You've had an SIA inspection notice. Here's your 72-hour plan to be Martyn's Law ready.
Last reviewed:
So, you've had 72 hours' notice that you're going to be checked against Martyn's Law. It can feel like an intimidating letter to open, and the same questions tend to arrive at once. Why my venue? Am I compliant? What do I need to get ready?
Here's the useful part. At the standard tier, the check has a narrow focus. An inspector is looking for three things:
What the inspector is checking
You know who your responsible person is.
You've counted your capacity properly.
You've mapped your four procedures, and your staff know them.
This guide explains the process and walks you through how to use your 72 hours to get everything in line.
One point before we start. If you're reading this before spring 2027, inspections haven't begun yet. This guide sets out the process the statutory guidance describes, and the plan to run once it starts. See when Martyn's Law comes into force.
Why has your venue been given 72 hours to get ready?
Seventy-two hours is the minimum written notice the guidance asks an inspector to give before a routine inspection (para 9.4).
It's worth saying that the SIA hasn't published how it will pick premises to inspect, so there's little to read into having been chosen. A randomised check is as likely a reason as any other. Notice is the norm, too: entry without it is the exception, and generally needs a warrant, for urgent cases or where giving notice would defeat the object of the visit (para 9.4). If you've heard that inspectors turn up unannounced as standard practice, that isn't the process the guidance describes. For what happens on the day and afterwards, see the full SIA inspection process.
How to get ready for Martyn's Law in three days
Three days is tight, but workable. The standard tier asks less of you than most people expect. There's no requirement to carry out a terrorism risk assessment, buy equipment, hire security staff, or put your team through accredited training.
The work that's left is real, though. Reading through the guidance, working out what you need to show for each of the four procedures, and then working out how to prove that you and your staff know it, is a lot to hold in three days. The hard part is usually the classic one: you don't know what you don't know. A good set of questions is worth more here than a long document.
Where the service helps
We help standard-tier venues write a plan specific to their venue, produce tracked logs showing who on the team has read their responsibilities, and follow readiness on one dashboard. That saves you hours, and lets you run your venue instead of reading red tape.
It doesn't replace walking your premises or practising your procedures, and none of this is something you have to pay for. What it removes is the day you'd otherwise spend reading general material to work out which parts apply to you. Start with the free tier checker →
What follows is how to spend the three days.
Day 1: your responsible person and your capacity
Today is about being able to answer two questions. Who is your responsible person, and how did you count your venue's capacity? These come first because everything else in the plan depends on them, and because they're the two an inspector is most likely to open with.
Who is your responsible person, and why?
The question is who controls the premises for its use. Not who owns the building, and not whose name is above the door (para 6.3). It's usually an organisation rather than a named individual, and the responsibility itself can't be handed to someone else, though the work of it can be shared out.
This is worth checking rather than assuming, because the obvious answer isn't always the right one. Take a pub owned by a brewery and let to a tenant: where the brewery holds the premises licence and the control, the brewery is the responsible person, not the tenant (para 6.3, example 3). Since this can be tricky to work out, we wrote a guide on how to identify your responsible person.
How did you count your capacity, and what backs the number?
Capacity is a slippery word here. Martyn's Law asks how many people you can reasonably expect to be present at the same time, from time to time, staff and volunteers included (para 4.23). That figure can sit well below the maximum your fire-safety occupancy allows. It also covers the whole premises, so a beer garden or terrace counts (para 4.10).
Three quick illustrations of how that works in practice:
- You regularly host around 300 people. You could hold more, but no larger event happens or is planned. Your figure is 300.
- Your weekly peak is 200, but a festival brings 500 through the doors once or twice a year. Your figure is 500, because "from time to time" includes the predictable spikes.
- Your peak is 150. One special event drew 200, it was a genuine one-off, and you don't expect it again. Your figure stays 150.
Whichever method you use, it has to be evidenced, and it has to satisfy the SIA that it was a reasonable way to assess attendance at your premises (para 4.25). So keep the working, not just the answer.
The guidance sets out several accepted ways to calculate this. The quickest route is our free tier checker: it asks the same things an inspector would, gives you your answer in about two minutes, and leaves you with a record of how the number was reached.
Prefer to read it through? How to count your capacity has the official worked examples if you want to check yours against one.
Day 2: the four procedures, and walking them
Day 2 is the longer one. It has two halves: understanding the four procedures the guidance sets out, then walking your premises to see how each would actually work in your building.
First, what the four procedures actually are
If this is new to you, start here. The Act names four types of public protection procedure (s.5(3)), and the statutory guidance gives each one a purpose.
- Evacuation. Getting people away from danger by moving them out of the premises, or out of part of it (para 7.33).
- Invacuation. The reverse: moving people to a safer place inside. That can mean bringing people in from outside, or moving them to a pre-arranged safer space within the building (para 7.39).
- Lockdown. Securing the premises to keep danger out, by locking doors, closing shutters, or using whatever barriers you already have. It can be partial: securing some entrances while keeping a safe exit open (paras 7.41–7.43).
- Communication. Telling people what's happening and what to do, quickly. The guidance counts verbal instruction, signage, briefings and announcements, so a public address system isn't required (paras 7.46–7.47).
The guidance's own example is a shop whose staff hear trouble outside and see people rushing for the front doors. The duty manager brings those people in off the street, locks the front and rear doors, and moves everyone into internal rooms that lock. That's an invacuation, then a lockdown, with someone telling people what to do throughout (example under paras 7.15–7.19).
For the fuller treatment, read the four public protection procedures explained, or go to the source: chapter 7 of the statutory guidance on GOV.UK. If you'd rather be talked through it than read it, ProtectUK's free ACT e-learning covers the same ground at no cost.
Then walk your premises
With the four procedures understood, walk your premises and consider how each one would apply. Your plans should reach the whole team, but the people working on the day of the visit need more than a copy. Walk it with them.
Walking it tends to surface things a desk review never does. A fire exit now stacked with stock. A communication plan that routes everything through a manager who left in March. Note down what's plainly broken, and fix it while you're standing in front of it if you can.
Keep each procedure simple, and resist the urge to make it thorough. The guidance's own example here is a bar that had written a separate evacuation procedure for each type of attack, then discovered during a practice run that staff couldn't tell which one to use when the threat wasn't clear. The delay put people at more risk than the extra detail removed, so the bar scrapped all of them and wrote one procedure instead (example under paras 7.15–7.19). That's what "so far as is reasonably practicable" (s.5(3)) is asking of you: a response that fits your building, not a perfect one.
Then brief everyone working
If you only do one thing from this guide, do this. The guidance expects the people with a role in the procedures to be made aware of those procedures and their own specific part in them (para 7.51). An inspector can require any person present to assist with the inspection (para 9.5), which in practice means your staff can be asked what they'd do. Five minutes at the start of a shift, covering what you do and who you tell, genuinely counts.
Day 3: gather what you'll show
Day 3 is about pulling together and documenting what you'll show the inspector. Four things want to be to hand: who your responsible person is and on what basis, how you counted your capacity and what backs it, your four procedures and how they'd be carried out, and something that shows your staff know their roles.
Format is open. An inspector can view physical or electronic documents (paras 9.4–9.5), so a folder and a shared drive are equally fine. Strictly, you aren't required to write anything at all at the standard tier (para 7.32), though the guidance is candid that compliance is harder to demonstrate without something written down, and it's easy to forget an important detail under the eye of an inspector. Our evidence checklist breaks the pack down item by item if you'd rather work from a list.
The easiest route through this part is the Martyn's Law Plan service. You answer straightforward questions about your venue, and it guides you through drafting your plan from the government guidance, produces a cue card for each responsible staff member, records their acknowledgement, and tracks your readiness on a dashboard.
Finish with one practice round. Ask a colleague to put the likely questions to you, and answer them out loud rather than in your head. Who's responsible here. How did you arrive at that number. What happens in a lockdown. Does the person who started last week know their part. It's a short exercise, and it tends to surface the questions you thought you had covered.
That's your three days. What's left is knowing what can and can't happen on the day itself.
Can they fine you on the day?
No. There are no on-the-spot fines in the process the guidance describes. An inspector's powers on the day are about gathering, not deciding. They can inspect the premises, observe what's going on, view and take copies of documents, take photographs, and require any person present to assist (para 9.5).
Any penalties come afterwards, from the SIA rather than from the inspector, and always as a written penalty notice setting out an amount and a date to pay by (paras 9.12–9.13). Standard-tier penalties are capped at £10,000 (para 9.14). The daily penalty of up to £500 is the one tied to a notice, and it only applies once a compliance or restriction notice exists and is still being ignored (para 9.16).
None of this is criminal at the standard tier. The guidance says so plainly: "Non-compliance with a compliance notice issued in relation to standard tier premises is not a criminal offence" (figure 16). And the £18 million and 5% of revenue figures you may have seen apply to the enhanced tier and to qualifying events, not to a standard-tier venue. The penalties in full and what a compliance notice is cover the rest.
What if you're honestly not ready?
Plenty of venues won't be, and it's a more common position than it feels like from the inside.
What to do about it is simple enough: show what exists, say what doesn't, and keep a dated note of what you're finishing and by when. What you must never do is bluff, backdate, or write something after the fact and date it earlier. Giving the SIA false or misleading information, knowingly or recklessly, is a criminal offence, and it applies to anyone, not just the responsible person (s.25).
If you're really struggling to know where to begin:
- Take our free checker to establish which tier you're in.
- Settle your responsible person and capacity facts.
- Record your procedures, or let the service guide you through drafting them.
- Focus on briefing your staff. It answers most of what an inspector asks.
A venue with a briefed team and thin paperwork stands in a better position than one with a beautiful document nobody on the floor has read. There's more on handling that conversation in what to do if you're not ready for Martyn's Law.
Common questions
Is 72 hours' notice normal?
Yes. At least 72 hours' written notice is the minimum the guidance describes for a routine inspection (para 9.4). It's the standard process, not a signal about your venue.
Can inspectors question my staff?
Yes. An inspector can require any person present to assist with the inspection, which in practice means asking staff to explain the procedures and their own role (paras 9.4–9.5). That's why Day 2 matters more than any document.
Do I need a written plan to show them?
No document is legally required at the standard tier (para 7.32). The guidance is honest that it's harder to demonstrate compliance without one, which is why Day 3 is worth doing even if nothing else gets written. See whether Martyn's Law requires a written plan.
Can I put the inspection off?
The statutory guidance doesn't set out a process for rescheduling, so we can't tell you one exists. Work to the date on the notice, and use the contact details on it if the timing is a genuine problem.
Where our service fits
Everything above can be done by hand, for nothing, and the law is deliberately written so that it can be. What the Martyn's Law Plan service does is walk you through it. Guided questions take you round your own building, the doors, the rooms people could shelter in, who'd take charge, and turn your answers into your four procedures, a written document, and a briefing card for each role on your team. It's the Day 2 walk and the Day 3 pack in one go, and we update your answers as the commencement date and notification rules land.
Either way, start with the free step: check which tier your venue is in → Two minutes, no email.
About this guide. Written by the Martyn's Law Plan team, based on the statutory guidance published under the Terrorism (Protection of Premises) Act 2025. Last reviewed: . Read the official guidance on GOV.UK.
Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.