Martyn's Law: who it applies to, what each tier must do, and how to show it is in place

01

What Martyn's Law is, and when it starts

The Terrorism (Protection of Premises) Act 2025 is known as Martyn's Law after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. It applies in England, Wales, Scotland and Northern Ireland. Its aim is to protect the public: those responsible for certain premises and events must take steps to prepare for a terrorist attack and help keep people safe if one happens. The Home Office's statutory guidance on the Terrorism (Protection of Premises) Act 2025 says its purpose is to set protective security "on the same footing as other regulatory regimes such as health and safety, fire safety and online safety" by setting legal minimum requirements for preparedness.

Parliament passed the Act, and it received Royal Assent on 3 April 2025. Its duties do not apply yet: section 37 of the Act leaves the main provisions to start on a day the Secretary of State appoints by regulations, and the government committed to an implementation period of at least 24 months from Royal Assent. The Security Industry Authority's page Understanding Martyn's Law and the SIA's role as regulator says "It is expected that the Act will come into force in spring 2027", with the exact date to be confirmed in advance. The statutory guidance was published on 15 April 2026 so that those in scope can prepare.

The Act works in two tiers, set by how many people can reasonably be expected on the premises at the same time:

• Standard tier (the Act calls these "standard duty premises"): 200 to 799 people. The duty is to have appropriate public protection procedures in place, so far as is reasonably practicable, and to notify the SIA.
• Enhanced tier ("enhanced duty premises"): 800 or more people, plus qualifying events. The duty adds public protection measures, a written compliance document sent to the SIA, and a designated senior individual.

Throughout, the test is what is reasonably practicable: the likely effectiveness of a procedure or measure weighed against its cost, time and difficulty. It is a proportionate duty, not a demand to make a building attack-proof.

02

Who is in scope: premises, events and the responsible person

Under section 2 of the Act, premises are "qualifying premises" when all four of these are true:

1. they consist of a building, or a building and other land (including part of a building or a group of buildings);
2. they are wholly or mainly used for one or more of the uses in Schedule 1 to the Act;
3. it is reasonable to expect that, from time to time, 200 or more individuals may be present at the same time in connection with those uses; and
4. they are not excluded by Schedule 2.

Premises that fail any one of the four are not qualifying premises, although a qualifying event can still be held at them.

The Schedule 1 uses include shops, pubs, restaurants and cafés, cinemas, gyms and leisure centres, sports grounds, libraries and museums, halls for hire and conference centres, visitor attractions, hotels, places of worship, health care, stations, childcare and education, and premises where a public authority serves the public. A private office block, warehouse or factory is not among them, so it is not qualifying premises on that basis. The list is broad and takes in many kinds of venue open to the public.

The count includes staff. The guidance says "staff" means everyone working at the premises, "whether as employees, contractors, volunteers or otherwise", so the cleaning and security teams on shift count towards the 200. "From time to time" means occasionally but predictably: a seasonal peak counts, a genuinely unexpected one-off does not. Whatever method is used to make the assessment "must be evidenced" and must satisfy the SIA that it is reasonable.

Some premises are always standard tier, however many people attend: places of worship, and premises used for childcare or for primary, secondary or further education. Universities are not in that group, so a large higher education site can be enhanced tier.

A qualifying event under section 3 of the Act is one held at a venue or other premises that are not already enhanced tier, open to the public, where 800 or more people may be present at the same time at some point, where entry is controlled by payment, tickets or passes, or club membership, and which is not excluded by Schedule 2.

03

The standard tier: four public protection procedures

Section 5 of the Act requires the person responsible for qualifying premises or a qualifying event to ensure, so far as is reasonably practicable, that appropriate public protection procedures are in place to reduce the risk of physical harm if an act of terrorism occurs on the premises, at the event or in the immediate vicinity. There are four, for the people working there to follow:

• Evacuation: getting people out of the premises, or part of it, away from the danger.
• Invacuation: moving people to a safer place inside, which can mean bringing people in from the street.
• Lockdown: preventing people entering or leaving, by locking doors, closing shutters or using barriers, in full or in part.
• Communication: telling people on the premises what is happening and what to do, as quickly as possible.

The guidance warns that a fire evacuation plan is not automatically a terrorism evacuation plan: the procedures "may differ from fire evacuation plans", and because fire can be used as a weapon, a fire alarm activation "should not immediately be assumed to be only a fire".

There is no legal requirement at the standard tier to write the procedures down. The guidance says the responsible person "should" prepare a document anyway, because it may otherwise "be difficult to demonstrate compliance with the Act – for example, in the event of an inspection by the SIA". It also suggests a grab bag with current emergency contacts, staff lists and floor plans.

Nor does the Act require any specific counter-terrorism training. What it does require is that procedures can actually be carried out: people with a role in them "must be made aware of the procedures and their specific role" and be given "the understanding, experience and tools required to carry them out effectively". In practice: induction and start-of-shift briefings, prompt cards and run-throughs, for every shift and contractor expected to act.

Each responsible person must notify the SIA as well. Under section 9 of the Act and the Home Office's notification requirement guidance, those responsible for qualifying premises when the requirement starts have three months to notify through the SIA's online portal; after that, a change of responsible person or of the information given must be notified within 28 days. Events have 14 days from when their date is first publicised.

04

The enhanced tier: measures, a compliance document and a senior individual

Enhanced tier premises and qualifying events must have the four procedures and then three things more.

Public protection measures. Section 6 of the Act requires the responsible person to assess and keep under review the public protection measures appropriate to reduce the premises' vulnerability to terrorism and the risk of harm, and, so far as is reasonably practicable, to put them in place. The measures relate to four things:

• Monitoring of the premises and its immediate vicinity, to spot suspicious activity and items: trained, alert staff, a clear reporting route, CCTV where it is used, and security staff checking that gates, doors and windows remain secure.
• Movement of people into, out of and within the premises: access control, ticket and pass checks, bag searches, locks, shutters and barriers.
• Physical safety and security: hostile vehicle mitigation such as bollards, blast-resistant glazing and other ways of hindering an attacker or limiting the harm.
• Security of information: keeping plans, security arrangements and other useful detail out of the hands of anyone planning an attack.

The guidance warns that "if no one working at qualifying premises or qualifying events knows how to carry out the relevant measures, the measures are not properly in place". Security measures must not impede safe entry and exit, so the fire strategy and the security plan are read together. Some roles still need a licence under other law: the guidance notes that CCTV operators and door guards require SIA licences.

A compliance document. Under section 7 of the Act, the responsible person must ensure a document is prepared and kept up to date containing a statement of the procedures, an assessment of how they are expected to reduce the risk of harm, a statement of the measures in place or proposed, and an assessment of how those measures are expected to reduce vulnerability and risk. A copy goes to the SIA as soon as reasonably practicable after it is first prepared, and within 30 days of any revision. The guidance treats a record of staff training and instruction as "a necessary element of the document of compliance".

A senior individual. Where the responsible person is a company or organisation, section 10 of the Act requires it to designate an individual "concerned in the management or control" of it to be responsible for compliance. They can delegate tasks, for example to a security manager, but not the overall responsibility.

05

How the SIA will check, and keeping it under review

The Security Industry Authority, which already licenses the private security industry, is the regulator. It says its assessments will be desk-based and on site, risk-based and informed by intelligence, and that it will typically give at least 72 hours' notice of an on-site inspection. Inspectors can also require information, or require someone to attend an interview.

The Home Office's regulator, sanctions and enforcement factsheet and the statutory guidance set out the civil sanctions:

• Compliance notices, requiring a responsible person to meet a specified requirement within a set period.
• Restriction notices, for enhanced tier premises and qualifying events only, restricting the use of the premises or the holding of an event.
• Penalties of up to £10,000 for a standard tier contravention, with daily penalties of up to £500, and up to £18 million or 5% of qualifying worldwide revenue, whichever is higher, for the enhanced tier, with daily penalties of up to £50,000. Failing to attend a required interview carries up to £5,000.

Penalty notices are the main tool. In the most serious cases the SIA can refer a matter for prosecution, and senior personnel can be prosecuted if an organisation's offence involved their consent, connivance or neglect.

An inspector will want to see that procedures exist, that the people expected to carry them out know their part, and that the doors, shutters, alarms and communication routes they rely on work. The Act requires enhanced tier measures to be kept under review; the guidance recommends reviewing procedures at either tier periodically, possibly annually, and after a significant change in use, numbers or layout. It adds that procedures and measures "should also be reviewed, tested and practiced regularly".

06

Where the record fails, and what SiteClara does about it

Where Martyn's Law preparation goes wrong is the gap between the document and the building. The lockdown procedure relies on a side shutter that has not closed fully for a month. The grab bag holds last year's staff list. The plan says officers check the entrances every hour, and the only evidence is a line in the occurrence book written at the end of the night.

SiteClara records the routine checks that procedures and measures depend on, at the place they are made. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the entrances, the lockdown doors and shutters, the grab bag store, the control room. Whoever does the round scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or explains what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A fault found on the round, such as the shutter that will not close, goes onto the team's list of jobs until someone closes it, and the supervisor can escalate it to the building manager.

The supervisor sees what was due, done and missed, and records the reason a check was missed. Each day they review the totals and photos and approve a report that goes to nominated management or client contacts at 8am the next morning, showing what was reported, what is still open and how scheduled checks went. That gives the responsible person a working record, made at the time, that the checks behind the procedures were done.

07

Questions people ask

Is Martyn's Law mandatory?

Yes, once its duties are in force: section 5 of the Terrorism (Protection of Premises) Act 2025 says the person responsible for qualifying premises or a qualifying event "must, so far as is reasonably practicable, ensure that appropriate public protection procedures are in place", and the SIA can enforce it with compliance notices and penalties. Until then, the Home Office's statutory guidance on the Terrorism (Protection of Premises) Act 2025 says "there is no legal requirement to comply until the legislation comes into force", although those in scope are expected to prepare.

When does Martyn's Law come into force?

In spring 2027, on current expectations: the SIA's page Understanding Martyn's Law and the SIA's role as regulator says "It is expected that the Act will come into force in spring 2027", and that the exact date will be confirmed in advance. The Home Office published its statutory guidance on the Terrorism (Protection of Premises) Act 2025 in April 2026 so that those in scope can prepare.

Does Martyn's Law apply to schools?

Yes, where 200 or more people, counting staff, can be expected on site at the same time from time to time. Paragraph 4.38 of the statutory guidance on the Terrorism (Protection of Premises) Act 2025 puts childcare, primary, secondary and further education premises in the standard tier "even if that number of expected individuals is 800 or more", so they need the four procedures but not the enhanced tier measures.

Do staff need counter-terrorism training under Martyn's Law?

No specific course is required: paragraph 7.51 of the statutory guidance on the Terrorism (Protection of Premises) Act 2025 says there is "no statutory requirement in the Act" for specific counter-terrorism training. But staff with a role in the procedures must be made aware of them and of their part, and paragraph 7.52 says that if they are not informed or trained, it is likely to be difficult to demonstrate that appropriate procedures are in place.

08

Further reading, and a list to take away

The Act itself is on legislation.gov.uk as the Terrorism (Protection of Premises) Act 2025. The Home Office publishes the statutory guidance and its supplementary documents and a set of Martyn's Law factsheets on scope, the standard and enhanced duties and enforcement. ProtectUK and the National Protective Security Authority (NPSA) publish free good practice advice and ACT Awareness e-learning.

Before the Act comes into force, check that:

• you know who the responsible person is for each building, and it is written down;
• the number of people expected at the busiest time, counting staff and contractors, has been assessed by a method you can explain;
• you know which tier applies, and when a change in use or numbers would move it;
• evacuation, invacuation, lockdown and communication procedures exist and are distinct from the fire plan where they need to be;
• every shift, including contractors, knows its part, and briefings are recorded;
• the doors, shutters, alarms and communication routes the procedures rely on are checked on a schedule, and faults are fixed;
• at the enhanced tier, the measures are assessed, the compliance document is drafted and a senior individual is named;
• you know how and when you will notify the SIA, and a review date is set.