# Does Martyn's Law Apply to Your Pub, Bar or Restaurant?

> Martyn's Law applies once your venue could reasonably have 200 or more people on site at once, staff included, even for a single occasional event. Here is how to tell your tier, what standard tier actually requires, and why the regulator itself is warning owners not to buy security kit they do not need.

- Author: Alex Riesenkampff (Super44)
- Published: 2026-08-15
- Canonical: https://super44.ai/blog/martyns-law-hospitality

## Key takeaways

- Martyn's Law applies once a venue could reasonably expect 200 or more people on the premises at once, staff and contractors included, at its busiest realistic moment rather than an average day (Terrorism (Protection of Premises) Act 2025, Section 2).
- Standard tier, 200 to 799 people, requires a written, rehearsed plan for evacuation, invacuation, lockdown and communication; the Home Office states explicitly that it does not require buying equipment or altering the premises.
- Non-compliance penalties reach £10,000 plus £500 a day for standard tier premises, and the greater of £18 million or 5% of worldwide revenue plus £50,000 a day for enhanced tier premises at 800 or more (Terrorism (Protection of Premises) Act 2025, sections 18 and 19).
- The SIA's own Executive Director for Martyn's Law has publicly warned owners against buying compliance products or services before the statutory guidance is finalised, calling it "very unlikely to be a wise investment."
- The Act had not commenced as of 15 August 2026. The government expects it to come into force in spring 2027, and the SIA's notification portal is not due to open for testing until early 2027.

Martyn's Law applies to your pub, bar or restaurant once you could reasonably expect 200 or more people on the premises at the same time, staff included, even if that only happens a handful of times a year. **Below that figure your premises has no duties under the Act at all; between 200 and 799 you sit in the standard tier, which asks for a written, rehearsed plan and nothing you have to buy; at 800 or more you move into the enhanced tier**, which adds physical protection measures and a compliance document filed with the regulator. The Act, formally the Terrorism (Protection of Premises) Act 2025, has not commenced yet: the government expects it to come into force in spring 2027, with no fixed date confirmed as of today (GOV.UK, *Understanding Martyn's Law and the SIA's role as regulator*). That gap between now and commencement is exactly why the wrong information is spreading. Search for what your venue must do, and most of what ranks is the businesses hoping to sell you the answer.

| Tier | People at once, staff included | What's required | Maximum penalty |
| --- | --- | --- | --- |
| Out of scope | Under 200 | No duties under the Act | None |
| Standard | 200 to 799 | Written, rehearsed procedures: evacuation, invacuation, lockdown, communication | £10,000, plus £500 a day |
| Enhanced | 800 or more | Standard tier procedures plus public protection measures and a compliance document submitted to the SIA | Greater of £18m or 5% of worldwide revenue, plus £50,000 a day |

*Source: Terrorism (Protection of Premises) Act 2025, sections 2, 18 and 19.*

## How your capacity is actually counted, and why it includes your staff

Your tier is decided by the greatest number of individuals reasonably expected to be present on the premises at the same time, and that is not your fire-safety capacity, your licence, or how many covers you take bookings for. **The Act sets the threshold at 200 individuals for standard duty premises and 800 for enhanced duty premises, defined as those it is "reasonable to expect" will "from time to time" be present "at the same time," assessed against your busiest realistic moment rather than an average Tuesday** (Terrorism (Protection of Premises) Act 2025, Section 2). The Home Office's statutory guidance is explicit that the figure includes everyone actually on site in connection with the venue's use, not just paying customers. Its own wording states that "this figure must include staff working at the premises," and defines staff broadly enough to cover "employees, contractors, volunteers and others" (Terrorism (Protection of Premises) Act 2025: statutory guidance, paragraph 4.23 and glossary). A restaurant with 170 covers at a full sitting and 35 staff on its busiest Saturday night has already passed 200 before a single guest orders a drink.

The guidance also treats the count per premises and per use, not as one blanket figure for a whole building. A restaurant trading inside a shopping centre, for example, is assessed on its own footfall rather than the centre's, while a venue spread across multiple connected rooms or floors has its numbers added together if they are reasonably treated as one premises. If you cannot point to a fire-safety occupancy figure, a ticketing system, or a licence condition that already gives you a defensible peak headcount, the honest starting point is simply to count it yourself on your three or four busiest trading nights of the year, staff included, and use the highest of those.

## The Christmas party problem

A venue that never comes close to 200 on an ordinary evening can still be caught, because the test is written to catch exactly that pattern. **The phrase doing the work in the legal definition is "from time to time": the assessment looks at your busiest realistic moment, not your typical one, so a private hire, a ticketed night or an annual Christmas party can decide your tier even when a normal Tuesday sits well under it.** Home Office guidance and the police-run ProtectUK service both confirm this reading of the rule. UKHospitality's advice to members reflects that risk directly: the trade body recommends that pubs and bars "follow at least the guidance for 'standard tier' venues, regardless of whether they consider it likely they will meet the 200-person threshold," precisely because an occasional function is often enough to trigger it.

There is one genuine nuance worth getting right rather than glossing over. A single, truly one-off event that spikes past a threshold does not necessarily convert your everyday premises into a higher tier permanently; ProtectUK's guidance notes it may instead be regulated separately as a "qualifying event" with its own duties, rather than reclassifying the venue itself. Distinguishing a recurring pattern from a genuine one-off is fiddly enough that if your capacity only clears a threshold because of occasional larger bookings, it is worth checking your specific situation against current SIA guidance rather than assuming either way.

**Which tier applies to your venue?** *(interactive decision helper in the web version)*

**Possible routes:**
- **At your busiest realistic moment, counting every member of staff on shift, how many people could reasonably be on the premises at once? — Under 200, even counting an occasional large private function:** Likely out of scope. Under the 200 threshold at every realistic peak, your premises has no duties under the Act at all. Next move: Re-check if trade grows, you add covers, or your event pattern changes.
- **At your busiest realistic moment, counting every member of staff on shift, how many people could reasonably be on the premises at once? — 200 to 799:** Standard tier. You need a written, rehearsed plan for evacuation, invacuation, lockdown and communication. No equipment purchase is required. Next move: Start drafting your plan now; the free ACT e-learning and ProtectUK materials cover this.
- **At your busiest realistic moment, counting every member of staff on shift, how many people could reasonably be on the premises at once? — 800 or more, and this recurs (not a single one-off):** Enhanced tier. You need public protection measures on top of procedures, plus a compliance document submitted to the SIA. Next move: Budget time for a formal compliance document, not just a plan.
- **At your busiest realistic moment, counting every member of staff on shift, how many people could reasonably be on the premises at once? — Only 800+ during one genuinely unique, non-recurring event:** A genuinely one-off event may not change your everyday tier. A single unique event that spikes past a threshold may be regulated as a separate "qualifying event" instead of reclassifying your premises permanently. Next move: Confirm your specific case against current SIA guidance rather than assuming either way.

*Based on the Terrorism (Protection of Premises) Act 2025, Section 2, and Home Office/ProtectUK guidance, checked 15 August 2026. Not legal advice; SIA guidance is still being finalised ahead of commencement.*

## What standard tier actually requires, and what it doesn't

If your venue lands in standard tier, the legal obligation is a plan, not a purchase. **ProtectUK, the police-run guidance service, states it plainly: "there is no requirement to put in place physical security measures in the standard tier,"** and GOV.UK's own guidance launch confirms venues can comply "without needing to buy specialist or consultancy services" (ProtectUK; GOV.UK, *Martyn's Law guidance published to help businesses*, 15 April 2026). In practice that means a written, rehearsed set of procedures covering four scenarios: evacuation, getting people out; invacuation, moving people to a safer part of the building instead; lockdown, restricting movement in or out; and communication, how staff tell each other and the public what to do. Jon Savell, Counter Terrorism Policing's Senior National Coordinator for Protect and Prepare, described the approach the day the guidance launched: "We know that it's not a one-size-fits-all when it comes to safety; Martyn's Law takes account of that, with different measures depending on the size and type of venue" (GOV.UK, 15 April 2026).

## The equipment you keep being sold, and why the regulator is warning against it

Official guidance is easy to miss entirely, which is exactly the gap oversold security products live in. Across seven searches run for this piece, including "martyn's law restaurant requirements" and "martyn's law security equipment," gov.uk and SIA pages were absent from most result sets, and where present ranked sixth to eighth, beaten out by security-equipment integrators, AV vendors and compliance-document sellers. **The SIA's own Executive Director for Martyn's Law, Laura Gibb, has publicly warned against exactly this kind of purchase: "we are increasingly hearing that people are being encouraged to buy specific products, consultancy advice or services now claiming to ensure or guarantee future Martyn's Law compliance. At this stage, that is very unlikely to be a wise investment,"** because, as she wrote, "until the Home Office statutory guidance is finalised, no one can offer a fully informed or accurate compliance solution" (GOV.UK, *A proportionate approach to Martyn's Law regulation*, 5 March 2026).

Some of what ranks is simply out of date. One law firm's guide, still ranking for pub-specific searches in 2026, states the standard tier threshold as "100 to 799 people": that was the figure in the draft Bill, but the Act as passed raised the floor to 200, a change confirmed independently by gov.uk, ProtectUK and the SIA's own materials. Another commercial page mixes an accurate penalty figure with claims that appear nowhere else, including a specific 12-month compliance deadline and a requirement for "SIA-approved" counter-terrorism training; neither claim is supported by gov.uk or ProtectUK, both of which describe standard tier as achievable with free, self-directed materials.

The more common problem is not a false claim but a missing one. Several access-control and CCTV suppliers describe their hardware as a venue's "first line of defence" against a Martyn's Law obligation, without ever mentioning that the 200-799 tier most independents fall into carries no equipment requirement at all, so a standard-tier reader lands on the page with no signal that none of it applies to them. To be fair to the trade, not every commercial page oversells. Several vendors selling documentation or training tools state the no-purchase rule correctly and just as plainly as gov.uk does, which is itself a useful check, since it means the "no equipment for standard tier" rule is not a matter of dispute even among businesses with a reason to want the opposite. Treat a specific number or deadline you find on a vendor page as a lead to verify against gov.uk, not as the answer itself. The same pattern shows up wherever a compliance answer is worth money to someone else, including [music licensing for hospitality venues](/blog/ppl-prs-music-licence), where a background-music vendor's wording can blur into implying a subscription already covers what PPL PRS charges separately.

## Preparing without overspending

Getting ready does not require waiting for a fixed commencement date, or a large budget. **Paul Davies, director and principal consultant at Si4 Security in the Vale of Glamorgan, put it plainly to fellow independent operators: "treat this seriously, treat it early, and treat preparedness as an operational discipline rather than a compliance exercise,"** not a box to tick once and forget (News from Wales, 10 June 2026). That framing matters for a small venue specifically, because a rehearsed plan folded into a normal shift briefing costs almost nothing beyond the time it takes to run it properly.

**What a standard-tier venue can do before commencement**

- [ ] **Work out your real peak headcount**: Count staff, contractors and volunteers alongside guests, on your busiest realistic shift, not an average one.
- [ ] **Flag your occasional big bookings**: A private hire, a ticketed night or an annual party that clears 200 is enough to bring standard tier into play, even if most weeks do not.
- [ ] **Draft the four procedures**: Evacuation, invacuation, lockdown and communication, written down and specific to your building, not a generic template.
- [ ] **Rehearse it once with the team**: A written plan nobody has practised is worth far less than a short, realistic run-through during a quiet shift.
- [ ] **Use the free materials first**: ProtectUK and the ACT Awareness e-learning are built for exactly this and cost nothing, before considering any paid service.

*None of this requires equipment, a consultant, or waiting for the exact commencement date to be confirmed.*

Super44 connects to your POS and shows you where your money leaks — then tells you what to do about it: https://super44.ai

## If you're closer to 800: what enhanced tier adds

Very few independent venues clear 800 people at once, but if yours does, the obligation moves from writing a plan to building a system. **Enhanced duty premises must add public protection measures covering monitoring, movement, physical safety and security, and information security, on top of the same procedures required at standard tier, and submit a compliance document to the SIA rather than simply holding one on file** (Terrorism (Protection of Premises) Act 2025, Section 2; GOV.UK statutory guidance). This is the tier where a security consultant or an access-control system genuinely earns its cost, unlike the equipment routinely marketed at standard-tier venues that do not need it.

Getting the tier wrong carries a real cost in both directions, just not a symmetrical one. Wrongly assuming you are out of scope leaves you exposed to the standard-tier penalties above if the SIA later disagrees with your headcount, on top of the reputational and insurance questions that follow any venue that had no plan when something went wrong. Wrongly assuming you need enhanced-tier measures, on the other hand, is a pure and avoidable cost: money spent on physical security a 200-799 capacity venue was never required to buy. The second mistake is the one this piece exists to prevent.

> **£10,000 vs £18m** — Maximum non-compliance penalty for standard tier premises versus enhanced tier premises or a qualifying event, plus daily penalties of £500 and £50,000 respectively (Terrorism (Protection of Premises) Act 2025, ss.18-19)

## Why this exists, and when it actually starts

Martyn's Law exists because of a real attack, not a hypothetical one. It is named for Martyn Hett, one of the 22 people killed in the Manchester Arena bombing on 22 May 2017; his mother, Figen Murray, campaigned for years for the kind of preparedness duty the Act now creates (Home Office, *Martyn's Law factsheet*). The same factsheet sets out why the government thinks a legal duty was needed rather than relying on venues to act voluntarily. Its own engagement with business found that "preparedness and protective security in the counter-terrorism space often falls behind areas where there are long-established legal requirements, such as health and safety," and that without a legal duty "there is no consistency of consideration or of outcomes achieved" across venues of a similar size. That is the practical case for a plan even before the Act commences: the four standard-tier procedures exist because plenty of venues, hospitality included, currently have none.

**The Act itself is not yet in force: the government's own timeline, last updated 17 July 2026, states "it is expected that the Act will come into force in spring 2027," with the exact date still unconfirmed, and the SIA's notification portal is not due to open for volunteer testing until early 2027.** Once commencement happens, premises get a three-month window to submit their first notification to the SIA, and 28 days to report any change after that (GOV.UK, *Martyn's Law: keeping up the momentum*, 5 August 2026). There is no reason to wait for that date before you start. The plan is what protects people, and the only cost of writing it early is the time it takes.

None of this sits in isolation. Martyn's Law lands in the same 2026-27 window as [the April 2026 business rates changes](/blog/business-rates-hospitality-2026) and [the Employment Rights Act's incoming shift-notice rules](/blog/uk-employment-rights-act-rotas), which between them mean most UK operators are tracking three separate regulatory changes at once, each with its own timeline and its own vendors offering to sort it for a fee. Super44 does not sell Martyn's Law compliance, and nothing here is legal advice, but it can hold the headcount, rota and cost data a real assessment actually needs in one place, so the plan you write is built on your own numbers rather than a guess.

## FAQ

### Does Martyn's Law apply to my pub, bar or restaurant?

It applies once you could reasonably expect 200 or more people on the premises at the same time, staff and contractors included, at your busiest realistic moment rather than an average day. Below 200, your premises has no duties under the Act at all; 200 to 799 puts you in standard tier, and 800 or more in enhanced tier (Terrorism (Protection of Premises) Act 2025, Section 2).

### Do I need to buy security equipment to comply with Martyn's Law?

Not for standard tier. GOV.UK's own guidance states standard tier requirements "do not require them to alter the premises or purchase equipment," and the SIA's Executive Director for Martyn's Law has publicly warned against buying compliance products before the statutory guidance is finalised. Equipment obligations only apply at enhanced tier, 800 or more people.

### Does an occasional big event, like a Christmas party, count toward my capacity?

Often, yes. The legal test asks whether you could "from time to time" reasonably expect 200 or more people present at once, assessed against your busiest realistic moment rather than a typical week. UKHospitality advises pubs and bars to follow standard tier guidance even when they are not certain they will hit the threshold, precisely because of this.

### When does Martyn's Law come into force?

It has not commenced as of 15 August 2026. The government's own timeline states it expects the Act to come into force in spring 2027, without a confirmed exact date, and the SIA's notification portal is not due to open for testing until early 2027.

### What happens if my venue doesn't comply?

Penalties reach a maximum of £10,000 plus £500 a day for standard tier premises, and the greater of £18 million or 5% of worldwide revenue plus £50,000 a day for enhanced tier premises or a qualifying event, under sections 18 and 19 of the Act.

### What's the difference between standard tier and enhanced tier?

Standard tier (200-799 people) requires written, rehearsed procedures for evacuation, invacuation, lockdown and communication, with no purchase required. Enhanced tier (800 or more) adds physical public protection measures covering monitoring, movement, safety and security, and information security, plus a compliance document submitted to the SIA.

## Sources

1. [Terrorism (Protection of Premises) Act 2025, Section 2](https://www.legislation.gov.uk/ukpga/2025/10/section/2) — Statutory definitions of standard duty (200+) and enhanced duty (800+) premises, "reasonably expected... at the same time," "from time to time"
2. [Terrorism (Protection of Premises) Act 2025, Section 18](https://www.legislation.gov.uk/ukpga/2025/10/section/18) — Maximum penalty: £10,000 standard duty premises; greater of £18m or 5% of qualifying worldwide revenue for enhanced duty premises or a qualifying event
3. [Terrorism (Protection of Premises) Act 2025, Section 19](https://www.legislation.gov.uk/ukpga/2025/10/section/19) — Daily penalties for continuing non-compliance: £500 standard duty premises, £50,000 enhanced duty premises or qualifying event
4. [Terrorism (Protection of Premises) Act 2025, Schedule 1](https://www.legislation.gov.uk/ukpga/2025/10/schedule/1) — Paragraph 2, "food and drink" use for consumption on the premises by visiting members of the public, brings pubs, bars, restaurants and cafes into scope
5. [GOV.UK: Understanding Martyn's Law and the SIA's role as regulator](https://www.gov.uk/guidance/understanding-martyns-law-and-the-sias-role-as-regulator) — Published 17 July 2026. Commencement "it is expected that the Act will come into force in spring 2027"; notification portal opens for volunteer testing from early 2027
6. [Terrorism (Protection of Premises) Act 2025: statutory guidance](https://www.gov.uk/government/publications/the-terrorism-protection-of-premises-act-2025/terrorism-protection-of-premises-act-2025-statutory-guidance) — Last updated 7 August 2026, paragraph 4.23 and glossary. "This figure must include staff working at the premises"; staff defined to include "employees, contractors, volunteers and others"
7. [GOV.UK: Martyn's Law: keeping up the momentum](https://www.gov.uk/government/news/martyns-law-keeping-up-the-momentum) — Published 5 August 2026. "A 3-month window from commencement... to submit a notification, with changes to be reported within 28 days after that"
8. [GOV.UK: Martyn's Law guidance published to help businesses](https://www.gov.uk/government/news/martyns-law-guidance-published-to-help-businesses) — Published 15 April 2026. Standard tier venues can comply "without needing to buy specialist or consultancy services"; Jon Savell (Counter Terrorism Policing) quote
9. [ProtectUK: Martyn's Law overview and what you need to know](https://www.protectuk.police.uk/martyns-law/martyns-law-overview-and-what-you-need-know) — "There is no requirement to put in place physical security measures in the standard tier"
10. [GOV.UK: A proportionate approach to Martyn's Law regulation](https://www.gov.uk/government/news/a-proportionate-approach-to-martyns-law-regulation) — Published 5 March 2026. Bylined by Laura Gibb, SIA Executive Director for Martyn's Law: warning against buying compliance products before statutory guidance is finalised
11. [Home Office: Martyn's Law factsheet](https://homeofficemedia.blog.gov.uk/2025/04/03/martyns-law-factsheet/) — Published 3 April 2025, updated April 2026. Origin in the 2017 Manchester Arena attack, tribute to Martyn Hett and campaigner Figen Murray
12. [ProtectUK: Martyn's Law frequently asked questions](https://www.protectuk.police.uk/martyns-law/martyns-law-frequently-asked-questions) — Dated 17 July 2026. Capacity assessed at "the busiest times," not an average day; one-off events may be treated separately from ongoing premises tier
13. [UKHospitality: Martyn's Law - what we know so far](https://www.ukhospitality.org.uk/martyns-law-what-we-know-so-far/) — Advises pubs and bars to follow standard tier guidance "regardless of whether they consider it likely they will meet the 200-person threshold"
14. [News from Wales: What Welsh businesses need to know about Martyn's Law](https://newsfromwales.co.uk/what-welsh-businesses-need-to-know-about-martyns-law-from-one-welsh-business-to-another/) — Published 10 June 2026. Paul Davies, Director and Principal Consultant, Si4 Security, Vale of Glamorgan, on preparedness as an operational discipline
15. [TLT LLP: Martyn's Law, pub and bar considerations](https://www.tlt.com/insights-and-events/insight/pub-and-bar-martyn-law) — Published 26 July 2023, still ranking in August 2026. States the pre-Royal Assent draft threshold of "100 to 799 people" for standard tier, now incorrect
16. [Priority First: What is Martyn's Law?](https://www.priorityfirst.co.uk/insights/what-is-martyns-law) — Commercial compliance-services page stating a "12 months of commencement" deadline and an "SIA-approved" training requirement for standard tier, neither supported by GOV.UK or ProtectUK