Martyn's Law: SIA sets out scope tool, templates and portal

What the September update covers

The SIA's Executive Director for Martyn's Law, Laura Gibb, published a September 2026 update on 11 September covering scope, template resources and the notification portal. The update is aimed at the businesses and organisations that will have duties under the regime, from pubs and shops to venues, village halls and event organisers. It sets out where the regulator has got to on the practical questions those organisations are asking: whether they are in scope, what paperwork they may want to use, and how they will eventually notify the SIA. Martyn's Law is the Terrorism (Protection of Premises) Act 2025, named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack. The SIA expects the Act to come into force in spring 2027.

The timing matters for planning. Commencement is the point at which duties begin, and the SIA is using the period before then to build and test the tools that will support them. The September update therefore reads as a progress report rather than a set of new legal duties. It confirms that work is under way on a scope-checking tool, on optional templates for documenting procedures and measures, and on the notification portal that will be accessed through GOV.UK. It also confirms that pilot assessments and inspections are continuing, with a second round beginning in autumn 2026. For organisations that will be in scope, the update is a signal to start preparing the basics now rather than waiting for commencement.

Am I in scope? The 200 and 800 thresholds

Under the Act the standard tier applies to qualifying premises where 200 or more individuals may reasonably be expected to be present at the same time. The enhanced tier applies from 800 or more, and to qualifying events of 800 or more. Those two numbers are the starting point for any organisation trying to work out whether it has duties. The test is not simply the capacity of a building or the number of people who might theoretically fit inside it. It is whether 200 or more individuals may reasonably be expected to be present at the same time, which means the realistic pattern of use matters as much as the floor plan. A venue that only ever holds small meetings may sit below the threshold even if the room could physically hold more.

The first step for any business is to check scope. Protect UK publishes flowcharts that walk through the questions, and the Home Office Section 27 statutory guidance includes case studies that show how the thresholds apply in practice. The SIA is also building an online scope-checking tool, which is due to be available in the new year, and is seeking volunteers to test it. Until that tool is live, the flowcharts and the Section 27 guidance are the available reference points. Organisations that are unsure should work through the flowcharts with their realistic occupancy figures in hand, rather than relying on a rough sense of whether they are a large or small premises.

Templates and pilot inspections

The SIA is developing optional templates to document procedures and measures, one for standard tier premises and one for enhanced tier premises and events. The word optional is important. There is no requirement to use them. They are being tested with protective security partners and volunteers, and they are intended to give organisations a starting point for recording what they have done. For a small venue with limited administrative capacity, a template can reduce the effort of deciding what to write down and how to structure it. For a larger organisation with existing systems, the templates may be less useful, and the SIA is not requiring them to be adopted.

A first round of pilot assessments and inspections has been completed, and a second round begins in autumn 2026. The SIA says inspectors will gather information without interfering with activity on the premises. That approach reflects the practical reality that inspections will take place in working pubs, shops, halls and venues where normal business continues. For organisations that may be selected for a pilot, the exercise is a chance to see how the process works before commencement. For everyone else, the pilots are a signal about the style of oversight to expect: information gathering on site, carried out alongside the ordinary use of the premises rather than in place of it.

Multi-use buildings and principal use

Where a single premises has more than one use, such as a hall hired for activities that also runs a cafe, responsibility sits with whoever controls the premises for its principal use. The Home Office has published guidance on determining principal use. This matters because multi-use buildings are common in the community and hospitality sectors, and the question of who holds the duty is not always obvious. A village hall that hosts a cafe, a sports club with a bar, or a community centre with a hired-out room may all fall into this category. The answer is not simply whoever is on site at a given moment, but whoever controls the premises for its principal use.

The SIA's position also draws a line around sites made up of separate premises with different uses. The principal use rule does not apply to those. That distinction matters for organisations that operate across more than one building or unit, where the question is whether the site is one premises with multiple uses or several premises each with their own use. The Home Office guidance is the reference point for working through that question. For organisations in this position, identifying the principal use and the person who controls the premises for that use is a necessary step before deciding what, if anything, needs to be documented.

How notification will work

The notification portal will be accessed through GOV.UK and is being designed for everything from a single small venue to large multi-site portfolios. That range is deliberate. The regime covers organisations of very different sizes, and the portal needs to work for a pub with one premises as well as a national operator with dozens of sites. The SIA needs more volunteers to test it, which suggests the design is still being refined and that feedback from real users is being sought before commencement. For organisations that will need to notify, the portal is the route through which that will happen, and it will sit on GOV.UK alongside other government services.

Martyn's Law enquiries go to MLR@sia.gov.uk. That address is the contact point for organisations with questions about the regime, including questions about scope, templates and notification. The SIA has not yet set out a full timetable for when notification will open, beyond the expectation that the Act comes into force in spring 2027. In the meantime, the September update confirms that the portal is being built and tested, and that volunteers are being sought to try it. Organisations that want to be ready should keep an eye on the SIA's communications and on GOV.UK for the point at which notification becomes available.

Related coverage on Kael Tripton: B&M Fined £2 Million for Food Hygiene Failings: What Business Insurance Would and Would Not Cover, AXA Business Insurance Review UK: SME Cover, Costs and FCA Regulation, Buying or selling a small business in the UK: tax, TUPE, insurance and the due diligence checklist, Mobile Card Readers for Small Businesses: Cost, Connectivity and Limits, World Cup 2026 Free to Air UK: Ofcom Listed Events Explained.

Frequently asked questions

When does Martyn's Law come into force?

The SIA expects the Terrorism (Protection of Premises) Act 2025 to come into force in spring 2027. Nothing is required until commencement.

What are the thresholds for the standard and enhanced tiers?

The standard tier applies to qualifying premises where 200 or more individuals may reasonably be expected to be present at the same time. The enhanced tier applies from 800 or more, and to qualifying events of 800 or more.

How can a business check whether it is in scope?

Protect UK publishes flowcharts and the Home Office Section 27 statutory guidance includes case studies. The SIA is building an online scope-checking tool, due in the new year, and is seeking volunteers to test it.

Are the SIA templates compulsory?

No. The SIA is developing optional templates to document procedures and measures, one for standard tier premises and one for enhanced tier premises and events. There is no requirement to use them.

Who is responsible in a multi-use building such as a hall that also runs a cafe?

Responsibility sits with whoever controls the premises for its principal use. The Home Office has published guidance on determining principal use. This does not apply to sites made up of separate premises with different uses.