Read the full text: Terrorism (Protection of Premises) Act 2025 on legislation.gov.uk.
Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It requires those responsible for certain public premises and events to prepare for the possibility of a terrorist attack — and, for larger venues, to actively reduce their vulnerability to one. It is not yet in force, and there is no legal duty to comply with it today, but it is coming, and it will affect a wide range of venues that currently have no equivalent legal duty at all.
The Act follows a recommendation of the Manchester Arena Inquiry, whose Volume 1 report (2021) examined the security failings around the 2017 Manchester Arena attack. It is named after Martyn Hett, one of the 22 people killed that night.
The Home Office’s case for the Act rests on a genuinely live threat picture: since the start of 2020, MI5 and the police have disrupted 19 late-stage attack plots and intervened in many hundreds of developing threats. Unlike fire safety, where legal duties have existed for decades, there has historically been no equivalent legal requirement for counter-terrorism preparedness — which is the specific gap Martyn’s Law closes.
When Does Martyn's Law Come Into Force?
Not yet. The Act received Royal Assent on 3 April 2025, and the government has committed to an implementation period of at least 24 months from that date before the duties become legally enforceable — so commencement is not expected before April 2027 at the earliest, and no exact date has been confirmed. On 15 April 2026 the Home Office published statutory guidance under section 27 of the Act, which explains how those in scope can meet its requirements. The regulator’s own operational guidance (under section 12 of the Act) has only been published in draft for public consultation so far, and still needs the Home Secretary’s approval before it’s finalised. There is no legal requirement to comply with anything until the Act commences, though the Home Office encourages premises likely to be in scope to start considering the requirements now.
Who Does It Apply To?
Scope depends on headcount, but headcount alone isn't the whole test. A premises is in scope if it meets four conditions: it's a building (or a building and other land); it's wholly or mainly used for one of the uses listed in the Act's Schedule 1 (things like a shop, restaurant, sports ground, place of worship or hotel); it's reasonable to expect 200 or more people could be present at the same time from time to time; and it isn't specifically excluded under Schedule 2. Events have a separate, six-part test — notably, a qualifying event must have some form of entry condition (people have paid, hold a ticket or pass, or are members/guests of a club or similar body), so a free, open-access gathering doesn't automatically qualify as an event even at high attendance, though the premises hosting it may still be in scope in its own right.
- Standard tier: 200–799 people (including staff). Covers a large range of everyday venues — shops, restaurants, cafés, small hotels, places of worship, community halls used for larger events, and similar.
- Enhanced tier: 800 or more people (including staff). Larger venues, and qualifying events that meet the entry-condition test — sports grounds, concert venues, large hotels, big conferences, festivals.
Premises and events expecting fewer than 200 people are out of scope entirely. There are also specific exclusions under Schedule 2, including parks and gardens with free, open public access. The Act applies across England, Wales, Scotland and Northern Ireland. If you're unsure whether your venue or event is in scope, the capacity you'd reasonably plan for — not just a typical quiet day — is what counts; the Home Office has published a supplementary methods document covering how to assess this, including using existing fire-safety occupancy calculations or historic attendance data.
Who Is the "Responsible Person"?
For premises, it's whoever controls the premises for the relevant Schedule 1 use — the venue operator, not necessarily the building's owner. For events, it's whoever controls the premises in connection with putting on that specific event, which can be a different person or organisation entirely from whoever controls the venue day-to-day. If a promoter takes over a park for a ticketed festival, the promoter is the responsible person for the event, separately from whoever manages the park the rest of the year. One detail worth knowing if you sub-contract security or event management: the responsible person can delegate tasks, but not the legal responsibility itself — that stays with them regardless of who they've hired to help.
What Standard Tier Actually Requires
The standard tier duty is deliberately low-cost and procedural — there is no requirement to install physical security equipment. The person responsible for a standard tier premises must:
- Notify the Security Industry Authority (SIA), the Act's regulator, that the premises is in scope.
- Have in place, so far as reasonably practicable, public protection procedures that could reduce the risk of physical harm if an attack occurred at or near the premises — covering things like evacuation, invacuation (moving people to a safer part of the building rather than out of it), locking down entry and exit points, and communicating clear information to people on-site during an incident.
In practice, for most standard tier venues this means staff training and a written procedure, not capital spending.
What Enhanced Tier Adds
Enhanced tier premises and qualifying events take on everything standard tier requires, plus a duty to actively reduce their vulnerability to an attack, not just respond to one. The responsible person must:
- Notify the SIA as an enhanced tier premises or event.
- Meet the same public protection procedure duty as standard tier.
- Put in place, so far as reasonably practicable, public protection measures that reduce the vulnerability of the premises or event to an attack and the risk of harm if one occurred — for example monitoring the premises and its immediate vicinity, controlling the movement of people, physical security measures, and protecting information about the venue's security arrangements.
- Document those measures and provide the document to the SIA.
What "reasonably practicable" looks like for a hotel expecting 900 guests will look very different from a festival expecting 5,000 — the Act deliberately doesn't prescribe a fixed checklist, weighing what can realistically be achieved against cost, time and difficulty for that specific premises.
Penalties for Non-Compliance
Once the Act is in force, the SIA has a tiered toolkit, starting well below the headline figure most coverage of Martyn's Law leads with. First-line tools are compliance notices (requiring a specific fix within a set time) and, for enhanced tier premises and qualifying events only, restriction notices (requiring specific prohibitions or restrictions on use). Monetary penalties sit above that: up to £10,000 for standard tier premises, and up to £18 million or 5% of worldwide revenue — whichever is greater — for enhanced tier premises and qualifying events. Failing to attend a required interview carries its own penalty, up to £5,000. If non-compliance continues after a compliance or restriction notice, daily penalties apply on top: up to £500 a day for standard tier, £50,000 a day for enhanced tier.
The SIA must notify the responsible person before issuing most of these and give them a chance to respond, and there's a right of appeal to a Tribunal afterwards. Criminal prosecution exists for the most serious cases, but the Home Office is explicit that penalty notices — not prosecution — are expected to be the primary enforcement route.
Martyn's Law and Your Existing Risk Assessments
Martyn's Law sits alongside your existing legal duties, not instead of them. A fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005 is still a separate, ongoing requirement whether or not your premises falls in scope of Martyn's Law — fire safety and terrorism preparedness are assessed differently, because they're different risks with different causes and different responses. The same goes for an event risk assessment if you're running something that draws a crowd: crowd safety, medical provision and structural risk from marquees or staging don't disappear because Martyn's Law exists.
To be clear about what Anyrisks does and doesn't cover here: Anyrisks generates fire and event risk assessments, not Martyn's Law public protection procedures or documentation — those are a distinct process, and once the Act's guidance is finalised they're worth getting proper security-specific advice on, particularly for enhanced tier premises. What we can help with today is making sure the fire and event risk assessments you already need are actually in place and up to date, which is worth doing regardless of where Martyn's Law implementation lands.
A Worked Example
A village hall that regularly hosts a Saturday market, wedding receptions and the occasional 300-capacity event sits right at the standard tier threshold. On a quiet weekday it might have a handful of people in it — but Martyn's Law looks at what it's reasonable to expect the premises could hold, not its average daily footfall. Once the Act is in force, whoever manages that hall's bookings will need an evacuation and lockdown procedure that staff and volunteers actually know how to run, and to have notified the SIA — even though installing CCTV or access control almost certainly won't be required at that size. The hall's existing duty to hold a current fire risk assessment doesn't change at all.
