Martyn’s Law Tiers: Standard vs Enhanced Explained

Martyn's Law sorts premises into two tiers, and your tier sets the size of your obligations. The short answer: if you can reasonably expect between 200 and 799 people on your premises at the same time, you fall in the standard tier. At 800 or more, the Home Office factsheet confirms you are an enhanced duty premises unless the Act says otherwise.

Standard-tier premises focus on making sure people on site know what to do in an attack. Enhanced-tier premises add physical protection measures, formal documentation and a named senior individual. This article explains each tier, shows how to place yourself and covers the situations where the answer is less obvious. For the full overview of the law, see our Martyn's Law guide.

The Two Tiers at a Glance

Here is how the tiers compare on the five points that matter most:

• Thresholds - The standard tier covers premises where 200 to 799 people can reasonably be expected at once. The enhanced tier begins at 800.
• Duties - Standard-tier premises notify the Security Industry Authority (SIA) and put reasonably practicable public protection procedures in place. Enhanced-tier premises do the same and also put public protection measures in place.
• Documentation - Enhanced-tier premises must document their procedures and measures and provide a copy to the SIA. The standard tier has no equivalent requirement.
• Senior individual - Where an organisation is responsible for enhanced-tier premises, it names a senior individual who answers for compliance. The standard tier requires no such appointment.
• Maximum penalties - The standard tier carries a fine of up to £10,000. The enhanced tier carries a fine of up to £18m or 5% of worldwide revenue, whichever is higher.

In short, the standard tier is a preparedness duty. The enhanced tier adds physical measures, evidence, and senior-management accountability.

How Your Tier Is Decided

Count the People You Reasonably Expect at Once, Staff Included

Your tier depends on how many people you can reasonably expect to be on the premises at the same time. Visitors, customers, students, contractors and delivery drivers all count, and so do the people who work there. The Home Office publishes a factsheet on assessing the number of individuals expected to be present that sets out the approach in detail.

Fire safety capacity answers a different question and has no bearing on your tier. A building certified for 1,000 that never sees more than 600 sits in the standard tier.

Busy Periods Count, and Averages Do Not

Plan around the realistic peak. A venue that averages 500 people but regularly reaches 850 on event nights, exam days or seasonal weekends should assess itself against the 850 figure.

Occasional extremes beyond reasonable expectation need not drive the number, though a pattern that recurs belongs in your assessment.

What the Standard Tier Asks of You

Standard-tier duties come down to two things. First, you notify the SIA about your premises. Second, you put public protection procedures in place, applied "so far as reasonably practicable." That phrase ties the effort to your size, layout, resources and the risks you face, so a small venue with limited staff is judged differently from a large site with a dedicated security team.

The Home Office describes these requirements as simple and low-cost activities where the cost is mainly staff time. The procedures cover four areas:

1. Evacuation - moving people out of the premises and away from danger.
2. Invacuation - moving people to a safer place inside the building when leaving would put them at greater risk.
3. Lockdown - restricting access and movement to keep an attacker out or contain a threat.
4. Communication - alerting staff and the public and giving clear instructions as events unfold.

Your staff know what to do, who makes the call and how everyone gets told. For many premises that means a short written procedure, a briefing for new and existing staff, and a periodic practice run.

The procedures are written for people working at the premises to follow if there is reason to suspect an attack is occurring or about to occur, either on site or in the immediate vicinity. A well-understood plan of modest length meets that expectation.

What the Enhanced Tier Adds

Enhanced-tier premises carry the standard duties and a further set of obligations on top:

• Public protection measures - These are reasonably practicable measures that reduce the premises' vulnerability to an attack and the risk of physical harm to individuals. Examples include monitoring the premises, managing the movement of people through and around the site, and protecting sensitive information about your security arrangements.
• Documentation - You prepare and keep up to date a document recording your procedures and measures, along with an explanation of how they reduce vulnerability and risk. A copy goes to the SIA.
• A named senior individual - Where an organisation is responsible, a person at senior level holds responsibility for making sure the body meets the Act's requirements.

You need physical measures and a paper trail. Measures can include how you handle deliveries and post. A logged receiving point, a clear route for escalating suspicious items, and some control over who reaches storage areas all help show that you manage movement and monitor what enters.

The Act does not prescribe a mailroom system, so any approach you take should suit your site and be justifiable as reasonable.

Edge Cases That Catch People Out

1. Some settings remain standard tier above 800. Schools, further education colleges, childcare settings and places of worship stay in the standard tier even when they can reasonably expect 800 or more people. The explanatory notes to the Act give places of worship as an example of this Schedule 1 treatment.
2. Events can sit in a different tier from the venue. An event expected to draw 800 or more people can be a qualifying event even when the building that hosts it is standard tier. The Home Office gives the example of a pub that hosts a one-off event with over 800 attendees. Organisers and venues should agree early who holds which duty.
3. Buildings with several uses need assessing by part. A site combining a lecture hall, a sports centre and a café may contain more than one qualifying premises. Work out each part's likely numbers and record how you divided the building.
4. Numbers near the line deserve a margin. A premises that reaches 750 on a busy day is standard today and could reach 800 after growth, refurbishment or a change in how the space is used. Keep notes on how you reached your figure, and revisit them when anything about the site changes.

Worked Examples

A university lecture theatre. A large theatre can hold 800 or more students and staff during induction week, exam sittings, or open days, likely placing it in the enhanced tier on those peak days. Assess the busiest realistic scenario for each large space, and record the reasoning.

A student accommodation block with a gym and café. Residents alone may fall under the 200 mark, so the amenities deserve a close look. If the gym and café admit members of the public or residents of neighbouring buildings, the number of people on site at once can climb.

Check who can enter and at what times. Consider also how the constant flow of parcels and deliveries is received and escalated.

An office with a ground-floor café. Offices are often out of scope. Premises with 199 or fewer people expected at any one time, or whose use is not listed in Schedule 1, do not need to comply.

The picture changes when the café is open to the public and can reasonably hold 200 people or more, because that part of the building may then count as qualifying premises in its own right. Review the café's peak footfall separately from the office.

What's at Stake: Penalties by Tier

For the standard tier, the SIA can issue a penalty notice of up to £10,000, plus daily penalties of up to £500 for continued non-compliance. For the enhanced tier, the maximum is £18m or 5% of worldwide revenue, whichever is greater, plus daily penalties of up to £50,000.

The SIA has a graded toolkit that runs from compliance and restriction notices through to financial penalties. It has also said it intends to take a "support first" approach, focusing on guidance before formal enforcement. Commentators currently expect the duties to start no earlier than spring 2027, and notification deadlines will run from the day the duty starts.

Not Sure Which Tier You're In?

If your numbers sit near a threshold, your site has several uses or you host events, a structured walk-through helps. Our readiness assessment asks a short series of questions about your premises, then gives you a likely tier and a list of next steps.

FAQs

Can you move between tiers?
Yes. Your tier follows the number of people you can reasonably expect at once, so growth, refurbishment, a new use or a change in event programming can move you up or down. Review your assessment whenever circumstances change and at regular intervals.

Who decides your tier, you or the SIA?
You make the first assessment as the person responsible for the premises and notify the SIA accordingly. The SIA is the appointed regulator and can question your reasoning and take enforcement action if it disagrees, so keep a record of how you reached your figure.

Does the enhanced tier mean buying security equipment?
Not automatically. Measures must be reasonably practicable for your premises and the risks you face. For many sites this means adjustments to layout, staffing, procedures and training, with equipment added only where the assessment points to a need.

Do staff count towards the numbers?
Yes. Employees, contractors and volunteers are all people you can reasonably expect on the premises, so they belong in your headcount alongside visitors.

Disclaimer: This article offers general information and does not constitute legal advice. Obtain advice on your own circumstances before making compliance decisions.