Martyn's Law creates a new legal duty for premises and events that expect 200 or more people. It is named after Martyn Hett, killed in the Manchester Arena attack in 2017, and it exists because his mother Figen Murray campaigned for it.
The most important thing to know first: the duties are not yet in force. The Act received Royal Assent on 3 April 2025 with a deliberate implementation period of at least 24 months, and the substantive obligations are expected to commence in 2027. What has happened so far is preparatory — the regulator has been given its guidance powers, and the notification rules have been made ready.
That gives you time. It also means anyone telling you that you must comply today is wrong.
The short version
- Applies to premises and events expecting 200+ people for a qualifying use
- Standard tier: 200–799 — procedures only
- Enhanced tier: 800+ — procedures, plus measures, plus notification and documentation
- Regulator is the Security Industry Authority (SIA), not HSE or your council
- Not yet in force. Expected 2027, after an implementation period of at least 24 months from April 2025
Who is in scope
The Act applies to "qualifying premises" — those used for one of the purposes listed in Schedule 1 to the Act, where it is reasonable to expect that 200 or more people may be present at the same time, from time to time.
Schedule 1 uses cover the kinds of places the public gathers: venues, hospitality, retail, leisure, sports grounds, places of worship, healthcare and education settings, visitor attractions and hotels among them. Qualifying events are covered separately.
Two points that catch people out:
- It is about expected capacity, not floor area or turnover. A modest village hall that hosts events for 250 people is in scope; a large warehouse with twelve staff is not.
- "From time to time" matters. You do not need to hit 200 every day. If you reasonably expect it to happen sometimes, you are in scope.
The two tiers
| Standard duty | Enhanced duty | |
|---|---|---|
| Capacity | 200–799 | 800 or more |
| Public protection procedures | Required | Required |
| Public protection measures | Not required | Required |
| Notify the SIA | — | Required |
| Document your approach | — | Required |
Standard tier: procedures
Standard duty premises must have appropriate public protection procedures in place, so far as is reasonably practicable. These are procedures expected to reduce the risk of physical harm to people if an act of terrorism occurred at the premises or in the immediate vicinity.
In practice that means knowing what you would do: evacuation, invacuation (bringing people in and securing the building), locking down, and communicating with people on site. It is planning and training rather than construction work.
The Act deliberately does not require standard tier premises to buy equipment or make physical alterations.
Enhanced tier: procedures and measures
Enhanced duty premises and qualifying events must do everything the standard tier does, and additionally have appropriate public protection measures — steps that reduce the vulnerability of the premises to an act of terrorism, or reduce the risk of physical harm if one occurs.
Enhanced tier duty holders must also notify the SIA and document what they have in place.
The notification requirements
The Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026 were made on 14 July 2026. They set out what a notification to the SIA must contain, and they come into force when section 9(1) of the Act fully commences — not before.
When they bite, the responsible person must tell the SIA:
- The information in Parts 1 and 2 of the Schedule to the Regulations, and for enhanced duty premises, Part 3 as well
- Whether the premises are standard duty or enhanced duty
- Any reference number the SIA has previously assigned to the premises
- Confirmation that the person submitting it is the responsible person, or is authorised to act for them
There is also an ongoing duty to keep it accurate. If information you have already notified stops being correct, you must tell the SIA within:
- 28 days for qualifying premises
- 14 days for qualifying events
That is a live obligation, not a one-off form. A change of responsible person, a change of capacity, or a change of use all have the potential to start that clock.
The timetable
| When | What happened |
|---|---|
| 3 April 2025 | Royal Assent. Implementation period of at least 24 months begins |
| April 2026 | Home Office publishes the statutory guidance |
| 15 June 2026 | SIA's guidance and advice functions commence, along with provisions on qualifying worldwide revenue |
| 14 July 2026 | Notification Requirements Regulations made, to commence with section 9(1) |
| Expected 2027 | The substantive duties come into force |
The commencement so far has been about equipping the regulator, not about imposing duties on premises. The Commencement No. 2 Regulations brought in the SIA's power to issue guidance and advice — which is what allows it to help you prepare before enforcement begins.
Who regulates it
The Security Industry Authority is the regulator. This is unfamiliar territory for most premises: your fire safety comes from the fire and rescue authority, your health and safety from HSE or the local authority, and now your counter-terrorism duties come from the SIA.
The SIA will investigate suspected non-compliance and take enforcement action where appropriate. Because the duties are not yet in force, there is nothing to enforce today.
What to do now
Nothing in this Act requires action from you this year. But the sensible preparation is cheap and it overlaps heavily with things you should be doing anyway:
- Work out whether you are in scope, and which tier. Base it on what you can reasonably expect at your busiest, not your average day. The 200 and 800 thresholds are the whole question.
- Identify the responsible person. For most premises this is whoever has control of them. Get it settled early — it determines who carries the duty and who notifies the SIA.
- Look at your existing emergency plans. If you have fire evacuation procedures, you already have part of the answer. Invacuation and lockdown are usually the gaps.
- Read the statutory guidance. The Home Office published it in April 2026 and it is the authoritative source on how the duties are meant to work in practice.
- Do not buy anything yet. Standard tier duties are explicitly about procedures rather than physical measures. Anyone selling you equipment on the basis that Martyn's Law requires it, at standard tier, is overselling.
If you are close to a threshold, work it out properly. The gap between 799 and 800 is the gap between writing procedures and running a documented programme with a regulator to notify. It is worth being confident which side you are on.
Frequently Asked Questions
No. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but the Government committed to an implementation period of at least 24 months before the duties come into force, and commencement is expected in 2027. What has commenced so far relates to the regulator's own functions — its power to issue guidance and advice began on 15 June 2026. Use the time to prepare rather than to comply.
It depends on how many people you can reasonably expect to be present at the same time, from time to time. 200 to 799 puts you in the standard tier; 800 or more puts you in the enhanced tier. It is based on reasonable expectation rather than a licensed capacity figure or a headcount on an average day, so a venue that occasionally fills is judged on those occasions.
Procedures that could reasonably be expected to reduce the risk of physical harm to people if an act of terrorism happened at your premises or nearby — typically evacuation, invacuation (bringing people inside and securing the building), lockdown, and communication. For standard tier premises these are the whole duty: the Act does not require you to install equipment or alter the building.
The Security Industry Authority. That is a change from what most premises are used to — fire safety sits with the fire and rescue authority and health and safety with HSE or the local authority. The SIA will investigate suspected non-compliance and take enforcement action where appropriate, once the duties are in force.
Only if you can reasonably expect 200 or more people at once. The threshold is about the number of people present, not the size of the business, so a small operator running a venue or event can be in scope while a larger business with few visitors is not. If you never approach 200, the Act does not apply to you.
This guide reflects the position as at August 2026 and is general information rather than advice on your premises. The duties are not yet in force and the detail may develop before commencement — check the statutory guidance for the current position.
Sources