Do you need a Martyn's Law risk assessment?
Last reviewed:
If you run a standard-tier venue (200–799 people), no: Martyn's Law does not require you to carry out or hold a terrorism risk assessment. The duty at that tier is to have public protection procedures in place, not to produce an assessment document. Enhanced-tier premises (800+) do have an assessment-type obligation, but it's called a vulnerability assessment and works differently from a conventional risk assessment. Here's the accurate version, tier by tier.
Where the confusion comes from
Three things feed this misconception. First, habit: most venues already hold a fire risk assessment, so it's natural to assume a similar terrorism document is required. It isn't. Second, marketing: some consultants sell "Martyn's Law risk assessment" templates and services to standard-tier venues that have no such duty, because a document is easier to sell than the truth that most small venues need is a clear, workable procedure, not a report. Third, the Protect Duty, an earlier, non-statutory version of this policy that did talk more loosely about risk assessment before the Act was passed in its current form. If you've seen the two conflated: they are not the same thing, and only the Act carries legal duties.
What standard tier requires instead
The standard-tier duty is to have appropriate public protection procedures (evacuation, invacuation, lockdown and communication) in place, so far as reasonably practicable. That's an operational duty, not a documentation duty: there's no legal requirement to write anything down, let alone produce a formal risk assessment. See the standard tier explained for the two duties in full, and the four procedures explained for what good ones actually look like.
Thinking through risk is still sensible, even without a duty
Not having a legal duty to assess risk doesn't mean ignoring it is a good idea. Working out your procedures properly means thinking through, in plain terms, what could go wrong and where: which doors would you actually use, where would people naturally gather, what's your blind spot. The guidance's own worked examples for procedures effectively walk through this kind of thinking. Do it because it makes your procedures better, not because a form requires it.
The enhanced tier's actual position
Enhanced-tier premises (800+) do have a real obligation in this space: a vulnerability assessment, covering how vulnerable the premises is, including to different methods of attack, which then informs the public protection measures the premises puts in place. That's a genuinely different, heavier duty than anything at the standard tier, and it comes with a requirement to document the reasoning and keep it under review. See the enhanced tier explained for the full picture.
Your fire risk assessment is a separate document
Fire risk assessments and Martyn's Law procedures address different hazards and can call for different responses. Evacuating toward a fire exit that happens to be the obvious, well-signed route is exactly right for a fire; during a terrorism incident, the obvious route might be the wrong one, or the right response might be to invacuate rather than evacuate at all. Keep your fire risk assessment as it is, and build your Martyn's Law procedures alongside it, not as a rewrite of it.
What to do instead of a risk assessment
- Confirm your tier with the free checker. This determines which duties actually apply to you.
- If you're standard tier, work through the four procedures for your specific building, rather than looking for an assessment template that doesn't exist for you.
- Write your procedures down using a free template, even though it isn't mandatory, so you can brief staff consistently and show an inspector something concrete.
Common questions
Is there a Martyn's Law risk assessment template for standard-tier venues?
No, and we won't offer to sell you one. Standard-tier premises have no risk assessment duty under the Act, so a document with that name would be inventing a requirement that doesn't exist. What you may want instead is a procedures document. See our free template, which covers what standard tier actually asks for.
Who can carry out a Martyn's Law assessment?
There's no accredited-assessor requirement in the Act, unlike some fire safety roles. At the standard tier there's no assessment duty to carry out in the first place. At the enhanced tier, the vulnerability assessment sits with the responsible person, who can involve whoever they judge competent, including staff, but the responsibility itself can't be delegated away.
Does my existing fire risk assessment cover Martyn's Law?
No. They're separate regimes assessing different things. Your fire risk assessment and fire evacuation plan get people away from a fire; a terrorism evacuation can mean moving people away from the danger, which might be a different direction, a different exit, or staying put rather than gathering in an obvious assembly point. Keep both, and don't assume one satisfies the other.
About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: . Read the official guidance on GOV.UK.
Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.