Martyn’s Law is the Terrorism (Protection of Premises) Act 2025, the UK law that requires publicly accessible venues and events to be ready for a terrorist attack. It covers premises where 200 or more people gather, and ticketed or checked events of 800 or more. The duties are not in force yet. The SIA expects the Act to come into force in spring 2027, leaving venue operators and event organisers a shrinking window to determine their tier, responsible person, and procedures. This guide covers it all, in the order you need it.
What is Martyn’s Law?
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, which requires those responsible for certain public premises and events to prepare for a terrorist attack. It applies across England, Wales, Scotland and Northern Ireland.
The name honours Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. His mother, Figen Murray OBE, led the campaign that turned his name into legislation. The purpose, as the Home Office statutory guidance sets it out, is better organisational preparedness and protective security at the places people gather.
Two levels of duty run through the law. Every venue in scope needs procedures that reduce physical harm if an attack happens. Larger venues and events carry a second duty, to reduce the vulnerability of the premises or event to terrorism in the first place.
The Act rests on an uncomfortable assumption. An attack might happen anywhere, so the requirements do not depend on how likely one is at your particular venue.
Why was Martyn’s Law introduced?
Martyn’s Law was introduced because the Manchester Arena Inquiry recommended legal security requirements for public venues. Without a legal duty, counter-terrorism planning kept losing out to other obligations.
Getting to Royal Assent took years. The statutory guidance traces the path: a 2019 Prevention of Future Deaths report after the London Bridge and Borough Market attack, then the first volume of the Manchester Arena Inquiry report in 2021. Public consultations ran in 2021 and 2024. A draft Bill went before MPs for scrutiny in 2023, a revised Bill was introduced on 12 September 2024, and Royal Assent followed on 3 April 2025.
Independent research from 2019, cited in the same guidance, found that counter-terrorism security was often pushed behind health and safety and fire safety work when it was not legally required. As a result, protection varied from one venue to the next.
The threat has not gone away. Since the start of 2020, MI5 and the police have disrupted 19 late-stage attack plots. In August 2026, the SIA reported the UK national threat level as SEVERE, which means an attack is judged highly likely.
When does Martyn’s Law come into force?
Martyn’s Law is expected to come into force in spring 2027, with the exact date still to be confirmed. Until it comes into force, no venue or event has a legal duty to comply.
The government committed to an implementation period of at least 24 months from Royal Assent on 3 April 2025, so April 2027 is the earliest possible start. The SIA says it will confirm the exact date ahead of commencement. There is no obligation before then, though the guidance expects those in scope to start preparing now.
Milestones so far
- 3 April 2025: Royal Assent.
- 15 April 2026: The Home Office publishes its statutory guidance, and the SIA opens a consultation on how it will enforce the Act.
- 12 June 2026: The SIA consultation closes, with final SIA guidance and a consultation report due in autumn 2026.
- 6 August 2026: A correction slip is added to the statutory guidance, changing who is responsible in a leased pub.
- Spring 2027 (expected): The duties switch on.
Who does Martyn’s Law apply to?
Martyn’s Law applies to premises used mainly for one of 17 listed purposes where 200 or more people, staff included, may be present at the same time. It also applies to publicly accessible events with entry checks where 800 or more people may be present at once.
Those 17 purposes sit in Schedule 1 to the Act. The statutory guidance lists them as shops, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, health care, bus and railway stations, aerodromes, childcare, primary and secondary education, further education, higher education, and public authorities. Pubs, nightclubs, theatres, gyms, conference centres and shopping centres all sit inside those categories.
How do you know if your premises are in scope?
Your premises are in scope if they pass four tests: there is a building on site, the site is used mainly for a Schedule 1 purpose, 200 or more people can be expected there at once from time to time, and the premises are not excluded.
Each test has an edge. A building can be part of a building or a group of buildings, and land used with it counts, so a pub’s beer garden or a hotel’s grounds sit inside the premises. The Home Office scope factsheet adds that temporary structures can be in scope. Charging for entry does not make a venue private either. Ticket-only and members-only premises still count as publicly accessible.
“From time to time” means occasionally, and it catches venues that sit below 200 on most days. The guidance describes a clothing shop that normally trades well under that figure but passes it during Black Friday and the January sales. That shop is in the standard tier. A surge nobody could have predicted, like a product going viral overnight, does not move a venue up a tier on its own.
How do you count the number of people?
Count the highest number of people you can reasonably expect at the same time, at your busiest point, then add every staff member working there. Your fire safety occupancy figure is a starting point, not the answer.
Staff has a broad meaning. The guidance defines staff as everyone working at the premises or event, including employees, contractors and volunteers. Hired door supervisors count. So do stewards, agency bar staff and the catering crew in the back.
Historic ticket data, till records, footfall counters, and fixed seating are all acceptable starting points, provided you can evidence the method. The SIA can require you to show how you did the assessment and must be satisfied it was reasonable for your circumstances. Keep the working, not just the final number.
Which venues are excluded or treated differently?
Parliaments and devolved legislatures, open-access parks and recreation grounds, and transport sites already covered by their own security law are excluded. Places of worship, childcare settings, schools, and further education colleges always sit in the standard tier, regardless of attendance.
The park exclusion applies only while the space remains open access. Once you check tickets, payment or membership, the exclusion no longer applies. Crown premises are generally exempt too.
Universities cause confusion. Higher education doesn’t get the standard-tier cap that schools and colleges do, because campuses are usually open to the public in a way school sites are not. The guidance confirms universities can fall in the enhanced tier when they meet the criteria, which some published guides still get wrong.
What counts as a qualifying event under Martyn’s Law?
A qualifying event is a publicly accessible event, with checks on entry, where 800 or more people, including staff, may be present at once. It cannot take place at enhanced-tier premises or at excluded sites such as places of worship and schools.
In one respect, the event definition is wider than the premises one: land with no building on it counts, so a festival in a field qualifies. The headcount is about the peak, never the average. One example in the guidance has a festival expecting 280 people during the day, rising to 920 once evening ticket holders and extra staff arrive after 6 pm. That evening peak puts the whole event in the enhanced duty.
Qualifying events carry the same requirements as enhanced tier premises. No separate event tier exists.
Do free events count?
Yes. A free event is a qualifying event when entry is checked by ticket, pass, wristband, QR code, membership card or turnstile, and the other criteria are met.
The guidance names those check methods and treats automated checks such as turnstiles the same as staff at a gate. For any check to be meaningful, the event needs a defined and secure perimeter.
Some conditions do not count. A suggested donation at the gate is not an entry condition, and neither is a dress code or search criteria. Paying to take part is also different from paying to get in. The guidance example is a fun run where runners pay and receive a QR code, but spectators wander in freely; because there is no condition for entering the area, the run is out of scope.
Are weddings and private corporate events covered?
No, not when attendance is by invitation only. A wedding reception for invited family and friends, or a staff event closed to the public, fails the public access test.
The guidance uses both examples. A networking event for 900 invited guests in a company’s own office is out of scope. Move the same event to a hotel that is already enhanced tier, and responsibility sits with the hotel, not with the company running the evening. The venue’s plan has to account for what happens inside it.
How are festivals, marathons and multi-venue events assessed?
Each controlled area is assessed separately. A grandstand, start zone or ticketed enclosure that checks entry and expects 800 or more people is in scope, while open roads and pavements are not.
The guidance applies this to a city marathon. Grandstands, staging areas and the start and finish zones each qualify separately, while the route itself stays outside the Act unless it falls within the immediate vicinity of a qualifying area. No fixed distance defines “immediate vicinity”.
Timed entry can keep an event under the line. A light show that staggers arrivals so no more than 300 people are ever inside is not a qualifying event. Frequency changes the answer as well. A single testimonial match that draws 1,000 people to a ground that normally holds 600 is a one-off qualifying event. A nightclub that passes 800 on five or six special nights a year is treated differently: the club becomes enhanced-tier premises, though the measures it needs can differ between big nights and ordinary ones.
Standard tier vs enhanced tier at a glance
The standard tier needs procedures for responding to an attack. The enhanced tier adds security measures, a compliance document sent to the SIA, and a named senior individual.
| Requirement | Standard tier | Enhanced tier and qualifying events |
|---|---|---|
| Who is covered | Premises where 200 to 799 people may be present at once | Premises where 800 or more may be present at once, plus qualifying events |
| Special cases | Worship, childcare, schools and FE colleges stay here at any size | Universities can reach this tier |
| Notify the SIA | Yes | Yes |
| Public protection procedures | Evacuation, invacuation, lockdown, communication | The same four |
| Public protection measures | Not required | Monitoring, movement, physical security, security of information |
| Compliance document sent to the SIA | Not required | Required |
| Senior individual | Not required | Required where the responsible person is an organisation |
| Restriction notices | Not available to the SIA | Available |
| Maximum penalty | £10,000 | £18m or 5% of worldwide revenue |
| Maximum daily penalty | £500 | £50,000 |
The tier requirements come from the SIA’s guidance on Martyn’s Law, and the penalty figures from the Home Office enforcement factsheet.
What must standard tier premises do?
Standard tier premises must notify the SIA and have appropriate, reasonably practicable procedures for evacuation, invacuation, lockdown and communication. Staff need to know those procedures and when to use them.
The SIA describes the four procedures like this:
- Evacuation: Moves people out of the premises, or part of it, away from danger.
- Invacuation: Moves people to a safer place inside, including bringing people in from outside.
- Lockdown: Secures the site to stop people entering or leaving.
- Communication: Gets information and instructions to everyone on site.
“Reasonably practicable” is the Act’s proportionality test. You weigh what a procedure achieves against its cost, time and difficulty, taking into account the nature of the premises and the resources you have. Staff are never expected to put themselves at risk; the guidance rules out actions that would compromise their own safety.
The Home Office published a worked example for a 400-seat restaurant, and none of it needs specialist equipment. Two evacuation routes: one through the main entrance and one through a side door. Invacuation into the main dining area and staff areas. A shift manager who knows when and how to lock the doors, close the shutters and turn off the lights. A short briefing for new starters at induction, alongside health and fire safety. An annual review, or sooner if the layout changes.
That is what the standard tier looks like in practice.
What extra steps apply to enhanced tier premises and qualifying events?
Enhanced tier premises and qualifying events need security measures in four areas: monitoring, movement, physical security and security of information. They must also document their procedures and measures, send that document to the SIA, and designate a senior individual where the responsible person is an organisation.
The SIA sets out the four measure areas:
- Monitoring the premises and immediate vicinity, with tools such as CCTV.
- Controlling how people move into, out of and within the site.
- The physical safety and security of the premises.
- Keeping details of the site’s design, operation and internal workings away from anyone who could use them to plan an attack.
For larger venues and events, the Home Office points to CCTV, bag search policies or vehicle checks, where appropriate. “Where appropriate” carries weight. The reasonably practicable test still applies, and the SIA has said that strong protective security already in place gives a solid starting point for compliance.
The compliance document records your procedures and measures and assesses how they reduce the risk of physical harm and the site’s vulnerability. The SIA has provided templates before the law takes effect. The senior individual must be involved in the management or control of the organisation.
Martyn’s Law also sits on top of your existing duties. It does not replace health and safety, fire safety, licensing or Equality Act 2010 obligations, so your fire risk assessment and premises licence conditions still apply alongside it.
Who is legally responsible for Martyn’s Law compliance?
The responsible person is whoever controls the premises or event, usually an organisation rather than one individual. That legal responsibility cannot be handed to a contractor.
Control decides it, not ownership. The SIA gives two markers: possession of the premises at the time, and the right to decide who may remain on site. A retailer leasing a unit is responsible for that unit. The landlord is not.
The August 2026 correction slip shows how fine the line can be. The original guidance named the brewery as responsible for a tenanted pub because it held the licence. The corrected text names the tenant, since the tenant is the one in control.
Events follow the same logic. In the guidance’s park concert example, a company that hires part of a council park and takes control of it is responsible for the concert. If the council keeps control, the council stays responsible, even after contracting out stewarding, security and ticketing.
Shared sites add another layer. A shopping centre operator and its tenants each carry their own duties, and the Act requires them to co-ordinate and co-operate so one lockdown plan does not undo another.
Can you hand Martyn’s Law duties to your security company?
No. You can pass tasks to a security contractor, but the legal duty stays with the responsible person.
The statutory guidance is clear: a contracted provider can take on tasks, but never the legal responsibility itself. The SIA repeats the point and adds that you can take advice from a suitably knowledgeable security adviser.
That splits the work cleanly. A contractor can staff the gates, run searches, operate CCTV, brief stewards on the evacuation plan and keep the logs. You decide which procedures and measures are appropriate, and you sign off the document that records them. So does the penalty if something is missing.
How will the SIA enforce Martyn’s Law?
The SIA will start by advising and supporting venues, then check compliance through desk reviews and on-site inspections. For serious or persistent failures, it can issue compliance notices, restriction notices and financial penalties.
The regulator has framed its role plainly: Martyn’s Law is about making events safer, not stopping them. Inspections will be risk-based. The SIA will typically give at least 72 hours’ notice, and can ask a court for a warrant to enter without notice in some circumstances.
On a visit, inspectors can observe activities, examine documents and equipment, take photographs and measurements, and ask anyone on site to explain a relevant record, according to the Home Office enforcement factsheet. They can bring a technical expert or a police officer.
Sanctions escalate in three steps:
- Compliance notices order you to fix a specific failure within a set period.
- Restriction notices limit how enhanced tier premises are used, or how a qualifying event runs, where that is needed to reduce the risk of harm.
- Penalty notices run up to £10,000 for standard tier premises and £18m or 5% of worldwide revenue for enhanced tier premises and qualifying events. Continuing to ignore a compliance or restriction notice can add daily penalties of up to £500 or £50,000, and failing to attend an interview carries a maximum of £5,000.
Before issuing any notice, the SIA must tell you and let you make representations, unless a restriction notice is urgent. You can appeal every notice to the Tribunal. The Act also creates criminal offences, and the SIA can refer the most serious cases for prosecution, but penalty notices are expected to be the main tool.
Do you need to notify the SIA?
Yes, once the law is in force. Premises get three months from commencement to notify and must report changes within 28 days, while most events must notify within 14 days of the event date being made public.
The deadlines come from SIA guidance published in August 2026. Notifications go through an online portal the SIA is still building. Someone else can submit on your behalf, a managing agent or an events company for example, but legal responsibility for compliance stays with the responsible person.
For event organisers, the 14-day rule is the tight one. The clock runs from the day the date becomes public, so notification belongs in your announcement plan.
Where a security provider fits into Martyn’s Law
Hiring a security company is not a legal requirement under Martyn’s Law. The Home Office wants venues in scope to comply without buying specialist or consultancy services, and neither it nor the SIA endorses any company, including Alpha Security Services.
A provider brings people who can carry out the plan on the day. The four procedures only work if the staff on the door, at the gate and in the crowd know them. At enhanced-tier sites and qualifying events, most of the measures the Home Office lists fall to the security team: searches at entry, stewarding people in and out, CCTV monitoring, and vehicle checks at the perimeter.
Records count as well. A compliance document says what you have in place. Patrol logs, search records, incident reports and briefing sign-offs show it happened. Contractors also count towards your headcount, so the size of the team you book feeds into your assessment.
Alpha Security Services supplies SIA-licensed officers for event security, door supervision, crowd management and CCTV monitoring, alongside manned guarding and security guard services.
You keep the decisions and the paperwork. Our role is to make sure the people on the ground can deliver what that paperwork says.
What should you do now to prepare?
Work out your tier, identify your responsible person and write your procedures before the spring 2027 start. Enhanced tier sites and event organisers also need to plan their measures and name a senior individual.
A practical order of work:
- Check whether your premises pass the four scope tests, or your event meets the qualifying event criteria.
- Count your realistic peak numbers, including staff and contractors, and keep the evidence.
- Confirm who has control, especially on leased sites and hired venues.
- Write evacuation, invacuation, lockdown and communication procedures for your actual layout.
- Brief every member of staff, agency and contract staff included.
- Plan monitoring, movement, physical security and information security measures, if you are enhanced tier or running a qualifying event.
- Name a senior individual where the responsible person is an organisation.
- Diarise notification: three months from commencement for premises, 14 days from announcement for most events.
The Home Office statutory guidance is free, runs to 130 pages, and comes with supplementary documents on counting people and scope examples. The Home Office recommends reading it in full.
Frequently Asked Questions:
Does Martyn’s Law apply in Scotland and Northern Ireland?
Yes. The Act applies across England, Wales, Scotland and Northern Ireland, with the SIA acting as the single regulator.
Is a concert at a church or mosque a qualifying event?
No. Places of worship stay in the standard tier at any size and events held there cannot be qualifying events, so even a 1,000-person fundraising concert remains the venue’s responsibility.
Are public parks covered by Martyn’s Law?
Open-access parks are excluded. A ticketed event in a fenced area of a park can still qualify, provided the organiser controls that area.
Can the SIA inspect without warning?
Inspectors usually give at least 72 hours’ notice. Where notice would defeat the purpose or access is refused, they can apply for a warrant.
Do I need to hire a consultant to comply?
No. The government’s stated aim is that venues can comply without buying specialist or consultancy services, although advice from a knowledgeable security adviser is allowed.
Can the SIA stop my event going ahead?
For enhanced tier premises and qualifying events, the SIA can issue a restriction notice that restricts use of the premises or the hosting of the event. In non-urgent cases, it must warn you first and give you a chance to respond.
Does a beer garden count towards my numbers?
Yes, when it is used as part of the pub. Land used together with a building forms part of the premises, so people in the garden count alongside those inside.
Do contractors and volunteers count towards the 200?
Yes. Staff under the Act includes employees, contractors, and volunteers, so door supervisors, stewards, and agency workers all count toward the headcount.
