Why the law exists
On 22 May 2017, a bomb was detonated in the foyer of Manchester Arena as people were leaving a concert. Twenty-two people were killed. One of them was Martyn Hett, who was 29.
His mother, Figen Murray, spent the years that followed campaigning for a law that would ask the places where people gather to think ahead, calmly and in practical terms, about how they would look after the people inside. That campaign succeeded: the Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, and nearly everyone calls it Martyn's Law.
It is worth saying plainly what the law is not. It does not assume your venue is a target, and it does not ask anyone to run their business in fear. It asks venues of a certain size to have sensible procedures ready, so that if the worst ever happened at or near them, the people working that day would know what to do.
What the Act does
The Act sorts qualifying premises into two tiers, based on the number of people it is reasonable to expect on site at once. The count includes everyone present: customers, visitors and staff, and "staff" takes in employees, contractors and volunteers alike.
| People at once, staff included | Tier | What it means |
|---|---|---|
| Under 200 | Out of scope | The Act is unlikely to apply to you. Keep a dated note of how you counted, in case your numbers change. |
| 200 to 799 | Standard Tier | Notify the SIA, have procedures for four situations, and make your people aware of them, plus co-ordinating with others where responsibility is shared or premises sit inside one another. Maximum civil penalty £10,000 for each breach. |
| 800 or more | Enhanced Tier | Generally applies from 800: significantly heavier obligations, aimed at arenas, stadiums and the largest venues, with much higher maximum penalties. |
There is one important exception. Places of worship, and childcare, primary, secondary and further education settings, stay in the Standard Tier at any size of 200 or more, where that is the building's principal use (s.2(4) and Schedule 1). Higher education follows the normal thresholds.
The test is what it is reasonable to expect at your busiest realistic moments, not what happens on an average Tuesday. A hall that fills for a monthly market, or a club that packs out on finals day, can be in scope even if most days are quiet. If you are not sure where your venue lands, our free tier checker walks you through it in about a minute.
The Standard Tier duties
1. Notify the SIA
The Security Industry Authority regulates the Act. The responsible person must tell the SIA the premises are in scope and keep those details accurate. For premises already in scope when the notification duty starts, the regulations give three months from that day to notify, and shorter 28-day windows apply to later changes (SI 2026/793, reg 3).
2. Have procedures in place
You need appropriate, workable procedures for four situations: evacuation (getting people out), invacuation (moving people to safety inside), lockdown (securing the premises) and communication (telling the people in the building what is happening). They have to fit your actual layout and staffing, and they're procedures, not kit. Nothing requires you to buy equipment or alter the building, though a small change, such as how a door locks, can sometimes be reasonably practicable (statutory guidance, para 7.25).
3. Make people aware of them
Procedures only help if the people on the floor know them. Staff with a role in the procedures "must be made aware of the procedures and their specific role" (statutory guidance, para 7.51). Note the word: awareness, not training. Briefing your own team counts, and there is no statutory training requirement and no course you have to buy.
4. Co-ordinate, where it applies
If more than one person is responsible for the premises, or your premises and other qualifying premises sit one inside the other, such as a bar in a shopping centre or a station, you must co-ordinate with the others so far as is reasonably practicable (s.8). Reviewing your procedures isn't a legal duty in itself, but the guidance recommends it, for example once a year (statutory guidance, para 7.29). If your layout, staffing or busiest days change and the procedures no longer fit, they stop being appropriate.
What it does not require
- No equipment to buy and no building work required. There's no statutory requirement for either (statutory guidance, para 7.25), though in some cases a small change, such as how a door locks, may be reasonably practicable.
- No training courses. Awareness is the duty, and briefing your own staff meets it.
- No written documents, strictly speaking. Written documentation is not legally required at Standard Tier (statutory guidance, para 7.32). The guidance strongly recommends it all the same, because a written record is how you show the duties are met: to yourself, to new staff, and to the regulator if asked.
- No consultants and no products. You don't have to use any outside company or product, and that includes this one (statutory guidance, para 6.7). The official guidance is free on GOV.UK.
Penalties and enforcement
The figures that get quoted in headlines belong to the Enhanced Tier. For Standard Tier venues, the ladder looks like this:
- The maximum civil penalty at Standard Tier is £10,000 for each breach (s.17(4) and s.18(1)).
- Daily penalties of up to £500 exist, but only for continuing contravention of a compliance or restriction notice (s.19). In other words, the regulator has to have issued a formal notice first and the venue has to keep failing to follow it. Daily penalties do not run from the day you fall short.
- Enhanced Tier maximums are far higher, and for the largest organisations they're set by worldwide revenue (s.18(2) and (3)).
- The government can change these figures by regulations, and no penalty can be given until the duties start (s.18(8)).
On inspections: routine SIA inspection visits come with at least 72 hours' written notice, which the Act itself requires (Schedule 3, para 4). Entry without notice is possible only with a warrant. In practice, a venue with its procedures written down and its records in order has everything an inspection would ask about already to hand.
The timeline
- 3 April 2025: the Act received Royal Assent.
- April 2026: the Home Office published the statutory guidance.
- Now: the SIA is testing early versions of its notification portal with volunteers. It isn't open to the public yet, and it'll be on GOV.UK.
- Spring 2027, expected: the Act comes into force. The exact date is still to be confirmed. From the day the notification duty starts, premises already in scope have three months to notify the SIA (SI 2026/793).
What to do now
Nothing about this law rewards panic, and nothing about it needs to be left to the last minute either. Three steps cover it:
- Find out your tier. Our free checker takes about a minute and tells you whether your venue is likely out of scope, Standard Tier or Enhanced Tier.
- Write your procedures down. Not because a document is legally required, but because writing them down turns a vague intention into something staff can actually follow, and it is the record you will reach for when the SIA asks. You can do it yourself from the free guidance, or MartynsLawPack generates and maintains it for your venue: see pricing.
- Brief the people who work your floor. Everyone with a role should know the procedures and their part in them. A note of who was briefed, and when, completes the picture.
Checked against the Act, the statutory guidance and the notification regulations on 29 September 2026.