Martyn's Law for hotels and B&Bs

Last reviewed: 23 July 2026

If you run a hotel or B&B, Martyn's Law may well apply to you, though most small guesthouses can relax on this one. This guide walks through what the law expects of a property like yours, who's responsible for meeting it, and the one counting quirk that catches hotels out: sleeping guests count too.

How the tiers break down for a hotel or B&B

Before working out where your premises fits, it helps to understand how the law categorises premises and what those categories demand. Martyn's Law places public premises into two main tiers based strictly on maximum expected headcount, including overnight guests, staff and anyone using restaurant, bar or function space.

Standard tier (200–799 people)

• What it means: focuses on simple, low-cost preparedness.
• Key requirement: you must notify the regulator and maintain basic procedures for four emergency responses (evacuation, invacuation, lockdown and communication).
• Implications: no mandatory paid training, expensive security upgrades, or heavy documentation are required.

Enhanced tier (800+ people)

• What it means: asks more of high-capacity premises, because of the larger potential impact of an incident.
• Key requirement: includes all standard tier duties, plus formal requirements like a documented vulnerability assessment, a designated senior responsible individual, and measures designed to reduce the premises' vulnerability.

Very few hotels reach this tier on room numbers alone. Where it comes up is a large annual conference or ticketed event, more a question for events and festivals than this guide.

How to tell if your hotel needs a plan for Martyn's Law

Hotels and similar accommodation fall under the Act's "hotels etc" category.

Your tier depends on the headcount you can reasonably expect at once, including predictable spikes like a wedding season or an annual conference, defined in the guidance as occurring "from time to time." That number must include overnight guests, staff on shift, and anyone using the restaurant, bar or function rooms who isn't staying the night.

Below are some examples to help illustrate this:

• Hotel A (out of scope). A small B&B with a handful of bedrooms, guests, staff and a breakfast sitting all together, comes nowhere near 200 even on its busiest morning.
• Hotel B (standard tier, function days). A 40-room hotel with roughly 80 guests, 20 staff and a 60-cover restaurant comes to 160 on a normal night, out of scope. The same hotel running a 150-seat wedding in its function barn adds substantially to that total, reaching around 230 on wedding days. If bookings at that scale happen with any regularity, that recurrence is what brings the hotel into scope.
• Hotel C (overnight numbers). A fully booked 90-room hotel has 180 guests asleep by midnight, plus 15 night staff, comes to 195. Every sleeping guest counts as reasonably present, but the hotel still stays just under 200 overnight. It's usually daytime conference and wedding bookings, not overnight guest numbers alone, that tip a mid-sized hotel over the threshold.

To double check whether your hotel comes under the scope of Martyn's Law, use our free checker.

Who is the "responsible person"?

Someone has to be legally on the hook for getting this done. The law calls that person the responsible person. Where a hotel has more than one use under the same roof, a restaurant and conference centre alongside the rooms, the guidance's approach is to identify the principal use and locate control there: its own example is a hotel with an attached restaurant and conference centre, where the hotel operator, as the party controlling the premises for its principal use, is the responsible person.

For an independently owned hotel, that's usually the owner-operator. For a franchised or managed hotel, check your franchise or management agreement, since it should say plainly who holds day-to-day control.

See who the responsible person is for the full test.

What you must do (standard tier)

If you're in the standard tier, compliance requires two primary actions:

1. Register your hotel with the Security Industry Authority (SIA), the law's regulator.
   • This is a simple registration, not an application process.
   • There's no fee and no approval process to wait for. The SIA portal isn't open yet, so no action is required until it launches.
2. Prepare four core emergency procedures. You must establish basic, practical procedures for four scenarios:
   • Evacuation. Getting people out of the building safely.
   • Invacuation. Moving people to safe spaces inside the building.
   • Lockdown. Securing doors to keep an external threat out.
   • Communication. Quickly telling guests and staff what to do.

Hotel challenge: overnight guests asleep in their rooms are a wrinkle most other venues don't have. Communication is usually the procedure that matters most here, since it has to reach people who aren't in a public space and may not hear a ground-floor announcement. Night porters and overnight reception staff often carry outsized responsibility during quiet hours, simply because they're the ones on site, which is worth reflecting explicitly in your plan rather than assuming daytime staffing levels apply around the clock.

What you do not have to do (standard tier)

A lot of the worry around Martyn's Law comes from assuming it means security staff, an expensive consultant, or mandatory training courses for your team. None of that is required at the standard tier.

• You do not need a written plan by law, though the guidance recommends one, since it's hard to demonstrate compliance without it (para 7.32). See what para 7.32 actually says.
• You do not need to hire security staff or install CCTV.
• You do not need paid or accredited training; using a third-party product or service is never mandatory (para 6.7).
• You do not need a fixed review schedule; periodic review is good practice, not a legal requirement.
• You do not need a risk assessment document or a designated senior individual at the standard tier. Those apply only at the enhanced tier.

How to get Martyn's Law ready in minutes

If you're in scope for the standard tier, every duty above can be worked out and written down by hand, for free. It's perfectly possible, and we'd rather tell you that straight than fear-monger you into hiring a consultant or buying a tool you don't need.

The part that takes real thought for a hotel is the overnight scenario and the swing between a quiet weeknight and a full wedding day, two genuinely different staffing pictures that both need a plan.

That's what Martyn's Law Plan was built to solve. It guides you through building both into your plan: a baseline procedure for normal operation, and a separate function-day version for when your numbers and staffing genuinely change. Above all, it gives you peace of mind that you're prepared for when an inspection comes.

For now, start with the free tier checker, no email required, to confirm where you stand.

Similar venues: restaurants and cafés and golf and sports clubs.

Common questions

Is a B&B in scope?

Almost never. A typical bed and breakfast or small guesthouse, a handful of rooms, a family running it, comes nowhere near 200 people at once even counting every guest, staff member and breakfast sitting together. Scope becomes a live question only once a site has meaningful capacity: a larger hotel, or any premises with function or event space attached.

Do sleeping guests count toward the 200?

Yes. The test is everyone who could reasonably be present at the same time, and guests asleep in their rooms overnight are present, even though they're not visibly moving around the building. This matters for your communication procedure especially: reaching people who are asleep, rather than in a public area, is a genuinely different problem worth planning for.

Weddings push us over 200. Are we always in scope, or just on wedding days?

If wedding or function bookings that push you over 200 happen with some regularity, even a handful of times a year, the guidance treats that as reasonably expecting 200+ "from time to time", which brings the whole premises into scope, not just those specific dates. A single, one-off booking that's unlikely to repeat is a different question.

About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: 23 July 2026. Read the official guidance on GOV.UK.

Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.