In brief
Martyn's Law received Royal Assent on 3 April 2025 and, with statutory guidance now published and Security Industry Authority (SIA) guidance consulted on, commencement is expected no earlier than spring 2027.
- Qualifying premises fall into the standard tier (200–799 expected individuals) or the enhanced tier (800 or more), with obligations scaling accordingly. The legislation also covers qualifying events.
- The SIA is building its regulatory capability and has a graded enforcement toolkit, from compliance and restriction notices through to penalty notices of up to £10,000 (standard tier) or £18 million / 5% of worldwide revenue (enhanced tier).
This article sets out an overview of this law and its implications and is the first in a series which will consider the implications of Martyn's Law for various sectors.
What's in place?
The long-awaited Martyn's Law is expected to come into force from early April 2027 and as that date approaches its impact on businesses and organisations is becoming clearer. On 15 April 2026, the Home Office published statutory guidance, a detailed document explaining how those responsible for qualifying premises should meet their obligations. On the same day, the SIA) launched a public consultation on its draft guidance, setting out how it intends to regulate and enforce the Act. The consultation closed on 12 June 2026 and a review is ongoing with a report expected to be published in autumn 2026.
On 15 June 2026, the first provisions of the Act came into force, placing duties on the SIA itself to produce its final guidance and set out how penalties will be calculated. On 14 July 2026, the notification deadlines were laid before parliament: responsible persons will have three months from the day the duty starts to notify the SIA, and 28 days for any subsequent changes. The SIA is actively building its regulatory infrastructure, having recruited over 100 new staff and established a new hub in Manchester, and pilot inspections are underway. Organisations that use this period well will be in a substantially stronger position when compliance becomes mandatory.
Qualifying premises and events
The Act applies to premises and events in certain circumstances. Schedule 1 of the Act lists the qualifying uses for premises. Whether and how the Act applies is generally determined by the number of individuals who can reasonably be expected to be present at the premises at the same time. Qualifying premises that can reasonably expect 200–799 individuals to be present at the same time fall into the standard tier, or a premises will fall under the enhanced tier where that figure is 800 or more.
Certain categories of premises benefit from special consideration under the Act, which treats them as standard tier regardless of the number of individuals who may be present. Settings where fewer than 200 individuals can reasonably be expected to be present are out of scope, but falling below this threshold should be verified rather than assumed, and all settings are nonetheless encouraged to have preparedness plans in place for the safety of those who use them.
Requirements under the standard tier
Premises within scope of the standard tier have two core obligations. First, they must identify and notify the SIA of their Responsible Person. Second, they must ensure that appropriate public protection procedures are in place, so far as is reasonably practicable, to reduce the risk of physical harm to individuals if a terrorist attack were to occur at or near the premises. The statutory guidance confirms that 'reasonably practicable' is a genuine qualification: what is required of a small, low-risk premises is not what is required of a concert arena.
The four procedures required by the Act are evacuation (moving people out of danger), invacuation (moving people to a safer place within the premises), lockdown (securing the premises to prevent entry or exit), and communication (alerting people to danger and providing clear instructions). Standard tier settings are not required to implement physical security measures, such as CCTV or bag searches, nor to produce a formal compliance document for submission to the SIA. Those obligations apply only to the enhanced tier.
What is required is that any procedures put in place are genuine, workable, and understood by the staff responsible for carrying them out: a written plan that staff have never seen or practised does not meet the standard. As such, best practice is for procedures to be documented and for those procedures to be well communicated so that those responsible for carrying out public protection procedures understand them and can implement them effectively.
There will be additional considerations for organisations that are the Responsible Person across multiple sites, which must develop site-specific procedures for each, as a single group-wide template will not satisfy the Act.
Additional requirements under the enhanced tier
Enhanced tier premises and qualifying events must meet all of the standard tier requirements described above, and in addition are subject to a further set of obligations aimed at reducing the vulnerability of the premises or event to a terrorist attack, not just the risk of harm if one occurs. Where the standard tier is concerned only with procedures, the enhanced tier adds a requirement to put in place appropriate public protection measures, so far as is reasonably practicable, falling into four categories: monitoring (to help detect suspicious activity or items), movement (controlling, restricting or screening the movement of people, for example through searches, restricted access points, or policies to manage crowds), physical safety and security (such as stand-off zones, vehicle security barriers, or protective glazing, which mitigate the impact of an attack or deter and hinder attackers), and security of information (ensuring that information about the premises or event is not readily available to those who might use it to plan an attack).
Unlike the standard tier, enhanced tier premises and qualifying events must document the procedures and measures that are in place or planned, together with an assessment of how they are expected to reduce the risk of physical harm and the vulnerability of the premises or event, and this compliance document must be submitted to the SIA, kept under review, and updated when there is a significant change to the premises, the event, or the numbers expected to attend. Further guidance on documentation requirements is expected from the SIA.
Where the responsible person is an organisation rather than an individual, it must also designate a senior individual with overall responsibility for ensuring compliance, who cannot delegate that responsibility even though day-to-day tasks can be assigned to others, such as a security manager. Finally, where another individual, organisation or company has control of all or part of the premises or event without being the responsible person, that party must co-operate with the responsible person so far as is reasonably practicable in meeting the Act's requirements.
Regulation and enforcement
Organisations may receive visits or enquiries from the Security Industry Authority (SIA), which has been appointed as the regulator for Martyn's Law. The SIA's background is in licensing commercial security operatives and regulating large public events, so it continues to build on this experience as it develops the systems and teams needed to fulfil its new role.
It remains to be seen how well the SIA's experience translates to regulation for Martyn's Law, and the SIA has stated it intends to take a 'support first' approach, focusing on guidance and compliance before reaching for formal enforcement. That said, the SIA has a range of enforcement tools available where a Responsible Person fails to comply or complies inadequately. It can issue a compliance notice requiring the recipient to meet a specific requirement of the Act within a set period, or a restriction notice imposing restrictions on how the premises may be used. Where financial penalties are warranted, the SIA can issue a penalty notice. For standard tier premises, the maximum penalty is £10,000, with a daily penalty of up to £500 for continued non-compliance. By contrast, enhanced tier premises face a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000. In the most serious cases, where a criminal offence has been committed with the consent, connivance, or neglect of senior personnel, individual prosecution is possible.
Why this matters
This legislation is the result of a passionate campaign by Figen Murray OBE, the mother of Martyn Hett, one of the 22 victims in the 2017 Manchester Arena attack. The Government's 2023 counter-terrorism strategy summarises the current threat facing the UK as 'enduring and evolving', with a domestic threat that is 'less predictable and harder to detect and investigate'. Against this backdrop, with the statutory guidance now published and the implementation period well under way, organisations have both the detail and the time they need to prepare.