Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, a UK law that requires the people responsible for certain publicly accessible premises and large events to be prepared for a terrorist attack. It received Royal Assent on 3 April 2025 and is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in May 2017. The duties are not yet in force: the Security Industry Authority (SIA), which will regulate the law, expects it to come into force in spring 2027, and the government has committed to an implementation period of at least 24 months, so no duties can start before 3 April 2027.

The law followed years of campaigning by Figen Murray, Martyn Hett's mother, for a legal duty on venues to plan for attacks. It applies across England, Wales, Scotland and Northern Ireland, and it is designed to make sure that the places where large numbers of people gather have thought through, in advance, how they would keep those people safe. The GOV.UK guidance from the SIA sets out the regulator's role and the timetable.

Who does Martyn's Law apply to?

Martyn's Law covers qualifying premises and qualifying events. A premises qualifies if it consists of a building, or part of a building, is wholly or mainly used for a purpose listed in Schedule 1 of the Act, is accessible to the public, and it is reasonable to expect that 200 or more people may be present there at the same time, from time to time. The listed uses include entertainment venues, sports grounds, shops, restaurants, schools and places of worship. Private homes and private areas of premises are not covered.

Qualifying events are public events with entry checks where 800 or more people, including staff, are expected at the same time. The person who has control of the premises, or of the event, is the "responsible person" under the Act, and the duties fall on them.

What are the two tiers?

How much a responsible person must do depends on one number: how many people it is reasonable to expect may be on the premises at the same time. Premises where 200 to 799 people may be present are in the standard tier. Premises where 800 or more people may be present are in the enhanced tier. Premises where fewer than 200 people may be present are out of scope and have no duties under the Act at all.

Schools, childcare settings, further education premises and places of worship fall within the standard tier. The tier is decided by the expected number of people, counting staff, volunteers and performers as well as the audience, not by the type of building alone.

What must standard tier premises do?

Standard tier premises have two core duties. First, the responsible person must notify the SIA when they become responsible for a qualifying premises or event, and tell it when they stop being responsible. The SIA is building an online portal for notifications, and the deadlines laid before Parliament in July 2026 give responsible persons three months from the day the duty starts to notify, and 28 days for any later changes.

Second, they must put in place public protection procedures, so far as is reasonably practicable, to reduce the risk of physical harm if an attack happens on the premises or in the immediate vicinity. The Act requires procedures covering four things: evacuation, getting people out safely; invacuation, bringing people inside to a safer place; lockdown, securing the premises to keep a threat out; and communication, raising the alarm and telling people what to do. Staff need to know the procedures. The standard tier is about planning, not purchases: there is no requirement to install equipment or alter the building.

What does the enhanced tier add?

Enhanced tier premises and qualifying events must meet all the standard tier duties, and then do more. They must assess, keep under review and, so far as is reasonably practicable, put in place public protection measures that reduce vulnerability to an attack and the harm it could cause. Those measures cover four areas: monitoring the premises and its immediate surroundings, controlling the movement of people into, out of and within the premises, the physical safety and security of the premises, and the security of information that could be useful to an attacker.

They must also produce a documented assessment setting out the procedures and measures they have put in place and how they reduce risk, and provide it to the regulator. And where the responsible person is an organisation rather than an individual, a designated senior individual must be named as responsible for making sure the duties are met.

It is important to be clear about what the law does not demand. It does not automatically require bag searches, metal detectors, CCTV, security staff or bollards. Measures must be appropriate and proportionate to the premises, its use and the risks involved.

When does Martyn's Law come into force?

The Act is law, but its duties are not yet switched on. The government committed to an implementation period of at least 24 months from Royal Assent on 3 April 2025, so the duties cannot start before 3 April 2027. The SIA expects the Act to come into force in spring 2027 and says it will confirm the exact date in advance.

Preparation is already under way. The Home Office published its statutory guidance under section 27 of the Act on 15 April 2026, and the SIA consulted on its own draft enforcement guidance between 15 April and 12 June 2026, with the final version expected in autumn 2026. The first provisions of the Act came into force on 15 June 2026, placing duties on the SIA itself to produce its final guidance and set out how penalties will be calculated. The SIA has recruited more than 100 new staff, set up a hub in Manchester, and pilot inspections are under way.

What are the penalties for not complying?

The SIA will regulate Martyn's Law through desk-based assessments and on-site inspections, and it can issue compliance, restriction and penalty notices. For standard tier premises, the maximum non-compliance penalty is £10,000, plus daily penalties of up to £500 for ongoing breaches of a notice. For enhanced tier premises and qualifying events, the maximum is the greater of £18 million or 5% of qualifying worldwide revenue, plus daily penalties of up to £50,000.

The SIA has said it wants to spend the implementation period helping venues prepare rather than catching them out, and inspections will normally come with at least 72 hours' notice. Even so, the size of the enhanced tier penalties means large venues and event organisers are already treating the guidance as a live planning exercise.

What should venues do now?

The first step is to work out the "reasonable figure" for your premises: how many people it is reasonable to expect may be there at the same time, from time to time. That number decides whether you are out of scope, in the standard tier or in the enhanced tier. The Home Office guidance and the flowcharts on ProtectUK, the government's protective security platform, help responsible persons check whether their premises or event is in scope.

From there, venues should review the Home Office section 27 guidance, put the four standard tier procedures in place, and make sure staff know them. Enhanced tier venues should start the documented assessment and think through the four areas of public protection measures. Responsible persons can also sign up for updates from the SIA, which will confirm the commencement date ahead of time. This article is general information, not legal advice, and the official guidance is the place to check the detail for a specific premises.

Frequently asked questions

Does Martyn's Law apply to village halls? It depends on the numbers. A hall where fewer than 200 people may be present at the same time is out of scope. A hall where 200 or more may be present is in the standard tier, and its duties are procedures and notification, not building work or equipment.

Does it apply in Scotland and Northern Ireland? Yes. The Act applies across the whole of the UK.

Will venues have to install CCTV or hire security guards? No, not automatically. The law requires measures that are appropriate and proportionate. For standard tier premises, the duty is procedures. For enhanced tier premises, the measures are chosen to fit the premises and its risks.

Who is the responsible person? Whoever has control of the premises in connection with its qualifying use, or, for an event, whoever will have control of the premises for the event. That person must notify the SIA and make sure the duties are met.