Martyn’s Law: Guidance for venues, premises and event organisers

Businesses, including those in the retail sector, need to ready themselves for full implementation of the Terrorism (Protection of Premises) Act 2025 expected in Spring 2027.  This law will introduce new duties on certain events and premises to pro-actively minimise the risk of acts of terrorism. Failure to comply with the new obligations carries significant sanctions and, as such, it is important to understand the scope of these changes, as well as how to comply.

What is Martyn’s Law and how do I know if I’m affected?

In April 2025, the Terrorism (Protection of Premises) Act 2025, or ‘Martyn’s Law’, was passed by the UK Parliament. This followed a longstanding campaign by Figen Murray OBE, the mother of Martyn Hett, who was one of the victims tragically killed in the 2017 Manchester Arena terror attack.

The legislation introduces a 2-tiered approach, based on the capacity of the event or premises. Smaller premises, which have a capacity between 200 to 799 people, fall within the ‘Standard Tier’. This allows premises to utilise economical and practical procedures to reduce harm and ultimately save lives in the event of an act of terrorism.

For larger qualifying premises and qualifying events with a capacity of 800 people or more, there is an ‘Enhanced Tier’ aimed at reducing vulnerability to acts of terrorism.

Both tiers have different requirements that have to be clearly understood. For premises in the Standard Tier, the following requirements will apply:

• The premises consists of a building (or part of a building, or other land).
• The premises is wholly or mainly used for one or more of the uses in Schedule 1 of the Act, e.g. shops, restaurants, visitor attractions.
• It is reasonable to expect that at least 200 individuals may be present in the premises, at least occasionally.
• The premises does not fall under the exclusions found in Schedule 2 of the Act.

If it’s likely that there will be at least 800 people present in the premises at some point (and the rest of the requirements above are met), the premises or event will fall into the Enhanced Tier.

The requirements for Enhanced Tier are:

• The premises at which the event is to be held consists of a building, other land or a building and other land.
• The premises are accessible to the public for the purpose of the event.
• There will be at least 800 people present for the event at some point.
• There will be measures to check that entry conditions are met e.g. ticket checks, members pass.
• The event does not fall under the exclusions found in Schedule 2 of the Act.

The exclusions listed in Schedule 2 include any premises that consists of either a park, garden, recreation ground, sports ground that is not a designated sports ground, and other open-air premises used for recreation and leisure purposes. There are also exclusions for any premises that falls under the transport security legislation named in the Schedule.

It’s important to consider how the premises you operate fits within the scope of the Act. While a department store or shopping centre may fit within the Enhanced Tier, there may be smaller restaurants and stores within it. These businesses will still have to consider how they ought to comply with the Act.

The implementation period of 2 years from April 2025 will allow for guidance to be issued and for businesses to prepare for compliance with the law.

I fall within the scope of Martyn’s Law. What should I do to ensure that I will be compliant?

Whilst detailed guidance is awaited and will likely be available in Spring 2026, in the meantime, the Act specifies that there must be a responsible person for each qualifying premises and event. At a Standard Tier premises, the responsible person will be the individual who has control of the premises in connection with their relevant Schedule 1 use. For example, the use of the premises as a shop. If there is more than one Schedule 1 use, for example, a restaurant with a small shop attached, the responsible person will be the individual who has control of the principal use of the premises (in this example, the restaurant).

It is important that the responsible person is properly identified and understands their role. This is because, under the Standard Tier, the responsible person will be required to:

• Notify the regulator, the Security Industry Authority (“SIA”) of the premises.
• Have in place, so far as reasonably practicable, appropriate public protection procedures.

Staff should be aware of these procedures in the event of an act of terrorism, either at the premises or in the immediate vicinity. As such, training on the new procedures is essential for employees. The procedures should ensure that they encompass topics such as reducing the risk of physical harm in relation to evacuation, invacuation, locking down the premises and communication.

For the Enhanced Tier premises, as well as ensuring they meet the requirements of the Standard Tier, the responsible person will also be required to:

• Have in place, so far as practically possible, appropriate public protection measures expected to reduce both (i) the vulnerability of the premises or event to an act of terrorism, and (ii) the risk of physical harm being caused to individuals if an attack were to occur there or nearby.
• Document the public protection procedures and measures that are proposed to be, or have been, put in place. This document will be provided to the SIA and should include an assessment of how the procedures/measures reduce vulnerability and/or risk of harm.
• Where the responsible person is not an individual, they must designate a senior individual with responsibility for ensuring that the responsible person complies with these requirements.

The responsible person must think about the practical implications of the Act. For example, the regular footfall of a shop or restaurant may only be several hundred people. However, hosting a pop-up event in the same premises could bring the footfall within the scope of the Enhanced Tier. In this scenario, the responsible person cannot rely on the existing steps taken under the Standard Tier for the day-to-day use of the premises. Rather, they should take account of the Enhanced Tier requirements in the planning of the pop-up event.

Who will regulate my businesses and how will they ensure that I am compliant?

The new Act established a new regulatory function of the existing Security Industry Authority. Its role is to provide support, advice and guidance to those responsible for premises and events to ensure compliance. The SIA will have various powers, including entering a premises with or without a warrant for the purposes of carrying out an inspection and gathering information and retaining evidence.

If an investigation has been carried out and there have been infringements identified, the SIA will be able to take enforcement action and there are a range of sanctions available, including compliance notices, restriction notices and penalty notices. Fines can be issued for a range of non-compliance offences. There is a penalty of up to £5,000 for failing to comply with an SIA information notice. For non-compliance, the penalty for Standard Teir premises can be up to £10,000. For Enhanced Tier premises and events, the penalty can be up to £18 million or 5% of worldwide revenue. Lastly, daily penalties can also be applied to businesses that are non-compliant.

It will be a criminal offence to provide false or misleading information to the SIA, or to intentionally obstruct or impersonate an inspector. Where a notice has been issued, it will be an offence not to comply with the terms of the notices. It’s possible to be prosecuted on indictment with sanctions including up to two years’ imprisonment and/or an unlimited fine.

Why choose Anderson Strathern?

As above, the initial guidance on this new regulatory regime is expected to be issued by the SIA in Spring 2026. Anderson Strathern will keep apprised of developments and will issue updates as they arise to assist businesses to prepare for compliance.

In the meantime, to prepare for implementation, businesses should assess whether they fall within either the Standard or Enhanced Tiers. This can be done by analysing  footfall/attendance data or, for ticketed events, ticket sales. If no data is currently available, consideration should be given to the collation of such data in preparation. Safe occupancy for fire safety purposes could also be used. Assuming a business does fall within one or both tiers, thought could be given to who may be appointed the responsible person.

Anderson Strathern regularly advises regulators, companies and individuals across a wide range of sectors on health and safety matters. Our experience of working collaboratively with regulators across various industries allows us to offer training packages on a variety of health and safety topics, including this new regime. The aim is to ensure that businesses and employees achieve ongoing compliance and create as safe an environment as possible for staff and consumers.

We are here to help

If you have any queries about how Martyn’s Law could impact your business, please get in touch with Julia McDonald at Julia.McDonald@andersonstrathern.co.uk or contact us here.

Sources

Martyn’s Law Factsheet – Home Office in the media

Terrorism (Protection of Premises) Act 2025

HCC Blog: MARTYN’S LAW: Essential Resources for Venues and Event Organisers – Harrogate Convention Centre

Martyn’s Law overview and what you need to know | ProtectUK

Terrorism (protection of premises) Act 2025: The regulator, sanctions and enforcement factsheet – GOV.UK

Martyn’s Law receives royal assent – what does this mean for your business? | Brodies LLP