible for the premises or event must notify the SIA. The notification system is expected to open when the Act comes into force, so there is nothing to submit yet.
These are the actions your staff take if they suspect an attack is happening or about to happen at the premises, at the event or in the immediate area. The Act specifies four:
Because enhanced tier sites are larger and more complex, expect to think harder about how these procedures work across multiple areas, entrances and tenants.
This is the main addition to the standard duty. You must consider and, so far as is reasonably practicable, put in place appropriate measures in four areas, and keep them under review:
Category | What it covers | Examples |
Monitoring | Observing the premises and the immediate area | Security patrols, searches of individuals, CCTV |
Movement | Controlling people entering, leaving and moving within the site | Doors, shutters, zoned access, screening of individuals |
Physical safety and security | Reducing the physical vulnerability of the site | Vehicle security barriers and other hostile vehicle mitigation |
Security of information | Protecting information that could help an attacker | For example, controlling who can see security plans, site layouts and CCTV footage |
The first three sets of examples come from ProtectUK’s enhanced tier guidance. The examples for security of information are our practical suggestions. Hostile vehicle mitigation is a good example of why measures need professional judgement: what works for a pedestrianised plaza will differ from a stadium concourse. See our vehicle-as-a-weapon mitigation case study for a worked example.
Enhanced tier premises and qualifying events must write a document and provide it to the SIA. It must contain:
The document is not a tick-box checklist. Where your measures differ materially from what would usually be considered appropriate for a site like yours, the guidance expects you to explain why. You must keep it up to date, provide it to the SIA as soon as reasonably practicable after you first prepare it, and provide any revised version within 30 days.
Where the responsible person is a company or organisation, it must designate a senior individual to ensure compliance. This is someone involved in the management or control of the organisation, not a junior or purely administrative role. The guidance suggests the role may include:
The senior individual can delegate actions, for example to a security manager, but keeps overall responsibility.
The Act does not give you a fixed shopping list of equipment. Instead, measures must be appropriate and reasonably practicable. The guidance defines reasonably practicable as proportionate: you weigh what could be done to achieve the objective against the cost, time and difficulty of doing it. Nobody is expected to take actions that would compromise their own safety.
In practice, this means a 60,000-seat stadium and a 900-capacity theatre will reach different answers, and both can be compliant. What the SIA will want to see is a clear, recorded rationale for the choices you made, and for the ones you decided against.
The responsible person is the individual, organisation or company in control of the premises for their main use, or in control of the premises for the purposes of a qualifying event. It is set by the Act, not by choice, and it is often the tenant or operator rather than the building owner. You can delegate tasks, such as event organisation or security delivery, but you cannot delegate legal responsibility to a contractor.
Where several people are responsible for parts of the same site, for example a shopping centre and its units, they must co-ordinate so far as is reasonably practicable. Anyone with some control over the premises who is not the responsible person must co-operate. For events, the organiser is usually the responsible person if they control the area for the event’s duration, but if a local authority retains control of the area, it stays responsible.
The SIA will have powers to require information, issue compliance notices, and issue penalty notices. For enhanced tier premises and qualifying events only, it can also issue restriction notices that limit how a premises is used until problems are fixed.
For the enhanced tier, penalties can reach up to £18 million or 5% of worldwide revenue, whichever is greater, plus daily penalties of up to £50,000 for continued non-compliance. The equivalent standard tier maximums are £10,000 and £500 a day. In the most serious cases, such as knowingly giving false or misleading information, criminal liability can arise. The SIA is also consulting on its approach to enforcement, so check its published guidance for the latest position.
Requirement | Standard duty (200–799) | Enhanced duty (800+ and qualifying events) |
Notify the SIA | Yes | Yes |
Public protection procedures (evacuation, invacuation, lockdown, communication) | Yes | Yes |
Public protection measures (monitoring, movement, physical safety and security, security of information) | No | Yes |
Compliance document provided to the SIA | No | Yes |
Designated senior individual (where the responsible person is an organisation) | No | Yes |
Restriction notices | No | Yes |
Maximum penalty | £10,000 | £18m or 5% of worldwide revenue |
A word of caution. The SIA has warned that some firms are marketing products and services that claim to guarantee Martyn’s Law compliance. No supplier can do that. The statutory guidance is free, and the Home Office and SIA do not endorse third-party compliance products. Choose advisers on their competence, accreditation and track record, and be wary of anyone who offers a certificate of compliance before the regime exists.
Ubique Risk Management is an SFJ Awards approved centre for counter-terrorism qualifications, with training delivered at our Warrington academy by former counter-terrorism policing specialists. Our counter-terrorism consultancy covers site assessments, hostile vehicle mitigation planning and protective security strategy, which are the building blocks of an enhanced duty compliance document.
We are a thriving team of dynamic, experienced, training and education professionals — full of personality minus the ego. Our trainers – Kevin, Miles, Darren and Richard – wear many hats dedicated to helping learners achieve their goals. Our breadth of knowledge and experience enables us to provide first-class training and educational development.
If you would like to talk through your tier, your measures or your staff training, speak to our team.
The standard duty (200–799 people) requires you to notify the SIA and put in place public protection procedures. The enhanced duty (800+ people, and qualifying events) adds public protection measures, a compliance document provided to the SIA, and a designated senior individual.
Not automatically. The test is the number of people, including staff, that you can reasonably expect at the same time, from time to time, for a relevant use. Licensed capacity is a useful input but not the legal test, and some premises, such as places of worship and schools, are always standard tier.
The Act received Royal Assent on 3 April 2025 and the implementation period is at least 24 months. The SIA is preparing for active regulation in spring 2027, but the exact date depends on Parliament commencing the Act.
You need a compliance document that records your procedures and measures and assesses how they reduce risk. A structured terrorism risk assessment is the most practical way to produce the evidence behind that assessment.
Someone involved in the management or control of your organisation, with the authority to make and resource decisions. They may delegate tasks, such as to a security manager, but remain accountable for compliance.
For the enhanced tier, up to £18 million or 5% of worldwide revenue, whichever is greater, plus daily penalties of up to £50,000. The SIA can also issue restriction notices limiting how premises are used.
You can delegate tasks, such as security delivery or drafting support, but legal responsibility stays with the responsible person and, for organisations, the senior individual.
This article is general information, not legal advice. Check the current Home Office and SIA guidance and take professional advice for your circumstances.
