https://www.noxia.co.uk/field-notes/two-hundred-people-and-a-duty · printed from noxia.co.uk · sources checked 24 September 2026
Field note · Security
Two hundred people is where a new duty starts.
Most scope rules are arguable. This one is a number of people, which makes it unusually easy to answer and unusually easy to get wrong — because the figure is the number reasonably expected to be present, not the number on a fire certificate.
- Security
- Martyn’s Law
- Premises
- Compliance
The short answer
The Terrorism (Protection of Premises) Act 2025 creates two tiers by expected capacity. Standard tier is 200 to 799 individuals: notify the Security Industry Authority and put appropriate public protection procedures in place, with no physical security measures required. Enhanced tier is 800 and above: document the procedures, submit them, and take appropriate measures where reasonably practicable. Royal Assent was April 2025, with at least 24 months before the duties take effect.
On this page · 6 sections
The thing to settle first is not what you must do. It is which side of two hundred you are on, and that is a question about a normal busy day rather than about a certificate.
Why the standard tier is lighter than people fear
The commonest assumption is that this means barriers, bag searches and security staff. At standard tier it does not. The duty is to notify the regulator and to have appropriate public protection procedures — what people do, where they go, how they are told — and the Act does not require physical security measures at that level.
That is a training and documentation duty rather than a capital one, which is a very different budget conversation from the one most standard-tier premises are expecting to have.
The enhanced tier is a different object
At 800 and above, the procedures have to be written down and submitted, and appropriate measures taken where reasonably practicable. "Reasonably practicable" is doing real work in that sentence — it imports a proportionality test that will be argued about, and the written submission means the regulator holds your account of your own arrangements.
What to do while there is time
- Do the capacity assessment and write it down. If you are under 200, the document that says so and explains the basis is the whole compliance position, and it costs an hour.
- Check whether it varies. A venue at 150 on a Tuesday and 400 for an event is in scope for the event. The assessment has to cover the busy case.
- Write the procedures before the deadline rather than at it. At standard tier this is a short document about what staff do, and it is the kind of thing that is genuinely better for having been thought about slowly.
What this does not tell you
It does not give you a commencement date, because there is not one yet. Royal Assent was April 2025, the government promised at least 24 months, and the SIA's guidance, published in July, says "It is expected that the Act will come into force in spring 2027". Expected is not a date, and anybody quoting you a day is inferring.
It also does not tell you how the SIA will regulate, because it has not yet. A regulator's first year sets expectations that guidance does not, which is the pattern in the CMA's first year of direct enforcement — letters first, investigations after.
And it is not legal advice on a specific premises. What we would say generally is that the scope question here is answerable in an afternoon, which is rare, and that the answer is worth writing down whichever way it goes — the same discipline as the Online Safety Act's scope test and the five Cyber Essentials controls. Knowing what you actually run is the common prerequisite, which is where the cleanup work starts.
Questions people actually ask
What capacity triggers Martyn’s Law?
Standard tier applies where 200 to 799 individuals are reasonably expected to be present, and enhanced tier at 800 and above. The figure is an expectation for a normal busy day rather than a maximum from a fire certificate.
What must standard tier premises actually do?
Notify the Security Industry Authority of the premises and implement appropriate public protection procedures reasonably expected to reduce harm. No physical security measures are mandated at standard tier, which makes it a training and documentation duty rather than a capital one.
When does Martyn’s Law come into force?
The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025, with at least 24 months promised before the requirements take effect. The Security Industry Authority’s guidance says it is expected to come into force in spring 2027, and the SIA will invite volunteers to test its notification portal from early 2027. No precise date has been set.
Who regulates Martyn’s Law?
The Security Industry Authority. Standard tier premises notify it; enhanced tier premises additionally submit documentation of their procedures and measures.
Sources
- ProtectUK (Counter Terrorism Policing), “Martyn’s Law overview and what you need to know”, read 23 September 2026: standard tier 200–799 individuals, enhanced tier 800 and above; standard tier duties are to “notify the regulator, the Security Industry Authority (SIA), of their premises” and implement “appropriate public protection procedures”, with no physical security measures mandated; enhanced tier adds documenting and submitting procedures and implementing “appropriate measures” where “reasonably practicable”; Royal Assent April 2025 with the government intending “at least 24 months following Royal Assent” before requirements take effect; the SIA is the regulator. protectuk.police.uk ↗ — primary for practical purposes; the official counter-terrorism policing guidance portal. The Act itself is the ultimate source re-checked every 6 months
- Security Industry Authority, “Understanding Martyn’s Law and the SIA’s role as regulator”, published 17 July 2026 and updated 14 September 2026: “It is expected that the Act will come into force in spring 2027”; “From early 2027, we’ll be inviting volunteers to help us test the portal before we launch it.” No commencement date had been set when we read it on 24 September 2026. gov.uk ↗ — primary; the regulator’s own guidance. An expectation, not a commencement order re-checked every 30 days
- The observation that standard tier is a training duty rather than a capital one, and the three things to do, are ours. This is not legal advice on a specific premises. — our own argument, labelled as such
Checked 24 September 2026. Next scheduled check 24 October 2026. Numbers that move — leaderboards, live indices — are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
Cite this note
Noxia, “Two hundred people is where a new duty starts”, Field notes, 23 September 2026; sources checked 24 September 2026. https://www.noxia.co.uk/field-notes/two-hundred-people-and-a-duty
If you are under two hundred, the document saying so is the whole job.
Scope questions that can be answered in an afternoon are rare and worth answering properly, whichever way they go. We write the assessment, the basis for the number, and the procedures if you need them — and we tell you when the honest answer is that you are out of scope and should stop reading.
Talk to us about thisRead next
Security
The Online Safety Act applies to all sizes. Including yours.
The duties apply to regulated user-to-user and search services regardless of size. The categories with extra duties start at 3 million UK users; the base duties do not.
Security
£320 buys five controls, and £25,000 of cover if you tick the box.
Five controls, £320 plus VAT to certify, and £25,000 of cyber liability cover for organisations under £20m turnover that opt in when they apply. It is the cheapest security decision a small firm makes.
What we found
The CMA fined £4.7m in its first year of deciding for itself.
14 investigations, 2 settlements, £4.7 million in fines, £760,000 refunded and 157 advisory letters. The largest single fine was £4.2 million over a price that appeared later.