What a finished record looks like

At the Standard Tier you do not legally have to write anything down. The duty is to have the right procedures in place and working, not to produce a document. But a short written record is still the sensible thing to keep — because it is how you show you have thought it through, and it is what a new manager, your insurer or the regulator will actually look at. Here is what a finished one contains.

Do you have to write anything down?

At the Standard Tier, no. There is no legal requirement to document your procedures. The duties are to notify the regulator that you are the responsible person, and to have appropriate public protection procedures in place, so far as is reasonably practicable. That is about what you can actually do on the day, not about paperwork.

At the Enhanced Tier it is different: there you must write down the procedures and measures you have in place or plan to put in place, assess how they reduce the risk, and give that document to the regulator. So the record moves from “sensible” to “required” as you cross into the Enhanced Tier — but the thinking behind it is the same.

So why keep a record if you don’t have to?

Because a plan that only lives in one person’s head is not really a plan. People move on, committees turn over, the duty manager is on holiday the week it matters. Writing it down is what makes it repeatable — so the next person can pick it up — and reviewable, so you can check once a year that it still fits the building and the team you actually have.

It is also what makes your position defensible. If anyone ever asks whether you took this seriously — the regulator, an insurer, your own trustees after an incident — a dated record of who is responsible, how you counted, and what your procedures are is a far better answer than “we talked about it once”. One caveat worth keeping in mind: a written procedure is not enough on its own if it cannot be carried out quickly and properly. The record describes something real that your people can do; it is not a substitute for being able to do it.

What goes in a finished record?

A good Standard Tier record is short — a page or two — and answers six plain questions. Each one is something you would want a stranger to be able to read and act on.

• Which premises, and who is responsible? Name the premises and the responsible person — the body or individual that controls the premises and makes the decisions about how it is run. If a few organisations use the building, be clear who holds the duty.
• Are you in scope, and how do you know? Your headcount reasoning: the most people who may be present at the same time, from time to time — public, staff and volunteers together — and how you arrived at the number. Write it down even if the answer is “comfortably under 200”; that reasoning is the record.
• Evacuation — how you get people out, by what routes, and who calls it.
• Invacuation — where the safer place inside is, and when you would move people there or bring them in rather than send them out.
• Lockdown — how you secure the building to stop people entering or leaving (which doors, shutters or exits), and who can call it.
• Communication — how you alert staff and the people in the building, and how you pass on a clear, calm instruction to stay put or get out.

Then two lines that turn a note into a live record: who has been briefed on it, and when you will look at it again.

A worked example

Here is what that looks like filled in, for a made-up mid-sized community venue in the Standard Tier. Yours would be shorter or longer depending on the building, but this is the shape of a finished record.

Notice what is not in there: no equipment list, no certificates, no consultant’s report. A Standard Tier record is about people and procedures, not kit — see what you do not have to buy. And the headcount line does the heavy lifting; if you are unsure how to count, our guide on how to work out if you reach 200 walks through it.

What makes a record “finished” rather than a draft?

Four things. It is dated, so you know how current it is. It names people — who is responsible and who can call each procedure — rather than leaving it to “someone”. The people who would have to act on it have actually been told it exists and what it says. And it has a review date, because a building, a team and an event programme all change, and a record from three years ago that nobody has looked at is back to being a note in a drawer.

It also has to be somewhere you can find it. A record that is real but lost on one person’s laptop fails the first test — could the next person pick this up and act on it?

What is different at the Enhanced Tier?

The record you have just seen is the heart of an Enhanced Tier document too — but there you have to go further, and it stops being optional. You must write down not just the procedures but the measures you have in place or plan, and include an assessment of how they reduce the premises’ vulnerability to an attack and the risk of harm if one happened. If the responsible person is an organisation rather than an individual, a named senior person has to be accountable for compliance. And the document has to be provided to the regulator.

So the difference is one of depth and duty, not of kind: the same six questions, answered more fully, with the reasoning shown and handed over. If you are working out which tier you are in, start with the 200 count — 200 to 799 is Standard Tier, 800 or more is Enhanced Tier.

You have time to get it right

Martyn’s Law is not in force yet. The statutory guidance was published on 15 April 2026, and commencement is expected in spring 2027 at the earliest, after a minimum 24-month implementation period. The regulator’s notification system is not open yet either, so there is nothing to file today. That is time to write a plain record once, brief your people, and set a date to look at it again — rather than scrambling it together later.

Where the definitive answer is

For definitive information about whether your premises or event is within scope and what is required, refer to the current statutory guidance issued under the Terrorism (Protection of Premises) Act 2025.