The readiness checklist, in full, with nothing to fill in first.

For venues and events, ahead of expected commencement in spring 2027.

General guidance, not legal advice. Prepared 20 August 2026 against public

guidance current at that date. The Terrorism (Protection of Premises) Act 2025

received Royal Assent on 3 April 2025; the Security Industry Authority is the

regulator, and its detailed guidance was still settling when this was written.

The substantive duties are not yet in force and the commencement date is not

confirmed, so treat spring 2027 as the planning assumption rather than a

deadline you have been given.

Check the current published guidance before you rely on any of it. The Act

itself is at legislation.gov.uk/ukpga/2025/13.

1. Work out which tier you are in

Capacity is "how many people may reasonably be expected to be present at the

same time", not your ticket allocation.

• ☐Standard tier — premises where 200 to 799 may be present at once.
• ☐Enhanced tier — premises where 800 or more may be present at once.
• ☐Qualifying event — 800 or more people, public present by express permission (ticketed or access-controlled). Free events count. Qualifying events sit in the enhanced tier.

Two things that catch people out:

• Some premises are standard tier however many people are present: places of worship, childcare, and primary, secondary and further education (Schedule 1). Higher education is not overridden.
• An operator can be a standard-tier premises for its year-round programme and an enhanced-tier duty holder for one festival in a park. A park that is itself out of scope still hosts qualifying events (Schedule 2). The two are assessed separately.

• ☐Written down, per site and per event, with the number you would defend.

2. Name the people

• ☐Responsible person identified for each premises and each event.
• ☐Enhanced tier only: designated senior individual named. This is a named human who can be personally prosecuted where non-compliance happens with their consent, connivance or neglect. Not a job title on a chart. A person who knows they hold it.
• ☐Deputy named for when they are not on site.

3. The four public protection procedures

Every tier needs these. Write them down; a procedure that lives in someone's

head is not evidence.

• ☐Evacuation — getting people out.
• ☐Invacuation — bringing people in, or moving them to safety inside.
• ☐Lockdown — securing the site against entry.
• ☐Communication — how you tell people what to do, and how fast.

For each: who decides, who executes, how it is communicated, and how you would

show it was in place on a given date.

• ☐Each procedure has a named owner.
• ☐Each has a review date that someone actually chases.

4. Communication is the one most operators cannot evidence

The other three are physical. This one is a data question, and it is where most

operators will struggle.

• ☐Can you reach everyone working on site, on their phone, in minutes?
• ☐Is that list current on the day, or is it last month's export?
• ☐Does it cover contractors and suppliers' crew, not just your own staff?
• ☐Can you show who you contacted, when, and what you said?

5. Records that will be asked for

• ☐Who was accredited, and to which zones.
• ☐Who was briefed or inducted, when, and on what.
• ☐Who was actually on site (not who was expected).
• ☐When each procedure was last reviewed, and by whom.
• ☐What changed after each event, and who signed it off.

The uncomfortable part: these cannot be backfilled. A record of who was

briefed in May 2026 either exists in May 2026 or it does not exist. If you plan

to start in 2027, you will start with an empty file.

6. Enhanced tier: public protection measures

Beyond procedures, enhanced-tier duty holders must have measures in place and

assess how they reduce vulnerability and the risk of physical harm.

• ☐Monitoring of the premises and its immediate vicinity.
• ☐Movement of people into, out of and within the premises or event.
• ☐Physical safety and security of the premises.
• ☐Security of information that could assist an attacker.

7. Notification and the compliance document

• ☐Premises: notify the SIA within the three-month window from commencement; report changes within 28 days.
• ☐Qualifying events: in most cases notify within 14 days of the event date being made publicly available — which in practice means within 14 days of your on-sale announcement. This one catches people out: it is tied to announcement, not to the event.
• ☐Enhanced tier: compliance document prepared, recording the procedures and measures plus the vulnerability assessment; filed with the SIA as soon as reasonably practicable, and again within 30 days of any revision.

8. Between now and spring 2027

• ☐Autumn 2026: tier decided, people named, procedures drafted.
• ☐Winter 2026: procurement decisions made for the 2027 season with these obligations in scope.
• ☐Spring 2027, if duties commence as expected: notification submitted, records already accumulating.

Where Bloop fits, plainly

Bloop is accreditation, entry and crew software. It is not a compliance product

and does not file anything with the regulator.

What it does do is hold the records in sections 4 and 5 as a **by-product of

running the show**: who is accredited and to which zones, who was inducted and

when, who actually scanned in, and how to reach them. Those records accumulate

whether or not anyone is thinking about Martyn's Law, which is the only way

they exist in time to be useful.

A one-click compliance file export is on our roadmap, not shipped. We would

rather tell you that than let you plan around it.

Questions about where your premises or event sits: hello@bloop.events, or book

a readiness call at bloophq.com/martyns-law. That call is advisory, not a demo.

*Bloop is a product of Templar Works Ltd, registered in England and Wales,

company no. 17239871.*