Martyn's Law: A Premises Manager's Readiness Check Before the Duties Bite

For many premises managers, Martyn's Law has occupied the same shelf as the fire risk assessment refresh and the lift maintenance contract: acknowledged, scheduled, and quietly deferred. That is an understandable response to legislation that has moved slowly through Parliament and secondary legislation, but it is no longer a defensible one. The duties created by the Terrorism (Protection of Premises) Act 2023 are now firming up, the regulator is in place, and managers who have not yet tested their arrangements against the requirements are storing up a concentrated burst of work for later.

The purpose of this piece is not to alarm anyone. It is to give those responsible for public-facing buildings a structured way to check their position, in the same way they would approach any other compliance obligation.

Establish whether you are a qualifying premises

The Act applies to premises and events in Great Britain. The threshold is a capacity of 200 or more individuals, which is significantly lower than many managers assume. Two tiers then apply: the standard duty covers premises with a capacity of 200 to 799, and the enhanced duty covers those with a capacity of 800 or above.

Two points catch people out. First, capacity is not the same as typical occupancy, footfall or floor area. It is a defined maximum, and the onus sits with the responsible person to arrive at a figure that can be defended and recorded. Second, qualifying events are caught even where the venue itself sits below the threshold, so a 250-person conference in a village hall can bring obligations that the hall's day-to-day management has never previously considered.

If you cannot currently produce a single, dated document stating the capacity of your premises and the tier that follows from it, that is the first gap to close.

The two tiers, side by side

Under the standard duty, the emphasis is on proportionate public protection procedures and ensuring that staff are aware of them. There is no statutory requirement to appoint a named security lead, and no expectation of substantial physical works. What is expected is that the procedures are written down, are specific to your building and your operating pattern, and that people know what to do when they are invoked. For many smaller venues this is a modest exercise, provided it is done properly rather than copied from a template.

The enhanced duty is more demanding. It requires a designated senior manager with responsibility for security, a documented security plan covering the premises, and procedures that address the reasonably foreseeable risks to the public. In practice that means someone with sufficient authority to secure budget and change behaviour, not a nominal name on a document.

Implementation is being phased, and the regulator's early posture is expected to favour advice and guidance over immediate enforcement. Managers should treat that as breathing space for preparation, not as an excuse to wait.

A manager's readiness checklist

The following items form a reasonable test of whether you could evidence compliance if asked:

• A capacity statement. A dated record of the maximum number of individuals your premises can hold, signed off by the responsible person, and consistent with your fire risk assessment and licensing conditions.
• A named responsible person. Clarity about who holds the duty, particularly in multi-occupancy buildings where the answer is rarely obvious.
• A designated lead, where the enhanced duty applies. A senior manager with a written remit, not an informal understanding.
• Documented procedures. Public protection arrangements written in plain language, covering the scenarios that are realistic for your site, including anything that departs from a standard evacuation.
• A staff briefing record. Evidence that front-of-house, security, cleaning and contractor staff have been briefed, with dates and names.
• A review cycle. A diary entry, an owner and a version number, so the plan is a living document rather than a launch-day artefact.
• A link to existing plans. Interface with invacuation, lockdown, first aid and business continuity arrangements, so staff are not asked to remember two conflicting sets of instructions.

The gaps that surface late

Experience from comparable regulatory rollouts suggests a predictable set of late discoveries. The most common is a capacity figure that conflicts with the fire risk assessment, leaving the manager unsure which number is authoritative. The second is procedures written for an auditor rather than for a steward on a busy Saturday, which read well and are unusable under pressure.

Third is the briefing problem: staff have been told, but nothing was recorded, so the organisation cannot demonstrate awareness. Fourth is the multi-tenant building, where two or three organisations each assume a different party is coordinating. Fifth is the seasonal event, added to the calendar after the plan was signed off. Sixth is communication, where a plan assumes PA announcements that cannot be heard in the bar or the back-of-house corridor.

None of these are exotic. All of them are cheaper to fix now than after an incident or a regulatory visit.

What good looks like in six months

A well-run premises should be able to reach a modest, unglamorous position within two quarters. Specifically: a one-page capacity and tier statement lodged alongside your other compliance documents; a designated lead with a written remit and a budget line; a set of procedures under ten pages that a new starter could follow; a briefing log with every relevant member of staff and regular contractor on it; and a review date in the calendar with a named owner.

Alongside that, the security plan should be tested once, in a tabletop exercise with the people who will actually be on shift. The findings from that exercise, including the awkward ones, are the most persuasive evidence of a functioning arrangement that any manager can hold.

A sensible first move

Block two hours this month. Confirm the capacity figure, confirm the tier, and confirm the name of the responsible person. Everything else in this article follows from those three answers, and until they are settled, any further work is built on sand.