Martyn’s Law compliance: What you need to know

At its core, Martyn’s Law (formally known as the Terrorism (Protection of Premises) Act 2025) places a legal responsibility on certain premises and event organisers to consider and prepare for the risk of terrorism in a structured, proportionate way. 

Public safety in the UK has changed significantly over the last decade. Places that were once considered low risk, such as shopping centres, education settings, entertainment spaces, stadiums, hotels, and even smaller hospitality sites, are now operating with an underlying awareness that threats, while rare, are no longer considered exceptional. 

Martyn’s Law has been introduced in response to that shift. It’s designed to ensure that protective security is no longer something left to chance, or something only considered after an incident. Instead, it becomes part of how public venues are run day to day. 

The law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. Following a sustained campaign by his mother, Figen Murray, the legislation was introduced to address a critical gap in public safety.

Before this, there was no consistent, legally enforceable standard for how public venues should prepare for and respond to a terrorist incident. 

Martyn’s Law is ultimately about ensuring organisations take steps to reduce harm in the event of a terrorist incident. It represents a major change in how organisations are expected to think aboutand approach safety, risk and public protection.

Martyn’s Law does not expect organisations to turn their premises into high-security environments. Instead, it focuses on reasonable, scalable planning based on size, capacity and risk profile. 

At its core, what Martyn’s Law does is introduce a tiered approach to how publicly accessible venues prepare for and respond to the risk of terrorism. 

The law applies to “qualifying premises”, or locations open to the public where people gather as part of normal activity. Whether it applies depends largely on maximum occupancy, including staff. 

With enforcement expected from Spring 2027, understanding where your organisation sits is a key step in Martyn’s Law compliance and early preparation. 

If it’s reasonable to expect that between 200-799 people (including staff) could be on your premises at any one time, your organisation falls under the Standard Tier. 

For most restaurants, bars and hotels, the focus here is on proportionate, practical measures rather than physical security infrastructure. The compliance at this level is centred on having clear, workable procedures in place and ensuring staff are confident in how to respond if an incident were to occur. 

• Procedures: You must have plans in place for evacuation, invacuation (sheltering in place), lockdown, and communication in the event of an attack. 

• Provide Staff Training: Employees need basic terrorism protection training to ensure they can carry out the procedures effectively. 

• Notify the Regulator: You will need to register your premises with the Security Industry Authority (SIA) as the new regulator for the Act. 

This applies to larger venues where 800 or more people could reasonably be present at any one time.

At this level, Martyn’s Law compliance requires a more formal and structured approach to security planning, reflecting the increased scale and complexity of the premises. 

Additional requirements are: 

• Physical Security Measures: You must implement “appropriate public protection measures” to reduce vulnerability to an attack. This could include CCTV, security lighting, access control systems, and hostile vehicle mitigation. 

• Vulnerability Assessment: You must formally assess the premises’ vulnerability to different types of terrorist attacks. 

• Appoint a Designated Senior Individual: A specific person within your organisation must be named as legally responsible for compliance with the enhanced duties. 

• Create a Compliance Document: A formal document outlining your security measures and assessments must be created and submitted to the SIA. 

The underlying principle is consistency. Two properties of similar risk should not have completely different levels of preparedness simply because of internal policy differences. 

Martyn’s Law has already progressed through the legislative process and is being introduced in stages, with full rollout expected in Spring 2027. 

Rather than switching on overnight, implementation is expected to be a phased approach, it gives organisations time to understand their obligations and put appropriate measures in place. 

This transition period is intended to support preparation, not disruption, with businesses already being encouraged to act ahead of formal enforcement dates.

As part of this process, the Security Industry Authority (SIA) is also consulting on how enforcement will work in practice, with consultation open until 12th June 2026. 

Yes. Penalties depend on the tier and the nature of the breach. 

For the Standard Tier, failure to comply can result in fines of up to £10,000. 

For the Enhanced Tier, penalties are significantly higher and can run into millions of pounds, particularly in cases of serious or systemic non-compliance. In some circumstances, individuals such as directors or senior managers may also face personal liability. 

Not every location falls within scope of Martyn’s Law. 

The legislation specifically excludes certain premises from the definition of “qualifying premises”. These include 

• Open-air spaces without buildings, such as parks, beaches, and playgrounds
• Transport hubs, which are covered by separate existing legislation 
• Private dwellings, even where they’re used for small-scale business activity such as a privately run B&B 

Historically, security preparedness in publicly accessible spaces have been inconsistent. Larger premises often had structured procedures in place, while smaller organisations relied more on general health and safety practices without specific terrorism-focused planning. 

That inconsistency is what Martyn’s Law is designed to address. 

Martyn’s Law shifts the expectation from reactive response to proactive preparation. It places responsibility on organisations to think in advance about how they would respond to a threat and what can be done to reduce harm before anything happens. 

This matters because when incidents occur, outcomes are often determined in minutes. Not hours. Not policy documents. Real-world preparedness is what makes the difference between confusion and coordinated response. 

Martyn’s Law represents a noticeable shift in how compliance is framed for publicly accessible premises. Previously, many organisations treated security as something that sat alongside broader health and safety obligations. Policies were often documented, but not always actively embedded into day-to-day operations. 

The new approach is different. 

Compliance now focuses more heavily on evidence of preparedness. It’s not enough to have policies in place. Organisations are expected to demonstrate that those policies translate into practical action. They are: 

1. Formalised risk awareness

Organisations are expected to actively consider: 

• How a venue could be targeted
• What vulnerabilities exist
• How to reduce harm to the public

2. Documented procedures

Venues may need: 

• Written security plans
• Escalation procedures
• Incident response guidance

3. Staff preparedness 

Staff training becomes a key requirement: 

• Recognising suspicious behaviour
• Responding appropriately during incidents
• Understanding evacuation or lockdown procedures

4. Ongoing review 

Compliance is not static: 

• Procedures must be reviewed regularly
• Risks must be reassessed as premises change

For many organisations, this means revisiting existing safety frameworks to ensure they align with the expectations introduced by Martyn’s Law, particularly around incident response and public protection planning. 

While detailed guidance will continue to evolve, the direction is already clear. 

Organisations should start by understanding their risk profile and where they sit within scope. Martyn’s Law is designed to be proportionate, but every organisation must demonstrate that it has considered risk in a meaningful way. 

From there, the focus moves to practical implementation. This is not about complexity, but ensuring basic, effective measures are in place and understood by staff. 

Training is central to this. Staff need clarity on what to look for and how to respond. In most cases, confidence and awareness are as important as procedure. 

Finally, organisations must consider ongoing compliance. Martyn’s Law is not a one-off exercise. It requires regular review as operations, layouts, and staffing change. 

Have you been able to estimate the maximum occupancy of your venue during peak times? 

For many organisations, the challenge with Martyn’s Law isn’t understanding its importance, but translating it into something practical and manageable. Hygenisys works with organisations to bridge that gap between regulation and real-world implementation, starting with a gap analysis to understand current readiness and identify key compliance risks. 

From there, support moves into practical delivery, including policies, incident response planning, and staff training to ensure Martyn’s Law compliance is embedded into day-to-day operations. 

To discuss your organisation’s readiness and progress towards Martyn’s Law compliance, you can book a consultation with the Hygenisys team.