Updated October 2026. This comparison reflects the Section 27 statutory guidance (15 April 2026, corrected 6 and 7 August 2026), the SIA's regulator guidance of 17 July 2026, which confirms which premises sit in which tier and that qualifying events carry enhanced-tier requirements, and the Home Office notification guidance of 14 July 2026, which sets the notification deadlines for both tiers.
This article is part of our comprehensive guide to Martyn's Law. For an overview of the legislation, who it applies to, implementation timelines, and how AV technology can support compliance, see our complete guide to Martyn's Law.
The standard tier applies to qualifying premises where 200 to 799 people may be present; the enhanced tier applies to premises where 800 or more may be present and to qualifying events expecting 800 or more. The standard tier is a procedural duty (notify the SIA, have workable procedures). The enhanced tier adds physical and organisational measures, a designated senior individual, a documented compliance narrative and far higher penalties.
Standard vs enhanced tier at a glance
| Standard tier | Enhanced tier | |
|---|---|---|
| Who | Qualifying premises, 200 to 799 people reasonably expected at once | Qualifying premises, 800 or more; qualifying events, 800 or more with entry checks |
| Always standard regardless of numbers | Places of worship; childcare, early years, primary, secondary and further education premises | Not applicable (higher education premises can be enhanced) |
| Notify the SIA | Yes, within three months of commencement (28 days if you become responsible later) | Yes, same deadlines; events within 14 days of first publicity |
| Public protection procedures | Evacuation, invacuation, lockdown, communication, so far as reasonably practicable | Same four procedures |
| Public protection measures | Not required | Monitoring, movement, physical safety and security, security of information |
| Documented compliance narrative sent to the SIA | Not required | Required, including why each measure reduces harm |
| Designated senior individual | Not required | Required where the responsible person is an organisation |
| Maximum civil penalty | £10,000, plus daily penalties for continuing breaches | £18m or 5% of worldwide revenue (whichever is higher), plus daily penalties |
| Restriction notices | Possible | Possible, can stop a venue opening or an event proceeding |
| Personal criminal liability | No | Senior individuals, up to two years' imprisonment for consent, connivance or neglect |
Sources: SIA, Understanding Martyn's Law (17 July 2026); Home Office, notification requirement guidance (14 July 2026).
Standard tier (200 to 799 people)
Premises expecting between 200 and 799 individuals at the same time fall under the standard duty tier. Events never fall into the standard tier: an event expecting fewer than 800 people is simply out of scope as an event, although the premises hosting it may be in scope in their own right. The focus of the standard tier is basic preparedness and awareness. Key obligations include:
Notification: The responsible person must notify the Security Industry Authority (SIA) that they control the premises, within three months of commencement for premises already operating on that date (gov.uk, notification guidance, 14 July 2026).
Risk assessment: Conduct a proportionate assessment of the potential terrorist threat and identify vulnerabilities (nalc.gov.uk).
Training and awareness: Provide basic security awareness training for staff and volunteers so they can recognise suspicious behaviour and respond appropriately (nalc.gov.uk).
Emergency procedures: Develop simple, low-cost plans to protect people in the event of an attack, such as identifying safe routes, locking doors, and closing shutters (protectuk.police.uk).
Standard-tier premises are not required to install physical security systems, such as metal detectors or CCTV. The goal is to ensure that staff know what to do during an incident and that there are clear procedures to minimise harm without imposing excessive costs on smaller venues.
Standard tier penalty. Financial penalties of up to £10,000 apply for non-compliance, plus daily penalties for continuing breaches once the duty is in force.
Enhanced tier (800+ people, including qualifying events)
Premises where 800 or more people may be present fall into the enhanced duty tier, and qualifying events (open to the public, with entry checks, 800 or more expected including staff) carry the same requirements as enhanced tier premises (gov.uk, SIA guidance, 17 July 2026). Places of worship and childcare, early years, primary, secondary and further education premises are the exception: they stay in the standard tier at any capacity. Enhanced tier duty holders must meet all standard-tier requirements and implement additional measures:
Four formal categories of public protection measures (April 2026 guidance): the responsible person must consider monitoring (e.g. CCTV, observation arrangements), movement (control of access, queuing, vehicle management), physical safety and security (barriers, glazing, layout) and security of information. Measures may be implemented through people, policies and processes, and/or physical mitigations, there is no single prescribed solution.
Physical security measures: Enhanced venues may need to introduce bag searches, CCTV or other monitoring, and vehicle checks to reduce vulnerability (protectuk.police.uk). These measures should be proportionate and based on the venue's risk assessment.
Senior responsible individual: A senior individual must be designated where the responsible person is an organisation. Statutory responsibility cannot be delegated, and the senior individual is personally exposed to criminal liability of up to two years' imprisonment for breaches involving consent, connivance or neglect.
Comprehensive emergency planning: Enhanced-tier premises must have more detailed plans covering evacuation, communication and coordination with emergency services. Staff should be trained in specific roles and response protocols.
The compliance document is a narrative, not a checklist. The April 2026 guidance is explicit that the document required from enhanced-tier responsible persons must explain what is in place, why each measure is expected to reduce harm, and where the chosen approach differs from what would normally be expected, why. The earlier "produce a security plan" framing is now noticeably stronger.
Notification and documentation: Enhanced venues must notify the regulator (SIA) within the same three-month window as standard tier premises, with qualifying events notified within 14 days of first being publicised, and must maintain documentation demonstrating compliance, including risk assessments, training records and security procedures. The notification for enhanced tier premises must also name the designated senior individual and the date they were designated.
Enhanced tier penalties. Civil penalties up to £18m or 5% of worldwide revenue (whichever is higher), daily penalties for continuing breaches, restriction notices that can prevent a venue opening or an event proceeding, and personal criminal liability for designated senior individuals.
These extra obligations reflect the greater risk posed by large crowds and the potential impact of incidents in venues such as stadiums, concert halls, and large festivals.
Why the distinction matters
The tier system is designed to ensure that security measures are proportionate to the scale of the venue or event. Smaller venues may not have the resources or need for advanced physical security, whereas larger venues can pose more attractive targets and require additional safeguards. Understanding which tier you fall into allows you to:
Allocate resources wisely: Focus investments on measures that match your risk profile. Standard-tier venues can prioritise staff training and simple emergency procedures, while enhanced-tier venues budget for surveillance systems and bag searches.
Assign responsibilities: Identify a responsible person for each venue or event and, for enhanced venues, appoint a senior individual to oversee compliance.
Plan: The Government committed to at least 24 months between Royal Assent (3 April 2025) and the duties taking effect. The SIA's guidance of 17 July 2026 says the Act is expected to come into force in spring 2027, with the exact date to be confirmed ahead of time (gov.uk). Use this time to evaluate your capacities, update procedures, and, if necessary, procure technology such as CCTV, public address systems and mass notification solutions.
Practical tips for compliance
Verify your capacity: Determine how many people your venue can host at peak times, including staff. This will establish whether you are in the standard or enhanced tier.
Document your plans: Keep written records of risk assessments, training sessions, evacuation plans and any security measures implemented. The regulator (insight-security.com) may review these documents.
Engage stakeholders: Involve venue owners, event organisers, security staff and local police when developing and testing emergency procedures. Collaboration ensures that everyone understands their role.
Consider scalable technology: For enhanced venues, explore integrated security solutions, such as surveillance cameras, access control systems and digital signage, to improve situational awareness and communication.
Conclusion
The distinction between the standard and enhanced tiers under Martyn's Law hinges on capacity, use and risk. Standard-tier premises (200 to 799 people, plus places of worship and most education premises at any capacity) must focus on awareness, training, and simple protective procedures (protectuk.police.uk). Enhanced-tier premises (800+ people) and qualifying events (800+ with entry checks) need additional physical security and a more formal compliance structure (gov.uk). By understanding the requirements for your tier and planning accordingly, you can ensure public safety and meet the obligations of this new legislation.
For more comprehensive information about Martyn's Law, including who it applies to, implementation timelines, special considerations for education settings, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Frequently Asked Questions
Q.What is the difference between standard and enhanced tier under Martyn's Law?
The standard tier covers premises expecting 200 to 799 people and focuses on basic preparedness: notifying the Security Industry Authority, risk assessment, staff training and simple emergency procedures. The enhanced tier covers premises expecting 800 or more people and qualifying events expecting 800 or more, and adds requirements such as the four formal categories of public protection measures (monitoring, movement, physical safety and security, and security of information), a designated senior individual with personal criminal liability, comprehensive emergency planning and a narrative-style compliance document. Events are never standard tier. Enhanced-tier penalties are also significantly higher: up to £18m or 5% of worldwide revenue, against up to £10,000 in the standard tier.
Q.Do standard-tier venues have to install CCTV or metal detectors?
No. Standard-tier premises are not required to install physical security systems such as metal detectors or CCTV. The standard tier focuses on awareness, training and procedural readiness so that staff know what to do during an incident. Physical security infrastructure is only mandatory for enhanced-tier venues, based on their risk assessment.
Q.How is venue capacity calculated under Martyn's Law?
Capacity refers to the total number of people reasonably expected on the premises at the same time, including staff, volunteers and attendees. The April 2026 statutory guidance (Supplementary Document A) formalises acceptable methods: fire safety safe-occupancy figures, historic attendance data or any other justified method. It is not the building's maximum legal occupancy but the actual number expected during peak times or events. Operators should document the method used and the assumptions behind it.
Q.What additional obligations apply to enhanced-tier venues?
Enhanced-tier venues must meet all standard-tier requirements plus designate a senior individual (who carries personal criminal liability and whose responsibility cannot be delegated), conduct documented risk assessments, address the four formal categories of public protection measures (monitoring, movement, physical safety and security, and security of information), develop comprehensive emergency plans, and produce a narrative-style compliance document for the SIA explaining what is in place and why.
Q.Can a venue's tier change?
Yes. Tier classification depends on the number of people reasonably expected at the venue at any one time. A venue that normally operates as standard tier may host a qualifying event (800 or more expected, with entry checks) that carries enhanced-tier requirements for the event itself, and the event must be notified to the SIA within 14 days of first being publicised. Operators should reassess capacity for each event and adjust procedures accordingly.
Q.Do standard tier premises have to notify the SIA?
Yes. Both tiers must notify the SIA once the Act commences. The Home Office notification guidance of 14 July 2026 gives responsible persons of premises already operating at commencement three months from the commencement date to notify; anyone who becomes responsible later has 28 days. Notification is made through the SIA's online portal on GOV.UK, and ProtectUK states there is no fee. The difference between the tiers is what follows notification: enhanced tier premises must also name their designated senior individual and send the SIA a compliance document.
