What good evidence looks like

Good evidence is not a thick folder. It is a short, dated record that shows your plan is real, known and kept up to date. At the Standard Tier you do not have to keep any of it — the duty is to have working procedures, not paperwork. But evidence is how you show you have done the thinking: to a new manager, your insurer, your trustees, and in time the regulator. Here is what good looks like, and what changes at the Enhanced Tier, where documenting it and handing it over becomes the law.

Do you have to keep evidence at all?

At the Standard Tier, no. Nothing has to be written down, and nothing goes to the regulator. The guidance asks for one thing: keep your procedures under review, so they still fit as the building, the team and the events change.

So keeping a short record is a sensible choice, not a legal one — and it is worth making anyway. A plan that lives only in one person’s head is not really a plan, and “we talked about it once” is a poor answer if anyone ever asks whether you took this seriously.

What makes evidence good, not just present?

Good evidence shows three things: that the plan is real, that the right people know it, and that it is current. A few plain items cover it.

• It is current. Dated, and looked at again on a set date — keeping it under review is the one thing the guidance asks for. A record nobody has opened in three years is back to being a note in a drawer.
• It names people. Who is responsible, and who can call each procedure — not “someone”.
• People have been briefed. The staff and volunteers who would actually act have been told the plan and their part in it. Good evidence shows that happened: a date, and who was there.
• It has been tried. A short walk-through, even once, is strong evidence the plan can be carried out — not just that it is written down. A procedure that cannot be done quickly and properly is not enough on its own.
• It can be found. It is somewhere the next person can reach, not lost on one laptop. Could a new manager pick this up and act on it tomorrow?

A simple evidence set for a Standard Tier venue

You do not need a system for this. For most Standard Tier premises, good evidence is a handful of things kept together:

• the record itself — who is responsible, how you counted, and the four procedures (what a finished record looks like walks through);
• a line on who has been briefed, and when;
• the date you last reviewed it, and the next date you will;
• a two-line note of anything you changed, and why.

That is a page or two, not a binder. Keep it where the team can find it, look at it once a year, and you have good evidence. There is no equipment list, no certificate and no consultant’s report in there — see what you do not have to buy.

Who would actually look at it?

The people most likely to, in practice: a new manager taking over, an insurer asking what you have in place, or your own trustees or committee after a scare. For all of them the question is the same — could the people here act on this today? Good evidence answers yes, and shows why. And it is not a certificate or a thick document any of them are after; it is whether the plan is real, current, known and doable.

The regulator may one day as well — but we do not yet know who would look, or what they would want to see. How the SIA will inspect has not been set out in full (see below), so keep evidence for the reasons that already hold, not for a checklist nobody has published.

What changes at the Enhanced Tier?

At the Enhanced Tier, evidence stops being optional. You must document how you comply — the procedures and the measures you have in place or plan to — and keep that document up to date. You also have to assess how those measures reduce the premises’ vulnerability to an attack and the harm one could cause, and show that thinking in the document.

Then you hand it over. The document goes to the regulator — the Security Industry Authority (SIA) — as soon as reasonably practicable after you first prepare it, and again within 30 days of any change. If the responsible person is an organisation rather than an individual, a named senior individual has to be accountable for compliance; they can hand tasks to a security manager or contractor, but the responsibility stays with them.

How will the regulator check?

Here we can only go on what has been published so far — the detail is not settled. The SIA will regulate, inspect and enforce Martyn’s Law, and has said it will work on risk, using what premises and events tell it to decide where to look. It has indicated that most inspections would come with at least 72 hours’ written notice, and some, under a warrant, would not. But none of this is in force yet, and the SIA’s own guidance on how it will regulate is still being finalised. Exactly what an inspection involves, and what it would want to see, will be clearer then. There is nothing to send anyone today — the evidence you keep now is simply what you would have ready.

You have time — but no reason to wait

The duties won’t start before April 2027, but you should start now. Official sources set no fixed date — only a minimum of 24 months from Royal Assent on 3 April 2025 — so April 2027 is the earliest they could begin, and the SIA’s notification system is not open yet.

Why wait? There is no reason to. And it is not onerous: understanding Martyn’s Law takes a few hours, and at the Standard Tier putting it in place is mostly agreeing with your team what you would do. Build the record once, brief your people, set a date to look at it again — that is good evidence, and it is most of the job. If you are still working out which tier you are in, start with the 200 count.

Where the definitive answer is

For definitive information about whether your premises or event is within scope and what is required, refer to the current statutory guidance issued under the Terrorism (Protection of Premises) Act 2025.