Notifying the SIA

When Martyn’s Law is in force, the responsible person will have to notify the regulator — the Security Industry Authority (SIA) — that they are responsible for a qualifying premises or event. Both tiers do it. But there is nothing to do today: the system to notify through is not open yet, and the SIA has not even published the exact detail of what you will submit. So this is a “know what’s coming and have the groundwork ready” piece, not a task for this week.

Do I have to register for Martyn’s Law now?

No — and “register” is not quite the right word. The duty is to notify the SIA that you are the responsible person, once the law is in force. There is no portal open for it yet, so there is nothing you can file today, and nothing you are late for. If anyone tells you to “register for Martyn’s Law now”, they are mistaken: the system does not exist yet.

Who has to notify, and for what?

The responsible person — whoever has control of the premises or the event. That is the body or individual that runs the place and decides how it is used, not a one-off hirer and not a “competent person” (a term that is not in the Act at all). Both the Standard Tier and the Enhanced Tier notify; it is not an Enhanced-only step. If you have worked out that you are in scope, the person or body that carries the duty is the one that will notify.

Does notifying differ between the tiers?

Yes, and this is the key difference. At the Standard Tier you simply notify the SIA that you are the responsible person — you do not have to send them any documents. Your procedures stay with you.

At the Enhanced Tier you notify and provide your compliance document — the procedures and measures you have in place or plan, with the assessment of how they reduce the risk. You keep it up to date and give the SIA the updated version within 30 days of any change. And if the responsible person is an organisation, a named senior individual is accountable for it.

What will I actually need to give them?

The SIA has said it will publish the detail in due course, so no one can fill anything in yet — and you should be wary of any “Martyn’s Law registration” service that claims otherwise. What you can do is have the sensible groundwork ready, because it is the same information whatever the final form looks like:

• Who the responsible person is — the body or individual in control, and your contact details. At the Enhanced Tier, the named senior individual too.
• Which premises or event, and which tier — and the reasoning behind your headcount, so you can say why you are Standard, Enhanced, or out of scope. Our guide on how to work out if you reach 200 walks through that.
• At the Enhanced Tier, your documented assessment — the procedures, measures and the thinking behind them, ready to provide.

If you have been through the Workbook, this is already in one place — who is responsible, your tier and how you reached it, your procedures and, at the Enhanced Tier, the document for the SIA — so notifying becomes a short form-filling job when the time comes, not a scramble.

When will the system open?

Not yet, and not before the law is in force. The duties won’t start before April 2027 — the government has committed to an implementation period of at least 24 months from Royal Assent on 3 April 2025 — and the SIA’s notification system is being built towards that. So there is no deadline bearing down on you, and genuinely nothing to file today. The date to watch is commencement; when it is set and the system opens, that is when you notify.

So what should I do now?

There are things to do now — just not SIA paperwork. The groundwork is the real work of Martyn’s Law; notifying is only telling the regulator you have done it. So use the time to get three things straight:

• Settle which tier you are in — work out the most people you could expect on site at once, staff included.
• Be clear who the responsible person is — the body or individual in control of the premises or event.
• Get your procedures in place — evacuation, invacuation, lockdown and communication — and make sure the people who would run them know them. At the Standard Tier you do not have to write anything down, though a short record is sensible: see what a finished record looks like and what you do not have to buy.

Do that, and when the notification system opens you are not starting from scratch — you are just passing on what you already have.

You have time — but no reason to wait

Martyn’s Law is not in force yet, and the duties won’t start before April 2027. But do not wait for the deadline, because the real point of this is not the paperwork. Notifying the SIA is just admin. What matters is being ready to act if something goes wrong — on a day nobody saw coming — with a plan your team actually knows how to run, whether or not the regulator ever asks to see it.

That is worth having for its own sake, and it is not onerous: working out your tier takes an afternoon, and at the Standard Tier getting ready is mostly agreeing with your team what you would do. Get it sorted now, and notifying becomes a five-minute job when the system opens — rather than one more thing to rush against a deadline.

Where the definitive answer is

For definitive information about whether your premises or event is within scope and what is required, refer to the current statutory guidance issued under the Terrorism (Protection of Premises) Act 2025, and to the SIA’s own guidance on how it will regulate.