How Martyn’s Law impacts your business security strategy

What is Martyn’s Law?

Martyn’s Law is UK legislation designed to protect the public from terrorist attacks at public venues and events. Formally titled the Terrorism (Protection of Premises) Act 2025, the law was named after Martyn Hett, one of 22 victims killed in the bombing at Manchester Arena in May 2017. Following years of campaigning by Martyn’s mother, Figen Murray, the legislation received Royal Assent in April 2025.

As checked against Home Office guidance on 7 October 2026, the Act’s substantive requirements have not yet commenced. They do not need to be complied with until brought into force by regulations. Government has provided an implementation period of at least 24 months from Royal Assent; businesses can use this time to prepare.

This guide explains the expected duties and practical preparation. It is general guidance, not a determination of whether a particular premises or event qualifies.

Who does Martyn’s Law apply to?

Qualifying premises generally require 200 or more people, including staff, reasonably expected to be present at the same time from time to time for a use specified in the Act. This is an attendance test, not simply maximum capacity. Qualifying public events have a separate threshold of 800 or more people reasonably expected at the same time and must meet the Act’s other conditions, including controlled entry. Events below 800 are not qualifying events, although the premises hosting them may separately qualify. Check the statutory uses, exclusions and special rules; for example, places of worship and certain education premises remain in the standard tier even at higher attendance.

Standard-tier premises generally cover reasonably expected attendance of 200–799. Once commenced, the responsible person must notify the Security Industry Authority (SIA) and ensure appropriate, reasonably practicable public protection procedures for evacuation, invacuation, lockdown and communication. The standard duty does not require a written plan, specific training or purchases of security equipment.

Enhanced-tier premises generally cover reasonably expected attendance of 800 or more, subject to special rules. Qualifying events at 800 or more are also subject to enhanced requirements. Once commenced, duties include notification, public protection procedures, appropriate and reasonably practicable protective measures, and documentation supplied to the SIA. Where the responsible person is an organisation, a designated senior individual oversees compliance; the organisation retains responsibility.

How Martyn’s Law changes your security strategy

Preparation should begin by checking whether your premises or event is in scope and which duty applies. Standard-tier requirements focus on procedures; enhanced requirements also cover protective measures and documentation. The following system reviews are recommendations to inform proportionate planning, not a requirement to buy particular products:

• CCTV review (recommended): Consider whether coverage of entrances and public areas supports proportionate threat detection; cameras are not mandatory for standard-tier premises.
• Access control review (recommended): Check that entry arrangements and any lockdown measures work with safe escape and accessibility.
• Emergency communications review (recommended): Check how staff and visitors receive instructions for evacuation, invacuation or lockdown.
• Response planning: Prepare appropriate public protection procedures and make relevant staff aware of their roles; enhanced-duty measures and documentation require additional assessment.

Why an incident reporting system matters

Keeping an incident log is a practical recommendation for security management. It can help you identify recurring risks, check staff responses and review procedures. A particular incident-reporting product or a formal incident log is not a blanket statutory requirement under the Act.

Enhanced-duty documentation must explain the procedures and protective measures in place and how they meet the requirements, once those duties commence. An incident log can support that review but does not replace the required documentation or determine compliance by itself.

Use incident records to improve readiness and wider safety management, rather than assuming that maintaining a log alone satisfies Martyn’s Law.

Crowd management strategies for public premises and events

Crowd management supports wider public safety planning and can inform proportionate public protection procedures and enhanced-duty measures. It is not a separate prescribed package of equipment or a universal crowd-management specification under Martyn’s Law.

Effective crowd management strategies include clear entry and exit routes, staff positioned at key points, and access control systems to regulate occupancy. For events, pre-event briefings, visible marshalling, and signage directing people away from potential risk areas all contribute to a safer environment.

These recommendations can reduce confusion and delay in emergencies. Choose them for your risks and site conditions, alongside the actual duties for your tier.

Martyn’s Law preparation checklist for UK businesses

1. Check scope and tier: Assess reasonably expected attendance including staff, specified uses, exclusions and the separate 800-person qualifying-event threshold.
2. Prepare public protection procedures: Plan evacuation, invacuation, lockdown and communication. A written plan may help, but it is not a standard-duty requirement.
3. Assess enhanced-duty measures: Where applicable, identify appropriate and reasonably practicable protective measures and the documentation needed. Equipment purchases are not automatically required.
4. Plan notification and oversight: Prepare to notify the SIA once duties commence; organisations subject to enhanced duties must designate a senior individual.
5. Brief relevant staff (recommended): Help people understand procedures. Choose proportionate training and exercises rather than assuming a particular course is mandatory.
6. Review readiness: Check procedures as circumstances change, and follow current official commencement and implementation guidance.

Why businesses should prepare now

Preparing ahead of enforcement gives businesses time to carry out a thorough risk assessment and identify gaps in current security provision. Changes can then be made in a considered, prioritised way rather than under pressure. It also creates an opportunity to upgrade systems that may have been overdue for review, including CCTV coverage, access control, and emergency communications.

Centurion can help assess CCTV, access control and emergency communications as part of your preparation. The responsible person remains accountable for determining scope and meeting the relevant duties.

Frequently asked questions about Martyn’s Law

Common questions from UK businesses preparing for Martyn’s Law compliance.