How Can Hotels Prepare for Martyn’s Law?

Hotels Prepare For Martyn's Law

Hotels can prepare for Martyn's Law by checking whether they are within scope, naming the responsible person, reading official Home Office guidance, assessing terrorism risk, training staff, planning evacuation, invacuation, lockdown and communication procedures, and keeping clear records ready for the Security Industry Authority.

Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, received Royal Assent in April 2025 and is expected to start around spring 2027, subject to formal commencement. That may feel a long way off, but hotels are busy places, and nobody wants to be writing emergency procedures during wedding season with three coaches outside and a best man asking where the bar is.

With support from iSecurity Solutions, UK hotels and hospitality businesses can review security, CCTV, access control and wider protection measures in a practical way, without turning guest experience into airport security. iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock with tailored, reliable and remotely monitored technology.

What Is Martyn's Law For Hotels?

Martyn's Law is new UK legislation designed to improve public safety at qualifying premises and events by asking organisations to plan for the threat of terrorism in a practical and proportionate way. For hotels, this matters because lobbies, restaurants, bars, function rooms, conference suites and entrances can all bring large numbers of people together.

The law does not expect every hotel to become a fortress, and it does not say that one single product fixes everything. It asks responsible people to think ahead, put sensible procedures in place, train staff, and for larger premises, document extra measures that reduce risk and potential harm.

The best starting point is the official Home Office Martyn's Law guidance, which explains the Act, scope, thresholds and duties. Hotels should treat the April 2026 statutory guidance as the main compliance baseline for decisions, then keep checking for updates from GOV.UK and the SIA as commencement gets closer.

Work Out Whether Your Hotel Is In Scope

A hotel is likely to be in scope if it is reasonable to expect 200 or more people to be present at the same time, including staff. The key point is simultaneous occupancy, not simply the number of bedrooms, which means a 120 bedroom hotel could still qualify if it has a busy restaurant, events space and a full staff team during peak periods.

The standard tier generally applies where 200 to 799 people may reasonably be present at the same time. Standard tier hotels will need to notify the SIA and put in place public protection procedures covering evacuation, invacuation, lockdown and communication of threats.

The enhanced tier generally applies where 800 or more people may reasonably be present at the same time. Enhanced tier hotels will have extra duties, including formal documentation, a security plan or similar document, and a named senior individual where required by the relevant guidance.

Capacity checks should include guests, staff, contractors, wedding guests, conference delegates, restaurant customers, bar customers and people queuing outside where relevant. If you run a city hotel with several meeting rooms, a public bar and a restaurant, your peak occupancy may be very different on a Tuesday breakfast shift compared with a Saturday awards dinner. Do you know your busiest realistic number on a packed event night?

Use A Hotel Specific Capacity Assessment

Start with the busiest realistic scenario, not the quietest day in January when the lobby has tumbleweed energy. Look at bedroom occupancy, event bookings, maximum restaurant covers, bar capacity, conference layouts, staff rotas, contractors, entertainment licences and expected queues.

A boutique hotel with 40 rooms and a small breakfast room may sit below the threshold unless it hosts large public events. A resort hotel with weddings, spa guests, restaurants and seasonal entertainment may reach the standard tier or enhanced tier even if the bedroom count alone does not tell the full story.

Mixed use hotels need special care. If you operate a separate nightclub, conference centre, public restaurant or leased leisure facility, you should review who controls each area, whether duties overlap, and how the different uses affect the overall scope assessment.

Keep a written record of your assumptions, including dates, room capacities, event formats and staffing levels. If the SIA later asks how you reached your conclusion, a clear paper trail will be far more helpful than a rushed spreadsheet called final version.

Name The Responsible Person

The responsible person is the person or organisation with control of the premises or event. In a simple independent hotel, that may be the owner operator, but in managed, leased or branded hotels, responsibility can sit across several parties.

You should map who controls emergency procedures, staff training, security systems, contractor access, event operations, guest communications and records. This is especially important where a landlord owns the building, a management company runs the hotel, and a group head office sets policies.

A written responsibility matrix is a useful tool. It should name the lead person for each hotel, identify deputies for nights and weekends, and explain who will handle SIA notification, document updates, training records and post incident reviews.

For a deeper look at accountability, you can read who is responsible under Martyn's Law. This is particularly useful for hotel groups, franchise operators and premises with several duty holders.

Carry Out A Terrorism Risk Assessment

A terrorism risk assessment for a hotel should look at how people use the building throughout the day and night. It should cover entrances, reception, lobby seating, lifts, stairwells, restaurants, bars, lounges, conference suites, function rooms, car parks, drop off points, loading bays, staff entrances, smoking areas and emergency exits.

The assessment should also consider how risk changes during different operating conditions. A breakfast service, a night shift, a Christmas party, a trade exhibition and a large wedding all create different crowd patterns, staffing levels and communication challenges.

Hotels should pay close attention to guests who may need extra support, including disabled guests, older people, children, international visitors, intoxicated guests, sleeping guests and people who do not know the layout. A plan that only works for fully awake, fully mobile people who know every fire exit is not really a plan.

Record existing controls, likely weak points, possible consequences and further actions that are reasonably practicable. Reasonably practicable simply means sensible and achievable when balanced against the risk, the premises, the resources available and the level of harm that could occur.

Plan Evacuation, Invacuation, Lockdown And Communication

Standard tier hotels will need public protection procedures that cover four core areas: evacuation, invacuation, lockdown and communication. These are not just words for a policy folder because they need to make sense to real staff on a busy shift.

Evacuation means moving people away from danger. Hotels should review routes, exits, assembly or dispersal arrangements, staff roles, alarm procedures and how to help guests who are unfamiliar with the building.

Invacuation means moving people to safer internal areas when leaving the building may be more dangerous. This could involve directing guests away from glass frontages, entrances or external queues and into internal corridors, meeting rooms or protected spaces where suitable.

Lockdown means restricting movement and securing areas to reduce exposure to a threat. Hotels should decide who can start a lockdown, which doors or access points can be controlled, how lifts and stairwells are handled, and what happens in restaurants, toilets, guest floors and event rooms.

Communication is the glue holding the plan together. Reception, management, security, housekeeping, events, food and beverage and night teams all need clear channels, plain messages and escalation contacts, including a backup plan if radios, phones or public address systems fail.

Train Every Department, Not Just Security

Hotel security is a team effort, and the people who notice something unusual are not always wearing a security badge. Reception may spot suspicious behaviour at the entrance, housekeeping may find an unattended item, and engineering may notice a service door being used incorrectly.

Front desk and concierge teams should understand suspicious behaviour, calm guest communication and how to direct people during evacuation or invacuation. Housekeeping and maintenance teams should know how to report concerns, protect service areas and support zone based procedures.

Food, beverage and events teams need briefings on queues, crowded rooms, event access, contractor arrivals and communication with organisers. Night teams also need special attention because staffing is often lighter, guests are asleep, and senior managers may be off site.

ACT Awareness e learning from Counter Terrorism Policing is a useful free starting point for staff, but it should not replace hotel specific procedures and drills. Pair online learning with practical walkarounds, tabletop exercises and short refresher briefings that people can actually remember.

It is a lot to balance. Hotel teams already manage guest comfort, service standards, staffing pressures and the occasional room key drama, so the best security approach is one that supports the operation rather than getting in everyone's way.

Review Physical Security And Premises Controls

Physical security should support your procedures, not overwhelm the guest experience. Hotels should review access control for staff areas, plant rooms, service corridors, offices, guest only zones and event back of house spaces.

For hotels considering controlled staff entrances, back of house doors or event access points, professionally designed access control can help manage movement without making the building feel unfriendly. The right setup depends on your layout, risk assessment, guest profile and daily operation.

CCTV can help with monitoring entrances, lobbies, bars, car parks, delivery points and external approaches, but it should be planned properly and used lawfully. Where CCTV forms part of an intruder alarm or monitored security design, systems should align with BS EN 50131 where relevant, and an SSAIB certified, Insurance Approved provider is normally the route to Police Response URN eligibility for alarm response.

Deliveries, vehicle approaches and drop off areas deserve a proper look too. Hotels should think about supplier booking processes, unattended vehicles, loading bay access, temporary event deliveries, coach arrivals and areas where people may gather outside.

Prepare For Weddings, Conferences And Events

Events can quickly change the risk picture because they increase numbers, create queues, bring in contractors and introduce people who do not know the building. A conference with registration desks, exhibition stands and external speakers may need different controls from a private dinner or wedding reception.

Before larger events, confirm who controls guest lists, entry points, contractor access, communications and emergency briefings. If an event organiser has their own staff, stewards or security team, agree how they will work with hotel procedures rather than running a separate plan in the same building.

Event day briefings should be short, practical and repeated where shift changes occur. Cover who raises the alarm, who contacts management, how guests are moved, how doors are controlled, and what messages should be used if there is a threat or suspicious item.

Document, Notify And Keep Reviewing

Good documentation proves that you have thought carefully, acted in a proportionate way and kept your arrangements under review. Standard tier hotels should keep scope assessments, responsible person records, public protection procedures, training records, drill reports, incident logs, action plans and review dates.

Enhanced tier hotels should go further by keeping formal security documents that explain public protection procedures and measures, how those measures reduce risk and potential harm, and who is accountable at senior level. This should be ready for SIA notification, review or inspection once the regulatory process is live.

Do not treat the first version as finished forever. Review plans after major events, layout changes, refurbishments, new entrances, changes in occupancy, serious incidents, drills or updated guidance from the Home Office or SIA.

A sensible review cycle includes induction training for new starters, regular refresher sessions, annual tabletop exercises, occasional departmental drills and short lessons learned reports. It does not need to be theatrical, but it does need to be real.

Practical Preparation Timeline For 2026 And 2027

In 2026, hotels should read the statutory guidance, assess capacity, identify the responsible person and map public areas, access points and current emergency arrangements. This is also the time to speak with landlords, operators, group teams and event managers so responsibilities are not left vague.

Before commencement, expected around spring 2027, complete a gap analysis, update procedures, train staff, test communication routes and prepare documentation for SIA notification or registration as the process becomes available. Hotels should use the SIA scope assessment tool when it becomes available, and they should keep an eye on official SIA tools, templates and inspection guidance as they develop.

After implementation, keep records current, rebrief temporary and seasonal staff, review after major events and update your procedures when the building or business changes. Hotels evolve constantly, and compliance needs to evolve with them.

Hotel Martyn's Law Preparation Checklist

• Assess simultaneous occupancy, including guests, staff, contractors and event attendees.
• Identify whether the hotel is likely to be standard tier or enhanced tier.
• Name the responsible person and clarify landlord, operator and group duties.
• Review the April 2026 Home Office statutory guidance and future SIA updates.
• Use the SIA scope assessment tool when it becomes available.
• Carry out a hotel specific terrorism risk assessment.
• Create procedures for evacuation, invacuation, lockdown and communication.
• Train reception, housekeeping, engineering, food and beverage, events, security and night teams.
• Review access control, CCTV, deliveries, vehicle approaches and event entry points.
• Keep training records, drill notes, action logs and version controlled procedures.
• Prepare enhanced tier security documentation if 800 or more people may be present.

Final Thoughts

Martyn's Law preparation is not about panic, overreaction or turning hotels into cold, unwelcoming spaces. It is about calm planning, clear responsibility, trained staff and practical procedures that help protect guests, staff and visitors if the worst happens.

The hotels that start now will have time to make sensible decisions, test arrangements and build confidence across their teams. By spring 2027, the goal is not to have a dusty folder on a shelf, but a living plan that your people understand and can use under pressure.

Frequently Asked Questions

Does Martyn's Law Apply To Hotels With Fewer Than 200 Bedrooms?

Yes, it can apply if 200 or more people may reasonably be present at the same time. The assessment includes guests, staff, contractors and event attendees, not just bedroom numbers.

Are Hotel Staff Included In The Martyn's Law Threshold?

Yes, staff should be included when assessing whether your hotel meets the 200 person or 800 person threshold. This includes permanent, temporary, casual and relevant contractor staff on site at the same time.

Is CCTV Mandatory For Enhanced Tier Hotels?

The law focuses on proportionate public protection measures rather than making one specific technology mandatory for every hotel. CCTV may be appropriate where it reduces risk, and alarm related systems should be installed by an SSAIB certified, Insurance Approved provider where Police Response URN eligibility is needed.

Who Is The Responsible Person In A Managed Hotel?

It depends on who has control of the premises and relevant activities. In managed or leased hotels, the owner, operator, management company or group head office may need to clarify duties in writing.

What Should Hotels Have Ready Before Spring 2027?

Hotels should have a scope assessment, responsible person record, terrorism risk assessment, public protection procedures, staff training records and a review cycle. Enhanced tier hotels should also prepare formal security documentation and senior accountability arrangements.