Martyn's Law 2026: what police and venues need to know

Martyn’s Law is now on the statute book, but most of its duties are not yet in force. The Terrorism (Protection of Premises) Act 2025 creates a new protective-security regime for qualifying premises and events across the UK; the Security Industry Authority, not the police, will regulate it. The immediate task for police leaders and venue operators is preparation, not enforcement.

That distinction has become more important during 2026. The Home Office has published the statutory guidance explaining what people in scope will be required to do. The SIA has completed consultation on how it intends to regulate the regime and says its final regulatory guidance will follow in autumn 2026. Commencement is expected in spring 2027, but the exact legal date has not yet been set.

For policing, the question is therefore narrower than much early commentary suggested: what does the Act actually require, where does police responsibility stop, and what should forces do before the new regime becomes operational?

The law creates two tiers, but the threshold is not the whole test

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. Its explanatory notes describe the purpose as improving protective security and organisational preparedness across the UK by requiring those responsible for certain premises to take steps to reduce physical harm if a terrorist attack occurs. Larger premises and qualifying events also have duties aimed at reducing vulnerability to an attack.

The headline thresholds are straightforward. Under the Home Office section 27 statutory guidance:

• standard duty premises generally expect between 200 and 799 people, including staff, to be present at the same time in connection with a qualifying use;
• enhanced duty premises generally expect 800 or more people;
• a qualifying event also requires 800 or more people, together with the statutory conditions applying to events, including access-control arrangements.

The thresholds should not be treated as a complete eligibility test. The Act defines the types of premises and activities in scope, contains exclusions, and treats some premises differently. For example, the Act’s explanatory notes state that qualifying places of worship are treated as standard duty premises even where 800 or more people may be present.

That is why a venue operator should start with the statutory guidance rather than a capacity graphic alone.

Standard duty is principally about procedures

The standard tier was deliberately simplified during the Bill’s development. The Home Office’s 2026 overarching factsheet explains that standard duty premises must have appropriate public protection procedures, so far as is reasonably practicable, to reduce the risk of physical harm if an act of terrorism occurs at the premises or in the immediate vicinity.

The statutory guidance describes the practical areas those procedures cover, including evacuation, moving people to safer places within premises where appropriate, securing premises and communicating information. The duty is about having workable arrangements for the circumstances of the premises and ensuring relevant people can implement them.

This is more restrained than some early descriptions of Martyn’s Law. Standard-tier operators are not automatically required to install airport-style screening, barriers or a new guarding operation. The government’s stated intention is that people should be able to comply without buying specialist third-party services merely to understand the law.

That does not make the duty trivial. A procedure that exists only on paper but cannot be implemented by the people working at the premises is unlikely to achieve the purpose of the legislation. The practical work is identifying who makes decisions, how people receive instructions, what safe movement looks like in that location, and how those arrangements interact with existing emergency plans.

Enhanced duty adds measures aimed at reducing vulnerability

Enhanced duty premises and qualifying events carry additional requirements because of the potential consequences where larger numbers of people are present.

The section 27 guidance explains the additional requirements, including public protection measures and documentation. The Act uses a reasonably practicable test, so the question is not whether every venue has purchased the same security package. It is whether the person responsible has taken the measures that are reasonably practicable in the circumstances to meet the statutory aims.

That matters for police advice. A CTSA can discuss threat, vulnerability and protective security. They should not be placed in the position of informally certifying compliance for the SIA. The Act deliberately separates protective-security relationships from the regulator’s statutory decisions.

The current position on 10 August 2026

The Act is enacted. The main duties are not yet operational.

The commencement provisions explained on legislation.gov.uk provide for the substantive Parts 1 and 2 requirements to be brought into force by regulations. The Home Office section 27 guidance was published in April 2026 and updated in May; section 27 itself was commenced so that guidance could be issued, while the guidance expressly says further details will be provided on commencement of the substantive requirements.

The SIA’s position has also moved on since the first version of this article was published. Its consultation on draft section 12 guidance closed in June 2026. The SIA said on 16 June that it had received nearly 200 detailed responses and engaged more than 1,800 people and organisations, and that it plans to publish final section 12 guidance and its consultation report in autumn 2026.

On 17 July, the SIA replaced earlier regulator material with updated guidance explaining Martyn’s Law and its regulatory role. It says the Act is expected to come into force in spring 2027, with the exact date to be confirmed. It is also building the notification portal and intends to invite volunteers to test it from early 2027.

The practical consequence is simple: operators cannot yet be in breach of duties that have not commenced, but those likely to be in scope now have authoritative material against which to prepare.

The SIA regulates; the police advise, respond and share intelligence

The Act establishes the Security Industry Authority as the regulator. The SIA’s consultation material describes a supportive, proportionate and risk-based approach and sets out how it intends to use powers to obtain information, conduct inspections and address non-compliance.

That is a statutory regulatory function. It is not transferred to chief constables, neighbourhood teams or CTSAs.

Police officers will, of course, continue to attend premises for ordinary policing purposes, respond to incidents, manage counter-terrorism intelligence and work with businesses and events. Counter Terrorism Security Advisers will continue to provide specialist protective-security advice. None of that makes the force the Martyn’s Law inspectorate.

This boundary needs to be understood early because the easiest operational failure is role drift. A business asks its local officer, “Are we compliant?” The officer wants to help and gives a definitive answer. That answer is then treated as regulatory approval even though the officer has no authority to give it.

The safer approach is specific. Officers should be able to explain the broad scope of the Act, point duty-holders to the Home Office statutory guidance, direct them to the SIA for regulatory questions and to ProtectUK for protective-security material, and refer specialist security questions through established CT channels.

That is useful without pretending to regulate.

Police leaders have preparation work even without an enforcement duty

The absence of a police regulatory role does not mean Martyn’s Law is operationally neutral for forces.

The first pressure is likely to be advice demand. The closer commencement gets, the more venues, event organisers, local authorities and internal police departments will ask what the legislation means. Specialist CTSA capacity is finite. Forces that do not distinguish questions requiring specialist protective-security advice from questions that can be answered by published guidance risk using scarce expertise as a general help desk.

The second issue is local event and premises knowledge. Enhanced-tier venues and qualifying events are the places where protective-security arrangements, event planning and policing activity are most likely to intersect. Chief officers do not need to create a shadow register for the regulator, but local planners should understand where the largest and most complex sites are and where demand for police advice is foreseeable.

The third issue is information exchange. SIA inspections may reveal matters relevant to crime, public safety or counter-terrorism. Police may hold intelligence relevant to protective security. The precise legal routes and safeguards will depend on the information and purpose, but forces should not wait for the first difficult case to decide who speaks to the regulator.

The fourth is the police estate itself. Schedule 1 includes public-authority uses within the statutory framework. Forces should identify which public-facing premises may fall within scope and ensure responsibility for preparation is assigned rather than assuming the organisation is outside a law it will also be explaining to others.

This is the same problem seen in other areas of neighbourhood policing and prevention: the quality of local advice depends on officers understanding both the policy objective and the boundary of their legal authority.

What venues should do before commencement

For a venue or event organiser, four steps are justified now.

Check scope carefully. Use the section 27 guidance to establish whether the premises or event is likely to qualify, which tier is likely to apply and who the responsible person will be. Do not rely on capacity alone where the use, event conditions or statutory exceptions matter.

Review existing arrangements against the statutory outcomes. Many organisations will already have fire, evacuation, security, communications and incident-management arrangements. The task is to identify whether those arrangements address the public protection procedures and, for the enhanced tier, measures required by the Act.

Use official material before buying compliance products. The Home Office says the regime is intended to be understandable without specialist services purely for compliance. Specialist security advice may still be valuable for complex premises, but a sales pitch is not the legal test.

Track the remaining regulatory changes. The SIA expects final section 12 guidance in autumn 2026 and says the online notification system is still being built. Those documents will matter for how regulation works in practice.

A useful related resource is the site’s wider coverage of civil and preventative powers, where the same discipline applies: distinguish the legal duty from guidance, local practice and advice about what good implementation looks like.

What should happen next

Chief officers and local resilience leaders should use the remaining implementation period for four concrete tasks.

They should identify the likely enhanced-tier and major event landscape in their area for planning purposes; forecast where CTSA and event-security advice is likely to be needed; brief neighbourhood, licensing, events and command teams on the SIA/police boundary; and assign an owner for reviewing the force’s own potentially qualifying premises.

They should also establish a named route for contact with the SIA before commencement. The purpose is not to invent an information-sharing protocol in advance of a real lawful basis. It is to ensure that when a regulatory issue and a policing issue overlap, the right people can quickly decide what can and should be shared.

Success is not the number of venues that receive a police visit. It is whether businesses know where to obtain authoritative advice, specialist policing capacity reaches the premises where it adds value, forces avoid giving unofficial compliance certificates, and police premises are ready for the same regime they are helping others understand.

Martyn’s Law gives the SIA the regulatory job. Police leaders still have a choice about whether the service enters spring 2027 with clear roles and prepared partnerships, or spends the first months of the new regime working out those boundaries in public.