Updated 23 October 2026. This checklist reflects the Section 27 statutory guidance (15 April 2026, corrected 6 and 7 August 2026), the Home Office notification guidance (14 July 2026), the SIA's regulator guidance (17 July 2026) and September 2026 update, and the Principal Use of Premises Regulations 2026, in force since 15 October 2026. Commencement is expected in spring 2027; the exact date has not yet been confirmed.
What changed (October 2026)
14 July 2026. The Home Office published the notification requirement guidance: premises in scope at commencement must notify the SIA within three months; anyone who becomes responsible later has 28 days; qualifying events must be notified within 14 days of first being publicised. See the notification deadlines section below.
17 July 2026. The SIA published "Understanding Martyn's Law and the SIA's role as regulator": commencement expected spring 2027 with the exact date to be confirmed; final Section 12 enforcement guidance and a consultation report due autumn 2026; notification through an online portal with volunteer testing from early 2027; inspections normally on at least 72 hours' notice; places of worship and childcare, early years, primary, secondary and further education premises stay standard tier even at 800 or more; qualifying events (800+) carry the same requirements as enhanced tier premises.
6 and 7 August 2026. A correction slip and a corrected 130-page PDF of the Section 27 statutory guidance were added on gov.uk. Welsh translations followed on 25 August 2026.
10 September 2026. Home Office guidance on the principal use of premises was published. The Terrorism (Protection of Premises) (Principal Use of Premises) Regulations 2026 (SI 2026/1005), made 8 September, came into force on 15 October 2026. They decide the responsible person for premises with more than one Schedule 1 use.
11 September 2026. The SIA's monthly update confirmed an online scope-checking tool "in the new year", optional standard-tier and enhanced-tier templates "over the coming months", a notification portal hosted on GOV.UK still being built with volunteers, and a second round of pilot inspections starting in autumn 2026.
Still pending at 23 October 2026. The SIA's final Section 12 enforcement guidance (due autumn 2026) and the commencement regulations that fix the date. This page is updated when either lands.
The checklist in brief: confirm which premises are in scope (200+ people) and which events (800+), name a responsible person, carry out a terrorism risk assessment, write evacuation, invacuation and lockdown procedures, train staff through ACT Awareness, engage local police and the council, review physical and technology measures, document everything, track SIA guidance, and phase the work so it is complete before commencement and your SIA notification is ready to submit in the first three months after it.
This article is part of our comprehensive guide to Martyn's Law. For an overview of the legislation, who it applies to, tier requirements, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Martyn's Law (the Terrorism (Protection of Premises) Act 2025) received Royal Assent on 3 April 2025 (homeofficemedia.blog.gov.uk). The Act introduces legal obligations for qualifying premises and events to assess terrorism risks and put in place protective measures. With statutory guidance in force, the notification regime published and spring 2027 the expected commencement window, the lead-in is no longer abstract: organisations should be moving from awareness into structured preparation.
Implementation timeline (updated October 2026)
Royal Assent: 3 April 2025. Martyn's Law became law on this date (homeofficemedia.blog.gov.uk).
Statutory guidance published: 15 April 2026. The Home Office published the Section 27 statutory guidance plus three non-statutory supplementary papers covering capacity calculation methods, illustrative scope examples and further resources and training. HTML accessible versions were added between 21 April and 18 May 2026. Available at gov.uk.
SIA Section 12 enforcement consultation: 15 April to 12 June 2026. The SIA consulted on its draft Section 12 guidance on investigation and enforcement powers and received nearly 200 detailed responses (gov.uk, 16 June 2026). The final guidance and a consultation report are due in autumn 2026.
Notification guidance: 14 July 2026. The Home Office published non-statutory guidance on how and when to notify the SIA, with the three-month, 28-day and 14-day deadlines set out below (gov.uk).
SIA regulator guidance: 17 July 2026. "Understanding Martyn's Law and the SIA's role as regulator" explains tiers, notification, inspections and penalties from the regulator's side (gov.uk).
Statutory guidance corrected: 6 and 7 August 2026. Correction slip and corrected PDF (130 pages) added; Welsh translations 25 August 2026.
Principal use guidance and regulations: 10 September and 15 October 2026. Guidance published 10 September; the Principal Use of Premises Regulations 2026 came into force on 15 October 2026 (gov.uk).
SIA September update: 11 September 2026. Scope tool in the new year, optional templates over the coming months, portal volunteer testing, second pilot inspection round in autumn 2026 (gov.uk).
SIA final Section 12 guidance: due autumn 2026. Not yet published as of 23 October 2026.
Commencement: expected spring 2027, date to be confirmed. The Act required at least 24 months between Royal Assent and the duties taking effect, so April 2027 was always the earliest realistic date. The SIA's July 2026 guidance says the Act "is expected to come into force in spring 2027" and that the SIA "will confirm the exact date ahead of when this happens". Commencement regulations have not been laid as of 23 October 2026.
No legal requirement yet, but preparation is now expected. With statutory guidance published, there is no longer any uncertainty about what compliance looks like. Government, the regulator and sector bodies all expect responsible persons to be moving towards readiness in 2026, not waiting for enforcement to begin.
For a detailed breakdown of who falls under Martyn's Law scope, see our guide: Who Does Martyn's Law Apply To?.
SIA notification deadlines (guidance published 14 July 2026)
Notification is the first hard deadline every duty holder will face, and it applies to both tiers. The Home Office notification requirement guidance of 14 July 2026 sets the following windows (gov.uk):
| Situation | Deadline to notify the SIA |
|---|---|
| Responsible for qualifying premises on the day the Act commences | Within three months of the commencement date |
| Become responsible for qualifying premises during that first three months | By the end of the three-month period, or 28 days after becoming responsible, whichever is later |
| Become responsible for qualifying premises after the first three months | Within 28 days |
| Qualifying event first publicised on or before commencement | Within 14 days of the commencement date |
| Qualifying event first publicised after commencement | Within 14 days of that first publicity |
| Notified information becomes inaccurate | Within 28 days (premises) or 14 days (events) |
Notifications go through the SIA's online portal, hosted on GOV.UK, unless the SIA directs otherwise; paper and easy-read formats are available on request. ProtectUK's regulator page states there is no fee for notification. The portal is still being built: the SIA said on 17 July 2026 that it will invite volunteers to test it from early 2027 and will announce when it opens. A notification must include the responsible person's details (registered and trading names, company or charity number), anyone else who controls or must coordinate on the premises, the postal address, the greatest number of people reasonably expected at once and how that was calculated, relevant licences, and, for enhanced tier premises and qualifying events, the designated senior individual and the date they were designated. If commencement falls in April 2027, the first premises notifications will be due around July 2027.
Compliance checklist: steps to prepare now
The following checklist outlines practical steps to meet the requirements of Martyn's Law during the implementation period. It draws on the statutory guidance, the SIA's regulator guidance and advice for councils and venue operators from the National Association of Local Councils (NALC).
1. Determine whether you're in scope
Identify all premises and events you operate or manage. Martyn's Law applies to qualifying premises where 200 or more people may be present and to qualifying events where 800 or more are expected with entry checks (gov.uk). Premises expecting 200 to 799 people are standard tier, premises expecting 800 or more are enhanced tier, and qualifying events carry enhanced-tier requirements; there is no standard tier for events. Places of worship and childcare, early years, primary, secondary and further education premises stay standard tier at any capacity. The April 2026 Supplementary Document A formalises capacity calculation methods: fire safety safe-occupancy figures, historic attendance data or any other justified method, with the reasonable-expectation test including staff and volunteers. For mixed-use premises, apply the principal-use test in the regulations in force since 15 October 2026 to identify the responsible person.
For a detailed comparison of standard and enhanced tier requirements, see our guide: Martyn's Law Standard vs Enhanced Tier: Requirements Compared.
2. Assign a responsible person
For every qualifying venue or event, nominate a responsible person, the individual or organisation that has control of the premises or event (homeofficemedia.blog.gov.uk). For enhanced-tier premises, where the responsible person is an organisation, a senior individual must be designated to oversee compliance and document public protection procedures (bclplaw.com). The April 2026 statutory guidance is explicit that statutory responsibility cannot be delegated, and that the senior individual is personally exposed to criminal liability of up to two years' imprisonment for breaches involving consent, connivance or neglect.
3. Carry out risk assessments
Conduct terrorism risk assessments tailored to each venue. This involves identifying potential vulnerabilities (entrances, crowd flow, escape routes) and evaluating the likelihood and impact of different attack types (nalc.gov.uk). For enhanced-tier premises, risk assessments must be documented and provided to the regulator (bclplaw.com).
4. Develop emergency plans
Draft simple emergency response plans that outline evacuation routes, invacuation procedures, and communication methods. Standard-tier premises must put in place appropriate public protection procedures, such as evacuation, invacuation, and lockdown plans (homeofficemedia.blog.gov.uk). Enhanced-tier venues will need more detailed plans, including procedures for crowd management and information dissemination (bclplaw.com).
5. Provide ACT awareness training
The recognised baseline training for Martyn's Law preparedness is ACT Awareness Training, a free, government-backed programme delivered through ProtectUK that gives staff, volunteers and regular contractors the skills to spot suspicious behaviour, respond to alerts and execute emergency plans. ACT (Action Counters Terrorism) is referenced throughout the statutory guidance as the expected training standard for the standard tier and a starting point for the enhanced tier. NALC's advice also emphasises offering security awareness training for staff and volunteers (nalc.gov.uk) to improve preparedness. Maintain a register of who has completed ACT awareness training and when, so the SIA can see evidence of compliance on inspection.
6. Engage with local authorities and emergency services
Liaise with local police, counter-terrorism advisors and your local council to ensure plans align with regional preparedness strategies. NALC recommends working with local authorities and emergency services for guidance and support (nalc.gov.uk).
7. Consider physical and technological measures
For enhanced-tier venues, the April 2026 guidance formalises four categories of public protection measures to be considered: monitoring (e.g. CCTV, observation arrangements), movement (control of access, queuing, vehicle management), physical safety and security (barriers, glazing, layout), and security of information. Measures may be implemented through people, policies and processes, and/or physical mitigations (bclplaw.com). Even standard-tier venues may benefit from inexpensive improvements such as improved lighting, secure doors, and mass-notification systems.
Technology is where most venues find the gaps. Your evacuation, invacuation and lockdown procedures only work if everyone hears or sees the instruction in seconds, so check you can: broadcast a clear spoken message to every area (a PA or voice evacuation system, not just a fire bell), switch every screen to an emergency message at once (digital signage override), trigger lockdown from more than one point, and test it all in a drill. Our guide to how AV technology supports Martyn's Law covers each system, and the Martyn's Law compliance service can survey what you already have and quote for what's missing.
8. Document and record procedures
Maintain clear, accessible records of your risk assessments, training, emergency plans and any physical security measures. Enhanced-tier venues must provide the SIA with a compliance document, and the April 2026 guidance is explicit that this is a narrative, not a checklist. The document should explain what is in place, why each measure is expected to reduce harm, and where the chosen approach differs from what would normally be expected, why.
9. Stay informed
The Section 27 statutory guidance was published on 15 April 2026 (corrected PDF 7 August 2026) and is available on gov.uk. The SIA's final Section 12 enforcement guidance is due in autumn 2026; read it when it lands, as it sets out how inspections and penalties will work in practice. The SIA's monthly updates on gov.uk (the latest, 11 September 2026, covers the scope tool, templates and portal) are the fastest way to track the portal launch and the commencement date. Subscribe to ProtectUK alerts and join industry forums to track further updates. NALC also offers risk-assessment templates for council and small-venue use (nalc.gov.uk), and the SIA has said it will publish optional standard-tier and enhanced-tier templates before commencement.
10. Plan your timeline (to spring 2027)
With spring 2027 the expected commencement window and the exact date still to be confirmed, roughly five to six months remain from late October 2026. A reasonable phasing:
October to November 2026: Read the statutory guidance, run an in-scope audit, classify each site as standard or enhanced, apply the principal-use test to mixed-use premises, designate the senior individual where required.
November to December 2026: Complete risk assessments, draft public protection procedures (evacuation, invacuation, lockdown, communication), read the SIA's final Section 12 guidance when published, and start staff training.
January to February 2027: Finish training, agree coordination arrangements for shared spaces, finalise the enhanced-tier compliance document narrative, and gather the information the SIA notification will need (capacity figure and method, licences, coordination contacts). Order any physical or AV technology now; equipment lead times and installer availability tighten as commencement approaches.
March 2027: Complete installation, run live drills and have the notification ready to submit through the SIA portal as soon as the Act commences. Premises then have three months from the commencement date to notify.
Next steps
With statutory guidance published, the notification regime set out and spring 2027 the expected commencement window, the time for "watch and wait" has effectively passed. By identifying in-scope venues, conducting risk assessments, training staff, developing emergency plans, and engaging with local authorities, you build resilience, protect your community and avoid a last-minute scramble before commencement.
For more comprehensive information about Martyn's Law, including who it applies to, tier requirements, special considerations for education settings, and how AV technology can support compliance, see our complete guide to Martyn's Law. Meanwhile, Strive AV's Martyn's Law Compliance service offers consultation, risk-assessment support and technology solutions to help you meet these obligations.
Frequently Asked Questions
Q.When does Martyn's Law need to be complied with?
Martyn's Law received Royal Assent on 3 April 2025. The SIA's guidance of 17 July 2026 says the Act is expected to come into force in spring 2027 and that the exact date will be confirmed ahead of time; commencement regulations had not been laid as of 23 October 2026. The Section 27 statutory guidance was published on 15 April 2026, the SIA's Section 12 enforcement consultation closed on 12 June 2026 with final guidance due in autumn 2026, and the notification guidance of 14 July 2026 gives premises three months from commencement to notify the SIA. With guidance live and the commencement window narrowing, organisations should now move from awareness into structured preparation rather than waiting for enforcement to begin.
Q.When do I have to notify the SIA under Martyn's Law?
Under the Home Office notification guidance of 14 July 2026, responsible persons for qualifying premises that are operating on the commencement date must notify the SIA within three months of that date. Anyone who becomes responsible later has 28 days. Qualifying events must be notified within 14 days of first being publicised, or within 14 days of commencement if they were publicised before it. Notification is through the SIA's online portal on GOV.UK, there is no fee, and changes to notified information must be reported within 28 days for premises and 14 days for events.
Q.Who enforces Martyn's Law?
The Security Industry Authority (SIA) is the regulator responsible for Martyn's Law enforcement. Responsible persons in both tiers must notify the SIA that they control qualifying premises or events, and the SIA will normally give at least 72 hours' notice of an inspection. Enhanced-tier venues must provide the SIA with a compliance document, risk assessments, training records and details of public protection measures upon request. Standard tier non-compliance carries financial penalties of up to £10,000; enhanced tier non-compliance carries the greater of £18m or 5% of global revenue, with daily penalties for continuing breaches, restriction notices and criminal liability for designated senior individuals where breaches involve consent, connivance or neglect.
Q.What documents do enhanced-tier venues need to keep?
Enhanced-tier venues must maintain documented risk assessments, public protection procedures (covering evacuation, invacuation, lockdown and communication), staff training records, emergency plans and details of any physical security measures implemented. The April 2026 guidance is explicit that the compliance document is a narrative, not a checklist; it must explain what is in place, why each measure is expected to reduce harm, and where the approach differs from what would normally be expected, why. Records should be accessible to the regulator and demonstrate ongoing compliance.
Q.What is the first step in Martyn's Law compliance?
The first step is determining whether your venue or event is in scope. Identify all premises and events you operate, calculate peak expected capacity (including staff and visitors), and classify each premises as standard tier (200 to 799 people) or enhanced tier (800+ people); events are in scope only at 800 or more and carry enhanced-tier requirements. Then assign a responsible person for each in-scope venue, using the principal-use test for mixed-use premises.
Q.How should venues structure their preparation before spring 2027?
With spring 2027 the expected commencement window, about five to six months remain from late October 2026. A reasonable phasing: October to November 2026, read the statutory guidance, audit in-scope sites, classify standard vs enhanced and designate senior individuals; November to December 2026, complete risk assessments, draft public protection procedures, read the SIA's final Section 12 guidance (due autumn 2026) and start staff training; January to February 2027, finish training, agree coordination for shared spaces, finalise the enhanced-tier compliance document, gather the notification information and order any technology; March 2027, complete installation, run live drills and have the SIA notification ready to submit within three months of commencement.
