Martyn’s Law and Your Front Door: What Building Access Has to Do with the Terrorism (Protection of Premises) Act

Martyn’s Law doesn’t mention building access control by name, but the law’s whole premise is about reducing harm at the point where the public comes in, which makes your front door one of the first things worth looking at, not an afterthought once the paperwork’s done.

Illustrative diagram: Martyn's Law and building access, covering Standard Tier, Enhanced Tier, controlled entry and lockdown capability.

What Martyn’s Law actually requires

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent in April 2025. The government has said it intends an implementation period of at least 24 months before the duty becomes enforceable, so compliance is currently voluntary, with enforcement realistically expected from around spring 2027. It applies in two tiers based on the number of people reasonably expected on the premises at once: Standard Tier covers premises expecting 200 to 799 people and requires “reasonably practicable” public protection procedures; Enhanced Tier applies at 800 or more and adds a requirement to reduce the premises’ own vulnerability to an attack, documented and reported to the Security Industry Authority, who regulate compliance under the Act.

Where access control fits in

The law requires public protection procedures “reasonably expected to reduce the risk of physical harm” if an attack occurred. Evacuation, invacuation, lockdown and communication come up most often in guidance, invacuation meaning moving people to safety within the building rather than out of it, and we’ve covered the communication side in detail on our own Martyn’s Law Communication Readiness page. But knowing who’s actually in the building, controlling how people move between zones, and being able to lock a specific area down quickly are access control jobs as much as they’re communication ones. A door that only unlocks with a fob, and a system that can lock a zone from one place in an emergency, is a physical procedure in exactly the same sense that evacuation signage is.

What “reasonably practicable” means for a front door

The Act explicitly scales expectations to the premises’ size and resources, a 250-capacity venue isn’t expected to run the same measures as an 800-plus Enhanced Tier site. For most Standard Tier premises, that likely means sensible basics: controlled entry points rather than every door standing open to the public, a reasonable way of knowing roughly who’s inside at a given time, and a lockdown capability covering at least the main public areas. It doesn’t mean a fully biometric, airport-style access-controlled building for a 300-capacity venue.

What to do before enforcement starts

With implementation running to at least spring 2027, premises expecting 200 or more people have a genuine window to assess their current access arrangements against the duty, rather than scrambling once it’s actually enforceable. That means working out which tier realistically applies based on expected capacity, not maximum theoretical capacity; auditing existing entrances and access control for whether they’d actually support a lockdown or controlled evacuation if needed; and aligning that with your existing fire strategy, the subject of our guide to BS 7273-4: rather than treating fire safety and security as two unrelated projects.

The bottom line: Martyn’s Law is a communication, procedure and physical access challenge together, not a separate access control standard on its own. If your premises expects 200 or more people, it’s worth treating entrances and access control as part of the same assessment as evacuation and lockdown procedures, with time before enforcement to fix what needs fixing rather than scrambling after the fact.

See our Building Access Systems page for how we scope door entry, access control and visitor management together, or Martyn’s Law Communication Readiness for the screens, speakers and network side of the same duty.

Questions worth asking

FAQ

Does Martyn’s Law require us to install specific access control equipment?

No, the Act doesn’t name specific technology or products, it requires “reasonably practicable” procedures proportionate to your premises. For many Standard Tier premises that’s about reviewing how entrances and existing systems would support a lockdown or controlled evacuation, not buying a prescribed access control system.

What’s the difference between Standard and Enhanced Tier?

Standard Tier applies to premises expecting between 200 and 799 people at a time and requires reasonably practicable public protection procedures. Enhanced Tier applies at 800 or more and adds a requirement to reduce the premises’ vulnerability to an attack, with documentation reported to the Security Industry Authority. Both are based on realistic expected capacity, not maximum theoretical capacity.

When does Martyn’s Law actually come into force?

The Act received Royal Assent in April 2025, and the government has said it intends an implementation period of at least 24 months before the duty becomes enforceable, meaning compliance is currently voluntary, with enforcement realistically expected from around spring 2027. Checking now gives you time to fix gaps before that point rather than after.

How does this relate to Efficient IS’s Martyn’s Law Communication Readiness work?

Communication readiness, whether your screens, speakers and network can actually deliver a lockdown or evacuation message, is one half of the picture. This covers the other half: whether your entrances and access control can physically support that same procedure. See our Martyn’s Law Communication Readiness page for the communication side specifically.

Working out what Martyn’s Law means for your premises?

Tell us your expected capacity and we’ll tell you honestly what tier applies and what’s worth doing now.

📞 0845 095 3600 · ✉ info@efficient-is.co.uk

Talk to our team

Is Your Door Access Control Actually Compliant with Fire Regulations? A Plain-English Guide to BS 7273-4

Building Access Systems · 6 min read

Is Your Door Access Control Actually Compliant with Fire Regulations? A Plain-English Guide to BS 7273-4

Fire door access control isn’t automatically a compliance problem just because a magnetic lock sits on an escape door. The problem is when nobody’s checked it against BS 7273-4, which is the standard that decides whether an access-controlled door will actually let people out in a fire.

Illustrative diagram: fire door access control under BS 7273-4, covering fail-safe release, automatic release on fire alarm, door-by-door assessment and manual override.

What BS 7273-4 actually covers

BS 7273-4 governs how electrically powered door locks interface with a building’s fire detection and alarm system, requiring automatic unlock when the fire alarm activates, fail-safe release if the system loses power, and an appropriate manual override. It doesn’t replace mechanical escape hardware like lever handle exit devices for staff areas or panic bars for public areas, it only comes into play where electronic control of an escape route is genuinely needed on top of that hardware, not instead of it.

Fail-safe vs fail-secure, the distinction that actually matters

A fail-safe lock unlocks if it loses power or receives a signal from the fire alarm, the correct behaviour for any door on a designated escape route. A fail-secure lock does the opposite: it stays locked if power is lost, which is appropriate where keeping something locked matters more than escape, like a server room or a comms cupboard, but should never be fitted to a door on a means of escape. Mixing the two up, putting a fail-secure lock on an escape route door because it happened to be the one in stock, is the single most common fire-door access-control mistake we see.

Who’s actually responsible

The building owner or “responsible person” under fire safety legislation defines the escape routes and fire strategy for the building. The installer or designer then has to competently assess each door individually against that strategy, rather than simply following a spec sheet the client handed over, and can’t introduce a double-action escape requirement, needing two separate actions, like a keypad and then a handle, to get out, on a door meant to allow single-action escape. Responsibility for getting this right genuinely sits with both sides, not just the person who commissioned the work.

Common mistakes we see

Retrofitting a mag-lock onto an existing fire door without checking it against the building’s fire strategy. Access control installed after the fire risk assessment was last reviewed, so nobody re-checks the door against it. Override or break-glass units positioned somewhere non-obvious, behind a noticeboard or above head height, rather than immediately beside the door they release. And in multi-let buildings specifically, access control added to a shared escape stair without coordinating with each individual tenant’s own fire strategy, so the building owner’s system and the tenants’ assumptions about that stair don’t actually match.

The bottom line: BS 7273-4 isn’t a reason to avoid access control on an escape route door, it’s the standard that lets you do it properly. Every electrically locked door on an escape route needs to fail safe, release automatically on a fire signal, and be assessed individually against your fire strategy, not retrofitted after the fact and assumed to be fine.

We check every door against your fire strategy as a standard part of designing a building access system, not as an optional extra, the same principle we apply on the CCTV side, where compliance is designed in from day one rather than bolted on afterwards.

Questions worth asking

FAQ

Does every access-controlled door need to comply with BS 7273-4?

Only doors where an electrically powered lock controls an escape route, a card reader on an internal office door that isn’t a designated fire exit doesn’t fall under it in the same way, though it’s still worth checking against your fire strategy as good practice. Any door on a means of escape fitted with an electric lock is where this genuinely applies.

What does “fail safe” mean in practice?

It means the lock releases, rather than stays locked, if it loses power or receives a signal from the fire alarm system, so a power cut or a fire never leaves someone unable to get out. The opposite, “fail secure”, is appropriate for doors where keeping something locked matters more than escape, like a server room, but should never be fitted to a designated escape route.

Who’s liable if an access-controlled fire door isn’t compliant?

Responsibility generally sits with the premises’ “responsible person” under fire safety legislation, though an installer who fits a non-compliant system without flagging the issue isn’t off the hook either, competent assessment of each door is expected from whoever’s designing and installing it, not only the person who commissioned the work. We check this against your fire strategy as a standard part of design, not an optional extra.

Can we add access control to an existing fire door without reassessing the whole building?

You need to reassess that specific door against the existing fire strategy, not the whole building, but skipping even that single-door check is the most common way access control ends up non-compliant. It’s a quick check as part of a properly scoped installation, not a reason to avoid doing the work at all.

Retrofitting access control onto an existing building?

We’ll check it against your fire strategy before anything’s fitted, not after.

📞 0845 095 3600 · ✉ info@efficient-is.co.uk

Book a compliance review

Door Entry, Access Control and Visitor Management: What’s the Actual Difference?

Building Access Systems · 5 min read

Door Entry, Access Control and Visitor Management: What’s the Actual Difference?

“Door entry”, “access control” and “visitor management” get used almost interchangeably in conversation, right up until someone asks which one actually stops a former employee getting back into the building. Access control and visitor management in particular get treated as one thing, and most buildings beyond a single-door office end up needing some combination of all three rather than just one.

Illustrative diagram: door entry, access control and visitor management compared, covering who's at the door, who's allowed through, who's on site, and specifying them as one system.

What door entry actually means

Door entry, sometimes called entry phone or intercom, is the simplest of the three. It lets whoever’s inside see or speak to whoever’s at the door before deciding whether to let them in, and it’s the standard setup on shared entrances in multi-let residential and managed buildings, where a single front door serves several separate occupiers. It doesn’t know who’s coming in, only that someone is, and whether the person being buzzed has decided to let them through.

What access control adds

Access control replaces that conversation with a credential, a fob, card, PIN or phone, and a reader that checks it against a list of who’s allowed through that specific door, at that specific time. Where door entry asks “should I let this person in,” access control already knows the answer and just checks the card. That’s what gives you an audit trail of who went through which door and when, permissions that can differ by door and by time (cleaners allowed in at 6am, not at midnight), and the ability to revoke one person’s access instantly without re-keying a lock. A reader like the UniFi Access Ultra reads a card, fob, PIN or phone and sits on the same network as the rest of the building’s IT, rather than needing its own standalone wiring closet and software.

What visitor management covers

Visitor management sits above both of those: tracking who’s on the premises who isn’t on the regular access list, contractors, couriers, interviewees, job applicants. Historically this has meant a paper book at reception, which has two real problems. It’s not a great look under UK GDPR if every visitor can read the entries above theirs, names, companies and visit reasons of complete strangers, left open for anyone waiting at the desk. And it tells you nothing useful in an emergency: if the fire alarm goes off, nobody actually knows who’s in the building at that moment. A proper setup, kiosk or app-based sign-in, printed or digital visitor badges, a real-time list of who’s on site, solves both problems at once.

Do you need all three?

Genuinely depends on the building. A five-person office with one door probably needs a decent access control reader and nothing else. A multi-let building with a shared entrance and several tenants is likely to need all three, door entry for the shared front door, access control for who gets into which suite, and visitor management so each tenant actually knows who’s visiting them specifically, not just that someone buzzed in. Public-facing premises, retail, hospitality, usually need visitor management and access control more than door entry, since the public walks straight in rather than waiting to be let through. The honest answer is that we design around what’s actually in the building, rather than selling a fixed bundle regardless of size.

The bottom line: the three terms describe three different problems, who’s at the door (door entry), who’s allowed through which door and when (access control), and who’s on the premises who isn’t staff (visitor management). Most buildings beyond a single-door office need at least two of the three working together, which is why we design them as one system from the start rather than three separate purchases from three different suppliers.

See our Building Access Systems page for typical costs and how we scope a project, or our CCTV page for the camera side of building security.

Questions worth asking

FAQ

Can one system do all three jobs?

Often, yes, modern platforms like UniFi Access can run door entry, access control and a basic visitor log from the same app and the same network, rather than three separate pieces of kit from three different suppliers. It’s not universal though, and a larger or more complex building may still need purpose-built visitor management software alongside it.

What’s the minimum a small office actually needs?

A single access control reader on the front door covers most five-to-twenty-person offices. It replaces the keyed lock, gives you an audit trail, and lets you revoke a leaver’s access immediately rather than re-keying the door. Door entry and formal visitor management tend to matter more once you’ve got a shared entrance or regular visitors you don’t already know.

Is a paper visitor sign-in book actually against the law?

Not inherently, but an open book that every visitor can read, seeing the names, companies and visit reasons of everyone before them, is the kind of thing the ICO would flag as part of a complaint, since it exposes other people’s personal data without their knowledge or consent. A kiosk or app-based system where each entry is only visible to authorised staff avoids the problem entirely.

How much does a basic access control reader cost installed?

From around £450 +VAT per door, supplied and installed, for a straightforward single-door reader, though it depends on cabling, mounting and how many doors you’re doing at once. See our Building Access Systems page for a fuller cost breakdown.

Not sure which of the three you actually need?

Tell us about the building and we’ll tell you honestly what’s worth having.

📞 0845 095 3600 · ✉ info@efficient-is.co.uk

Tell us about your project

Find our work useful? Add us as a preferred source on Google.