Last reviewed: September 2026 · Written by: Alex Craven · 01792 732702
Martyn’s Law Is Coming in 2027: What a Pub, Café or Restaurant Actually Has to Do
Martyn’s Law — the Terrorism (Protection of Premises) Act 2025 — is not yet in force. As of September 2026 no commencement date has been set for the duties on venues, and nothing before April 2027 is possible under the committed 24-month implementation period. Premises where fewer than 200 people can reasonably be expected at once are out of scope entirely. The standard tier (200–799) means notifying the Security Industry Authority and holding low-cost procedures — not scanners, guards or bollards.
- Not yet in force: Royal Assent 3 April 2025; no commencement regulations exist for the duties on premises. Nothing is enforceable today.
- Under 200 capacity = out of scope. Most small cafés and wet-led pubs will have no duties at all.
- Standard tier (200–799): notify the regulator and hold reasonably practicable procedures — evacuation, invacuation, lockdown, communication.
- Enhanced tier (800+): further measures such as CCTV, bag checks or vehicle screening where appropriate.
- Statutory guidance published: Home Office, 15 April 2026, with supplementary documents on assessing your capacity number.
- Regulator: the Security Industry Authority (SIA). Its own machinery was switched on in June 2026; venue duties were not.
If you run a pub, café, restaurant or takeaway, you have probably met Martyn’s Law in a trade newsletter or a consultant’s mailshot, wrapped in urgency. So here is the sentence that matters most: for the majority of small hospitality businesses, Martyn’s Law will require nothing at all. Where it does apply, the standard tier is procedures and planning, not spending.
We sell refrigeration and catering equipment, not security kit — nobody here earns a penny whether you buy a bollard or not, which is why you are getting the calm version. Everything below is checked against the Act, the statutory guidance and the commencement position as of 22 September 2026.
Table of Contents
What Martyn’s Law is and why it exists
The Terrorism (Protection of Premises) Act 2025 is named for Martyn Hett, one of the twenty-two people killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for years for a simple principle: places where the public gather should have thought, in advance, about how they would protect people if the worst happened. That campaign, alongside the Manchester Arena Inquiry’s findings, led to Royal Assent on 3 April 2025. It deserves to be taken seriously — which also means describing accurately what it asks of a business, not using it to frighten anyone.
It is the first time counter-terrorism preparedness duties have been placed on ordinary public-facing premises — hence the attention, and the noise. The design is proportionate by intention: two tiers, the duty scaled to the venue, the smallest venues carrying no duty at all.
Are you even in scope? The capacity test explained
Scope is one number: how many individuals — customers and staff — it is reasonable to expect to be present at the same time. Not your fire capacity by default, not the maximum theoretical squeeze, not annual footfall. The guidance’s supplementary document covers assessing it — safe occupancy figures, attendance history or floor-area calculations, applied to how your venue actually trades.
Fewer than 200: out of scope. 200 to 799: standard tier. 800 and above: enhanced tier. In hospitality terms:
| Venue | Reasonable expectation | Position under the Act |
|---|---|---|
| A 60-cover café with four staff | Well under 200 | Out of scope — no duties |
| A neighbourhood pub, 120 at its peak | Under 200 | Out of scope — no duties |
| A pub with a function room, 250 across the premises on a big night | 200–799 | Standard tier — notification plus procedures |
| A town-centre restaurant and bar, 400 including staff | 200–799 | Standard tier — notification plus procedures |
| A hotel with banqueting space for 900 | 800+ | Enhanced tier — additional protective measures |
Two caveats. The number is what is reasonable to expect, so a function room that genuinely fills matters even if Tuesday does not. Edge cases — multi-use buildings, outdoor areas, ticketed events — belong to the guidance’s worked examples. Near the 200 line, work the number out properly and write down how.
What the standard tier actually requires
A standard-tier venue is asked for two things, both straight from the statutory guidance.
1. Notify the regulator. The Security Industry Authority (SIA) is the regulator, and responsible persons will need to notify it of their premises. The Government has already made the Notification Requirements Regulations 2026 setting out what that notification contains — essentially who you are, where the premises is and who is responsible. A registration, not an inspection.
2. Have public-protection procedures in place, so far as reasonably practicable. These reduce the risk of physical harm if an attack occurred at or near the premises, across four themes: evacuation (getting people out), invacuation (bringing people in and away from danger), lockdown (securing the building), and communication (how staff alert customers and each other). “Reasonably practicable” is the proportionality language operators already know from health and safety: what a venue of your size can sensibly do, balanced against cost and difficulty.
Notice what that describes: thinking, writing down, briefing staff. For most venues the raw material already exists in the fire evacuation plan — this extends it to a different emergency, including scenarios where the right answer is keeping people inside, not sending them out the front door.
What the standard tier does NOT require
This is where consultant noise does the most damage, so let’s be blunt. The Home Office describes the standard tier as simple, low-cost activities, met without buying equipment or hiring specialists. There is:
- ✗
No airport-style scanners or metal detectors. Screening belongs to the enhanced-tier conversation, and even there only where appropriate.
- ✗
No security guards or door staff. Your existing team, briefed on the procedures, is the workforce the tier is designed around.
- ✗
No bollards, barriers or physical hardening. The standard tier is about procedures, not alterations to the premises.
- ✗
No compliance package or accreditation to buy. There is no official Martyn’s Law certificate. The guidance is free on GOV.UK.
- ✗
Nothing to comply with today. Until commencement regulations arrive, there is no enforceable obligation on any venue — and no fine anyone can threaten you with.
The timeline: what’s law today, and what’s signalled for 2027
The verified position as of 22 September 2026 — worth being precise, because a two-month-old article here can mislead.
| Date | What happened | What it means for a venue |
|---|---|---|
| 3 April 2025 | The Act received Royal Assent | The framework became law; duties not switched on |
| 15 April 2026 | Home Office published the statutory guidance | You can read exactly how scope, tiers and duties will work |
| 15 June 2026 | Commencement No. 2 Regulations took effect | Regulator machinery only — the SIA’s duty to produce its own guidance; nothing commenced for venues |
| 9 July 2026 | Notification Requirements Regulations made | The future SIA notification is defined; it bites only when the notification duty commences |
| 2027 (signalled) | Expected commencement of the duties | At least 24 months’ implementation from Royal Assent means nothing before April 2027 — no date fixed in law yet |
Read the middle rows again — the part most coverage misses: commencement regulations have started to appear, and so far they switch on obligations for the regulator, not venues. The Commencement No. 2 Regulations require the SIA to produce guidance on how it will regulate, consulted on in mid-2026. The machine is being assembled in order — rules, regulator, then duties — and “2027” remains a consistently repeated signal, not a date on the statute book.
What is sensible during the run-in? Three free things. Work out your capacity number and note the method. If you are 200 or over, read the standard-tier chapters of the guidance — they are in plain English. And sketch the four procedures on a page: how we evacuate, where we bring people in, how we lock down, who tells whom. Commencement will come with formal notice and nothing left to panic about.
Where this meets the operations planning you already do
The reassuring structural point: hospitality already runs on headcount thinking. Licensed capacity, the fire risk assessment, the seating plan and the rota all start from “how many people are in this building at once”. Martyn’s Law borrows the same number for one more scenario — a venue that knows its capacity honestly for fire purposes has done the hardest part of the scope test.
The same goes for procedure culture. If your kitchen runs a proper food-safety management system — the discipline in our HACCP master guide — then “identify the risk, write the procedure, train the team, review it” is a muscle you already have. Four protection procedures are an afternoon with your duty managers, not a consultancy project.
It also belongs in the conversation when a venue changes shape. A new function room, a knock-through or a switch to standing bar format can move your number across the 200 line — as surely as it changes kitchen load, refrigeration capacity and service flow. We walk through that whole-premises thinking in our pub and bar equipment dealer’s guide and the companion restaurant equipment dealer’s guide. At the smaller end, a takeaway or fast-food operation will almost always sit comfortably out of scope — worth knowing before anyone sells you otherwise.
Refitting a site in 2026–27 anyway? Fold the headcount question into the plan — our guide to planning a commercial kitchen fit-out makes the same argument: numbers before spending. The equipment side is what we are for — the Swansea showroom is on 01792 732702 or [email protected], with a 2-year parts warranty. For Martyn’s Law itself, your authority is the guidance, not a supplier — ours included.
Martyn’s Law is on the statute book but its venue duties are not in force as of September 2026: statutory guidance arrived on 15 April 2026, the SIA’s regulator machinery was switched on in June 2026, and commencement is signalled for 2027 with no date yet fixed. Premises expecting fewer than 200 people at once — most small cafés, pubs and takeaways — are out of scope entirely. Standard-tier venues (200–799) will notify the SIA and hold reasonably practicable procedures for evacuation, invacuation, lockdown and communication. Scanners, guards and bollards are not standard-tier requirements. Know your capacity number, read the free guidance, and treat urgency-sellers with suspicion.
Frequently asked questions
Related posts and guides