Enhanced tier premises and qualifying events must document what they have in place. Section 7 of the Terrorism (Protection of Premises) Act 2025 requires a document setting out the public protection procedures and measures in place, or planned, together with an assessment of how they are expected to reduce harm and vulnerability. This page sets out what the statutory guidance says that document must contain.
Standard tier premises do not have this documenting duty. They do still have to have procedures, and they do still have to notify the SIA — see below.
Source: Terrorism (Protection of Premises) Act 2025: statutory guidance, Home Office, published 15 April 2026 and last updated 18 May 2026.
Who has to document
The guidance lists four additional duties for enhanced tier premises and qualifying events, on top of the procedures every tier must have:
- Ensure appropriate public protection measures are in place under section 6, so far as is reasonably practicable.
- Document the procedures in place, and the measures in place or planned, plus an assessment of how they are expected to reduce the risk of physical harm and reduce vulnerability (section 7).
- If the responsible person is an organisation rather than an individual, designate a senior individual responsible for ensuring compliance (section 10).
- Where others control parts of the premises or event, co-operate with the responsible person (section 8).
What the document must contain
Para. 8.61 is the operative paragraph: “The document must contain statements that set out the public protection procedures in place and public protection measures in place, or that will be in place. The statements should include information that relates to each individual procedure and measure, their associated policies, how and when they will be used, and who can make relevant decisions in relation to the procedures or measures were an attack to occur.”
Read that closely, because it is more demanding than “list what you have”. For every procedure and every measure it asks for four things:
- What it is — the procedure or measure itself.
- The policy behind it — why this, here.
- How and when it will be used — the trigger and the mechanism.
- Who decides — named roles who can activate it during an attack.
For the communication procedure specifically, that means you cannot simply write “we will inform visitors”. You need to state through which channels, at what point, on whose authority, and with what content.
Where documents usually fall short on communication
Three gaps recur, and all three map to paragraphs in chapter 7.
No named decision-maker. Para. 7.48 asks who will share information when a procedure is activated, and how information flows between staff and decision-makers. A document that says “management will decide” does not answer para. 8.61’s question about who can make relevant decisions.
The same message for every procedure. Para. 7.49 states the instructions for an evacuation “should be different to the instructions communicated for a lockdown procedure”. If your document contains one generic emergency message, it describes one procedure, not four.
Nothing about reach. Para. 7.49 also asks where people will be and whether information will reach them effectively in those areas. A document that lists channels without saying who they reach has skipped the question.
Submitting and keeping it current
The document is provided to the SIA (para. 8.57). Where it is revised, the revised document must be provided within 30 days (para. 8.60).
On review, there is an asymmetry worth knowing. Para. 8.5 notes that the Act does not require the procedures under section 5 to be kept under review — although it is strongly recommended — whereas the measures under section 6 must be. Para. 8.6 advises reviewing both, periodically and possibly annually, so that they remain appropriate and reasonably practicable as the premises or event changes.
Notification: this one applies to both tiers
Para. 7.64: “Those responsible for qualifying premises or qualifying events must notify the SIA when they become responsible and when they cease to be responsible.” Timescales and the information required will be set in regulations under section 9.
This is widely reported incorrectly. Notification applies to standard tier as well as enhanced. It is the documenting duty under section 7 that is enhanced-tier only.
What this does not require
No product, and no consultant. Para. 6.7: “It is not mandatory to use third-party products or services to comply with the Act’s requirements.” Para. 7.25: no statutory requirement to make physical alterations or purchase specific equipment for the procedures. And para. 6.1: the responsible person “cannot delegate their legal responsibility to a contracted service provider” — you may delegate tasks, never the duty.
What a system can do is make the document easier to write and easier to keep true, because the answers to “how and when” and “who decides” are already recorded. See which scenarios your communication should cover and what the communication procedure requires.
Frequently asked questions
Who has to produce a Martyn’s Law compliance document?
Responsible persons for enhanced tier premises and qualifying events, under section 7 of the Act. Standard tier premises do not have this documenting duty, although they must still have public protection procedures in place and must still notify the SIA.
What must the document contain?
Para. 8.61 requires statements setting out the public protection procedures in place and the measures in place or planned, including for each one its associated policies, how and when it will be used, and who can make relevant decisions were an attack to occur.
Do standard tier premises have to notify the SIA?
Yes. Para. 7.64 states that those responsible for qualifying premises or qualifying events must notify the SIA when they become responsible and when they cease to be responsible. This applies to both tiers; only the documenting duty is enhanced-tier only.
How often must the document be updated?
Where the document is revised, the revised version must be provided to the SIA within 30 days (para. 8.60). Para. 8.6 advises reviewing procedures and measures periodically, possibly annually, depending on the circumstances of the premises or event.
Do I need to buy software to produce it?
No. Para. 6.7 states it is not mandatory to use third-party products or services, and para. 7.25 states there is no statutory requirement to purchase equipment for public protection procedures. The legal responsibility stays with the responsible person under para. 6.1.
Last reviewed 29 July 2026 against the statutory guidance published 15 April 2026 (updated 18 May 2026). This page explains published government guidance. It is not legal advice, and only the SIA determines compliance.
