Martyn's law compliance: what hospitality venues must do now

By Zynthio. Published 4 September 2026, updated 12 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

Martyn's law compliance brings counter-terrorism duties to many venues. Here is how the tiers work and how to use the implementation period.

If your venue can reasonably expect 200 or more people on site at once, across all areas, martyn's law compliance already applies to you, and the most common mistake operators make is assuming this only concerns large stadiums and arenas. The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025 and creates a legal responsibility that most hospitality businesses have never had to think about formally. Government has confirmed an implementation period of at least two years before the duties commence, with the Security Industry Authority acting as regulator. That gap exists so operators can get their arrangements in order without panic, not so the subject can be filed away and forgotten.

Most compliance obligations in hospitality arrive in stages, tied to something already familiar: an existing risk assessment, an existing register, an existing inspection regime. Martyn's Law is different because it introduces a new category of duty from a standing start. There is no legacy paperwork to adapt. That is precisely why the implementation period matters, and why venues that use it well will be confirming settled arrangements when the duties commence, while venues that ignore it will be improvising against a deadline.

Working out your tier under martyn's law compliance

The Act applies to qualifying premises used for specified purposes, and hospitality and leisure venues are explicitly within scope. The trigger is not your licensed capacity, your covers, or your fire certificate figure. It is how many people it is reasonable to expect may be present at the same time, counting staff and customers together, across the whole premises. Premises where 200 or more people may reasonably be expected fall into the standard tier. Larger premises, from 800 people upwards, fall into the enhanced tier, which carries heavier requirements including a documented assessment and a security plan. Qualifying events held at otherwise smaller premises can also be caught. The government's Martyn's Law factsheet sets out the definitions and thresholds in more detail, and is worth reading alongside your own occupancy figures rather than relying on a summary.

Two points get missed regularly. First, the count includes every area of the premises together, not just the main trading floor. A pub with a large beer garden, a first-floor function room, or a marquee used for summer events may be much closer to the 200 threshold than the bar alone suggests. Second, standard tier duties are procedural rather than about buying equipment. The legal test is reasonably practicable steps, proportionate to the size and nature of a small business, not the security posture of a concert venue. Working through the arithmetic properly, room by room and event by event, is worth doing early, because it is the one decision everything else depends on.

What the standard tier actually asks operators to do

For venues in the standard tier, the duties are narrower than the name of the Act suggests. In summary, a responsible person must notify the regulator that they are responsible for qualifying premises, and must put in place public protection procedures: what the team does to reduce risk to the public and keep people safe if an attack occurs at or near the premises. Those procedures need to cover evacuation, invacuation, meaning moving people to a safer place inside the building, lockdown, and communication. Relevant workers must be aware of the procedures and understand their own part in them, and the arrangements need to be kept current as layout, trading patterns and events change. A dedicated Martyn's Law compliance workflow makes it easier to keep this tied to a specific occupancy figure, tier decision and briefing record rather than a loose set of intentions.

None of that requires anything exotic. Most venues already have a fire evacuation route, an assembly point, and some way of getting a message to the whole team quickly. The added thinking is that a hostile threat often calls for the opposite response to a fire: staying inside and locking down rather than filing out to a car park. Working through those scenarios in advance, and deciding who makes the call on the night, is the substance of the standard tier duty. It is not a security budget line; it is a decision-making exercise that costs time rather than money.

Why the implementation period is not a reason to wait

An implementation period of at least two years sounds generous, and operators under daily pressure from rotas, food safety inspections and margin will reasonably deprioritise something with no live deadline. That is understandable, but it treats the gap as slack rather than as the intended use of the time. The period exists precisely so that venues can work through occupancy calculations, draft procedures, brief staff, and iron out the practical problems, such as a duty manager who has never had to decide between evacuation and lockdown, before the duties are legally enforceable. Starting now converts a legal deadline into a manageable project; starting late converts it into a rushed compliance exercise done under scrutiny.

There is also a reputational dimension that sits alongside the legal one. Licensing authorities, insurers and, increasingly, customers expect venues that host the public in numbers to have thought about this. A venue that can show a dated, versioned set of public protection procedures, reviewed alongside its fire risk assessment, is in a materially different position to one that has a folder gathering dust, whichever tier it falls into.

Building procedures that survive contact with a real shift

The content of the procedures matters less, in practical terms, than whether they are actually known by the people on shift. A document written by a head office team and never read past the general manager satisfies nothing. Procedures need to be short enough to be read in a briefing, specific enough to tell a team member what to actually do, and revisited whenever the layout or trading pattern changes, for example a new outdoor seating area or a change in event use. Building this alongside your existing fire risk assessment work makes sense, since both are asking staff to make fast decisions about crowd movement under pressure, even though the correct decision is often the reverse. The general duty to manage workplace risks in a proportionate way, as set out in guidance on fire safety in the workplace, is a useful frame here, since the same manager who owns the fire evacuation plan is usually the right person to own the lockdown and invacuation plan too.

Evidence is the part that regulators actually test

Awareness that exists only in a team meeting that nobody minuted is worth very little if a regulator, an insurer, or an incident review ever asks for it. The practical discipline is the same one that already applies to food safety and licensing records: date every version of the procedure, record who briefed which shift and when, and keep an auditable trail of updates as circumstances change. Venues that already run a digital refusals register or incident log for licensing purposes, as covered in our guide to alcohol licensing compliance, already have the habit of dated, contemporaneous records; the same discipline applies directly here.

A documented assessment and security plan is a formal requirement at enhanced tier, but even standard tier venues benefit from treating public protection procedures as a living document rather than a one-off write-up. Reviewing it on the same cycle as other workplace safety documentation, alongside COSHH assessments and general risk assessments, keeps it from becoming the one policy nobody has looked at since it was first drafted.

Questions to ask your own venue

Have you actually calculated how many people could reasonably be present across your whole premises at once, including outdoor areas and any function space, rather than relying on your licensed capacity figure? And if a hostile incident happened outside your front door right now, does every member of tonight's shift know whether the right response is to evacuate, lock down, or move people to a safer part of the building? A dedicated Martyn's Law compliance solution page sets out how to document occupancy calculations, procedures and staff briefings in one place, with dates and version history to show the work was done.

See how Zynthio handles this