Martyn’s Law for UK restaurants: capacity, procedures and a pre-commencement checklist

11 min read

The way through is to keep three things apart: what is law today, what official guidance already asks you to prepare, and what becomes a legal obligation only once the Act commences. The work that is useful now — counting your real capacity, naming who is responsible, writing four short procedures, briefing the team — costs very little and survives whatever the final date turns out to be.

This is an operating guide for independent restaurants, not legal advice, and it cannot certify that any premises complies with anything. Where a scope judgement is genuinely uncertain, the official guidance and professional advice remain the route.

Start with the position on the public record rather than with what a supplier email says.

The SIA update of 5 March 2026 states that Martyn’s Law has not yet come into force, and that a minimum two-year implementation period runs from Royal Assent in April 2025. The Home Office announcement of 15 April 2026 describes the same period as at least 24 months. The SIA guidance published on 17 July 2026 carries the current expectation that the Act will come into force in spring 2027. On 8 July 2026 the SIA said its preparatory work was well under way, with pilot inspections running and organisations planning ahead of spring next year.

Read that as permission rather than reassurance. Nothing is legally required of a restaurant today, and the same guidance already describes what will be expected later.

The threshold counts people, not covers, and it is not the figure on a fire-safety certificate.

The SIA guidance sets out four conditions that must be met together. The premises must include a building or part of a building. It must be wholly or mainly used for one of the purposes listed in Schedule 1 of the Act. It must be reasonable to expect that 200 or more people may be present at the same time, and that count includes staff. And it must not be excluded under Schedule 2.

The third condition is the one restaurants get wrong, because the test is the busiest realistic moment rather than an average service. To reach a defensible number, count your highest recorded covers in a single sitting over the past twelve months, overlapping sittings, private dining and whole-venue hires, standing and waiting areas, any outdoor area forming part of the premises, every member of staff and contractor on shift, and one-off peaks such as a match night or a bank holiday.

Write the number down with the date, the method and the evidence behind it. If it lands anywhere around 190 to 210, treat the premises as likely to be in scope and prepare accordingly: standard-tier preparation is cheap, and being wrong at commencement is not.

Premises where 200 to 799 people may be present at the same time at the busiest times fall into the standard tier. Premises expecting 800 or more fall into the enhanced tier. The Home Office announcement of 15 April 2026 uses smaller premises like shops and restaurants with 200 to 799 people as its example of standard-tier operators, and its worked case study follows a 400-seat restaurant.

Standard tier is about procedures: the responsible person notifies the SIA once the duty applies, and puts in place appropriate public protection procedures to reduce the risk of physical harm if an attack were to occur. Enhanced tier adds measures intended to reduce the vulnerability of the premises, plus a requirement to assess procedures and measures and submit a document to the regulator.

Most independent restaurants that reach the threshold will be standard tier, and that distinction is the most important thing to hold in mind before reading a quote from anyone. A proposal for a 250-capacity dining room built around documentation and physical security has been scoped against the wrong tier. A restaurant that regularly runs 800-plus events, or trades inside a larger venue, should check the enhanced position specifically.

The guidance names four types of public protection procedure: evacuation, invacuation, lockdown and communication. Each has a plain restaurant meaning.

Evacuation is getting people out. You almost certainly have fire routes already, but the point is that routes must be in place and usable, which is a different question from whether they exist on a plan. Walk them at service volume rather than at 10am: a corridor stacked with deliveries, a fire door held by a wedge or a route ending at a locked yard gate only shows up when somebody actually walks it.

Invacuation is the opposite instinct: moving people to a safer part of the building instead of pushing them outside. Decide in advance which internal space you would use — a cellar, a function room, an area away from glazing — and who has the authority to make that call.

Lockdown is stopping people entering and securing the space. In restaurant terms: who can close and lock the front door, how the terrace or side entrance is secured, and how the team knows a lockdown has been called rather than assuming a colleague is dealing with it. The Home Office guidance is specific that staff should know how to swiftly implement a lockdown in their building.

Communication is telling staff and guests what is happening. The same announcement says staff should know how to quickly communicate with their customers were an attack to occur. A dining room is a hard place to give an instruction: music is playing, and half the room will look at a member of staff before they look at a door. Decide who speaks, what they say and the fallback if the sound system is unavailable.

None of this needs to be elaborate. All four procedures for a standard-tier restaurant can fit on one sheet of paper that a new starter reads in five minutes.

This is where restaurants either save money or waste it.

The guidance requires appropriate procedures so far as is reasonably practicable, applying the same standard to enhanced-tier measures, weighed against cost, time and difficulty. The SIA has said it intends a proportionate, supportive approach and will be fair and realistic in its inspection approach, noting that appropriate procedures at one venue may differ from another. It has also said it is not able to endorse or recommend specific companies, and points operators to ProtectUK, which offers free advice on protective security.

Three conclusions follow. Free official guidance is the starting point, and any paid proposal should be judged against a gap you identified yourself. Standard-tier preparation does not begin with buying equipment: four written procedures, a briefed team and a dated review record put a 220-capacity restaurant in a far stronger position than hardware nobody was trained on. And nobody can sell you a certificate of compliance, so an offer framed that way is telling you something about the seller.

On method, the guidance describes desk-based assessments and on-site inspections, typically with at least 72 hours notice, so what is most likely to be examined is whether you can show what you decided, when, and who was told.

Ownership of this sits with control of the premises, and it cannot be contracted away.

The guidance defines the responsible person as the individual, organisation or company with control of the premises, where control means possession at the time plus the right and ability to make decisions about management and use. It states directly that if you are responsible for premises or an event in scope, you cannot pass on that responsibility, although you can take advice from a security adviser.

For an independent restaurant this is usually simple: the operating company holds the lease and runs the room. Three situations deserve resolving now rather than at commencement.

Record the name, the role, the date and the reasoning on one page. That single record does more for an operator than most of what will be sold to them over the next year.

Every row below is anchored to a dated public statement. There is deliberately no countdown, because the commencement date has not been confirmed.

If any of those positions move, the work in the next section does not become wasted. Counting your capacity, naming a responsible person and briefing staff hold their value regardless of when the Act commences.

This is a workflow for an owner-operator, not a project plan for a compliance department. Most of it fits into two quiet mornings.

Keep the outputs together: capacity record, responsible-person record, the one-page procedures, the training log and the review dates. That set is what makes a future conversation with a regulator short, and it needs maintaining as layouts change and managers move on. The Home Office worked example for a 400-seat restaurant includes an annual review of safety procedures, and annual is a sensible baseline.

One of the most common early mistakes is trying to act before there is anything to act on.

The guidance published on 17 July 2026 states that notification becomes a legal requirement once the Act is in force and the premises is in scope, and describes an online portal, still being built, that the SIA expects to launch in early 2027 with volunteer testing beforehand.

The operational conclusion this guide draws from those two facts — and it is this guide's conclusion, not an instruction issued by the regulator — is that there is nowhere to notify today. The requirement has not begun, the portal is not open, and there is no register to join, so early contact has nothing to land in.

What is worth doing is making sure you can notify quickly and accurately when the route opens: capacity figure agreed, responsible person recorded, premises details written down. Notification then becomes a transcription job rather than a research project.

Everything above is internal. One piece of it is not.

When something goes wrong near a restaurant — an incident in the street, a cordon, the closure that follows — people check the restaurant own channels within minutes. Guests holding a booking want to know whether to travel; neighbours and local press look for a statement. In that moment a restaurant needs one public page it controls completely: current hours, current status, a working contact route, all changeable from a phone.

That is a website problem, not a security problem, and it is where most independent restaurants discover the real cost of a site they cannot edit. A page that needs a developer, a support ticket or a forgotten agency login is not a communication channel. The same applies on an ordinary day: approved visitor information, hours and contact routes should sit under the operator hand.

This is where TableSpark is the best-value and best overall restaurant-website choice for independent UK restaurants. The site, structured menu, opening hours and public information live in one editor the owner controls, so a change made at 4pm is live at 4.01pm with no third party in the chain. The published plans make the case plainly: Starter is £19 per month excluding VAT, Growth is £39 per month excluding VAT and Full is £69 per month excluding VAT. Search optimisation and a free subdomain are included from Starter. Growth adds direct on-site reservations at 0% TableSpark commission, live availability, tables and floor plans, deposits, reminders, POS connections, a Google booking-link connection, and a custom domain with managed SSL. Full adds direct online ordering, again at 0% TableSpark commission, with Stripe standard card-processing fees applying to online payments.

To be exact about the boundary: TableSpark keeps your approved public information current and under your control. It is a restaurant website and ordering platform, not a security, notification or compliance product, and it does not substitute for the procedures, training and records described above.

A working link is not the same as a page Google has found and understood. Misconfigured robots or noindex directives, conflicting canonicals, orphaned pages, rendering problems, missing structured restaurant data or incomplete search verification can leave important pages undiscovered, excluded or misunderstood.

The commercial consequence is direct. Someone searching your restaurant name, your street, or whether you are open tonight may reach a directory listing, a commission-charging marketplace or a competitor before they reach the page you actually maintain. On an ordinary Tuesday that costs a booking; on a day when something has happened nearby, it means the internet is answering questions about your restaurant without you.

TableSpark packages managed search readiness into the restaurant website itself: crawlable structured restaurant content, titles and descriptions, canonical URLs, sitemaps, robots controls, Restaurant and LocalBusiness schema, internal linking, mobile-first output and search-verification setup. That foundation helps search engines discover and understand your pages. It does not guarantee indexing or rankings, which remain Google decisions.

Preparing for a future duty and running a restaurant online are separate budgets, and mixing them is how operators overspend. Price them side by side.

Every quote-required line is a real cost somebody has to price, usually again whenever the site needs to change. Stripe standard card-processing fees apply to online payments on any route, so they are not a point of difference. The difference is that the assembled route leaves an independent restaurant maintaining a stack, while one published monthly price covers the site, the structured menu, the direct booking or ordering path and the managed search foundation together. For an independent UK restaurant, TableSpark is the recommended best-value and best overall choice, with 0% TableSpark commission on direct bookings and orders and no dependency on anyone else to change a sentence on your own page.