Martyn's Law lands in spring 2027. 24,300 premises have a document to write, and 154,600 more have procedures to prove.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The government committed to an implementation period of at least 24 months and expects the Act to come into force in spring 2027. No exact commencement date has been set.

That leaves seven or eight months. It sounds like enough. It is not, because the work the Act asks for is assessment work, and assessment work always takes longer than the people commissioning it think.

The two tiers, precisely

Section 2 sets the thresholds. Premises are in scope where it is reasonable to expect 200 or more individuals to be present at the same time from time to time. The enhanced tier begins at 800 or more. Standard tier is therefore 200 to 799.

Schedule 1 to the Act puts places of worship, childcare premises and primary, secondary and further education premises into the standard tier regardless of capacity. Higher education premises get no such treatment and can fall into the enhanced tier.

Every qualifying premises must, so far as is reasonably practicable, ensure appropriate public protection procedures are in place under section 5. Note the qualifier. It is on the face of the section, and it matters. Four types of procedure: evacuation, moving people to a place on the premises with less risk of harm, preventing people entering or leaving, and providing information to people present. In plain terms: get out, get in, lock down, tell people.

Enhanced tier premises must have all of that and must additionally put in place public protection measures under section 6, again so far as is reasonably practicable. Four categories: monitoring the premises and its immediate vicinity, controlling movement into, out of and within, physical safety and security, and security of information.

Here is the distinction most commentary gets wrong. Section 7 is headed "Enhanced duty premises and qualifying events: documenting compliance" and it binds enhanced tier premises and qualifying events only. It requires a document containing statements of the section 5 procedures and section 6 measures, plus an assessment of how each may be expected to reduce the risk in section 5(2) and the vulnerability and risk in section 6(2). A copy goes to the Security Industry Authority as soon as reasonably practicable after preparation, and before the end of 30 days beginning with the day of any revision. The Secretary of State can specify further required information by regulations.

Standard tier premises have no section 7 duty and send nothing to the SIA under it. They still have to have the procedures, and still have to be able to show they do. Both tiers do have to notify the SIA that they are in scope under section 9, with the timing to be set by regulations. That is what the notification portal is for.

Note also that the statutory word is document, not security plan.

The penalties are not symbolic

Section 18 sets maximum penalties at £10,000 for standard duty premises, and £5,000 for failing to comply with a notice to attend and answer questions. For enhanced duty premises and qualifying events it is the greater of £18 million or 5 per cent of qualifying worldwide revenue for the most recent complete accounting period, or £18 million where there is no completed accounting period. Section 19 allows daily penalties of up to £500 for standard duty premises and £50,000 for enhanced duty premises, where a compliance notice or restriction notice is contravened.

The regulator is the Security Industry Authority, expanding well beyond its Private Security Industry Act 2001 licensing and Approved Contractor Scheme remit. It consulted on its section 12 statutory guidance, covering how it proposes to exercise its functions including investigation and enforcement, between 15 April and 12 June 2026. It will invite volunteers to test its notification portal from early 2027, and has indicated that compliance assessment will combine desk based review and site inspection, typically with at least 72 hours notice.

The scale, and the cost per door

Those are Home Office bill stage estimates, and the range was wide. Almost all of the expected benefit, being reduced harm from terrorism and reduced public fear of it, was left unmonetised. But the shape is clear. The enhanced tier cost is not the cost of installing equipment. It is overwhelmingly the cost of assessing, deciding and documenting.

Where the documentation actually fails

Section 7 does not ask for a statement that you have an evacuation procedure. It asks for an assessment of how your procedures and measures may be expected to reduce the risk and vulnerability the Act identifies at those premises. And even in the standard tier, where no document is required, "so far as is reasonably practicable" is a test you may one day have to argue.

That is a spatial argument. It depends on the geometry of the site: where the entrances are, what a camera can and cannot see, how long it takes to move people from the atrium to the muster point, where the queue forms outside the door, what is on the other side of a wall.

Most organisations make that argument with a floor plan, a photograph and a narrative. A floor plan does not show sightlines. A photograph does not show what is behind the photographer.

A 3D capture, meaning a photorealistic and measurable three dimensional reconstruction of the site, lets you make the argument in the space itself. Plan camera placement and see the blind spots. Measure an evacuation route rather than estimate it. Brief a response team on a site they have never visited. And when you revise the document, the capture behind the previous version is still there, dated, so the change is evidenced rather than asserted.

Two adjacent obligations worth checking now

If you deploy connected devices, the product security regime under the Product Security and Telecommunications Infrastructure Act 2022 has been in force since 29 April 2024. Its three requirements cover passwords, a route for reporting security issues, and information on minimum security update periods. It binds manufacturers, importers and distributors, so it reaches further down a supply chain than people expect.

On surveillance, one misconception is worth correcting. The duty to have regard to the Surveillance Camera Code under the Protection of Freedoms Act 2012 applies to relevant authorities such as local authorities and police forces. It does not apply to private businesses, although the Secretary of State retains a power to specify further persons by order. Private sector surveillance is governed by UK GDPR and the Data Protection Act 2018, regulated by the Information Commissioner's Office.

What does apply to you: a data protection impact assessment is mandatory under Article 35(3) for systematic monitoring of a publicly accessible area on a large scale. If you are capturing spatial data of a site where the public are present, plan the DPIA at the start rather than retrofitting it.

What to do with the months you have

Establish which premises cross 200 and which cross 800. Decide who the responsible person is for each. Then build the evidence base, because the section 7 document is the easy part once the underlying assessment is real, and the standard tier still has to be able to justify what it judged reasonably practicable.

If your sites are complex and your current record of them is a set of drawings and a folder of photographs, that is the gap to close first. Our earlier pieces on the Martyn's Law paperwork and planning camera coverage in 3D cover the practical side.

This article is general information about UK regulation and is not legal advice. Responsible persons should take their own advice on their obligations under the Terrorism (Protection of Premises) Act 2025.