Martyn's Law: your regulator is about to regulate your clients too

The Terrorism (Protection of Premises) Act 2025 — Martyn's Law — puts duties on premises and events above a capacity threshold, and makes the SIA its regulator. The SIA's own guidance says the Act is expected to come into force in spring 2027, with the exact date confirmed nearer the time.

That gives a security contractor roughly two quarters, and two separate reasons to use them.

The two tiers, and where the line falls

• –Standard tier: premises where it is reasonable to expect 200 to 799 individuals — staff included — to be present at the same time.
• –Enhanced tier: 800 or more, on the same counting basis. Qualifying events of 800 or more with controlled entry are treated the same way.
• –Childcare, primary, secondary and further education premises, and places of worship, stay in the standard tier even above 800. Higher education does not get that exception.

Staff counting towards the figure is the detail most people miss on a first read, and it is the one that moves borderline premises across the line.

What each tier actually has to do

The standard tier is lighter than most of the commentary suggests, and it is worth being precise about it when a client asks.

• –Standard tier: notify the SIA, and have procedures for evacuation, invacuation, lockdown and communication, so far as is reasonably practicable. There is no requirement to install physical measures.
• –Enhanced tier: all of that, plus measures to reduce vulnerability and the risk of harm — bag searches, CCTV, vehicle checks and the like — documented, assessed for how they reduce risk, and sent to the regulator.
• –Enhanced tier also requires a designated senior individual responsible for compliance.

A client being told they must buy equipment to satisfy the standard tier is being sold something. The honest answer is that the standard tier is a procedures-and-notification duty, and saying so is worth more to a long contract than the sale is.

The commercial opportunity, stated honestly

Procedures for evacuation, invacuation, lockdown and communication are not new to a security contractor. They are what assignment instructions have always contained, written for officers rather than for a regulator.

So the work in front of most contractors is translation rather than invention: taking procedures that already exist, making sure they cover all four of the named responses rather than the two most sites have thought about, and putting them in a form the responsible person can show somebody.

• –Check your assignment instructions name all four responses. Most cover evacuation and something about lockdown; invacuation — keeping people inside, away from an external threat — is routinely missing, and it is the one that conflicts with the fire drill.
• –Check who the responsible person is at each site. It is the client, not you, and a contractor who assumes otherwise has taken on a duty it cannot discharge.
• –Check your incident escalation route reaches that person, by name, out of hours.
• –Check your officers have been briefed on the procedures rather than issued with them.

And the other half: your regulator is watching a new thing

The SIA has regulated you through licensing and, voluntarily, through the ACS. From spring 2027 it also regulates the premises your officers work on, for a duty your officers deliver.

That does not transfer the client's duty to you. It does mean the quality of what you supply becomes visible to the same regulator that licenses you, which is a different kind of exposure from the one the industry is used to.

The SIA consulted on its regulatory guidance between April and June 2026 and said it would publish the final version with a consultation report in autumn 2026. That document, when it lands, is the one to read properly rather than summarise.