Hotels face integrated security oversight as Martyn’s Law nears implementation

Hotels are being told to treat security, facilities and supplier oversight as part of the same operational problem, not as separate back-office tasks, as Martyn’s Law moves closer to commencement in spring 2027 and the Security Industry Authority prepares its final regulatory guidance for publication this autumn. The shift matters for an industry that sells ease and welcome out front, but increasingly has to prove that the unseen systems behind reception, housekeeping, kitchens and ...

According to Home Office guidance published on 15 April 2026, (gov.uk) premises expecting 200 to 799 people at the same time fall into the standard tier, while those expecting 800 or more move into the enhanced tier, with correspondingly heavier duties. The government’s example of a 400-seat restaurant is notably practical rather than theoretical: operators are expected to think through evacuation routes, bringing people inside if needed, who locks doors and shutters, how customers would be briefed during an incident, and how often procedures should be reviewed. The same guidance confirms that the SIA, not a local trade body or private adviser, will regulate the regime.

That is an important distinction because some of the discussion around Martyn’s Law in hospitality has run ahead of the fine print. ProtectUK’s frequently asked questions, (protectuk.police.uk) state that there is no legal requirement to complete a specified training module. Staff involved in carrying out public protection procedures must understand their role, but the law does not mandate a single approved course. Nor do all venues face the same paperwork burden: standard-tier premises do not have to submit procedure documents to the SIA, although they are expected to keep them under review, while enhanced-tier premises and qualifying events must keep formal records up to date and provide them to the regulator, including within 30 days of revision once those requirements are in force.

The official timetable is tightening, even if the law is not yet live. UKHospitality says, (ukhospitality.org.uk) that the Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025 and that the implementation phase is expected to last at least 24 months, giving businesses time to prepare. ProtectUK says the notification portal is currently expected in spring 2027, and that the SIA will not charge fees for inspections, advice or notifications. The SIA has also said summer consultations on its regulatory approach have now closed and that more detailed guidance on how it will exercise its powers is due later this year. (protectuk.police.uk)

For hotels, the challenge is that one property may not fit neatly into one box. United Outcomes, a consultancy working in security and resilience, says, (united-outcomes.com) that hotels can sit “at more than one threshold at once” because lobbies, bars, restaurants, conference suites and function rooms may all contribute to the numbers reasonably expected on site. Larger properties can therefore fall into the enhanced tier as premises while also staging weddings, exhibitions or conferences that qualify separately as events. Its guidance for hotel clients argues that risk assessments should cover not just guest rooms and reception desks but car parks, arrival points and the spaces where people gather before entering.

That layered approach is a more developed version of the warning some hotel advisers were giving long before the Act was passed. In 2023, CoStar reported, (costar.com) that hotels were specifically named in the draft bill and that their “open” nature could create vulnerabilities precisely because they are designed to feel accessible. Brian Moore of Global Secure Accreditation told the publication that hotels should separate public areas from private ones, identify designated people at each property rather than relying on group-level policies, and keep plans under regular review. Mary Lawrence of Osborne Clarke argued in the same piece that many operators ought already to have policies and risk assessments in place, meaning the eventual regime should not feel entirely alien even if it creates new duties.

What has changed since then is both the detail and the tone. The draft bill discussed in 2023 worked off a lower threshold of 100 people for some premises, whereas the final framework published by government now uses 200 as the entry point for standard-tier duties. Official material also places repeated emphasis on proportionality. The Home Office says the aim is not to force businesses into buying consultants or expensive equipment as a first resort, and its July and August updates have added more detail on notifications and scope as the regime is built out. (gov.uk)

That broader focus on evidence rather than appearances reaches beyond counter-terrorism planning. The Hotel Magazine article that prompted the debate, (thehotelmagazine.co.uk) argued that the guest offer in 2026 rests on an operational base of contractor checks, maintenance discipline and supplier assurance, from laundry and food to fire safety. A sponsored analysis in Retail Sector, (retailsector.co.uk) using Vantify data from “1000s of live assessments”, made the same point more starkly: “closing an action is not the same as controlling a risk”. Its argument was that hazards are only genuinely dealt with when actions are completed, verified and backed by evidence, a standard that translates readily to hotels managing overdue inspections, expired certificates or patchy third-party records.

For hotel operators, then, the immediate lesson is not that every lobby is about to resemble an airport. It is that the promise made to guests at check-in increasingly depends on whether managers can show, calmly and quickly, that their building, staff, contractors and event spaces are being run with joined-up oversight. And when it comes to Martyn’s Law, the official message is clear: the sources that count are the Home Office and the SIA, not sales pitches or guesswork. (protectuk.police.uk)

Source: Noah Wire Services