Martyn's Law: An overview for Police, Business owners and Local Authorities

Martyn Hett was 29 when he was murdered at the Manchester Arena on 22 May 2017, one of 22 people killed as they left an Ariana Grande concert — and the law that now carries his name exists because his mother refused to accept that nothing would change. Figen Murray’s campaign ran for six years, through three Prime Ministers, a public inquiry and two governments, and ended with her walking 200 miles from the spot where her son died to the door of Downing Street, arriving on the seventh anniversary of the attack. Eleven months later, on 3 April 2025, the Terrorism (Protection of Premises) Act 2025 received Royal Assent. Everyone, including the government, calls it Martyn’s Law.

This is a plain-English guide to what it actually says, where it is right now on the road from Act to enforcement, and what it will ask of the people who run venues, the officers who police them, and the leaders who sit in between. The second half is a practical starting point — are you in scope, what you will actually have to do, where the free official help lives, and a provisional checklist to work from while the duties are not yet switched on.

What Martyn’s Law actually is

Strip away the legal architecture and the idea is simple: if you are responsible for a place where lots of people gather, you must have thought about what you would do if a terrorist attacked it.

That is genuinely new. Before this Act, no law required a shopping centre, a theatre, a nightclub or a festival to prepare for terrorism in any way. Fire safety has been compulsory for decades; counter-terrorism preparedness was a polite suggestion. The Manchester Arena Inquiry found exactly what that voluntary regime produced: security that was nobody’s clear responsibility, staff who saw something and weren’t sure what to do about it, and an attacker who waited in a CCTV blind spot for an hour.

Martyn’s Law closes that gap with a duty that scales by size. It applies to premises across the UK where it is reasonable to expect 200 or more people may be present at once — shops, bars, restaurants, theatres, sports grounds, hospitals, libraries, hotels, festivals — and it splits them into two tiers.

The standard tier (200–799 people) is deliberately cheap. Those responsible must notify the new regulator and have public protection procedures in place: how you would evacuate, how you would keep people in if outside is more dangerous (“invacuation”), how you would lock down, and how you would tell people on site what is happening. Staff need to know the plan. There is no requirement for physical security measures at all — no obligatory scanners, barriers or guards. The government’s own myth-buster is blunt that a village hall does not need a consultant, just a plan.

The enhanced tier (800+ people, including big one-off events) asks more, because the consequences of failure are bigger. On top of the procedures, those responsible must put in place reasonably practicable measures — monitoring, physical security, security of information — and document how they have assessed and met the requirements, with a named senior person accountable.

Two carve-outs matter for community life: places of worship and schools sit in the standard tier regardless of capacity, a deliberate decision to ask preparedness of them without the enhanced tier’s weight.

Where it is right now

An Act that has received Royal Assent is law, but Martyn’s Law’s duties are not yet in force — and the gap is by design. The government committed to an implementation period of at least 24 months so that venues could prepare and the regulator could be built.

The current state of play, as of June 2026:

• The Act passed on 3 April 2025.
• The regulator is being built. Enforcement goes not to the police but to a new function inside the Security Industry Authority (SIA) — the body that already licenses door supervisors and security guards.
• The official guidance has landed. On 15 April 2026 the Home Office published the Act’s statutory guidance, the document that tells duty-holders what compliance actually looks like, and the SIA opened a public consultation on how it intends to regulate and enforce — a consultation that closes on 12 June 2026.
• The duties are expected to switch on around spring 2027, once the 24-month runway ends and the SIA stands ready.

So if you run a venue: nothing is enforceable against you yet, the official guidance now exists to plan against, and you have roughly a year. That is the whole point of the runway — the venues that wait for commencement day to start reading will be the ones who find it stressful.

What it means for businesses

The honest answer for most premises is: less than the more excitable headlines suggested, but not nothing.

If your capacity is under 200, the Act does not apply to you at all. If you are standard tier, your obligations amount to registering, thinking through four scenarios (out, in, lockdown, communicate), writing the answers down and making sure your staff know them. The Home Office’s design intent — repeated across the factsheet and the myth-buster — is that this should cost time, not money.

Enhanced-tier operators have real work: a documented assessment, protective measures justified as reasonably practicable, information security, and a senior accountable owner. The free, police-backed ProtectUK platform is the closest thing to an official preparation hub, and the sensible sequence for the next year is: confirm your tier, read the statutory guidance, assign ownership, write or refresh the procedures, train against them.

The incentive to take it seriously is also now concrete. The SIA will be able to issue compliance notices and, at the top end, penalties of up to £10,000 in the standard tier and £18 million or 5% of worldwide revenue in the enhanced tier, with daily penalties for continued non-compliance. Nobody expects the maximums to be routine — the SIA’s own consultation emphasises advice first — but they exist, and they are not small.

The practical “how do I actually start?” toolkit is the second half of this guide.

What it means for the police

Here is the detail most coverage misses: Martyn’s Law gives the police no new powers and no enforcement role. The regulator is the SIA. No officer will be inspecting pubs for invacuation plans, and that is deliberate — the government’s framing keeps regulatory enforcement away from local policing relationships.

But it would be a mistake to read that as “nothing changes for policing”. Three things change.

First, the advice burden lands locally before the regulator ever appears. Counter Terrorism Security Advisers and the ProtectUK infrastructure sit on the policing side of the fence, and every neighbourhood team in the country polices premises that are about to acquire a legal duty they will have questions about. The officer who can say what the law actually requires — and, just as usefully, what it doesn’t — will save businesses money and the service goodwill. The neighbourhood policing relationship is where most of those conversations will actually happen.

Second, the quality of what police find on arrival should improve. The operational promise of Martyn’s Law is not that venues will stop attacks; it is that when the worst happens, the first officers through the door meet staff who have rehearsed an evacuation rather than improvised one. Every review of the Arena attack came back to those first minutes. A service that has spent years arguing prevention beats response — the argument running through this site’s evidence-based policing coverage — should recognise the logic.

Third, expect demand at the seams. Lockdown drills generate calls. Suspicious-behaviour training generates reports, most of them well-meant and unfounded. Forces will want to think now about how Protect-driven reporting is triaged, because the legislation will manufacture more of it.

What it means for police leaders

For chief officers and PCCs, Martyn’s Law is the Protect strand of CONTEST finally acquiring a statutory skeleton — and it arrives needing local leadership even though the enforcement duty sits elsewhere.

The leadership questions are concrete. Does the force know its enhanced-tier landscape — the venues, the events calendar, the places where 800 people stand in one room? Are CTSAs resourced for a year in which every sizeable venue in the force area wants an hour of their time? Is there an agreed interface with the SIA when its inspectors find something that looks less like non-compliance and more like intelligence? And is the force’s own estate compliant — because public-facing police buildings over the threshold are premises like any other.

There is also a quieter cultural opportunity. Martyn’s Law normalises the idea that preparedness is ordinary professionalism rather than alarmism — the same shift policing has been trying to make internally for years. Leaders who frame the Act to local businesses as “this is what we already wished you were doing, now with a form” will land it better than those who let it be experienced as Whitehall paperwork.

A practical starting point for businesses

If you run a venue, a shop, a café or an event, the rest of this guide is for you. For most premises, getting ready costs time and attention, not money — the smallest premises in scope are asked for a plan, not a fortress.

One honest caveat before the lists: the law is real but not yet in force. The statutory guidance has been published and the regulator is being built, with the duties expected to commence around spring 2027. So everything below is a way to get ahead of the curve, not a list you can be penalised against today. Treat the checklists as an orientation aid — the final detail still depends on the regulator’s guidance, which is still being settled.

First, are you even in scope?

Martyn’s Law applies to premises and events where it is reasonable to expect 200 or more people may be present at once. Below that line, the Act does not apply to you at all. Above it, you fall into one of the two tiers above, and the tier decides how much is asked.

Working out your capacity is therefore the first job, and it is not always obvious — it is about how many people might reasonably be present, staff and public, at the busiest realistic moment, not your fire-certificate number or your average Tuesday. If you are genuinely near the 200 or 800 line, that judgement is worth documenting now.

Who in your business owns this?

The single most useful thing you can do before any guidance lands is to decide who is responsible. Martyn’s Law expects an identifiable responsible person — the individual or body accountable for the premises meeting its duty. In a small business that may simply be you; in a larger one it should be a named senior person, not a vague collective “management”. Counter-terrorism preparedness fails in exactly the way fire safety used to fail: when it is everybody’s job and therefore nobody’s. Naming an owner costs nothing and changes everything about whether the rest actually happens.

What you’ll actually have to do

For the standard tier, the duty is built around four simple public protection procedures — things you plan for and train your staff to do:

• Evacuation — getting people out safely.
• Invacuation — bringing or keeping people inside and away from danger when going out would be more dangerous.
• Lockdown — securing the premises to delay or prevent an attacker entering.
• Communication — alerting staff and the public on site quickly and clearly.

There is, in the standard tier, no requirement to buy physical security — no obligatory scanners, barriers or guards. The duty is to think it through, write it down simply, and make sure your team knows the plan.

The enhanced tier adds, on top of those procedures, reasonably practicable measures — monitoring, physical security, security of information — and a documented assessment of how the requirements are met, with a senior person accountable for it. If you run large events, this is your world.

A principle worth holding on to: the statutory guidance is explicit that compliance is not a fixed checklist or a prescribed set of security controls. You are expected to apply informed, proportionate judgement to your own premises and how an attack might realistically unfold. Anyone selling you a one-size-fits-all “Martyn’s Law package” has misunderstood the law.

Where the official guidance lives

You do not have to work this out alone, and you should be wary of paying anyone who implies you do. The authoritative, free sources are:

• ProtectUK — the official platform run by the Home Office, the National Counter Terrorism Security Office (NaCTSO) and Counter Terrorism Policing. Its Martyn’s Law hub and resources are the closest thing to a one-stop shop: guidance, templates, posters and a free mobile app.
• The statutory guidance on GOV.UK — the formal document setting out what compliance is intended to look like, and the Home Office factsheet for the plain-English version.
• The Security Industry Authority (SIA) — the regulator. Enforcement goes to the SIA, not the police; no officer will be inspecting your invacuation plan. The SIA’s stated posture is advice-first.
• Counter Terrorism Security Advisers (CTSAs) — specialist police advisers who can help, accessed through ProtectUK and local forces.

Free training to do this week

Two free courses will move you further than any amount of worrying:

• ACT Awareness e-Learning — the National Counter Terrorism Security Office’s free introductory course in spotting and responding to a threat. It is short, open to any member of staff, and the obvious first thing to put in front of your team.
• SCaN — See, Check and Notify — the National Protective Security Authority’s free training for customer-facing staff, security teams and managers, on noticing and acting on suspicious behaviour.

Booking your staff onto ACT e-learning is, today, the most concrete compliance-flavoured thing a standard-tier business can actually do.

What are the “Purple Guides”?

If you organise events, you will hear about the Purple Guide, and it is worth knowing exactly what it is so you neither ignore it nor over-rely on it. The Purple Guide — properly, The Purple Guide to Health, Safety and Welfare at Music and Other Events — is an industry guidance document maintained by the Events Industry Forum, a not-for-profit made up of events-industry bodies. It is a subscription-based online handbook, and it includes a Counter Terrorism chapter developed with NaCTSO, plus a section addressing Martyn’s Law directly.

In plain terms: the Purple Guide is the events sector’s practical rulebook, and its counter-terrorism material is a respected, semi-official reference — especially relevant if you run outdoor events or fall into the enhanced tier. It is not the law itself and not a substitute for the statutory guidance; think of it as the trade’s detailed working manual that sits alongside the official duty.

One quick disambiguation, because the names collide: the Purple Guide is not the same as “Purple Flag”. Purple Flag is a separate accreditation scheme run by the Association of Town and City Management for well-managed evening and night-time economies. Both are worth knowing; they are different things.

A provisional starter checklist

Here is something you can actually work from — with the loudest possible caveat attached.

Provisional — please read. The checklists below are an orientation aid based on the current published and draft guidance. They are not legal advice, they are not the final compliance standard, and the duties are not yet in force (commencement is expected around spring 2027, and the regulator’s enforcement guidance is still being finalised). Use them to get organised and ahead — not as a guarantee of compliance. When the SIA’s final guidance lands, check your plan against it.

If you are (or might be) standard tier (200–799):

• Estimate your realistic maximum capacity and confirm you are in scope.
• Name a responsible person accountable for the duty.
• Draft simple procedures for the four scenarios: evacuate, invacuate, lock down, communicate.
• Walk your premises and note where people would go, and where an attacker might exploit a blind spot.
• Put your staff through the free ACT Awareness e-learning.
• Brief the team on the plan — and make sure new starters get it too.
• Rehearse, even informally, at least once. A plan no one has walked through is paper.
• Keep a short written record of what you have done and when.

If you are enhanced tier (800+), add:

• A documented risk assessment of how an attack might realistically occur.
• Reasonably practicable protective measures (monitoring, physical security, information security) — proportionate to your risk.
• A named senior individual formally accountable.
• A process to review and update the assessment, not a one-off document.
• For events: read the Purple Guide’s counter-terrorism material and factor it into your planning.

What it might cost

For a standard-tier business, the honest answer is: mostly time. There is no mandatory spend on equipment, the official guidance and training are free, and the design intent — repeated across the factsheet and the government’s myth-busting — is that a small venue should not need a consultant. Your costs are the hours to write a plan, train your staff and rehearse.

Enhanced-tier operators have real work and, often, real spend — assessments, measures, accountable ownership — but even there the test is reasonable practicability, scaled to the venue and its risk, not a blank-cheque demand for maximum security.

Myths worth dropping

• “I’ll have to turn my café into an airport.” No. The standard tier requires no physical security at all.
• “The police will come and inspect me.” No. The regulator is the SIA, and its approach is advice-first.
• “I need to hire a Martyn’s Law consultant.” For most standard-tier premises, no — the free ProtectUK resources and ACT training are designed to be enough.
• “It’s already enforceable, I’m behind.” Not yet. The duties are expected to commence around spring 2027; you have a genuine runway.
• “A laminated plan in a drawer counts.” This one is true on paper and false in spirit. Procedures only protect anyone if your staff have actually rehearsed them.

The honest caveats

This site owes readers the limits as well as the case.

The threshold moved for a reason. The original proposal captured premises from 100 capacity; after consultation and scrutiny — including warnings that village halls and community groups would drown — the floor rose to 200. That was probably right, and it was also a concession: the Act protects fewer places than Figen Murray campaigned for.

Procedures are not protection. The standard tier requires a plan, not a capability. A laminated evacuation plan that nobody has walked through is compliance theatre, and the Act’s success will hang on whether the SIA and the guidance push for rehearsal over paperwork. The evidence habit this site keeps banging on about applies here too: the meaningful test of Martyn’s Law, a decade from now, will be measured outcomes in exercises and real incidents — not registration statistics.

The fine detail is still settling. The SIA’s enforcement guidance has been through consultation, the fine detail of what “good” looks like will firm up as commencement approaches, and sensible businesses will check their plans against the final guidance when it lands. Nothing here is a substitute for that official guidance or for professional advice on your specific premises. But none of that is a reason to wait — every concrete thing in the starter checklist is worth doing on its own terms, law or no law.

And no law guarantees the counterfactual. Nobody can say a duty like this would have stopped the Arena bomber. What the Inquiry record supports is narrower and still worth having: prepared venues spot more, respond faster, and save lives in the minutes before the first officer arrives. Figen Murray never claimed more than that. “I will feel Martyn walking beside me,” she said, setting off on the walk that finished the job. The law that resulted is modest, practical and overdue — which may be exactly why it passed.

Start with the free, official ProtectUK Martyn’s Law hub — it is the single best place to turn the checklist above into a plan.

---

Sources and further reading

• Home Office, Martyn’s Law Factsheet, 3 April 2025, and Martyn’s Law myth-buster (PDF).
• ProtectUK, Martyn’s Law hub, overview and what you need to know, and resources.
• GOV.UK, Martyn’s Law guidance published to help businesses, Martyn’s Law: the SIA’s new regulatory role, and SIA launches consultation on section 12 guidance, April 2026.
• The Purple Guide, Martyn’s Law; and ProtectUK, the Purple Guide Counter Terrorism chapter.
• National Protective Security Authority, NPSA — SCaN (See, Check and Notify) training.
• Norton Rose Fulbright, Martyn’s Law: statutory guidance, SIA consultation and key implications for duty holders, 2026.
• Osborne Clarke, Martyn’s Law introduces new security measures for public premises and events in the UK.
• WTW, Martyn’s Law: statutory guidance update, 2026.
• Counter Terror Business, The campaign for Martyn’s Law.