Understanding Martyn’s Law and what it means for your organisation

The introduction of Martyn’s Law represents one of the most significant changes to public venue security and counter-terrorism preparedness in recent years. Formally known as the Terrorism (Protection of Premises) Act 2025, the legislation aims to improve public safety by requiring certain premises and events to be better prepared for the risk of a terrorist attack. 

Named in memory of Martyn Hett, one of the 22 victims of the Manchester Arena attack in 2017, the law has been driven by a long-running campaign led by his mother, Figen Murray OBE. 

For organisations responsible for public-facing premises and events, now is the time to understand the legislation, assess potential obligations, and begin preparing for implementation. 

What Is Martyn’s Law? 

Martyn’s Law applies across England, Wales, Scotland and Northern Ireland and is designed to improve preparedness and protective security measures at locations where members of the public gather. The legislation requires responsible persons to take proportionate steps to reduce harm and respond effectively should a terrorist incident occur. 

The Security Industry Authority (SIA) has been designated as the regulator responsible for overseeing compliance. 

The Two Compliance Tiers 

The legislation adopts a tiered approach based on the number of individuals reasonably expected to be present at the same time. 

Standard Tier 

The Standard Tier applies to qualifying premises where 200 to 799 individuals may be present. 

Organisations within this tier must implement and maintain procedures that help protect people in the event of a terrorist incident. 

Enhanced Tier 

The Enhanced Tier applies to qualifying premises and events where 800 or more individuals may reasonably be expected to be present at the same time. 

In addition to Standard Tier requirements, Enhanced Tier organisations must undertake further security planning and implement measures designed to reduce vulnerabilities to attack. 

Core Requirements 

Standard Tier Requirements

Responsible persons must establish and maintain public protection procedures covering four key areas: 

1. Evacuation – safely moving people out of the premises. 
2. Invacuation – moving people to safer areas within the premises. 
3. Lockdown – restricting or preventing an attacker’s access. 
4. Communication – informing and directing people during an incident. 

The focus of the Standard Tier is on preparedness, planning and effective response rather than extensive physical security measures. 

Enhanced Tier Requirements 

Enhanced Tier premises and events must meet all Standard Tier obligations plus: 

• Notify the SIA of relevant details. 

• Designate a senior individual where the responsible person is an organisation. 

• Assess vulnerability to terrorist threats. 

• Implement reasonably practicable public protection measures. 

• Maintain documented security arrangements and compliance evidence. 

Public protection measures may include controls relating to: 

• Monitoring of premises and surrounding areas. 

• Management of entry, exit and crowd movement. 

• Physical security arrangements. 

• Systems for identifying and responding to suspicious activity. 

Implementation Timescales 

The Act received Royal Assent on 3 April 2025. However, the Government has provided a substantial implementation period before the operational requirements come into force. 

Current guidance indicates an implementation period of approximately 24 months, with the substantive requirements expected to commence in 2027. Organisations therefore have a limited but valuable window in which to prepare. 

While compliance is not yet mandatory until commencement, organisations should avoid delaying preparations, particularly if they operate larger premises or host public events. 

Practical Guidance for Organisations 

1. Determine Whether You Are in Scope

Review your premises and events against the capacity thresholds: 

• Under 200 persons: generally outside scope. 

• 200–799 persons: Standard Tier. 

• 800+ persons: Enhanced Tier. 

2. Identify the Responsible Person

Every qualifying premises or event must have a clearly defined responsible person accountable for compliance. Enhanced Tier organisations must also designate an appropriate senior individual. 

3. Review Existing Emergency Procedures

Many organisations already have fire, health and safety, or crisis management plans in place. Assess whether these procedures adequately cover: 

• Evacuation 

• Invacuation 

• Lockdown 
• Emergency communications 

4. Train and Exercise

Staff awareness and preparedness are central to Martyn’s Law. Ensure teams understand procedures and can confidently respond during an incident. Regular exercises and scenario testing should be considered, particularly for larger venues. 

5. Document and Review

Maintain records of procedures, training, assessments and reviews. Enhanced Tier organisations should ensure security measures and decision-making processes are fully documented. 

Key Takeaway 

Martyn’s Law introduces a proportionate, risk-based framework designed to improve terrorism preparedness across UK public venues and events. Organisations with capacities of 200 or more should begin reviewing their responsibilities now, while those operating 800+ capacity venues or events should start planning for the additional Enhanced Tier requirements. 

Although formal enforcement is not expected until 2027, early preparation will help organisations demonstrate good governance, improve resilience, and most importantly, enhance the safety of staff, visitors and the wider public.