Martyn's Law - What Venues Need to Do Before Enforcement Begins
Martyn’s Law is now part of UK legislation, but its main duties are not yet in force.
Martyn’s Law is now part of UK legislation, but its main duties are not yet in force.
Formally known as the Terrorism (Protection of Premises) Act 2025, the Act will require many premises and events where the public gathers to prepare for terrorist attacks. What you need to do will depend on whether your premises fall within scope, which tier applies and, for larger venues, what vulnerabilities need to be addressed.
The Security Industry Authority currently expects the regime to come into force in spring 2027, with the exact commencement date still to be confirmed.
The period before commencement gives you time to establish scope, review existing procedures and test your current arrangements before formal duties begin.
What Does Martyn's Law Require?
Martyn’s Law is intended to improve protective security and organisational preparedness across the UK.
The Home Office overarching Martyn’s Law factsheet explains that those responsible for qualifying premises and events must take proportionate steps to reduce physical harm if a terrorist attack occurs. Larger premises and qualifying events must also consider measures that reduce their vulnerability to an attack.
The Act introduces two levels of duties: standard and enhanced.
Both tiers require appropriate public protection procedures, so far as is reasonably practicable. These cover:
Evacuation, moving people away from danger
Invacuation, moving people to a safer place within the premises
Lockdown, restricting access or movement to reduce exposure
Communication, providing people with appropriate information during an incident
Enhanced-tier premises and qualifying events must go further. The Act requires appropriate public protection measures relating to monitoring, movement, physical safety and security, and security-sensitive information.
Enhanced-tier responsible persons must also document their procedures and measures and assess how those arrangements are expected to reduce vulnerability or physical harm.
The important phrase is reasonably practicable. The measures appropriate for one venue may be unnecessary or unrealistic for another. Cost, time, difficulty, available resources and the particular characteristics of the premises all matter.
Which Martyn's Law Tier Applies to Your Premises?
Tiering is mainly determined by the number of people who can reasonably be expected to be present at the same time, from time to time. This includes relevant members of staff.
People reasonably expected at the same time | General position |
Fewer than 200 | Generally outside the premises duties |
200 to 799 | Standard tier, where the other qualifying criteria are met |
800 or more | Enhanced tier, subject to specific exceptions |
Qualifying event meeting the Act’s criteria, including 800+ people | Enhanced requirements |
Headcount is not the only test.
Your premises must also be wholly or mainly used for one of the activities covered by the Act and must not fall within an applicable exclusion.
There are also specific exceptions. Certain places of worship, childcare premises and education settings are treated differently under the legislation.
For events, attendance alone does not determine scope. Other criteria include public access and whether an entry condition, such as checking a ticket, pass or membership, applies.
Shared sites, leased premises and event arrangements can also make responsibility less straightforward, so you should not determine your tier from capacity alone.
The SIA’s current guidance on Martyn’s Law and its role as regulator provides a practical summary of the scope criteria and explains how the regulator intends to approach compliance.
What Does a Martyn's Law Vulnerability Assessment Involve on Site?
“Vulnerability assessment” is useful shorthand here. The Act does not prescribe a separately named assessment template.
For enhanced-tier premises, the responsible person must assess how public protection measures are expected to reduce vulnerability or physical harm and keep those measures under review.
In practice, we recommend examining how an attack could affect your actual premises rather than relying on a generic checklist.
Start Outside the Front Door
Look at how people approach and gather around your premises.
Review entrances, queues, outdoor seating, taxi or vehicle drop-off points, delivery areas and other locations where people may congregate.
Consider whether these areas can be observed effectively and whether current arrangements create avoidable concentrations or uncontrolled access.
Walk the Routes People Actually Use
Walk through the premises from the perspective of a customer, employee, contractor, and delivery driver.
Review:
Public and staff entrances
Loading and service areas
Back-of-house routes
Internal circulation
Crowded or confined spaces
Access to staff-only areas
Doors or gates routinely left open
Record where access is controlled effectively and where someone could move beyond their intended area.
Compare Procedures with the Building
Written procedures need to work within the physical layout of your premises.
If you evacuate, where will people actually go? Could that route move them towards the threat?
If invacuation is safer, do you have suitable internal areas?
Can lockdown procedures be implemented without creating another safety problem? How quickly can staff communicate instructions to customers, visitors and colleagues?
These questions overlap with wider incident readiness. Our business continuity and crisis management service considers response structures, responsibilities, communications and exercises that can support organisational resilience during serious incidents.
Review Existing Security Measures
For enhanced-tier premises, you may also need to consider whether existing CCTV, access controls, doors, glazing, barriers or other protective measures address the vulnerabilities identified.
Identifying a vulnerability does not automatically justify buying additional equipment.
We recommend looking at how barriers, surveillance, access control, people and response arrangements work together rather than judging each measure independently.
Check Security-Sensitive Information
Operational information can itself expose security weaknesses.
Detailed floor plans, access arrangements, security procedures, CCTV positions and staff routines should not be available more widely than necessary.
ProtectUK’s risk identification guidance can help you consider threats, vulnerabilities and credible risk scenarios systematically.
Does Martyn's Law Require a Certified External Risk Assessor?
No.
The Act does not require you to appoint an external consultant, use a particular professional register or purchase a specific commercial service.
The statutory guidance states that an enhanced-tier assessment may be completed by any individual who is sufficiently informed and capable.
If you choose to use a third party, the responsible person should be satisfied that they have relevant experience and competence that can be evidenced.
Legal responsibility does not transfer to the consultant. The responsible person remains accountable for meeting the Act.
The Home Office also makes clear that the regime is intended to be understandable without requiring organisations to buy specialist third-party services simply to comply.
You may still choose external support where independent scrutiny or specialist security expertise would help you understand vulnerabilities or plan proportionate improvements. We would position that as professional support, not a mandatory compliance requirement.
What Can You Put in Place Before Enforcement Begins?
The main duties are not yet in force, so you are not currently required to demonstrate compliance with the substantive requirements.
However, we recommend using the preparation period to work through the following steps:
Confirm whether your premises are likely to be in scope.Check the qualifying use, attendance threshold and relevant exceptions.
Identify your likely tier and responsible person.Establish ownership early, particularly if your premises are shared or operated by several organisations.
Review evacuation, invacuation, lockdown and communication procedures.Check whether they reflect how your premises operate today.
Carry out an on-site vulnerability review.Examine approach routes, entrances, crowded areas, internal movement and existing protective measures.
Brief the people who may need to act.Relevant staff should understand the procedures and their responsibilities.
Review security-sensitive information.Restrict unnecessary access to information that could help someone understand or exploit your premises.
Record actions and priorities.If you are likely to fall within the enhanced tier, you can start documenting why improvements may be appropriate and reasonably practicable.
Test your arrangements.Tabletop exercises or controlled drills can expose problems that are difficult to identify from a written procedure alone.
Preparation should remain proportionate. Standard-tier premises are not required simply to purchase new CCTV, barriers or other physical security equipment because they fall within scope.
Turning a Vulnerability Review into Practical Action
Official guidance defines the statutory duties, but it cannot assess the conditions at your individual premises.
Our Physical Security Assessment reviews infrastructure, access arrangements, operational procedures, staff behaviours and existing protective measures to identify vulnerabilities and prioritise proportionate improvements.
Depending on the agreed scope, we can also support the next stage through project planning, implementation oversight and verification of agreed improvements.
We do not provide regulatory approval under Martyn’s Law, and using an external consultant does not transfer your legal responsibilities as the responsible person.
If you want a clearer picture of your existing vulnerabilities before Martyn’s Law comes into force, visit our Physical Security Assessment service page to see how we can review your current arrangements and help you prioritise practical next steps.
What to Prioritise Before Commencement
Martyn’s Law is intended to improve preparedness and protection, not create a standard shopping list of security equipment.
Before commencement, prioritise confirming scope, understanding your tier, reviewing your procedures and identifying site-specific vulnerabilities.
Starting that work early gives you more time to make proportionate decisions, brief your staff and plan any improvements that genuinely need to be made.
Disclaimer: This article provides general information about Martyn’s Law and is not legal advice. Requirements depend on the circumstances of individual premises and events. Check the latest Home Office and SIA guidance when determining your responsibilities.
Comments