Martyn's Law July 2026: SIA consultation closes, enforcement clock is running

The Security Industry Authority's consultation on its Section 12 guidance under Martyn's Law closed in July 2026. Final guidance is due in autumn 2026. Enforcement begins spring 2027. If you run a venue or organise events in the UK, the compliance window is now shorter than it was six months ago — and the picture is clear enough to act on.

What has happened since Royal Assent

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. Since then:

• April 2026: Home Office published statutory guidance (sections 4–5 detail scope — which premises are in, which are out)
• Summer 2026: SIA launched consultation on its Section 12 guidance, defining how the regulator will assess compliance
• July 2026: Consultation closed — final wording due from SIA in autumn 2026
• Spring 2027: Enforcement begins (minimum 24 months from Royal Assent)

The SIA's compliance notification portal is not yet live. They are currently recruiting sector volunteers to test the platform. That means the mechanism for formal notification does not exist yet — but the obligation to prepare does, and it starts from the moment enforcement lands.

What the SIA guidance actually says

The key shift in the SIA's approach — confirmed through the consultation — is that compliance is risk-based and proportionate, not prescriptive. There is no mandated checklist. There is no mandatory qualification for the person designated as responsible. The question the SIA will ask is whether you have taken reasonable and practicable steps proportionate to your premises and risk profile.

According to NCASS reporting from the UK Crowd Management Association webinar in June 2026, the Home Office confirmed:

• Compliance does not require hiring external consultants
• The ProtectUK website has flowcharts, infographics and scope decision trees that cover most standard-tier cases
• Safety Advisory Groups can observe your compliance efforts but cannot demand measures beyond what the Act requires
• The Level 3 Award in Counter Terrorism Protective Security is available but not compulsory for the responsible person role

Which tier are you in?

The two tiers have not changed:

• Standard tier (200–799 capacity): documented procedures for evacuation, invacuation, lockdown and communication; staff who know what to do
• Enhanced tier (800+ capacity): all of the above, plus a written security plan, a named responsible person with documented authority, and more formal training requirements

The Home Office statutory guidance (sections 4–5) includes decision trees for determining which tier applies and which premises are out of scope entirely. If you are unsure, that is the first document to read — before paying anyone to tell you.

What to do before autumn 2026

The SIA's final guidance lands in autumn. By then, you should already have:

1. Confirmed your tier using the Home Office decision tree
2. Named a responsible person — no qualification required, but they need to know what the role involves
3. Documented your procedures — evacuation routes, lockdown protocol, communication chain. Written down, not just understood
4. Trained your staff — the standard tier does not require formal certification, but staff need to know the procedures. Untrained staff with a written plan is still a failing

The Ops Con assessment from 5 July 2026 puts it plainly: "the compliance picture under Martyn's Law is now clear enough to act on." Waiting for the final SIA guidance before starting is a choice to compress your preparation window to under six months.

Staff training: the fastest part you can do now

The responsible person, the documented plan and the notification portal are things you prepare once. Staff training is ongoing — every new hire, every season, every event.

Our Festival & Crowd Safety certificate covers evacuation protocols, density recognition and emergency communication in 15 minutes per person, and gives each staff member a verifiable certificate. For venues training a full team, CrowdCert Teams tracks completion across everyone from one dashboard — useful when an inspector asks for evidence that your staff have been trained.

Spring 2027 is closer than it looks.