Martyn’s Law – Awaited statutory guidance now published

The Government has published statutory guidance to support implementation of the Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law.

Compliance is likely to be required by Spring 2027. Organisations responsible for premises and events should therefore begin reviewing their security arrangements and preparing for compliance.

October 2026 update

Further clarification has now been provided by the Terrorism (Protection of Premises) (Principal Use of Premises) Regulations 2026 and accompanying guidance. The Regulations will help organisations operating mixed-use premises determine:

• the principal use of their premises;

• whether the premises fall within scope; and

• who is responsible for compliance.

Background

Martyn’s Law was introduced following the terrorist attack at Manchester Arena in 2017, in which 22 people were killed. It is named after Martyn Hett, one of the victims. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. It aims to improve organisational preparedness and protective security at publicly accessible premises and events.

The Security Industry Authority (SIA) will regulate the new regime and provide support and guidance to those responsible for complying with it. The statutory guidance explains how the Act will apply and includes illustrative examples and decision trees to help organisations determine whether their premises or events are in scope. Relevant premises may include shops, restaurants, arenas, cinemas, visitor attractions, universities and hospitals.

Public protection procedures

Those responsible for qualifying premises and events must ensure that appropriate public protection procedures are in place, so far as reasonably practicable. These procedures should set out the actions staff can take to reduce the risk of physical harm if they suspect that an act of terrorism is occurring, or is about to occur, at the premises or nearby. Procedures should address four key areas:

1. Evacuation: moving people out of the premises and away from danger.

2. Invacuation: moving people to a safer location within the premises.

3. Lockdown: preventing people from entering or leaving the premises.

4. Communication: alerting staff and members of the public as quickly as possible.

There is no one-size-fits-all approach. Procedures should reflect the nature, size, location, layout and use of the premises, as well as the number and types of people likely to be present.

Organisations should also consider:

• where an attack may originate;

• different methods of attack;

• available staffing and financial resources; and

• existing equipment and infrastructure, including doors, locks, public address systems and areas that can be secured.

Practical steps may include displaying procedures in communal areas, updating staff training and induction processes, and preparing incident-response “grab bags” containing emergency contacts, plans and other critical information.

Standard tier premises

Standard tier premises are qualifying premises where between 200 and 799 people, including staff, may reasonably be expected to be present at the same time. Certain places of worship and educational premises will remain within the standard tier even where 800 or more people may be present.

The responsible person must ensure that appropriate public protection procedures are in place, so far as reasonably practicable. This may include suitable evacuation routes, effective communication arrangements and staff awareness of lockdown procedures. Although there is no general legal requirement for standard tier premises to document their procedures, the guidance recommends doing so. A written record can help staff understand the arrangements and provide evidence of compliance.

Enhanced tier premises and events

Enhanced tier premises are qualifying premises where 800 or more people may reasonably be expected to be present at the same time. These premises are subject to additional requirements. As well as implementing appropriate public protection procedures, the responsible person is required to have in place, so far as is reasonably practicable, appropriate public protection measures. These measures will be centred around monitoring, movement, physical safety and security along with security of information.

Organisations should:

• document the procedures and measures in place or planned;

• assess how they will reduce physical harm and the premises’ vulnerability to terrorism;

• keep those measures under review; and

• appoint a senior individual with responsibility for compliance.

Appropriate measures will depend on the scale and nature of the premises or event. They may include:

• CCTV and control-room monitoring;

• searches of bags and individuals;

• access controls and identification checks;

• security patrols;

• hostile vehicle mitigation;

• security lighting and voice alerts; and

• physical measures such as barriers, shutters and protective glazing.

Anyone who controls the premises but is not the responsible person must cooperate with the responsible person where required.

Determining the principal use of mixed-use premises

Determining whether Martyn’s Law applies can be more complicated where premises are used for several Schedule 1 purposes.

This is particularly relevant to universities, sports stadia, entertainment venues and large public estates. A university campus, for example, may include teaching facilities, accommodation, shops and cafés, while a stadium may also host conferences, hospitality events and tours.

Under the 2026 Regulations, principal use is the use most closely connected to the purpose and nature of the premises. Relevant factors include:

• whether the premises were built or modified for a particular use;

• whether they continue to be used for that purpose;

• their layout, size and physical characteristics; and

• how the premises are treated under planning permissions, premises licences and other regulatory arrangements.

These factors must be considered as a whole. If the principal use remains unclear, organisations should assess the wider circumstances, including:

• the proportion of the premises used for each activity;

• the amount of time devoted to each activity; and

• whether one activity primarily supports another.

For example, a sports stadium that occasionally hosts conferences or tours is still likely to have sport as its principal use. Similarly, a university campus with ancillary retail and catering facilities will generally retain higher education as its principal use.

Organisations should document their assessment and retain relevant supporting evidence, such as premises plans, licences, leases, operating hours, capacity information, staffing data and floor-area calculations.

Principal use should also be kept under review, particularly following refurbishment, licensing changes or significant changes in the activities carried out at the premises.

Enforcement

The SIA will regulate compliance with Martyn’s Law.

Qualifying premises and events will be required to notify the SIA when they become, or cease to be, responsible for premises or an event. Enhanced tier premises and qualifying events must also document their compliance. The SIA will have powers to inspect premises, obtain information and issue compliance or restriction notices. Financial penalties may be imposed, and the most serious failures could lead to prosecution.

Organisations should retain evidence showing how attendance figures have been calculated. Those operating mixed-use premises should also keep records explaining their principal-use assessment and the identification of the responsible person.

What should organisations do now?

Organisations should use the implementation period to understand how the Act applies to them and review their existing arrangements. The guidance does not require separate procedures for every possible method of attack. Instead, organisations should focus on identifying where a threat is coming from and selecting the response most likely to keep people safe.

Preparatory steps should include:

• determining whether premises or events are in scope;

• identifying the responsible person;

• assessing the applicable tier;

• reviewing evacuation, invacuation, lockdown and communication procedures;

• checking whether procedures can be implemented quickly and effectively;

• reviewing staff training and induction arrangements;

• documenting principal-use assessments for mixed-use premises; and

• keeping decisions, procedures and supporting evidence under review.

Compliance does not necessarily require significant spending on specialist equipment or external consultants. The guidance emphasises the importance of a strong security culture, proportionate planning and procedures that staff understand and can implement effectively.

How we can help

We can support organisations with:

• regulatory readiness and compliance reviews;

• enforcement risk management;

• strategic projects and policy engagement; and

• enforcement strategy.