Two hundred people. That is the number that decides whether Martyn’s Law applies to your venue, and most of the pubs, village halls, function rooms and small event spaces we speak to have no idea whether they cross it, because nobody has ever counted properly.
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. It is expected to come into force in spring 2027, with the exact date to be confirmed by government ahead of commencement. That is roughly six to nine months of runway from today. Long enough not to panic, short enough that the venues who leave it until the portal opens will be doing their capacity assessment in a hurry.
This post is about one narrow slice of that: where a booking system genuinely earns its place in your preparation, and where software is the wrong tool entirely. We build booking systems, so we have an obvious interest in the first answer. The honest version is that most of Martyn’s Law is not a software problem.
This is not legal advice. The duties below are drawn from the government’s own guidance, linked at the end. Read the primary source and take proper advice on your own premises.
The two tiers, and where the lines fall
The Act splits qualifying premises into two tiers based on the number of individuals it is reasonable to expect may be present at the same time, from time to time.
| Standard tier | Enhanced tier | |
|---|---|---|
| Capacity | 200 to 799 | 800 or more |
| Notify the SIA | Yes | Yes |
| Public protection procedures | Yes, four types | Yes, four types |
| Public protection measures | No | Yes, four types |
| Documented assessment to the SIA | No | Yes |
The four procedures are evacuation, invacuation (moving people to safety inside the building), lockdown and communication. Standard tier premises must have these in place so far as is reasonably practicable.
The four measures, which only enhanced tier premises must also address, cover monitoring, movement of people, physical safety and security, and security of information. Enhanced tier premises also have to document how those procedures and measures reduce risk and vulnerability, and submit that assessment.
Counting capacity is where venues get caught
The threshold is not your licensed capacity, your fire capacity or the number of covers you can seat. It is the number of individuals reasonably expected to be present at the same time, and the guidance is explicit that this figure must include staff working at the premises.
That last point catches function venues repeatedly. A room laid out for 180 guests with 25 staff on a busy wedding is a 205-person premises. Two rooms that share a building and are regularly hired on the same evening may need counting together depending on how the premises is used.
The other thing worth knowing early: the assessment has to be evidenced. The SIA can require the responsible person to explain how the count was arrived at, and the guidance says the assessment must satisfy the regulator that it reflects the actual circumstances of the premises. A number remembered from a licensing application in 2014 will not do that. Peak realistic attendance is what is assessed, not an average.
What a booking system genuinely helps with
Four things, and they are all about evidence rather than safety.
Knowing your real numbers. If bookings go through a system, you already hold the data that answers the capacity question: actual headcount per session, across overlapping bookings, for every night of the past two years. That turns “we think about 250 on a Saturday” into a distribution you can point at. Our post on custom database reports covers the reporting side of this in more detail.
Capping what you can sell. A hard cap in the booking flow means the number you assessed is the number that can physically be booked in. Most off-the-shelf tools cap per time slot but not across a whole building, which is exactly the case a multi-room venue needs. That difference is one of the usual dividing lines between a bespoke system and an off-the-shelf one.
Staff records and training logs. Procedures only count if staff know them. A date-stamped record of who completed what training, and who was on shift on a given night, is trivial to keep in a system you already run rota and booking data through, and genuinely awkward to reconstruct from memory.
A document trail with dates on it. When your procedures were last reviewed, when the capacity assessment was redone, who signed it off. Enhanced tier venues need to submit an assessment; both tiers benefit from being able to show the working.
| Task | Software helps? | Why |
|---|---|---|
| Establishing expected headcount | Yes | You already hold the booking data |
| Enforcing a capacity cap | Yes | Cap at the building level, not the slot level |
| Logging staff training | Yes | Date-stamped, per person, queryable |
| Recording event dates for notification | Yes | Events are already in the system |
| Writing the evacuation procedure | No | A decision about your building |
| Training staff to use it | No | Software logs it, it does not deliver it |
| Physical measures and monitoring | No | Doors, sightlines, stewarding |
| Deciding what is reasonably practicable | No | A judgement for the responsible person |
What is a procedure problem, not a software problem
Most of the Act is the right-hand column above, and it is worth being blunt about it.
Nobody can buy compliance. The four procedures are decisions about your specific building: which exit to use when the front of house is the problem, where you move people when outside is less safe than inside, who has the authority to call a lockdown at 11pm on a Saturday when the duty manager is the only one on site. A booking system has no view on any of that.
Training is the same. You can log it perfectly and still have staff who would freeze. The log is evidence that the training happened, not evidence that it works.
And appointing the responsible person, then having them actually own this, is an organisational act. It cannot be delegated to a tool, and the guidance is clear that legal responsibility stays with the responsible person even where someone else submits a notification on their behalf.
If you are near the 200 line and your bookings currently live in a diary and a spreadsheet, the useful sequence is: count properly first, decide your tier, write the procedures, and only then ask what a system should record. Doing it the other way round produces a nicely built tool pointed at the wrong question. We wrote about how to scope that kind of thing in how to write a brief for custom software.
The timeline
| When | What happens |
|---|---|
| 3 April 2025 | Royal Assent |
| 2026 | Home Office statutory guidance published, SIA guidance consultation run |
| Expected spring 2027 | Act comes into force, exact date to be confirmed |
| At commencement | Online notification portal opens on GOV.UK |
Until the Act is in force there is no legal requirement to comply and no need to notify the SIA. The work worth doing now is the counting and the procedure writing, because those are the parts that take months rather than an afternoon on a portal.
FAQ
Does Martyn’s Law apply to my pub or restaurant?
It depends on whether 200 or more individuals, staff included, are reasonably expected to be present at the same time, from time to time, and on the premises being used for a qualifying purpose. Many small pubs and restaurants fall below the threshold. Function rooms, village halls hired out for events, and venues with multiple rooms are the ones most likely to be surprised by their own number.
Do staff count towards the 200 and 800 thresholds?
Yes. The government guidance states the capacity figure must include staff working at the premises. This is the single most common reason a venue that assumed it was out of scope is not.
Is my licensed capacity the same as my Martyn’s Law capacity?
No. Licensed and fire capacities are set for different purposes. Martyn’s Law asks for the number reasonably expected to be present at the same time, from time to time, which may be lower than a maximum licensed figure or, once staff are added, higher than a seated cover count.
Do I need new software to comply?
No. Nothing in the Act requires software. What it requires is procedures, and for enhanced tier premises, measures and a documented assessment. Software is useful for evidencing headcount, capping bookings and logging training, which makes the rest easier to demonstrate.
What happens if we do not comply once it is in force?
The Act gives the SIA compliance notices, restriction notices and penalty notices, and penalty notices can include daily amounts for continued non-compliance. Check the current guidance for the figures that apply to your tier.
When do we have to notify the SIA?
Not until the Act comes into force, expected spring 2027. Notification will be made through an online portal on GOV.UK. Responsible persons for both standard and enhanced tier premises will need to notify.
Where to read the primary source
Two pages are worth your time rather than the dozens of summaries circulating. The government’s overview of Martyn’s Law and the SIA’s role as regulator ↗ is the plain-English starting point, and the full statutory guidance issued under section 27 of the Act ↗ is the document your assessment should be built against.
If your capacity numbers currently live in a paper diary and you would struggle to produce a year of headcounts, that is the gap worth closing first. It is also the question behind do you need a custom booking system. Get in touch if you want a look at what your existing booking data could already tell you.