Martyn's Law is the Terrorism (Protection of Premises) Act 2025, UK legislation that requires certain premises and events to have plans in place to protect the public if a terrorist attack occurs. It's named after Martyn Hett, one of the 22 victims of the 2017 Manchester Arena attack, whose mother, Figen Murray OBE, led the campaign for its introduction.

The law sets out, for the first time, a minimum legal security standard for public premises and events across the UK.

The Act received Royal Assent on 3 April 2025, and duties are expected to come into force in spring 2027, at least 24 months on from Royal Assent. There's no legal requirement to comply until then, but for Contract Managers overseeing venues in scope, now is the time to start preparing. Understanding what applies to your premises or client sites today gives you the runway to get it right before enforcement begins.

Which premises and events does Martyn's Law cover?

Whether you're in scope comes down to two things: what the premises or event is used for, and how many people it draws. The Act sets out a list of qualifying activities, and splits premises into two tiers based on size: standard tier for venues expecting between 200 and 799 people at once, and enhanced tier for anything hosting 800 or more.

Qualifying activities include things like shops, nightclubs, entertainment venues, sports grounds, education establishments, and healthcare facilities. If your premises is used purely for private purposes, or you'd never reasonably expect 200 people on site at once, you're outside the scope of the Act.

There's one test for working out your numbers: how many people could reasonably be on site at the same time, counting your own staff alongside customers and visitors. You can use whatever reasonable method fits your business, safe occupancy calculations for fire safety, historic attendance data, fixed seating numbers, or ticket and pre-registration limits. Getting this number right decides which set of duties applies to you, so it's worth checking each site on its own rather than assuming every location is the same because the buildings look alike.

How to comply with Martyn's Law

Standard tier premises focus on public protection procedures. Enhanced tier premises and qualifying events go further: they also need to consider vulnerability, put protective measures in place, and meet documentation and regulator-facing obligations.

Standard tier requirements

Public protection procedures are the actions staff can take if they suspect a terrorist attack is happening, or about to happen, at the premises, at the event, or nearby. They cover evacuation, invacuation, lockdown, and communication. Once the Act comes into force, expected in spring 2027, the responsible person for standard tier premises will also need to notify the SIA of their premises.

Here is what each procedure involves:

• Evacuation: Clear routes and processes for moving people out of the premises quickly and safely.
• Invacuation: Bringing people into a designated safe area when leaving the building is not appropriate. This is the reverse of evacuation and applies when the threat is outside.
• Lockdown: Securing the building to prevent a threat from entering or spreading through it.
• Communication: A reliable method for alerting staff and emergency services during an incident.

You don't need to make physical alterations or buy equipment for standard tier compliance. People working at the premises just need to know the procedures well enough to put them into practice. For most standard tier premises, the real cost of compliance is time, developing and testing these plans properly.

Enhanced tier requirements

Enhanced tier premises meet all standard tier requirements and more. They also need appropriate public protection measures in place, so far as is reasonably practicable, to reduce vulnerability to acts of terrorism and the risk of physical harm if an attack were to occur.

These measures can be people-based, such as extra staff training, process-based, such as a bag search policy, or physical, such as CCTV. Enhanced tier responsible persons must also:

• Carry out a formal vulnerability assessment of the premises or event.
• Produce a written security plan, ready to submit to the SIA once its notification portal opens alongside commencement, expected in spring 2027.
• Designate a senior individual to ensure compliance with the Act, where the responsible person is an organisation or company.

For organisations managing several enhanced tier sites, security plan submission is a significant ongoing commitment, not a one-off task. It's worth building a consistent process now for producing, storing, and reviewing these documents across all sites.

Who is the responsible person?

The responsible person is the individual or organisation that controls the premises for its qualifying use. For qualifying events, it is the event organiser.

Responsible persons can't hand off their legal accountability to a contractor or service provider. They can delegate tasks, but the duty itself stays with them. If you work as a facilities management contractor or maintenance business across client sites, your client is the duty holder, though you may still be asked to support their compliance activities as part of your service agreement.

The SIA's role as regulator

The Security Industry Authority (SIA) is the regulator for Martyn's Law. In the first instance, its role is to advise and support, helping responsible persons understand what reasonably practicable procedures and measures they need to have in place, before moving to enforcement.

Where non-compliance is serious or ongoing, the SIA can take formal action. Its powers include:

• Investigation: inspecting premises and requiring information from responsible persons.
• Compliance notices: requiring specific action by a set deadline.
• Restriction notices: for enhanced tier premises and qualifying events only, limiting numbers or hours until issues are fixed.
• Monetary penalties: civil fines for non-compliance.

The maximum penalties reflect the tier:

• Standard tier: up to £10,000, plus a daily penalty of up to £500 for continued non-compliance.
• Enhanced tier: up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, plus a daily penalty of up to £50,000.

Both types of notice can be appealed to a tribunal. The government's intent is that responsible persons can meet these requirements without needing to buy in specialist services, and the SIA will publish further guidance during the implementation period.

How to prepare for Martyn's Law now

If your business owns qualifying premises, or you manage service contracts at venues in scope, here's what to do during the implementation period:

• Confirm you're in scope: check each site against the qualifying use list and capacity threshold to find out which tier applies.
• Audit your existing procedures: check whether you already have evacuation, invacuation, lockdown, and communication plans, and note any gaps against the requirements.
• Train your staff: make security awareness part of everyday practice, not a one-off session.
• Centralise your records: keep completed checks, safety procedures, and compliance documentation in one place so you can prove readiness quickly.
• Embed checks into planned work: when your engineers carry out scheduled visits at venues in scope, build evidence capture into the visit itself, not as a separate step afterwards.

Work through these in order, and by the time the Act comes into force, compliance is something you're already doing, not something you're scrambling to catch up on.

Getting your evidence in order

Getting ready for Martyn's Law will mean more internal auditing than most businesses are used to, checking evacuation plans, training records, capacity assessments, and eventually security plans, all kept in a form you can produce on demand. That sounds like a lot, but you have time on your side, and the requirements themselves are laid out plainly. There are no hidden traps here, no vague standard you're meant to guess at. You know your tier, you know what it asks of you, and you have until spring 2027 to get there.

The part worth getting right early is where all that evidence lives. If it's spread across spreadsheets, inboxes, and paper files, producing it on demand becomes the hard part, even when the underlying work was done properly. Software with UK compliance built in as a focus turns that evidence trail into something your team builds as they work, not something they reconstruct afterwards.

Joblogic's Mobile Forms capture site evidence, signatures, and checks at the point of work, and Asset Management keeps a full history against every site and piece of equipment, so nothing needs reconstructing after the fact. If you want to see how it fits your business, book a demo and a specialist will walk you through it.

Frequently asked questions

These questions cover some of the finer points that often come up once the core requirements are understood.

Can a standard tier premises be pulled into the enhanced tier by a one-off event?

A premises that normally falls within the standard tier may host a one-off event that meets the qualifying event test. In that situation, the event itself may fall within enhanced tier requirements, even though the venue's normal capacity is lower. Assess each large-scale event separately, regardless of your premises' usual tier.

Does Martyn's Law apply to outdoor events without a fixed building?

Premises must include at least one building, whereas events can take place on land, buildings, or a combination of both. Large public gatherings don't automatically meet the qualifying event test. Without specific entry conditions, such as ticket checks or access control, an event may fall outside the qualifying event definition even if the crowd is very large.

Can existing fire safety procedures count towards Martyn's Law compliance?

Many standard tier requirements, including evacuation, invacuation, and communication, overlap with procedures you may already have in place for fire safety. Familiar methods such as safe occupancy calculations or historic attendance data can also be used to assess capacity, so your starting point is likely closer to compliance than you might expect.

Do maintenance contractors have any direct duties under Martyn's Law?

Contractors don't hold direct legal duties under the Act. The responsible person can't transfer their legal accountability to a service provider, though specific tasks can be delegated. If you work across client venues that fall within scope, your clients remain the duty holders, but understanding their obligations helps you support them more effectively within your service agreements.

Where can you find the official Martyn's Law guidance?

The statutory guidance is published on GOV.UK, alongside supplementary documents covering scope, capacity assessment, and duty requirements. The ProtectUK website also provides supporting resources and updates from Counter Terrorism Policing.