Martyn's Law Explained: What It Means for UK Venues and Businesses
Martyn's Law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack on 22 May 2017. Following years of campaigning led by his mother, Figen Murray, it became law as the Terrorism (Protection of Premises) Act 2025 on 3 April 2025.
Its aim is straightforward: public venues and larger events should think in advance about how they would protect people if a terrorist attack happened. Here is a plain-English guide to who it affects, what they will need to do, and when.
Is Martyn's Law in force yet?
Not yet. The Act has an implementation period of at least two years, so its duties cannot be enforced before April 2027. The Home Office published its final statutory guidance in April 2026, but at the time of writing the government has not confirmed the exact date enforcement will begin. Until then there is no legal requirement to comply, but the guidance is available now, which gives you time to prepare properly rather than in a rush.
Who does it apply to?
The law covers premises that are wholly or mainly used for certain public-facing purposes, such as shops, pubs and restaurants, entertainment and sports venues and visitor attractions, as well as larger public events. Which rules apply depends on how many people could reasonably be expected to be there at the same time:
Standard tier: premises where 200 to 799 people may be present at once.
Enhanced tier: premises where 800 or more people may be present at once.
Qualifying events: public events where 800 or more people may be present at once and entry is controlled (for example, ticket checks), held somewhere not already in the enhanced tier. These follow the enhanced tier rules.
Premises where attendance could never exceed 199 people are out of scope, as are private premises and a few specific exclusions such as certain transport premises and Parliament.
What standard tier premises must do
Standard tier premises will need to notify the regulator, the Security Industry Authority (SIA), and have appropriate public protection procedures in place, so far as reasonably practicable. These are about what staff would do if an attack happened at or near the premises, for example:
Evacuation: getting people out safely.
Invacuation: bringing people inside to a safer place.
Lockdown: stopping an attacker getting in.
Communication: alerting staff and the public quickly and clearly.
Importantly, the standard tier does not require any physical security equipment or building changes. The emphasis is on sensible, low-cost planning and making sure your staff know what to do.
What enhanced tier premises and events must do
Enhanced tier premises and qualifying events have the same notification and procedures duties, plus two more:
Put appropriate public protection measures in place, so far as reasonably practicable, to reduce both the vulnerability to an attack and the risk of harm if one happens.
Document those procedures and measures (including planned ones) and provide the document to the SIA.
Examples given in official material include monitoring the premises, controlling how people move in and out, CCTV, bag search policies, extra staff training, safety glass, hostile vehicle mitigation, and restricting access to sensitive information such as floor plans.
"Reasonably practicable" means proportionate: the benefit of a measure is weighed against its cost, time and difficulty. A mid-sized venue is not expected to do what a national stadium does.
Who enforces it, and what are the penalties?
The SIA will be the regulator, with powers to inspect and enforce. It consulted on its draft inspection and enforcement guidance in spring 2026. The maximum penalties are:
Standard tier: a fixed penalty of up to £10,000, plus up to £500 a day for continued non-compliance.
Enhanced tier and qualifying events: up to £18 million or 5% of worldwide revenue, plus up to £50,000 a day.
Where security systems fit in
For the standard tier, Martyn's Law is about procedures, not equipment. That said, the systems many premises already have can make those procedures far easier to carry out:
Lockdown: access control can secure doors quickly, sometimes from a single point.
Situational awareness: CCTV helps staff see what is happening and where, and can help the emergency services when they arrive.
Communication: public address, intercom and alerting systems let you warn people fast.
Evacuation and invacuation: knowing which doors and routes you can open, close or monitor is a big part of a good plan.
For enhanced tier premises, physical measures such as CCTV, access control and perimeter protection may form part of a proportionate plan.
A word of caution
There is no product that makes a building "Martyn's Law compliant". The government has advised against using providers who claim to make premises compliant at this stage, and neither the Home Office nor the SIA endorses any product. The best starting point is the free statutory guidance on GOV.UK and the resources on ProtectUK. Once your procedures are planned, you can then decide whether any equipment would genuinely help.
What you can do now
Work out how many people could be on your premises at once, and which tier that puts you in.
Read the statutory guidance on GOV.UK and the Martyn's Law pages on ProtectUK.
Start drafting your evacuation, invacuation, lockdown and communication procedures, and talk them through with staff.
Check what your existing systems can do. Can you lock doors quickly? Can you alert everyone at once? Does your CCTV cover your entrances?
Keep an eye on the SIA website for confirmation of when the duties take effect.
This article is general guidance, not legal advice. For your specific obligations, refer to the official guidance or a legal adviser.
Need a second opinion on your systems?
If you would like an honest look at whether your existing CCTV, access control or alarm systems would support your plans, Protect CSM carries out site surveys across Hampshire and Surrey. Call 01420 375376 or email info@protect-csm.co.uk.
Comments