Martyn's Law, read from a field rather than a foyer.

Where the Act actually is, as of this page

It is easy to find confident statements online that the duties commence in spring 2027. They are inferences from the Government saying it intends an implementation period of at least 24 months after Royal Assent, which was 3 April 2025. At least 24 months is a floor, not a date.

What has happened is real but narrower. Section 27 was commenced in April 2026 so that the statutory guidance could be published, and the Home Office published that guidance on 15 April 2026. The Security Industry Authority is named as the regulator. The substantive duties are not yet enforceable.

We are flagging this because planning to a date nobody has set is how people either panic a year early or relax a year too long. Plan to the guidance, which exists, rather than to a commencement date, which does not.

The two tiers, and the penalty figure that goes with each

The tiers turn on the number of individuals it is reasonable to expect may be present at the same time. Standard tier is 200 to 799. Enhanced tier is 800 or more.

The penalties differ by an enormous margin, and this is where most coverage of the Act does its readers a disservice. For standard duty premises the maximum monetary penalty is 10,000 pounds, with a daily penalty of up to 500 pounds. For enhanced duty premises and qualifying events, the maximum is 18 million pounds or 5 percent of qualifying worldwide revenue, whichever is greater, with a daily penalty of up to 50,000 pounds.

If you run a 400 capacity event and you have been shown the 18 million pound figure, you have been shown the wrong number. It does not apply to you, and whoever showed it to you was selling something.

What each tier asks you to do

Standard tier duty holders notify the regulator of their premises, and have in place, so far as is reasonably practicable, appropriate public protection procedures: the things you would do to reduce the risk of physical harm if an attack happened.

Enhanced tier adds appropriate measures that could reasonably be expected to reduce the vulnerability of the premises or event to an act of terrorism, and it adds documentation: the procedures and measures have to be written down and provided to the Security Industry Authority.

Note what standard tier does not ask for. It does not ask for a document, and it does not ask you to buy anything. The Home Office has been explicit that organisations can meet these duties without purchasing software, and they are right.

The questions outdoor sites raise that buildings do not

A building has walls, and the walls answer most of the scoping questions for you. A greenfield site answers none of them.

• Where is the boundary? A ticketed arena inside a wider open site is a different question from a fenced perimeter with a single entry.
• Who counts? Crew, contractors, traders and their staff are on site in numbers that can move an event between tiers before a single ticket holder arrives.
• Who is responsible? The Act puts duties on those with control. On a hired site with a promoter, a landowner, a production company and a security contractor, that is a question to settle in writing during contracting, not during an incident.
• What about the build and the break? The site exists for weeks. The capacity on a wet Tuesday in build is not the capacity on Saturday.

What accreditation records have to do with any of this

Nothing, directly. Accreditation is not a public protection procedure and we are not going to dress it up as one.

What accreditation gives you is the answer to who was on your site, in which areas, with what briefing, approved by whom. When the enhanced tier asks you to document procedures and measures, and when anyone at all asks you afterwards to account for who had access to what, that record is the difference between an answer and a shrug.

It is worth building the record now for the ordinary operational reason: you will be asked for it by a licensing authority, an insurer or a client long before the Act commences.