Martyn's Law enhanced tier: what the 800+ duties actually require

The Terrorism (Protection of Premises) Act 2025 — Martyn's Law — received Royal Assent in April 2025. The enhanced tier covers qualifying premises and qualifying events where 800 or more people are expected. It asks for more than the standard tier: measures as well as procedures, and a security document given to the regulator. Here is what that means, without the scaremongering.

First: does the enhanced tier apply to you?

Enhanced-tier duties can be reached by two different routes, and event organisers need to understand both.

Enhanced duty premises. Qualifying premises — places used for the purposes set out in the Act — where it is reasonable to expect that 800 or more individuals may be present at the same time. Arenas, large venues, big retail and leisure sites sit here.

Qualifying events. This is the route that catches organisers by surprise. An event can be caught in its own right, broadly where 800 or more individuals are expected to be present at the same time and there are measures controlling access — tickets, passes, or express permission to enter. That means a field, a park or a showground which is not qualifying premises on an ordinary Tuesday can host a qualifying event on a Saturday, and the duties attach to whoever is responsible for it.

The practical test for most organisers is therefore twofold: how many people will realistically be present at once, and do you control who gets in? If you are ticketed or fenced with 800-plus, look at this carefully. If you are genuinely open-access, the qualifying-event route generally does not bite — though any qualifying premises you use may be caught separately. Our standard tier checklist covers the 200–799 band, and the events guide covers how outdoor events fit generally.

What the enhanced tier requires

The enhanced tier is a genuine step up from the standard tier — not just more paperwork, but a different kind of duty. In outline, the responsible person must:

• Notify the regulator. The Security Industry Authority (SIA) is the regulator for these duties.
• Have public protection procedures — the same four as the standard tier: evacuation, invacuation, lockdown and communication.
• Have public protection measures — this is the addition. Measures directed at reducing vulnerability to an act of terrorism, so far as reasonably practicable, covering things like monitoring the premises or event and their immediate vicinity, controlling the movement of people into, out of and within the site, physical safety and security, and the security of information that could assist an attacker.
• Prepare and maintain a security document setting out the procedures and measures and how they are intended to work, and give it to the regulator. The standard tier has no equivalent submission duty.
• Appoint a designated senior individual where the responsible person is not an individual — a named person at senior level accountable for ensuring the duties are met.

The word doing the heavy lifting throughout is reasonably practicable. The Act is not asking a county show to become an airport. It is asking you to think properly about what an attack on your site would look like, put proportionate things in place, write them down, and be able to show your working.

The security document, in practice

The security document is the enhanced tier's centre of gravity, and it is where most organisers will spend their effort. It should describe the site or event, the procedures and measures you have in place, and how they address the vulnerabilities you have identified. It needs to be a live document that reflects how the event actually runs — reviewed when your layout, capacity, or operation changes.

For event organisers the sensible approach is not to write it in isolation. Your event management plan already describes your site, your crowd, your stewarding, your communications and your emergency procedures. The security document should be consistent with it and cross-reference it, so that the Safety Advisory Group, the police and the regulator are all looking at one coherent account of your event rather than three documents that disagree.

An enhanced-tier checklist

• Establish which route applies to you — enhanced duty premises, qualifying event, or both — and record the capacity reasoning behind it.
• Identify the responsible person, and appoint the designated senior individual if the responsible person is a body rather than an individual.
• Carry out and document an assessment of how an attack could affect your site and your people.
• Write the four procedures — evacuation, invacuation, lockdown, communication — specific to your actual site: real exits, real refuge, real lock points, a real way to reach everyone including in an open field where a PA may be the only route.
• Decide your public protection measures: monitoring, access and movement control, physical security, information security. Be honest about what is reasonably practicable for your scale.
• Prepare the security document and plan for providing it to the SIA when that duty commences.
• Brief and train staff, stewards and volunteers — and record that you did. A measure nobody has been told about is not a measure.
• Align it with your event management plan and your SAG submission so the documents tell one story.
• Diarise a review after any significant change and periodically regardless.

Timing, and a word of caution

The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025, and the government committed to an implementation period of at least 24 months before duties commence, precisely so that premises and events could prepare. That means the immediate task is preparation rather than panic — but for a large annual event, 24 months is roughly two planning cycles, which is not as long as it sounds.

Detail on commencement, the regulator's approach, and official guidance will come through gov.uk, the SIA and ProtectUK. Check those directly for the current position. This page is an orientation written to help you plan, not a statement of the law, and you should not rely on it — or on any third-party summary — in place of the official guidance.

Where EventSafetyPack fits

EventSafetyPack drafts event management plans and risk assessments from a plain-English description of your event, in the structure UK reviewers expect. For enhanced-tier organisers that means the surrounding documentation — the site description, the crowd and stewarding picture, the emergency procedures — arrives already written and consistent, so the security work sits on a solid base instead of a blank page.

What we produce is always a draft for you to review, edit and sign. Counter-terrorism planning at 800-plus deserves your own judgement and, where the risk warrants it, professional advice — a counter terrorism security adviser via the police, or a competent security consultant. You remain the responsible person.

Common questions

What is the difference between the standard and enhanced tiers?

Capacity is the trigger: standard-tier duties attach where it is reasonable to expect 200 to 799 individuals may be present, and enhanced-tier duties from 800. The substance differs too. The standard tier asks for notification and reasonably practicable public protection procedures. The enhanced tier adds public protection measures, a documented security assessment provided to the regulator, and a designated senior individual where the responsible person is not an individual.

Can an outdoor event be caught even if the venue isn't?

Yes — that is what the 'qualifying event' route is for. An event can be caught in its own right where 800 or more individuals are expected to be present at the same time and there are measures controlling access, such as tickets, passes or express permission to enter. So a field that is not qualifying premises on an ordinary day can host a qualifying event. Open, freely accessible events without access control generally fall outside that test.

How is the 800 figure calculated?

It is based on the number of individuals it is reasonable to expect may be present at the same time, judged on how the premises or event actually operates — not the fire capacity plaque, not the total number of tickets sold across a whole day, and not an optimistic guess. Official guidance sets out acceptable methods. Whichever method you use, document your reasoning, because it is the thing you will be asked to justify.

What are the penalties for getting it wrong?

The Act provides for significantly higher maximum penalties at the enhanced tier than the standard tier, and for daily penalties for continuing contravention, alongside criminal offences for certain conduct. Exact figures and the enforcement approach are matters for the regulator and the commencement regulations, so check gov.uk and the SIA's published material for the current position rather than relying on any third-party summary — including this one.