Martyn’s Law Is Coming in 2027: What a Pub, Café or Restaurant Actually Has to Do

Staff member with a clipboard counting seating in a UK pub function room — Martyn's Law Is Coming in 2027

Last reviewed: September 2026 · Written by: Alex Craven · 01792 732702

Martyn’s Law Is Coming in 2027: What a Pub, Café or Restaurant Actually Has to Do

Martyn’s Law — the Terrorism (Protection of Premises) Act 2025 — is not yet in force. As of September 2026 no commencement date has been set for the duties on venues, and nothing before April 2027 is possible under the committed 24-month implementation period. Premises where fewer than 200 people can reasonably be expected at once are out of scope entirely. The standard tier (200–799) means notifying the Security Industry Authority and holding low-cost procedures — not scanners, guards or bollards.

Key facts: Martyn’s Law status, September 2026

  • Not yet in force: Royal Assent 3 April 2025; no commencement regulations exist for the duties on premises. Nothing is enforceable today.
  • Under 200 capacity = out of scope. Most small cafés and wet-led pubs will have no duties at all.
  • Standard tier (200–799): notify the regulator and hold reasonably practicable procedures — evacuation, invacuation, lockdown, communication.
  • Enhanced tier (800+): further measures such as CCTV, bag checks or vehicle screening where appropriate.
  • Statutory guidance published: Home Office, 15 April 2026, with supplementary documents on assessing your capacity number.
  • Regulator: the Security Industry Authority (SIA). Its own machinery was switched on in June 2026; venue duties were not.

If you run a pub, café, restaurant or takeaway, you have probably met Martyn’s Law in a trade newsletter or a consultant’s mailshot, wrapped in urgency. So here is the sentence that matters most: for the majority of small hospitality businesses, Martyn’s Law will require nothing at all. Where it does apply, the standard tier is procedures and planning, not spending.

We sell refrigeration and catering equipment, not security kit — nobody here earns a penny whether you buy a bollard or not, which is why you are getting the calm version. Everything below is checked against the Act, the statutory guidance and the commencement position as of 22 September 2026.

The short answer: know your capacity number, read the guidance if you are near or over 200, and ignore anyone selling panic. The statutory guidance on GOV.UK and the ProtectUK overview are free, official and written for operators.
Table of Contents
200Where the standard tier begins — below this, out of scope
800+Where the enhanced tier applies, with additional measures
2027Signalled commencement window — not yet fixed in law

What Martyn’s Law is and why it exists

The Terrorism (Protection of Premises) Act 2025 is named for Martyn Hett, one of the twenty-two people killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for years for a simple principle: places where the public gather should have thought, in advance, about how they would protect people if the worst happened. That campaign, alongside the Manchester Arena Inquiry’s findings, led to Royal Assent on 3 April 2025. It deserves to be taken seriously — which also means describing accurately what it asks of a business, not using it to frighten anyone.

It is the first time counter-terrorism preparedness duties have been placed on ordinary public-facing premises — hence the attention, and the noise. The design is proportionate by intention: two tiers, the duty scaled to the venue, the smallest venues carrying no duty at all.

Are you even in scope? The capacity test explained

Scope is one number: how many individuals — customers and staff — it is reasonable to expect to be present at the same time. Not your fire capacity by default, not the maximum theoretical squeeze, not annual footfall. The guidance’s supplementary document covers assessing it — safe occupancy figures, attendance history or floor-area calculations, applied to how your venue actually trades.

Fewer than 200: out of scope. 200 to 799: standard tier. 800 and above: enhanced tier. In hospitality terms:

Venue Reasonable expectation Position under the Act
A 60-cover café with four staff Well under 200 Out of scope — no duties
A neighbourhood pub, 120 at its peak Under 200 Out of scope — no duties
A pub with a function room, 250 across the premises on a big night 200–799 Standard tier — notification plus procedures
A town-centre restaurant and bar, 400 including staff 200–799 Standard tier — notification plus procedures
A hotel with banqueting space for 900 800+ Enhanced tier — additional protective measures

Two caveats. The number is what is reasonable to expect, so a function room that genuinely fills matters even if Tuesday does not. Edge cases — multi-use buildings, outdoor areas, ticketed events — belong to the guidance’s worked examples. Near the 200 line, work the number out properly and write down how.

What the standard tier actually requires

A standard-tier venue is asked for two things, both straight from the statutory guidance.

1. Notify the regulator. The Security Industry Authority (SIA) is the regulator, and responsible persons will need to notify it of their premises. The Government has already made the Notification Requirements Regulations 2026 setting out what that notification contains — essentially who you are, where the premises is and who is responsible. A registration, not an inspection.

2. Have public-protection procedures in place, so far as reasonably practicable. These reduce the risk of physical harm if an attack occurred at or near the premises, across four themes: evacuation (getting people out), invacuation (bringing people in and away from danger), lockdown (securing the building), and communication (how staff alert customers and each other). “Reasonably practicable” is the proportionality language operators already know from health and safety: what a venue of your size can sensibly do, balanced against cost and difficulty.

Notice what that describes: thinking, writing down, briefing staff. For most venues the raw material already exists in the fire evacuation plan — this extends it to a different emergency, including scenarios where the right answer is keeping people inside, not sending them out the front door.

What the standard tier does NOT require

This is where consultant noise does the most damage, so let’s be blunt. The Home Office describes the standard tier as simple, low-cost activities, met without buying equipment or hiring specialists. There is:

  • ✗
    No airport-style scanners or metal detectors. Screening belongs to the enhanced-tier conversation, and even there only where appropriate.
  • ✗
    No security guards or door staff. Your existing team, briefed on the procedures, is the workforce the tier is designed around.
  • ✗
    No bollards, barriers or physical hardening. The standard tier is about procedures, not alterations to the premises.
  • ✗
    No compliance package or accreditation to buy. There is no official Martyn’s Law certificate. The guidance is free on GOV.UK.
  • ✗
    Nothing to comply with today. Until commencement regulations arrive, there is no enforceable obligation on any venue — and no fine anyone can threaten you with.
If someone is selling you urgency: ask which section of the Act creates the duty, and what date it came into force. As of September 2026 the honest answers are “none yet” and “it hasn’t”. A legitimate adviser will tell you that themselves.

The timeline: what’s law today, and what’s signalled for 2027

The verified position as of 22 September 2026 — worth being precise, because a two-month-old article here can mislead.

Date What happened What it means for a venue
3 April 2025 The Act received Royal Assent The framework became law; duties not switched on
15 April 2026 Home Office published the statutory guidance You can read exactly how scope, tiers and duties will work
15 June 2026 Commencement No. 2 Regulations took effect Regulator machinery only — the SIA’s duty to produce its own guidance; nothing commenced for venues
9 July 2026 Notification Requirements Regulations made The future SIA notification is defined; it bites only when the notification duty commences
2027 (signalled) Expected commencement of the duties At least 24 months’ implementation from Royal Assent means nothing before April 2027 — no date fixed in law yet

Read the middle rows again — the part most coverage misses: commencement regulations have started to appear, and so far they switch on obligations for the regulator, not venues. The Commencement No. 2 Regulations require the SIA to produce guidance on how it will regulate, consulted on in mid-2026. The machine is being assembled in order — rules, regulator, then duties — and “2027” remains a consistently repeated signal, not a date on the statute book.

What is sensible during the run-in? Three free things. Work out your capacity number and note the method. If you are 200 or over, read the standard-tier chapters of the guidance — they are in plain English. And sketch the four procedures on a page: how we evacuate, where we bring people in, how we lock down, who tells whom. Commencement will come with formal notice and nothing left to panic about.

✓
The whole standard tier fits on one sheet of paperA capacity number with your working, a notification when the SIA opens for it, and written procedures — evacuation, invacuation, lockdown, communication — your staff have been walked through. That is the duty. Anything beyond it is a sales pitch, not the statute.
0Security equipment the standard tier obliges you to buy

Where this meets the operations planning you already do

The reassuring structural point: hospitality already runs on headcount thinking. Licensed capacity, the fire risk assessment, the seating plan and the rota all start from “how many people are in this building at once”. Martyn’s Law borrows the same number for one more scenario — a venue that knows its capacity honestly for fire purposes has done the hardest part of the scope test.

The same goes for procedure culture. If your kitchen runs a proper food-safety management system — the discipline in our HACCP master guide — then “identify the risk, write the procedure, train the team, review it” is a muscle you already have. Four protection procedures are an afternoon with your duty managers, not a consultancy project.

It also belongs in the conversation when a venue changes shape. A new function room, a knock-through or a switch to standing bar format can move your number across the 200 line — as surely as it changes kitchen load, refrigeration capacity and service flow. We walk through that whole-premises thinking in our pub and bar equipment dealer’s guide and the companion restaurant equipment dealer’s guide. At the smaller end, a takeaway or fast-food operation will almost always sit comfortably out of scope — worth knowing before anyone sells you otherwise.

Refitting a site in 2026–27 anyway? Fold the headcount question into the plan — our guide to planning a commercial kitchen fit-out makes the same argument: numbers before spending. The equipment side is what we are for — the Swansea showroom is on 01792 732702 or [email protected], with a 2-year parts warranty. For Martyn’s Law itself, your authority is the guidance, not a supplier — ours included.

In summary

Martyn’s Law is on the statute book but its venue duties are not in force as of September 2026: statutory guidance arrived on 15 April 2026, the SIA’s regulator machinery was switched on in June 2026, and commencement is signalled for 2027 with no date yet fixed. Premises expecting fewer than 200 people at once — most small cafés, pubs and takeaways — are out of scope entirely. Standard-tier venues (200–799) will notify the SIA and hold reasonably practicable procedures for evacuation, invacuation, lockdown and communication. Scanners, guards and bollards are not standard-tier requirements. Know your capacity number, read the free guidance, and treat urgency-sellers with suspicion.

Frequently asked questions

No. As of September 2026 the duties on venues have not commenced. The only commencement regulations made so far switch on obligations for the regulator (the SIA), not for premises. There is currently nothing a venue can be fined for.
Almost never. Premises where it is reasonable to expect fewer than 200 people — customers and staff — at the same time are out of scope entirely. A typical café, coffee shop or small pub sits well below that line.
The standard tier applies from 200 to 799 people; the enhanced tier from 800 upwards. The number is how many individuals, including staff, it is reasonable to expect on the premises at the same time — assessed using safe occupancy figures, attendance history or floor-area calculations, per the statutory guidance.
Two things: notifying the Security Industry Authority of the premises, and holding reasonably practicable public-protection procedures covering evacuation, invacuation, lockdown and communication — how staff would move, shelter, secure and inform people if an attack occurred at or near the venue. A planning and training duty, not an equipment duty.
Not at the standard tier. Government guidance describes standard-tier measures as simple, low-cost activities: no screening equipment, security staff or physical hardening is required. CCTV, bag checks or vehicle screening belong to the enhanced tier for venues of 800 or more, and even there only where appropriate.
The Security Industry Authority (SIA). Its duty to produce guidance on how it will regulate was switched on in June 2026, and it consulted on a draft that summer. Regulations made in July 2026 define what venues will eventually notify to the SIA once the notification duty commences.
No commencement date for the venue duties is fixed in law as of September 2026. The committed implementation period of at least 24 months from Royal Assent rules out anything before April 2027, and commencement has been consistently signalled for 2027. A date will be announced officially with formal notice — not by a sales email.

Related posts and guides