Since Martyn’s Law was passed, we have been helping organisations work out what it means for them in practice. The same lessons keep coming up, so we have pulled them together here: a quick recap of the law, the three hurdles we see most often, a four-step route to compliance, and the risks that are easiest to overlook.
Martyn's Law at a Glance
Martyn’s Law, formally known as the Terrorism (Protection of Premises) Act 2025, received Royal Assent in April 2025. Designed to reduce the risk of harm in the event of a terrorist attack, the legislation requires certain public-facing premises and events to implement proportionate public protection procedures.
The requirements are divided into two tiers based on capacity:
- Standard Tier (200 to 799 people): Venues must ensure appropriate public protection procedures are in place, covering evacuation, invacuation, lockdown, and communication.
- Enhanced Tier (800 or more people) and all qualifying events: In addition to the Standard Tier procedures, larger venues must implement comprehensive public protection measures. These aim to reduce both the vulnerability of the premises and the risk of physical harm during an attack. The responsible person must also formally document their procedures and measures and provide an assessment of how effectively they mitigate these risks. Where the responsible person is an organisation, it must designate a senior individual responsible for compliance.
Note: capacity is not the only test. Whether the Act applies also depends on how your premises are used, the physical nature of the site and specific exclusions. Check the Home Office’s guidance, which includes decision trees and worked examples. Whichever tier you fall into, you will also need to tell the SIA who is responsible for your premises.
Affected premises and events have been given an implementation period of at least 24 months, and the duties are expected to come into force in spring 2027. The SIA’s final guidance on how it will regulate is expected in autumn 2026.
Enforcement and Penalties
The Security Industry Authority (SIA) acts as the regulator for Martyn’s Law and possesses several powers to ensure compliance. If the SIA has reasonable grounds to believe a venue is failing to meet its obligations, it can issue a compliance notice mandating specific corrective actions.
For Enhanced Tier premises and all qualifying events, the SIA can also issue a restriction notice. This prohibits or restricts how a venue operates if doing so is deemed necessary to protect the public from physical harm. Furthermore, the SIA can impose significant financial penalties for non-compliance: up to £10,000 for Standard Tier premises, and up to £18 million or 5% of qualifying worldwide revenue (whichever is greater) for Enhanced duty premises and qualifying events.
Three Common Compliance Hurdles
With the enforcement date approaching, venue operators and event organisers are facing a steep learning curve. We have spoken to a great many organisations about Martyn’s Law, and the same three challenges come up time and again. If any of them sound familiar, you are far from alone:
- Lack of Confidence: “Where do we even start?” is the question we hear most often. Navigating complex security requirements can be overwhelming. Many venue operators lack the confidence to begin, leading to total inertia and delayed compliance.
- Underestimating the Timeline: “We’ll look at it nearer the time.” Given the daily demands of running a busy venue, immediate operational needs understandably take precedence, so preparation often starts later than it should. In reality, thorough preparation takes significantly longer than most anticipate, making early action essential.
- Budget Constraints: “There’s no budget for this.” With finances already stretched, many organisations lack a dedicated budget for Martyn’s Law and fear the high costs associated with external consultancy. This can stall decision-making, ultimately leaving operators exposed to the even higher cost of doing nothing.
A Four-Step Route to Compliance
To be prepared by spring 2027, affected venues must act now. Drawing on our operational counter-terrorism experience, we have developed a four-step framework to provide the building blocks for your compliance journey:
- Understand Your Current Position: Begin with an initial assessment. Are you in scope? Which tier do you fall under? What requirements apply to you? Evaluate what security measures you already have in place and identify your gaps. This will clarify which procedures need developing and which vulnerabilities must be addressed.
- Consider Your Options: Choose solutions that are “reasonably practicable” for your specific venue. The responsible person should weigh the operational benefits of a security measure against the cost, time, and difficulty of implementation. We recommend recording your reasoning as you go (more on why below).
- Implement Your Approach: Put your chosen measures into action. For Standard Tier premises, this means establishing robust public protection procedures. For Enhanced Tier premises and events, it also requires implementing broader protective measures and formally documenting the entire framework. There is no legal requirement for formal training, but staff responsible for carrying out your procedures must be made aware of them. We recommend going further and training and briefing your staff so they can act confidently in a real emergency.
- Review and Maintain: We recommend you regularly review your procedures and measures, particularly when physical or operational changes are made to the premises. This continuous auditing ensures your security remains effective in practice and builds long-term resilience.
Three Commonly Overlooked Risks
As you progress through your compliance journey, keep these three frequently overlooked risks in mind:
- The Impact of a Critical Incident: According to Bradford Council’s business continuity guidance, 80% of businesses affected by a major incident either never re-open or close within 18 months. Martyn’s Law is not just a regulatory hurdle; it is a vital mechanism to make your organisation safer and more resilient.
- Staff Confidence: When designing your procedures, we recommend keeping your team in mind. Most of your team will not have a background in security or emergency response. If a plan is too complex, it can be difficult to execute under pressure. We advise creating simple, accessible, and well-practised emergency plans. This approach helps ensure that your team feels confident and capable of implementing the procedures effectively during an incident.
- Document Your Decision-Making: While the legislation explicitly requires only Enhanced Tier venues to document their procedures and measures, we strongly advise all tiers to audit and record their decision-making process. Evidencing why a measure was deemed “reasonably practicable” protects you after the fact, removing the need to rely on undocumented statements or verbal agreements.
What This Means for Attractions, Parks and Piers
Leisure and visitor attractions face some particular challenges:
- Plan for Your Busiest Day, Not Your Average One: Your tier depends on how many people it is reasonable to expect on site at the same time, including at peak times, not on a typical day. A site that is quiet in winter may still fall into the Enhanced Tier because of summer peaks, bank holidays or regular events. One-off events are treated differently and may count as qualifying events in their own right.
- Break Large Sites into Manageable Zones: Designing public protection procedures for a large park or attraction can be incredibly difficult. Many parks are already divided into distinct themed areas, and we recommend using these existing boundaries (or creating new ones) to develop tailored procedures for each manageable section. It is an approach one major operator we have spoken to is already taking. The key is making sure each zone’s procedures complement one another, so that localised actions do not get in the way of a wider response, such as a full-park evacuation.
- Brief Seasonal Staff Quickly: Many attractions rely on seasonal and temporary staff. Procedures need to be simple enough to cover at induction and to practise before the busy season starts. Action cards, which break each procedure down into clear steps staff can refer to under pressure, are a simple way to support this.
Conclusion
Martyn’s Law is here, and its ultimate goal is to make the United Kingdom a safer place for everyone. While the requirements may appear daunting, taking action now ensures you will be well-prepared when enforcement begins. Most importantly, it will help protect your staff, volunteers, and members of the public whenever they are on your premises.
If you are not sure where to start, we can help. Book a free 30-minute consultation to talk through your specific circumstances with our team. Or, if you would rather work through it yourself, our Martyn’s Law Readiness Platform takes you through a risk assessment, builds your action plan and gives you the templates and guidance to put it in place.
This article provides general information and is not legal advice. Always check the statutory definitions and guidance to confirm how Martyn’s Law applies to your premises or event.
