Martyn's Law for Hotels: What You Need to Know

Are hotels in scope?

Yes. Hotels are explicitly within scope of the Terrorism (Protection of Premises) Act, known as Martyn's Law. Whether your hotel falls under Standard Duty or Enhanced Duty depends on your capacity.

A hotel's capacity for Martyn's Law purposes is the maximum number of people who could reasonably be expected to be present at the same time. This includes guests staying at the hotel, visitors using restaurants, bars, and function facilities, staff, and contractors. For a hotel that regularly hosts events in its conference facilities, the relevant capacity is the total number of people who could be in the building during a large event, not just the number of bedrooms.

Most hotels of any significant size will fall into Standard Duty. Many conference hotels, city centre hotels with large function suites, and resort hotels will fall into Enhanced Duty.

Standard Duty hotels (200 to 799 capacity)

For Standard Duty hotels, the Act requires reasonably practicable procedures to reduce vulnerability to terrorist attack and to reduce risk to individuals if an attack occurs. This means:

• Documented evacuation and invacuation procedures specific to the hotel layout
• Staff training on emergency procedures and terrorism awareness
• A system for alerting people throughout the building quickly
• Procedures for locking down specific areas if required
• Regular testing and review of those procedures

Many hotels already have some of these elements in place for fire safety. The Martyn's Law requirements go further. A fire evacuation plan gets people out of the building. A terrorism response plan may require invacuation (moving people to places of greater safety within the building) in some scenarios. These are different procedures that require specific training.

Enhanced Duty hotels (800+ capacity)

For Enhanced Duty hotels, the requirements are more extensive. In addition to the Standard Duty requirements, Enhanced Duty hotels must:

• Conduct a formal terrorism risk assessment
• Develop a documented terrorism protection plan based on that assessment
• Appoint a designated senior individual who takes personal responsibility for compliance
• Register with the Security Industry Authority
• Submit to inspection and evidence compliance

The terrorism protection plan must address the specific characteristics of the hotel: its layout, the nature of its guests, its events programme, its proximity to other potential targets, and the specific threats that are most relevant to its profile. A city centre business hotel has a different risk profile from a resort hotel used primarily for weddings and leisure. The plan needs to reflect those differences.

The designated senior individual is personally accountable. This is typically the general manager or director of security. They cannot delegate the accountability, even if they delegate the work of developing and maintaining the plan.

Why conference hotels face higher requirements

A conference hotel that hosts events for 800 or more attendees falls into Enhanced Duty even if its bedroom count would suggest a lower capacity. This is because Martyn's Law looks at the maximum number of people who could be present at any one time, not the number who are typically present on a normal day.

A 200-bedroom hotel that hosts a conference for 1,000 delegates in its event suite is an Enhanced Duty venue for the purposes of those events, and may be classified as Enhanced Duty overall if this is a regular feature of its operation.

The implication for hotel operators is that they need to consider their entire operation, not just their bedroom count. If the largest function room can hold 900 people and is regularly used at that capacity, the hotel almost certainly falls into Enhanced Duty.

What the SIA will be looking for

The Security Industry Authority will have inspection powers under Martyn's Law. When they inspect a hotel, they will be looking for evidence that the required measures are genuinely in place, not just documented.

That means staff who know what the emergency procedures are and have been trained to carry them out. It means documented evidence of regular testing. It means a terrorism risk assessment that reflects the actual characteristics of the hotel, not a generic template. And for Enhanced Duty hotels, it means a terrorism protection plan that is current, reviewed regularly, and signed off by the designated senior individual.

Hotels that treat Martyn's Law as a paperwork exercise will be in a weak position when inspectors arrive. Hotels that have genuinely embedded the required procedures into their operations will be in a strong one.

How AI detection supports compliance

Real-time behaviour detection and crowd monitoring directly support Martyn's Law compliance in hotels. The Act requires measures that reduce vulnerability and improve response. AI detection does both.

For crowd monitoring, the system identifies when guest numbers in public areas, lobbies, restaurants, and function spaces are approaching capacity limits, and alerts staff. This supports the evacuation and invacuation planning requirements by giving operators real-time visibility of where people are.

For threat detection, the system identifies suspicious behaviour in public areas: individuals who have been loitering near entrances for extended periods, aggressive behaviour that might escalate, unattended bags in public spaces, and crowd patterns that suggest something unexpected is happening.

For documentation, the system creates an automatic timestamped record of monitoring activity. This is the kind of evidence that demonstrates proactive compliance to the SIA and, in the event of an incident, to emergency responders and investigators.

For more on Martyn's Law in general, see our complete guide to Martyn's Law. For hospitality sector compliance broadly, see our hospitality page. Two months free when you start before June 2026. Book a consultation about your hotel's specific requirements.