You do not need somebody stood on the door with a clicker. When you are calculating how many people it is reasonable to expect on your site, the Terrorism (Protection of Premises) Act 2025 is not trying to drive any organisation into employing someone to count people in and out.

What it asks is that you can show you have taken all reasonable efforts to establish what your peak level of attendance regularly is. That is a standard about effort and honesty, not about precision.

This is worth saying clearly, because the assumption behind the question is usually that compliance starts with buying something. It does not. The legislation certainly does not want to drive any organisation into employing somebody whose job is counting customers in and out with a clicker. That is not what they want to see.

The duty at standard tier is about procedures — people knowing what to do, and being able to show it. Establishing your expected attendance is the step before that, and it is a desk job rather than a staffing decision.

The test is whether you have made a genuine attempt to establish the peak level of attendance your site regularly sees, using the evidence available to you.

In practice that usually means the records you already hold and the knowledge you already have:

• Records you already keep. Historic footfall, event records, whatever the site has gathered for its own purposes over the last year or two.
• The nights you already know about. The fixtures, functions and occasions that reliably fill the place. You do not need data to know which they are.
• Everyone on site, not just customers. Staff on shift, contractors in for the day, anyone volunteering at an event.
• Your outside space. Gardens, terraces and yards are part of the premises, so they are part of the figure.

A single-room pub and a multi-floor venue are both asked the same question: did you make a reasonable effort with what you had? The answer is not scaled to turnover or headcount, and a small site is not excused from asking, any more than a large one is required to install something to answer it.

The method for getting to the figure — peak rather than average, and where the evidence usually comes from — is the companion to this question, and worth reading alongside it.

Here is the part that changes how you should approach a close call. If you are verging on that 200-person threshold, the regulator will do their own calculations based on the evidence that they can find.

That is not a threat and it is not unusual — it is simply how a threshold question gets settled when two parties are looking at the same site. It does mean that a figure chosen because it happens to land at 190 is a fragile thing to build a position on.

So the advice is straightforward. Do not go for the lower calculation if there is a reasonable way to go for the higher one. Where two honest estimates are available, work from the higher figure if that puts you in scope of the legislation.

The asymmetry is what makes this easy. Being in scope with four public protection procedures written, exercised and evidenceable is a settled, comfortable position. Sitting just outside scope on the most generous possible reading of your own numbers is a position that has to be defended, and it can unravel on somebody else’s arithmetic.

Counting high also tends to be the more useful answer operationally. A procedure written for your busiest night works on a quiet one. The reverse is not true.

Our Am I in Scope? tool asks for the attendance you expect and returns your scope position from it. If you are in scope, the duty is four public protection procedures in place so far as is reasonably practicable — evacuation, invacuation, lockdown and communication, as four distinct items. Nothing is submitted to the regulator for approval at standard tier, and you have to be able to evidence those procedures if you are inspected.

Doing that work this year means you set your own pace rather than compressing it, and you get to exercise the procedures properly before compliance is expected in April 2027.

Prova Risk works out what is reasonably practicable for your site, builds all four procedures around it, holds the training and exercise records, and produces a single compliance document you can put in front of a regulator. £399 per year per site.

This answer comes in two parts. The clip below is the companion to the one above.

• Counting peak attendance rather than an average week
• Which hospitality premises are covered, and does a beer garden count?
• “We run a hotel — people come and go all day”
• Do I need to hire a security guard to comply with Martyn’s Law?
• Does Martyn’s Law only apply to large premises?
• The 200-person threshold under Martyn’s Law
• Martyn’s Law hub