Martyn’s Law introduces new legal duties for certain publicly accessible premises and larger events across the UK. Its formal title is the Terrorism (Protection of Premises) Act 2025.
The legislation is intended to improve preparedness for terrorist incidents and reduce the potential for physical harm. It does not require every business to install new security systems, employ security personnel or guarantee that an attack can be prevented.
Whether an organisation is covered will depend on how its premises are used, the number of people reasonably expected to be present at the same time and, for events, whether public entry is controlled.
The Act received Royal Assent on 3 April 2025. Its principal duties are not yet in force. The Security Industry Authority is preparing for commencement in spring 2027, but the exact date must still be confirmed through Parliament.
Key Point
Martyn’s Law will require qualifying premises to prepare practical procedures for evacuation, invacuation, lockdown and communication. Premises and qualifying events where 800 or more people may reasonably be expected will also need to consider proportionate protective measures, document their arrangements and appoint senior oversight.
Why Martyn’s Law Matters to UK Organisations
Martyn’s Law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack on 22 May 2017.
Following the attack, Martyn’s mother, Figen Murray, campaigned for clearer legal responsibilities for organisations operating publicly accessible premises.
Many venues already include security incidents within emergency planning, health and safety arrangements or business continuity procedures. However, there has not previously been a consistent legal framework requiring a broad range of publicly accessible premises to prepare specifically for terrorist incidents.
The Act creates a national framework, but it does not assume that every location faces the same risk or requires the same measures.
A community venue, hotel, hospital, university and major stadium have different layouts, resources, operating patterns and levels of public access. The measures adopted should therefore be appropriate and reasonably practicable for the individual premises or event.
When Will Martyn’s Law Come Into Force?
The Terrorism (Protection of Premises) Act 2025 is enacted law, but most of its operational requirements have not yet commenced.
Limited provisions have been brought into force to allow the Home Office and the SIA to prepare statutory guidance, notification arrangements and the future regulatory framework. These preparatory provisions do not yet require businesses to notify the SIA or comply with the complete standard or enhanced duties.
The SIA has stated that it is preparing for the Act to come into force in spring 2027. The final commencement date will be confirmed through Parliament.
Until then, organisations can assess whether they are likely to fall within scope and prepare their procedures. They cannot yet submit formal notification to the SIA because the notification portal is not open.
What Changed During 2026?
The fundamental scope of Martyn’s Law has not changed. The standard-tier threshold remains 200 people, and the enhanced-tier threshold remains 800.
The main developments during 2026 have concerned official guidance, notification and the SIA’s regulatory preparations.
In April 2026, the Home Office published statutory guidance explaining:
- which premises and events may fall within scope;
- how to identify the responsible person;
- the standard and enhanced duties;
- the meaning of reasonably practicable measures;
- the SIA’s future enforcement powers;
- the potential penalties for non-compliance.
In July 2026, the Home Office published separate guidance explaining the notification process, the information responsible persons may need to submit and the deadlines that will apply after commencement.
The Home Office also refined the terminology used to describe occupancy. Earlier material commonly referred to capacity calculations. Current guidance focuses on the greatest number of people reasonably expected to be present at the same time.
This is important because the legal assessment is not automatically determined by a fire certificate, theoretical maximum capacity or employee headcount. Those records may provide evidence, but the assessment must reflect how the premises or event actually operates.
Which Premises Are Covered?
A location will generally need to satisfy several conditions before it becomes a qualifying premises.
It must:
- include a building, part of a building, a group of buildings or a building with associated land;
- be publicly accessible to some extent;
- be wholly or mainly used for an activity listed in Schedule 1 of the Act;
- reasonably expect at least 200 people to be present at the same time on at least some occasions;
- not fall within a statutory exclusion.
Schedule 1 covers categories including:
- shops and retail premises;
- restaurants, cafés, bars and food-and-drink premises;
- entertainment and leisure venues;
- sports grounds;
- museums, galleries, libraries and visitor attractions;
- hotels;
- places of worship;
- healthcare premises;
- educational establishments;
- certain transport premises;
- public authority buildings.
The use of the premises is as important as its size.
A large factory, warehouse, construction site, storage yard, vacant property or solar farm is not automatically covered merely because it occupies a substantial area or employs a large workforce.
Its main use must also fall within a Schedule 1 category.
However, part of a wider industrial or commercial site may require a separate assessment. For example, a public visitor centre, retail unit, restaurant or event space could potentially meet the statutory tests even where the surrounding operational site does not.
Who Counts Towards the Threshold?
The assessment is not limited to customers or members of the public.
It may include:
- employees;
- contractors;
- visitors;
- customers;
- volunteers;
- performers;
- event staff;
- other people reasonably expected to be present.
A business with fewer than 200 employees could therefore fall within the standard tier if customers, contractors and staff together bring the number reasonably expected above the threshold.
Conversely, an organisation employing hundreds of people across several sites will not automatically bring every location within scope.
Each premises should be assessed individually.
Useful evidence may include:
- ticket sales;
- booking records;
- footfall data;
- staffing levels;
- contractor attendance;
- event schedules;
- historic occupancy;
- licensing records;
- fire safety documents.
The responsible person should be able to explain how the number was assessed rather than relying on an unsupported estimate.
Standard Tier and Enhanced Tier Explained
Martyn’s Law creates two principal levels of responsibility.
Standard tier
A qualifying premises will generally fall within the standard tier where between 200 and 799 people are reasonably expected to be present at the same time.
The responsible person will need to:
- notify the SIA;
- establish appropriate evacuation procedures;
- establish appropriate invacuation procedures;
- establish appropriate lockdown procedures;
- establish appropriate communication procedures.
Enhanced tier
A qualifying premises will generally fall within the enhanced tier where 800 or more people are reasonably expected at the same time.
Enhanced premises must meet the procedural duties and also:
- implement reasonably practicable public protection measures;
- prepare and submit a compliance document;
- review and update the documented arrangements;
- designate a senior individual where the responsible person is an organisation.
Places of worship and most childcare, primary, secondary and further education premises will generally remain within the standard tier even where 800 or more people may be present.
Higher education premises may fall within the enhanced tier where the relevant tests are met.
Who Is the Responsible Person?
The responsible person is generally the individual or organisation controlling the premises in connection with its qualifying use.
This could be:
- an owner;
- a tenant;
- an operating company;
- a charity;
- a public body;
- an event organiser;
- another organisation exercising operational control.
Ownership alone does not decide responsibility.
A landlord may own the building while a tenant controls how the premises is used. In a mixed-use development, several organisations may control different activities or areas.
Contracts can allocate tasks and responsibilities between parties. However, the underlying statutory duty cannot simply be transferred to a consultant, facilities management company or security contractor.
Where several parties share or overlap in their control, they may need to co-operate and co-ordinate their procedures.
For enhanced-tier premises and qualifying events where an organisation is the responsible person, a senior individual must be appointed to oversee compliance.
That person should have sufficient authority to influence policies, budgets, operational decisions and corrective actions.
What Is a Qualifying Event?
Martyn’s Law also covers certain large events that are not already held within enhanced-tier premises.
A qualifying event will generally involve:
- public access;
- at least 800 people reasonably expected at the same time;
- an entry condition;
- no applicable exclusion.
An entry condition could include:
- a ticket;
- a pass;
- an invitation;
- membership;
- accreditation;
- another form of authorisation or checking.
Land without a permanent building can qualify under the event provisions. This means that certain temporary festivals, exhibitions and controlled-entry outdoor events could be covered.
An unrestricted public gathering does not automatically become a qualifying event merely because attendance exceeds 800.
Entry control is a central part of the legal test.
Where an event takes place within an existing enhanced-tier premises, it will generally be dealt with through the duties applying to that premises rather than being classified separately.
What Must Standard-Tier Premises Prepare?
The standard tier focuses on practical public protection procedures rather than mandatory security purchases.
Evacuation
Evacuation means moving people out of all or part of the premises.
A terrorism-related evacuation may need to use different routes from a normal fire evacuation.
A fixed outdoor assembly point could move people towards a threat or create a concentrated group in an exposed area. Procedures should therefore consider alternative routes, changing threat locations and how staff will direct people if the normal exit is unsafe.
Invacuation
Invacuation means moving people into the premises or to a safer location inside it.
This may be appropriate where the danger is outside the building or where leaving would expose people to a greater risk.
Potential safer areas should be identified, and staff should understand how people will be directed to them.
Lockdown
Lockdown involves restricting entry, exit or movement across all or part of the premises.
This may include securing entrances, closing internal areas or preventing people from moving towards an affected location.
Lockdown procedures must remain compatible with fire safety. A measure designed to protect people from one threat should not prevent necessary escape from another.
Communication
Staff, visitors and contractors need clear information during an incident.
Communication arrangements may include:
- public-address systems;
- alarms;
- radios;
- telephone or messaging systems;
- verbal instructions;
- contact with emergency services.
The organisation should also consider how instructions will be delivered if the primary communication system fails.
The standard tier does not impose a universal requirement to install CCTV, barriers, turnstiles, screening equipment or new access-control systems.
It also does not automatically require security officers or security dog handlers.
For many standard-tier premises, the most valuable improvements may be clearer procedures, allocated responsibilities, staff briefings and practical exercises.
What Additional Measures Apply to Enhanced Premises?
Enhanced premises and qualifying events must implement reasonably practicable public protection measures intended to reduce:
- vulnerability to an act of terrorism; or
- the risk of physical harm if an attack occurs.
The measures fall into four broad areas.
Monitoring
Monitoring may include CCTV, alarms, control-room functions, staffed observation points or mobile patrols.
Passive systems can record activity, generate alerts or support evidence. Their operational value depends on coverage, maintenance, monitoring and the response that follows an alert.
Active security involves direct observation, assessment, escalation and response support.
The appropriate combination will depend on the premises.
Controlling Movement
Enhanced organisations may need to consider how people enter, leave and move through the site.
Measures may include:
- controlled entrances;
- passes or ticket checks;
- screening;
- queue management;
- restricted zones;
- internal barriers;
- procedures for closing areas quickly.
The arrangements must remain practical during normal operations and emergencies.
Physical Safety and Security
Physical measures may include secure doors, vehicle barriers, protected areas, strengthened access points and protection for critical systems.
The Act does not provide a universal equipment list.
Measures should be selected according to the actual layout, operating environment, vulnerability and resources of the premises.
Protecting Sensitive Information
Enhanced responsible persons must also consider information that could expose vulnerabilities or assist hostile planning.
This may include:
- building plans;
- access credentials;
- security rotas;
- CCTV layouts;
- emergency procedures;
- contractor information;
- details of restricted areas.
Access should be limited to people who genuinely require the information.
What Is the Enhanced-Tier Compliance Document?
Enhanced responsible persons must prepare a compliance document explaining:
- the public protection procedures in place;
- the protective measures selected;
- how those measures are expected to reduce vulnerability or physical harm;
- any measures that are planned but not yet implemented;
- relevant responsibilities and oversight.
The initial document must be submitted to the SIA as soon as reasonably practicable after the duty applies.
Material revisions will generally need to be submitted within 30 days.
The document should describe the real premises and its operating arrangements. A generic policy copied from another organisation is unlikely to demonstrate that the particular site has been assessed properly.
The objective is not to produce the longest possible document. It is to show clear reasoning between the premises, the risks considered, the procedures selected and the way those arrangements will operate.
How Will SIA Notification Work?
The formal notification portal is not yet open.
Premises already within scope when the notification provisions commence will generally have three months to notify the SIA.
After the initial period, relevant changes will normally need to be reported within 28 days. This may include a change to the responsible person or correction of inaccurate information.
Qualifying events will generally have shorter deadlines.
An event publicised before commencement will normally need to be notified within 14 days after commencement. An event first publicised later will generally need to be notified within 14 days of its first publicity.
The information required may include:
- details of the responsible person;
- details of other people exercising control;
- the premises or event location;
- the Schedule 1 use;
- the number reasonably expected;
- the method used to assess that number;
- relevant licensing or safety certificate information;
- event dates and operating times;
- website or social media information;
- the enhanced-tier senior individual;
- information concerning the compliance document.
A representative may submit information on behalf of the responsible person, but the legal responsibility remains with the responsible person.
Written evidence of the representative’s authority should be retained.
How Will the SIA Enforce Martyn’s Law?
The Security Industry Authority will regulate the legislation.
The SIA has indicated that it intends to operate a risk-based and intelligence-led regulatory approach using desk-based assessments and on-site inspections.
Its powers will include:
- requesting information;
- examining documents;
- inspecting premises;
- interviewing relevant individuals;
- requiring reasonable assistance;
- issuing compliance notices;
- imposing financial penalties.
For enhanced-tier premises and qualifying events, the SIA may also issue a restriction notice limiting or prohibiting use where this is considered necessary to reduce the risk of physical harm from terrorism.
Maximum financial penalties include:
- up to £10,000 for most standard-tier contraventions;
- for enhanced premises and qualifying events, the higher of £18 million or 5% of qualifying worldwide revenue;
- additional daily penalties where failures continue after formal enforcement action.
Certain serious failures may amount to criminal offences. These can include deliberately failing to comply with enforcement notices, obstructing inspectors or knowingly or recklessly supplying materially false information.
Because the principal duties have not commenced, there are currently no completed Martyn’s Law enforcement cases that organisations can use as practical precedents.
How Does Martyn’s Law Interact With Existing Duties?
Martyn’s Law adds to existing legal responsibilities rather than replacing them.
Health and safety systems may provide a useful structure for risk assessment, training and emergency planning. However, a general workplace risk assessment will not automatically address terrorism-related evacuation, invacuation, lockdown and communication.
Fire safety arrangements must remain effective.
Locked doors, barriers, restricted routes or secure internal areas should not obstruct emergency escape or create unacceptable new hazards.
Procedures should also consider people who may require assistance because of disability, age, mobility or another relevant circumstance.
Where CCTV, body-worn video, access logs or visitor records process personal data, organisations must continue to meet UK GDPR and Data Protection Act requirements.
Protecting security-sensitive information overlaps with data protection, but the two are not identical. A building plan may be security-sensitive without containing personal data, while a CCTV recording may involve both security and data-protection considerations.
Where Can Active Security Support Preparation?
Martyn’s Law does not automatically require organisations to employ security personnel, and a security contract does not establish compliance by itself.
However, where an organisation’s own assessment identifies a need for active security, trained personnel may support parts of a wider protective arrangement.
Depending on the premises and agreed responsibilities, security teams may assist with:
- monitoring entrances and perimeter areas;
- visible patrols;
- access control;
- identifying suspicious behaviour;
- incident reporting and escalation;
- emergency communication;
- supporting evacuation, invacuation or lockdown;
- co-ordinating with management and emergency services.
Security dog-handler teams may be relevant where qualifying premises include extensive external areas, service roads, compounds, car parks or several access points.
A mobile dog team can provide visible presence, patrol capability and direct observation. It does not replace management responsibility, staff training, communication systems, written procedures or physical security.
Where active cover is considered appropriate, the deployment should be integrated with the client’s emergency plans, escalation structure and site instructions.
Further information is available through our security dog handler services.
Seven Essential Preparation Steps
Organisations should begin with governance and operational planning rather than unplanned security purchases.
1. Identify potentially covered premises and events
Create a register of sites and recurring events that may satisfy the public-access, Schedule 1 use and occupancy tests.
2. Assess the number reasonably expected
Record the greatest number of people reasonably expected at the same time and retain the evidence used to reach that figure.
3. Identify the responsible person
Confirm who controls each premises or event and document any overlapping responsibilities between owners, tenants, operators and contractors.
4. Determine the likely tier
Establish whether each location is likely to be outside scope, standard tier, enhanced tier or a qualifying event.
5. Review emergency procedures
Compare current arrangements against evacuation, invacuation, lockdown and communication requirements.
Check that terrorism procedures do not conflict with fire safety, accessibility or other emergency arrangements.
6. Assess enhanced measures where applicable
Enhanced premises should consider monitoring, movement control, physical security and protection of sensitive information.
The assessment should include existing measures as well as identified gaps.
7. Train, test and record
Brief employees, contractors and security providers on their roles.
Use tabletop exercises, communication tests or practical drills to identify weaknesses. Record findings, corrective actions and subsequent reviews.
Free preparedness resources are available through ProtectUK, while the detailed legal framework is explained in the Home Office statutory guidance.
Organisations do not need to purchase consultancy services or third-party products simply because Martyn’s Law is approaching commencement. Neither the Home Office nor the SIA endorses individual providers or products as guaranteed compliance solutions.
Preparing Proportionately
Martyn’s Law is not intended to convert every publicly accessible premises into a high-security environment.
It creates a structured duty to understand the premises, establish appropriate procedures and take reasonably practicable steps to reduce harm.
For standard-tier premises, the immediate priority will be clear emergency procedures and staff preparedness.
For enhanced-tier premises and qualifying events, the requirements extend to protective measures, documented reasoning, notification and senior accountability.
Passive measures such as CCTV, alarms, barriers and access-control systems may contribute to the overall arrangement.
Active measures such as observation, patrols, assessment and escalation may also be appropriate.
The correct combination should be based on the actual premises and its operations, not a standard security package promoted as guaranteed compliance.
Frequently Asked Questions
Is Martyn’s Law already in force?
The Act is law, but its principal operational duties are not yet in force. Commencement is expected in spring 2027, although the exact date has not yet been confirmed.
What is the Martyn’s Law standard-tier threshold?
A qualifying premises will generally be standard tier where between 200 and 799 people are reasonably expected to be present at the same time.
What is the enhanced-tier threshold?
A qualifying premises will generally be enhanced tier where 800 or more people are reasonably expected at the same time.
Does the threshold include employees?
Yes. Employees, contractors, visitors, customers and other people reasonably expected to be present may all count.
Does every large warehouse or factory fall within scope?
No. The premises must also be publicly accessible and wholly or mainly used for an activity listed in Schedule 1 of the Act.
Does Martyn’s Law require CCTV?
No. CCTV may be an appropriate enhanced-tier measure in some premises, but the Act does not create a universal requirement to install it.
Does Martyn’s Law require security guards or dog handlers?
No. Security personnel may support a wider protective-security plan where justified, but they are not automatically required.
Can a security contractor take responsibility for compliance?
Supplying security services does not normally transfer the responsible person’s legal duty. Tasks may be outsourced, but the underlying responsibility remains with the person or organisation controlling the premises or event.
Can businesses notify the SIA now?
No. The formal notification portal will become available when the relevant provisions commence.
What procedures should qualifying premises prepare?
Qualifying premises must prepare appropriate procedures covering evacuation, invacuation, lockdown and communication during or immediately after a terrorist incident.
This article provides general information and is not a substitute for legal advice concerning a particular premises, event or contractual arrangement.