The paperwork behind Martyn's Law is starting to land. On 14 July the Home Office published guidance on the section 9 notification requirement under the Terrorism (Protection of Premises) Act 2025, alongside an economic note. Factsheets followed on 24 July. Both sit on top of the statutory guidance published on 18 May.
The notification guidance is the practical part. It explains how a responsible person notifies the Security Industry Authority, when they must do it, and what information the notification has to carry. This is the first concrete obligation in the regime, and it now has a defined process rather than a promise of one.
The Act is not in force. Government has committed to an implementation period of at least 24 months from Royal Assent, which was 3 April 2025, so the duties bite no earlier than April 2027. The SIA is the regulator and is standing up the function that will support, advise and inspect.
The tiers are unchanged. The standard tier covers qualifying premises where 200 to 799 people may be present at once. The enhanced tier covers premises and events expecting 800 or more. Standard tier holders must notify the SIA and put reasonable public protection procedures in place, with no physical security measures mandated at that level. Enhanced tier holders add measures to reduce the site's vulnerability to an attack, documented and provided to the regulator. The test throughout is what is reasonable and practicable for the premises.
For anyone running venues or events in scope, the work to do now is not compliance, it is readiness. Confirm which tier a site sits in, name the responsible person, and understand the notification route while there is still time to design for it rather than react to it.
