Martyn's Law Compliance Guide for UK Premises and Events

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It places new duties on those responsible for certain premises and events to reduce the risk of harm to the public from terrorist attacks.

The Act will be regulated by the Security Industry Authority (SIA). It is expected to come into force in Spring 2027, following an implementation period of at least 24 months from Royal Assent.

There are two tiers, measured by the number of individuals who may reasonably be expected to be present at the same time. Standard duty premises cover 200 to 799 individuals. Enhanced duty premises and qualifying events cover 800 or more.

The headline penalties are significant. Standard duty breaches carry a maximum penalty of £10,000, while enhanced duty breaches and qualifying events carry a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater.

There is no legal duty to comply until commencement, so the period before Spring 2027 is preparation time rather than enforcement time. The full Act text is published on legislation.gov.uk (Terrorism (Protection of Premises) Act 2025).

What Martyn's Law Is and Why It Exists

The law is named after Martyn Hett, who was killed in the Manchester Arena attack in 2017. His mother, Figen Murray, campaigned for legislation requiring premises and events to be better prepared for terrorist attacks.

The campaign led to the Terrorism (Protection of Premises) Act 2025. The aim is to make sure that those responsible for qualifying premises and events consider the risk of a terrorist attack and take steps to protect the public.

The duties are designed to be proportionate to the size of the premises or event. Smaller venues face simpler requirements, while the largest venues and events face a more detailed set of obligations.

Full Scope and the Two Tiers

Whether a premises or event is in scope depends on capacity. The count includes everyone who may reasonably be expected to be present at the same time, including staff, not only customers or visitors.

Capacity should be assessed against peak use. Occasional higher-attendance events can bring a premises into scope even where day-to-day numbers sit below the relevant threshold.

Standard Duty Premises (200 to 799)

Standard duty applies where 200 to 799 individuals may reasonably be expected to be present at the same time. The duties here sit under section 5 of the Act.

Those responsible must put in place appropriate, reasonably practicable public protection procedures. These procedures are expected to be simple and low cost, with no requirement to buy equipment.

Enhanced Duty Premises and Qualifying Events (800 or more)

Enhanced duty applies where 800 or more individuals may reasonably be expected to be present at the same time. These obligations sit under section 6 and apply in addition to the standard duty procedures.

Enhanced premises and qualifying events face further requirements around public protection measures, a designated senior individual and a compliance document. These are covered in detail below.

Education Settings

Education settings remain in the standard tier regardless of capacity, where they are above the 200 threshold. This means schools and similar settings face the standard duty procedures rather than the enhanced obligations, even where their numbers would otherwise place them higher. The government has published specific guidance for education settings (how Martyn's Law will affect education settings).

The Implementation Timeline

The Act follows a staged path from Royal Assent to commencement. The key dates published so far are set out below.

1. 3 April 2025. The Terrorism (Protection of Premises) Act 2025 received Royal Assent.
2. 15 April 2026. The section 27 statutory guidance was published, setting out how duty holders should approach their obligations.
3. 12 June 2026. The SIA's draft section 12 statutory enforcement guidance consultation closes at 11:59pm on Friday 12 June 2026.
4. Spring 2027. The Act is expected to come into force, following an implementation period of at least 24 months from Royal Assent. There is no legal duty to comply until this point.

The implementation period is intended to give duty holders time to understand their obligations and put procedures and measures in place before the duties take legal effect.

The SIA's Regulatory Role

The Security Industry Authority is the regulator for Martyn's Law. The SIA's role covers supporting duty holders to understand and meet their obligations, and enforcing the duties where necessary.

The SIA has set out how it will approach this new role, including its intended emphasis on advice and support during the early period (Martyn's Law: the SIA's new regulatory role). Its draft section 12 enforcement guidance is currently out for consultation, with responses accepted until 11:59pm on 12 June 2026.

Standard Procedures: The Four Areas

Standard duty premises must put in place appropriate, reasonably practicable public protection procedures across four areas. These are expected to be simple, low cost and achievable without buying equipment.

• Evacuation. Procedures for getting people out of the premises safely.
• Invacuation. Procedures for moving people to safety inside the premises where leaving is not the safest option.
• Lockdown. Procedures for securing the premises to restrict or prevent access.
• Communication. Procedures for alerting people on the premises and giving them instructions.

The standard duty is about preparedness and clear procedures rather than physical infrastructure. The expectation is that most standard duty premises can meet these requirements using existing staff and planning.

Enhanced Measures: The Four Categories

Enhanced duty premises and qualifying events must put in place public protection measures in addition to the standard duty procedures. These measures fall under four categories.

• Monitoring the premises. Keeping watch on the premises and the area around it.
• Movement of individuals. Managing how people move into, out of and around the premises.
• Physical safety and security. Measures relating to the physical protection of the premises and the people within it.
• Security of information. Protecting sensitive information that could assist an attacker.

These measures are intended to reduce both the vulnerability of the premises or event and the risk of harm in the event of an attack.

The Compliance Document and the Designated Senior Individual

Enhanced duty premises and qualifying events carry two further obligations that do not apply at standard tier. Both relate to accountability and record keeping.

First, they must designate a senior individual responsible for compliance with the enhanced duty. This person carries responsibility for making sure the procedures and measures are in place.

Second, they must prepare a compliance document. This document records the procedures and measures in place and includes an assessment of how they reduce the vulnerability of the premises or event and the risk of harm. The compliance document must be provided to the SIA.

Quick Reference: Standard Tier Versus Enhanced Tier

Feature	Standard duty premises	Enhanced duty premises and qualifying events
Capacity (individuals present, including staff)	200 to 799	800 or more
Relevant section	Section 5	Section 6
Core obligation	Public protection procedures (Evacuation, Invacuation, Lockdown, Communication)	Procedures plus public protection measures (Monitoring, Movement, Physical safety and security, Security of information)
Designated senior individual	Not required	Required
Compliance document provided to SIA	Not required	Required
Maximum penalty	£10,000 (daily penalty up to £500)	£18 million or 5% of qualifying worldwide revenue, whichever is greater (daily penalty up to £50,000)

What Duty Holders Must Do Now

There is no legal duty to comply until commencement in Spring 2027, but the preparation work is substantial. Duty holders who start now will be in a far stronger position when the duties take effect.

• Assess your capacity against peak use, counting everyone including staff, to work out whether you fall into the standard or enhanced tier.
• Identify any occasional higher-attendance events that could bring your premises into scope or move you up a tier.
• Read the section 27 statutory guidance to understand what is expected of your tier (section 27 statutory guidance).
• Draft your public protection procedures across Evacuation, Invacuation, Lockdown and Communication.
• Plan your public protection measures across the four enhanced categories if you are an enhanced duty premises or qualifying event.
• Appoint a designated senior individual responsible for compliance if you fall into the enhanced tier.
• Prepare your compliance document recording the procedures, the measures and the assessment of how they reduce vulnerability and the risk of harm.
• Train your staff so they understand and can carry out the procedures.

Common Errors to Avoid

The tier thresholds and the capacity test catch out many duty holders during early preparation. The following errors are worth checking against before you commit to an approach.

• Counting only customers or visitors and leaving staff out of the capacity calculation.
• Assessing capacity against an average day rather than peak use.
• Overlooking occasional higher-attendance events that bring the premises into scope or into the enhanced tier.
• Assuming an education setting moves into the enhanced tier on capacity, when education settings remain in the standard tier regardless of capacity above the 200 threshold.
• Treating standard duty as requiring expensive equipment, when the procedures are expected to be simple and low cost.
• Failing to designate a senior individual for an enhanced duty premises.
• Preparing procedures and measures but not recording them in a compliance document and providing it to the SIA, where enhanced duty applies.
• Waiting until commencement to start, then finding the preparation work cannot be completed in time.

Enforcement and Penalties

The SIA will have a range of enforcement tools under the Act. These include compliance notices, restriction notices and monetary penalties.

Standard duty breaches carry a maximum penalty of £10,000, with a daily penalty of up to £500. Enhanced duty breaches and qualifying events carry a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with a daily penalty of up to £50,000.

The scale of the enhanced penalties reflects the size of the premises and events in that tier. The overarching factsheet sets out the framework in more detail (overarching factsheet).

How Policy Pros Can Help

Policy Pros helps UK premises and event organisers prepare for Martyn's Law ahead of commencement in Spring 2027. We translate the section 27 statutory guidance into the procedures, measures and records your tier requires, so you are ready when the duties take legal effect.

For document preparation, our Martyn's Law compliance documentation service produces the procedures and records you need, including the enhanced tier compliance document and the assessment that sits behind it.

If you are working out where you fall, start with our capacity assessment guide, which explains how to count individuals including staff against peak use. From there, our standard tier procedures guide and enhanced tier compliance document guide set out what each tier must put in place.

We also publish sector guides for the premises types most affected, including hotels and hospitality, schools and education settings, churches and places of worship, village halls and community venues, gyms and leisure and events and festivals. For the most common questions, see our Martyn's Law FAQ.

The procedures sit alongside your wider safety planning. Our emergency evacuation policies, health and safety policies and risk management policies services help you align Martyn's Law procedures with the rest of your safety documentation.