You've probably heard of Martyn's Law, decided it sounds like something for stadiums and shopping centres, and moved on. For most independent cafés that's roughly right, but not entirely. The capacity rules are easier to trip over than you'd think.

This is the honest read. No fear-mongering, no upsell, just what you need to know in 2026 and what you can safely ignore.

Where the law came from

Martyn's Law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. His mother Figen Murray has campaigned for nearly a decade for venues to have a clear, baseline duty to plan for an attack. The Terrorism (Protection of Premises) Act received royal assent in April 2025.

The principle is simple. Publicly accessible venues should have thought about what they'd do if something went wrong, and staff should know the plan. It is not a counter-terrorism regime aimed at corner cafés.

The two tiers

The Act creates two tiers, based on the capacity of the premises, not the number of seats, not the average covers, not your busiest Saturday.

Standard tier: premises with a capacity of 200 to 799 people
Enhanced tier: premises with a capacity of 800 or more

Most independent cafés sit below the standard threshold and have no duties under the Act. Some will sit just inside it. Almost none will hit enhanced. If you're enhanced tier you already know it, and you'll be working with security consultants, not reading this blog post.

The rest of this piece is written for operators near or just over the 200 line.

What "capacity" actually means

This is where people get caught out. Capacity under the Act is the maximum number of individuals who may be present on the premises at the same time, including staff. It's not your covers. It's not your fire occupancy figure exactly, but fire safety occupancy is the closest proxy most operators already have.

Three areas where the number creeps up on you:

Mezzanines and first-floor seating count
Outdoor seating and garden areas that are part of your premises count
Function rooms or event spaces count, even if you only use them occasionally

A 70-cover ground-floor café with a 60-cover upstairs, a 40-seat terrace, 8 staff on shift, and a small private events room can drift over 200 quickly. Run the numbers honestly. If you're confidently under, you can stop reading and get back to work. If you're within 30 or so of the line, keep going.

Standard tier obligations

If you fall into the standard tier, the duty is genuinely lighter than the headlines suggest. There is no inspection regime, no licensing requirement, no specific equipment to buy, and the SIA is not going to turn up at your café.

You need to do four things.

1. Identify a responsible person

That's almost certainly you, or your general manager. One named individual who owns this. They don't need a qualification. They need to know the building and the team.

2. Have four public protection procedures

These are the heart of standard-tier compliance. They don't have to be lengthy. A page each is plenty for most cafés.

Evacuation: how you get people out and where they go. You already have this for fire. Document it with terrorism in mind too, which usually means having a secondary route in case the primary exit is the threat.
Invacuation: moving people into the building or to a safer internal area when the threat is outside. For a high-street café this is often the back-of-house or a windowless prep area.
Lockdown: how you secure the premises, who locks what door, how you stop new arrivals entering.
Communication: how staff alert each other and guests. A code word, a radio channel, a group chat. Not a 50-page comms plan, just clarity on who says what.

3. Document the procedures

A simple written record. Stored somewhere staff can actually find it, not buried on a shared drive nobody opens.

4. Make sure staff are aware

Brief the procedures at induction and revisit them in your usual team meetings. The bar here is awareness, not training certification.

What you do not need to worry about

Things the Act does not require for standard-tier venues:

Bag searches, metal detectors, or specific CCTV coverage
Bollards or physical security upgrades
Counter-terrorism training certificates
A security manager
A licence or registration with any authority

If a vendor is selling you any of these as "Martyn's Law compliance" for a 220-capacity café, they are selling fear, not compliance.

When does it actually go live

Royal assent was April 2025. The Act includes an implementation period of at least 24 months before duties commence, putting the realistic go-live date around April 2027.

So you have time. But two reasons to start preparing in 2026 rather than waiting. The four procedures take a few hours to write once and then sit on the shelf, much easier in calm time than under a deadline. And if you're near the 200 threshold, you want to understand your real capacity now so you're not caught off guard later.

Where it fits in the 2026 compliance load

I'll be honest, this is yet another thing landing on operators who are already managing the April 2026 cost cliff across wages, NICs, and business rates, the Employment Rights Act 2025 changes, and the usual day-to-day. The good news is Martyn's Law is one of the cheaper items on that list to deal with properly. A few hours of thinking, four short procedures, a staff briefing.

The same logic applies as with food hygiene: the things that actually move the needle are the simple operational habits, not the binder of paperwork. A team that genuinely knows what to do beats a perfect document nobody has read.

Practical steps for an independent in 2026

A pragmatic order of operations.

Step 1: Calculate your honest capacity

Walk the premises. Add up ground floor, first floor, mezzanine, outdoor seating that belongs to your premises, any event space, plus typical staff on shift. Compare to 200. If you're comfortably under, file a note and move on. If you're within striking distance, treat yourself as standard tier and prepare.

Step 2: Write the four procedures

One page each. Plain English. Reference real locations in your building. Photos help. Don't outsource this to a generic template, because the value is in knowing your building, not in having a polished PDF.

Step 3: Brief the team

Add a short Martyn's Law section to your induction pack. Cover the four procedures in a team huddle. Run a quick walk-through of the evacuation and invacuation routes. Use the same muscle you already use for closing checklists and staff accountability, the rhythm of clear procedures becoming second nature through repetition.

Step 4: Review yearly

Stick a calendar reminder for an annual review. Buildings change, layouts change, teams change. Five minutes a year keeps it current.

The bottom line

Martyn's Law is not the burden the headlines suggest, but it isn't nothing either. For most independent cafés the answer is "we're below the threshold, here's the note showing why". For the operators just over the line, it's a few hours of clear thinking, four short procedures, and a confident team. No kit to buy, no licence to chase, no inspector at the door.

If you're going to do one thing in 2026, walk your premises this week with a notepad and work out your honest capacity. Everything else flows from that number.

Ed O'Brien has run Hunters Cake Company for 17 years across cafés in Witney, Burford, and a bakery in Carterton, Oxfordshire. He's building Brikly - modular tools that give independent café owners the same data the big chains have, without the big chain price tag.