Prepare your venue for Martyn's Law

The duty applies to premises that consist of at least one building, are open to the public, and where 200 or more people may reasonably be expected to be present at the same time at some point. It also applies to certain qualifying public events. Work out the maximum number of people who could reasonably be present on your premises at once - not your average footfall, and not a worst-case one-off surge, but a realistic estimate of the crowd your venue could hold on a normal busy occasion.

If your maximum reasonably expected capacity is under 200, the duty does not apply to you yet. Re-check this if you expand, reconfigure, or change how the premises is used, since a change in capacity can bring you into scope later.

Martyn's Law has two tiers based on the maximum number of people reasonably expected to be present:

Standard tier covers premises where between 200 and 799 people may be present. This tier is built around simple, low-cost procedures rather than physical works or major expenditure.

Enhanced tier covers premises and qualifying events where 800 or more people may be present. Enhanced tier adds a documented security plan, a named senior individual accountable for compliance, and additional measures to reduce the venue's vulnerability to an attack, on top of everything standard tier requires.

If you're in the 200-799 capacity band, you have two duties. First, notify the SIA that your premises is a qualifying premises, through the online notification system the SIA is building - this is free. Second, put public protection procedures in place covering evacuation, invacuation, lockdown, and communication, and make sure your staff know them:

Evacuation - how to get people out of the building safely. Invacuation - moving people into safe internal areas rather than out of the building, where that's the safer response. Lockdown - how you'd quickly secure doors, windows, and access points. Communication - how you'd tell people on the premises what to do and keep them informed as a situation develops.

These procedures need to make sense for your specific building and how you use it - a generic downloaded template that doesn't reflect your actual layout and exits won't hold up if the SIA inspects you.

At 800 or more people, you take on everything standard tier requires, plus more. You must consider your premises' vulnerability to an act of terrorism and, where appropriate, put in place public protection measures across four areas: monitoring the premises, managing the movement of people, physical safety and security of the site, and security of information. You must designate a senior individual with real authority to make sure procedures and measures are implemented and kept under review - this is a named accountability point, not a box-ticking title. You must also prepare a compliance document recording your procedures and measures, and provide it to the SIA on request.

Martyn's Law places duties on the "responsible person" for the premises - generally whoever has control of the premises in connection with their trade, business, or other undertaking. For a single-site business this is usually straightforward. If you lease part of a larger building, or share responsibility for common areas with a landlord or other occupiers, work out early who is responsible for what, since gaps in that coverage are exactly what an SIA inspection will test for.

You don't need to wait for commencement to start. Useful groundwork now: draft your evacuation, invacuation, lockdown, and communication procedures and test them with staff; identify who your responsible person (and, if enhanced tier, senior individual) will be; check your public liability and business interruption cover reflects the risk; and build basic staff awareness so day-one compliance isn't a scramble. None of this needs to wait for the SIA's online notification system to go live.