Martyn's Law Readiness Workspace for Standard-Tier Venue Groups
One-line thesis — Build a lightweight, site-by-site Martyn's Law readiness and evidence workspace for UK independent venue, hospitality, visitor-attraction, and event operators with multiple standard-tier premises; sell the initial wedge through security/compliance consultants and trade-association content rather than pretending software replaces judgement.
opportunity / idea_filter. The law creates a mandatory, date-bound operational readiness job across many public premises. The best product is not “legal compliance certification” or an enterprise security platform; it is a practical workspace that helps operators know which sites are in scope, keep public protection procedures usable, brief staff, run tabletop/drill activity, and produce a clean evidence pack if the SIA, insurer, board, landlord, council, or consultant asks what has been done.
This is a buildable but narrow compliance wedge. Pain is real because Martyn's Law is now statute, has a likely 2027 enforcement window, applies to a broad long-tail of public premises, and forces site-specific judgement around capacity, responsibility, procedures, and staff awareness. But the standard tier was deliberately redesigned to be “simple, low-cost” and “low-to-no financial cost,” so many single-site operators will tolerate free checklists, Word templates, ProtectUK resources, and one-off consultant help.
The paid opportunity is strongest where the same responsible person must manage many uneven sites: small venue groups, pub/restaurant groups, hotels with event spaces, visitor attractions, arts/community venue networks, and consultants with 10-100 client premises. These buyers do not need Enablon or an enterprise resilience suite. They need a repeatable readiness tracker: scope/capacity decisions, named responsible person, evacuation/invacuation/lockdown/communication procedures, training/action logs, review cadence, tabletop/drill records, and exportable evidence.
Best first ICP: security/compliance consultants and fractional risk advisers serving independent venue/hospitality groups.
Why consultants first:
Best direct operator ICP: UK operators with roughly 3-50 public premises where some sites plausibly cross the 200-person threshold from time to time. Good segments: independent music/theatre/cinema groups, pubs/restaurants with large gardens/function rooms, hotels/event spaces, visitor attractions, leisure/activity venues, faith/community-hall networks, and local event operators that repeatedly use public premises.
Weaker initial ICPs:
The authoritative facts are strong. The Home Office factsheet says the Terrorism (Protection of Premises) Act 2025, also known as Martyn's Law, received Royal Assent on 3 April 2025. It says the government intends an implementation period of at least 24 months before the Act comes into force and that statutory guidance was published on 15 April 2026. It also states that standard-tier premises are those where it is reasonable to expect between 200 and 799 individuals, including staff, may be present at the same time.
The standard-tier duty is operational rather than capital-intensive. ProtectUK says the responsible person for standard-tier premises must notify the SIA and ensure appropriate public protection procedures are in place, so far as reasonably practicable. The four procedure types are evacuation, invacuation, lockdown, and communication. ProtectUK also says the standard-tier requirements are centred on “simple, low-cost activities with costs relating primarily to time spent.” That weakens the case for expensive software, but strengthens the case for a low-friction workflow tool priced below consultant-heavy alternatives.
The statutory guidance creates the core product wedge: written procedures alone are not enough. It says the responsible person should have confidence that procedures can be implemented rapidly and effectively, including staff awareness of procedures and roles; it says “it is not sufficient to have a written procedure” that staff cannot implement. It also says it is good practice for even the simplest procedures to be documented and suggests a readily accessible grab bag or incident-response kit with emergency contacts, staff lists, floor plans, or other critical documents. That points directly to a site evidence workspace: not just a template, but current people, plans, actions, and records.
The standard-tier consultation evidence shows scope and buyer breadth. The Home Office estimated 278,880 standard-tier premises, mostly retail and hospitality (65%), places of worship (16%), and schools (11%). It estimated 55.1% are operated by micro businesses/organisations, 13.4% by small businesses/organisations, 10.3% by medium businesses, and 21.2% by large businesses/organisations. This is a broad market, but much of it is price-sensitive; the best software target is the multi-site/operator-consultant slice, not the whole universe.
The same consultation also quantifies the cost as time rather than spend: an estimated £160-£525 per site per year, central estimate £310, mostly working hours for counter-terrorism planning and training. That is awkward for a SaaS: if official expected cost per site is only hundreds of pounds annually, pricing must be lightweight. But it also validates an efficiency sell: a £20-£50/site/month workspace is difficult for micro single-sites, while consultant bundles or multi-site dashboards can be justified if they save repeated manager hours and reduce evidence chaos.
Enforcement is credible but not panic-level. The consultation says the regulator can issue compliance notices and monetary penalties for standard-tier premises, with an original fixed penalty not exceeding £10,000 and possible daily penalties up to £500 for continued non-compliance. The British Safety Council says enforcement is expected to be proportionate and risk-based, with SIA requesting information, reviewing plans/procedures, and carrying out inspections where appropriate. This supports “be inspection-ready” messaging, but over-selling existential risk would be misleading.
The pain-language pattern is emerging in vendor and checklist content. StandardTier.co.uk frames a key operational question: if an SIA inspector asked a random team member to explain the evacuation procedure, could they? Its checklist emphasizes capacity assessment, responsible-person identification, staff briefings, records of training, procedure review dates, and changes after layout/refurbishment/staff turnover. Martyn's Law Software explicitly says standard-tier venues need capacity calculation, public protection procedures, staff training, and drills with evidence, and says drill records are what the SIA will likely ask for first. VenueLinQ positions “No consultants. No guesswork,” “audit-ready evidence,” “staff training records with acknowledgement tracking,” version control, and evidence pack generation. These are commercial signals that others see the same workflow gap.
The timing is unusually clean for a small compliance product:
The market will likely have two buying waves: first, consultants and proactive multi-site operators in 2026; second, laggards and insurers/brokers/trade bodies pushing readiness as enforcement gets close.
The MVP should be a site readiness workspace, not a generic document generator.
Core objects:
The wedge phrase: “Know every site’s Martyn's Law status and produce a clean readiness pack in five minutes.”
Weekend-buildable v1:
1. Premises inventory with CSV import and site status.
2. Guided standard-tier scope/capacity questionnaire.
3. Four public-protection-procedure template builder with version history.
4. Staff briefing log: manual roster, acknowledgement links/QR, evidence upload.
5. Action tracker with due dates and per-site owners.
6. Review/exercise log with notes and attachments.
7. One-click evidence pack export.
8. Consultant dashboard: clients, sites, overdue items, white-label export cover page.
Do not start with AI-generated legal advice, CCTV/security hardware recommendations, live incident management, mass notification, or “SIA approved” claims. Those increase risk and competition. Start with workflow, evidence, reminders, and exports. Optional AI can later summarize gaps or draft procedure text from structured inputs, but every output should be editable and clearly non-legal guidance.
Best initial wedge: consultant-led readiness audits.
Offer a free “standard-tier readiness pack generator” for consultants: they run a workshop, import client sites, generate a gap report, then invite the client into the workspace for ongoing evidence. Price the consultant seat and client-site count. This aligns incentives: consultants remain the expert; the product becomes the system of record.
Direct channels:
Landing-page language should mirror the evidence:
Substitutes today:
The product gap is not “nobody has noticed Martyn's Law.” They have. The sharper gap is multi-site standard-tier operational readiness for independent operators and consultants, priced and scoped below enterprise resilience tools, more durable than a PDF checklist, and careful enough not to imply official endorsement.
Recommended pricing:
Be cautious about pricing per employee; standard-tier obligations are site/procedure/readiness driven, and many venues have casual staff turnover. Site-count pricing maps better to pain and official per-site cost estimates.
1. Standard tier may be too low-burden for strong SaaS urgency. The government intentionally reduced requirements; there is no standard-tier legal requirement to submit a detailed written plan to SIA in the same way enhanced-tier premises document measures. The pitch must lean on multi-site coordination, evidence, and avoiding stale procedures, not on overblown paperwork.
2. Official guidance and free resources are good enough for many buyers. A free checklist plus ACT e-learning may satisfy single-site operators. Narrow the ICP.
3. Consultants may prefer billable manual work. Counter-position the product as recurring revenue and better client retention, not consultant replacement.
4. Niche competitors are already appearing. Martyn's Law Software, StandardTier.co.uk, and VenueLinQ show the category is forming. Differentiation must be consultant/multi-site workflow and evidence operations, not just another checklist.
5. Regulatory interpretation can change. SIA guidance and notification systems are still developing. The product needs content governance, update logs, and careful disclaimers.
6. Trust/security sensitivity. Premises layouts, lockdown procedures, contact lists, and security actions are sensitive. Role-based access, secure exports, and UK/EU data posture matter from day one.
7. Sales timing risk. The market may not buy until closer to enforcement. Use waitlist, audits, free scope checker, and consultant pilots now; expect conversion pressure in late 2026/early 2027.
The strongest evidence is official: Royal Assent, implementation period, standard-tier scope, duties, enforcement mechanisms, and government cost estimates. The medium-strength evidence is commercial: multiple vendors are already targeting audit trails, training evidence, and checklist workflows, which validates demand but also introduces competition. The weakest evidence is first-person buyer pain from actual venue managers; search results surfaced more official/vendor/legal commentary than forum-style complaints. Before building, validate with 15-20 UK security consultants, operations directors at 5-30-site venue/hospitality groups, and association/risk-control people. Ask what they are using now, who owns Martyn's Law internally, whether they will brief staff centrally or site-by-site, whether insurers/boards are asking, and whether they would pay for evidence exports or only for consultant advice.
Real recurring multi-site workflow, but it still risks being a narrow UK compliance tracker that distributes harder than it builds.