Martyn’s Law Explained: What UK Venues and Employers Must Do

This guide is for employers, venue operators, facilities managers and anyone who runs a building the public uses. It explains who the law applies to, what each tier has to do, what the penalties are, and how to get ready now without wasting money. It is based on the Act itself, Home Office material and guidance from the Security Industry Authority (SIA).

What is Martyn’s Law?

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It applies across England, Wales, Scotland and Northern Ireland.

The Act puts a legal duty on the people who control certain premises and events to consider what they would do if a terrorist attack happened at or near them. Until now, counter terrorism preparedness at most venues has been voluntary. The Home Office contrasts this with health and safety, where legal requirements have long been established.

The law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for years for venues to be required to prepare for terrorism, and the government credits her campaign with bringing the Act forward.

When does Martyn’s Law come into force?

The government expects the Act to come into force in spring 2027. The SIA’s guidance, last updated in September 2026, says the exact date will be confirmed in advance.

The Act itself does not fix a start date. Section 37 leaves commencement to regulations made by the Secretary of State. The government has committed to an implementation period of at least 24 months from Royal Assent, which takes it to April 2027 at the earliest. Until commencement there is no legal requirement to comply, but the government encourages anyone in scope to start preparing.

Source: SIA, Understanding Martyn’s Law and the SIA’s role as regulator; Home Office Martyn’s Law factsheet.

Who does Martyn’s Law apply to?

It applies to qualifying premises where 200 or more people can reasonably be expected to be present at the same time, and to qualifying public events of 800 or more. The count includes staff, not just visitors.

Qualifying premises

Premises are in scope if all four of these apply:

1. They are a building, or a building together with other land.
2. They are wholly or mainly used for one of the uses listed in Schedule 1 of the Act.
3. 200 or more people can reasonably be expected to be present at the same time.
4. They are not excluded by Schedule 2.

The uses in Schedule 1 are wide. They include shops, food and drink venues, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, health care, bus and railway stations, airports, childcare, schools, further and higher education, and public authority premises.

Qualifying events

An event is in scope if it takes place at a building or other land, is open to the public, uses entry checks such as payment, tickets or membership, can reasonably be expected to have 800 or more people present at once, is not held at premises already in the enhanced tier, and is not excluded under Schedule 2.

Exclusions

Schedule 2 excludes certain premises and events. These include premises used by Parliament and the devolved legislatures and governments, parks, gardens and other open-air leisure spaces with no entry checks, and premises covered by transport security regimes. Events held at places of worship, childcare settings, schools and further education premises are also excluded. Check the Schedule against your own site rather than assuming you are out of scope.

How do you work out the number of people?

The test is how many people could reasonably be expected to be present at the same time at your busiest. Home Office supplementary guidance suggests methods such as fire safety occupancy calculations or historic attendance data. If you already have a fire risk assessment, the occupancy figures in it are a sensible starting point. See our fire risk assessment guide for how those figures are normally set.

Standard tier and enhanced tier: what is the difference?

The standard tier covers premises for 200 to 799 people and focuses on procedures. The enhanced tier covers premises for 800 or more, plus qualifying events, and adds physical measures, documentation and a named senior individual.

Source: Terrorism (Protection of Premises) Act 2025, sections 5 to 10 and 18.

One exception matters for schools, further education colleges, childcare settings and places of worship. They sit in the standard tier at 200 people and stay there even if 800 or more may be present. Universities and other higher education premises do not get this exception.

What standard tier premises must do

Standard tier premises must notify the SIA and have appropriate public protection procedures in place, so far as reasonably practicable. There is no requirement for physical security measures.

The procedures cover four things:

• Evacuation: getting people out of the premises and away from the threat.
• Invacuation: bringing people into the building, or into a safer part of it, when the danger is outside.
• Lockdown: stopping people entering or leaving the premises.
• Communication: telling staff and the public what is happening and what to do.

“Reasonably practicable” means weighing what you could do against the cost, time and difficulty involved, taking account of the nature of your premises and the resources you have. It is the same test employers already apply under the Health and Safety at Work Act 1974. For a small venue, the procedures may be a short written plan and a staff briefing.

What enhanced tier premises and events must do

On top of the standard tier duties, enhanced tier premises and qualifying events must put public protection measures in place, document them, and send that document to the SIA.

The measures fall under four headings: monitoring the premises and its immediate surroundings, managing how people move in and around the site, physical security, and the security of information that could help an attacker. The document must include an assessment of how the procedures and measures reduce the risk of harm.

Where the responsible person is an organisation rather than an individual, it must designate a senior individual, someone involved in management or control, to make sure the duties are met. This also applies to events run by organisations.

Who is the responsible person?

For premises, the responsible person is whoever has control of them in connection with their in-scope use. SIA guidance explains control as being the occupant with the right and ability to make decisions about how the premises are managed and used. For events, it is whoever controls the premises in connection with the event.

Where several organisations share a site, the Act includes duties to co-ordinate and co-operate. The SIA says you can take advice from a suitably knowledgeable security adviser, but you cannot pass on your responsibility.

Who regulates Martyn’s Law?

The Security Industry Authority is the regulator. It will advise and support duty holders, check compliance through desk-based reviews and on-site inspections, and take enforcement action where needed.

The SIA says it will normally give at least 72 hours’ notice of an inspection, although it can seek a court warrant to enter without notice in some circumstances. In-scope premises and events will notify the SIA through an online portal, which the SIA plans to test with volunteers from early 2027.

What are the penalties under Martyn’s Law?

The SIA can issue compliance notices, restriction notices and monetary penalties. Under section 18 of the Act, the maximum non-compliance penalty is £10,000 for standard tier premises. For enhanced tier premises and qualifying events it is £18 million or 5% of qualifying worldwide revenue, whichever is greater. Where a compliance notice or restriction notice is ignored, daily penalties of up to £500 (standard tier) or £50,000 (enhanced tier and events) can be added under section 19.

Some failures are criminal offences, including failing to comply with a restriction notice, failing to comply with a compliance notice for an enhanced tier premises or event, and giving false or misleading information. These three offences carry up to two years’ imprisonment on conviction on indictment. Obstructing an SIA inspector is also an offence.

The government’s stated approach is to support and advise first, with tougher enforcement reserved for serious or persistent non-compliance.

How Martyn’s Law fits with fire safety and evacuation planning

Most workplaces already have an evacuation plan under the Regulatory Reform (Fire Safety) Order 2005. Martyn’s Law does not replace it, and the response to a terrorist attack can be the opposite of a fire response.

In a fire, the aim is to get everyone out to an assembly point. In an attack, sending people out to a predictable gathering spot may put them in danger, and the safer choice may be to keep them inside and lock the doors. Your procedures need to tell staff how to decide which response applies, and how that decision is communicated.

In practice, the people who already lead fire evacuations are often the obvious people to brief on invacuation and lockdown. They know the building, the exits and the headcount routine. Our fire marshal duties guide sets out what that role already covers, and our fire warden and marshal training gives those staff a firm grounding in evacuation and muster.

How to prepare for Martyn’s Law: a checklist

1. Work out whether you are in scope. Check your use against Schedule 1 and estimate how many people could be present at once at your busiest, including staff.
2. Identify the responsible person. Decide who has control of the premises, and if you are an enhanced tier organisation, who will be the designated senior individual.
3. Read the official guidance. Start with the Home Office section 27 guidance and the SIA’s regulatory guidance, and sign up for SIA updates.
4. Review your existing emergency arrangements. Look at your fire risk assessment, evacuation plan and any security procedures. Note where they would not work for an attack.
5. Write your procedures. Cover evacuation, invacuation, lockdown and communication. Keep them short enough that staff can actually follow them.
6. Brief your staff. Make sure the people on shift know what the procedures are and their part in them.
7. For the enhanced tier, plan measures and documentation. Consider monitoring, movement, physical security and information security, and start drafting the document you will send to the SIA.
8. Talk to neighbours and landlords. If you share a site, agree how you will co-ordinate.
9. Get ready to notify. Watch for the SIA portal opening.

The Home Office says you do not need to pay a consultant to comply, and neither it nor the SIA endorses any company or product. Free materials are available from ProtectUK. Outside help is useful where you want an independent review, but it is not a legal requirement.

Frequently asked questions

Where to learn more

• KeyOstas Consultancy: fire risk assessments, risk assessments, audits and policy writing
• Fire Warden and Marshal Training: evacuation and muster duties for the staff who lead them
• Fire risk assessment: a UK guide
• Fire marshal duties explained
• Risk assessments: a UK guide