“People come and go all day” is a fair description of a hotel and a reasonable objection to a headcount threshold. Under the Terrorism (Protection of Premises) Act 2025 you need to establish what is reasonable to expect from time to time on your site, and for a hotel that resolves into a single, concrete calculation.

It is the day everything lands at once: fully booked, conference facilities in use at their capacity, and all your staff on shift. Even if that only happens once or twice a year, that is the number to use.

The threshold is 200 or more individuals reasonably expected on site from time to time. It is not average occupancy, and it is not a snapshot of a normal Tuesday afternoon.

That is why the fluid nature of a hotel does not defeat the question. Nobody is asking you to know how many people were in the building at 3pm on a given day. The question is what a full site looks like, because that is the situation the procedures have to work in.

Clearly it can be reasonable to expect that you are fully booked. Build the figure from there:

• Every room occupied, at an average of two people per room. That average is the standard starting assumption, and it is usually closer to the truth on a busy weekend than a per-booking count would be.
• Conference and function facilities in use, and in use at their capacity. If you have the space, expect it to be full at some point in the year.
• All your staff on shift. Front desk, housekeeping, kitchen, restaurant and bar, maintenance, management. Everyone who is working when the hotel is full.
• Everything else that comes with a full house. Contractors on site, external guests at a function, anyone else you would reasonably expect to be there on that day.

This is the part that surprises people. That combination may only happen for a hotel once or twice a year — a wedding weekend, a conference, a bank holiday with the restaurant fully booked.

As long as it does happen once or twice a year, that is the number of people you should use. “From time to time” is not a frequency test. It asks what it is reasonable to expect, and a full house at a hotel that fills every summer is entirely reasonable to expect.

The figure you arrive at does two things. It settles whether the premises is in scope at all, and it settles which tier applies.

Standard tier covers 200 to 799 individuals. Enhanced tier begins at 800. For most hotels the answer is standard tier, but a large site with substantial conference and function space can genuinely reach the enhanced figure on a full day — which is precisely why the calculation is worth doing carefully rather than estimating.

The two tiers carry different duties, and the difference between standard tier and enhanced tier is worth understanding before you settle on a number.

One point of care. Asking what a conference room holds when it is in use at capacity is a component of estimating the people you expect on a full day. It is not the scope test itself.

The test is expected attendance, not the capacity of the building. A fire capacity figure for the hotel is a different number arrived at for a different purpose, and it is not what decides your position. Nor is precision expected: the duty is a reasonable estimate from what you already know — booking records, function diaries, staff rotas. Our Am I in Scope? tool asks for the attendance you expect and returns your scope position from it.

A standard tier premises needs four public protection procedures in place so far as is reasonably practicable — evacuation, invacuation, lockdown and communication, as four distinct items. That standard is not a size test: it weighs the likely effectiveness of a procedure against the burden of putting it in place, taking account of the nature and use of the premises, its location, its visitor profile, the resources available and the mitigation already there. A twelve-room inn and a 300-bedroom hotel will produce very different documents, and both have to show they asked the same questions.

Nothing is submitted to the regulator for approval at standard tier, and you have to be able to evidence those procedures if you are inspected.

Prova Risk works out what is reasonably practicable for your site, builds all four procedures around it, holds the training and exercise records, and produces a single compliance document you can put in front of a regulator. £399 per year per site.

• Counting peak attendance rather than an average week
• Counting attendance without a clicker on the door
• Which hospitality premises are covered, and does a beer garden count?
• Capacity is not the same as expected attendance
• Martyn’s Law scope and tiers
• Martyn’s Law for multi-site organisations
• Martyn’s Law hub