Martyn’s Law, answered plainly
Straight answers to the questions venues actually ask — each grounded in the official guidance it rests on, not opinion.
What is Martyn's Law?
Martyn's Law is the everyday name for the Terrorism (Protection of Premises) Act 2025. It asks those responsible for larger publicly accessible venues and events to be prepared to keep people safe in the event of a terrorist attack — with simple public protection procedures at the standard tier, and additional measures at the enhanced tier.
Check whether your venue is likely in scope→
What the guidance says
Standard-tier responsible persons must put in place, so far as reasonably practicable, public protection procedures covering evacuation, invacuation, lockdown and communication.
ProtectUK / Counter Terrorism Policing
The Home Office scope diagram asks five questions in order: are they premises (a building, part of a building, or a building and other land); are they wholly or mainly used for a Schedule 1 use; could 200 or more people reasonably be expected at the same time; are they excluded under Schedule 2; and how many individuals (including staff) are reasonably expected — 200 to 799 indicates standard tier and 800 or more indicates enhanced tier.
Home Office (via ProtectUK)
When does Martyn's Law come into force?
Not yet. The Act received Royal Assent on 3 April 2025 with an implementation period of at least 24 months, and there is no legal requirement to act until commencement. The Home Office published statutory guidance in April 2026 so venues can prepare early. martynslaw.app watches the official sources daily and reflects changes when they happen.
What the guidance says
There is no legal requirement to comply until the Act comes into force. The implementation period is expected to be at least 24 months from Royal Assent (3 April 2025), and the section 27 statutory guidance was published on 15 April 2026 to help those in scope prepare.
Home Office (via ProtectUK)
Notification to the SIA is not required until the law comes into force, and the online notification portal is not yet live.
Security Industry Authority
Does Martyn's Law apply to small businesses?
Only premises where 200 or more people (including staff) can reasonably be expected at the same time are in scope. If your realistic peak is below 200, the duties do not apply — though it is still sensible to keep a short record of how you reached that number in case anything changes.
What the guidance says
Standard tier applies where it is reasonable to expect that from time to time 200 or more individuals may be present at the same time.
Home Office
The figure should include staff and is the number reasonably expected to be present at the same time from time to time — not average attendance. Methods are non-exhaustive and include fire safe occupancy, fixed seating/standing, licence capacity, ticketing or pre-registration, or another justified method. The assessment should be kept under review.
Home Office
What is the difference between the standard and enhanced tiers?
The standard tier covers premises expecting 200 to 799 people at the same time and focuses on simple public protection procedures: evacuation, invacuation, lockdown and communication. The enhanced tier covers premises and events expecting 800 or more, and adds public protection measures, documentation and further duties.
What the guidance says
Standard tier applies where it is reasonable to expect that from time to time 200 or more individuals may be present at the same time.
Home Office
Enhanced tier applies where it is reasonable to expect that from time to time 800 or more individuals may be present at the same time, unless a special exception applies.
Home Office
Enhanced-tier responsible persons must have in place appropriate public protection measures, document the procedures and measures, and assess how they reduce vulnerability and the risk of physical harm.
Home Office
How do I work out how many people to count?
Count the number reasonably expected to be present at the same time, from time to time — including staff — not your average attendance. Acceptable methods include fire safe occupancy, fixed seating, licence capacity, ticketing or pre-registration limits, or another method you can justify and evidence.
What the guidance says
The figure should include staff and is the number reasonably expected to be present at the same time from time to time — not average attendance. Methods are non-exhaustive and include fire safe occupancy, fixed seating/standing, licence capacity, ticketing or pre-registration, or another justified method. The assessment should be kept under review.
Home Office
What procedures does a standard-tier venue need?
Standard-tier responsible persons must put in place, so far as reasonably practicable, public protection procedures covering evacuation, invacuation, lockdown and communication. They should be practical, proportionate and practised with the people expected to carry them out.
What the guidance says
Standard-tier responsible persons must put in place, so far as reasonably practicable, public protection procedures covering evacuation, invacuation, lockdown and communication.
ProtectUK / Counter Terrorism Policing
Do standard-tier venues need a written document?
There is no legal requirement for standard-tier premises to prepare a document recording the procedures — but writing them down helps staff understand and communicate them, and helps demonstrate preparedness if you are ever inspected. martynslaw.app keeps that record date-stamped and versioned for you.
What the guidance says
There is no legal requirement for standard-tier premises to prepare a document recording the procedures, but preparing one can help staff understand and communicate procedures and may help demonstrate preparedness in an inspection.
Home Office
Do I need to hire a consultant or buy specialist services?
The Government's stated intent is that those responsible for premises and events in scope can comply with the Act without needing to buy specialist services, and the Home Office, SIA and NaCTSO do not endorse any third-party products. Tools like martynslaw.app help you organise and evidence your own preparation — the decisions stay yours.
What the guidance says
The Government's intent is that those responsible for premises and events in scope can comply with the Act without needing to buy specialist services. The Home Office, the SIA and the National Counter Terrorism Security Office do not endorse any third-party products.
Home Office (via ProtectUK)
How much will meeting the requirements cost?
The government's impact assessment estimated around £330 per year for standard-tier premises — mostly management and staff time rather than cash spending. The standard tier deliberately centres on simple, low-cost procedures; there is no requirement to buy physical security equipment.
What the guidance says
In the standard tier the focus is on simple, low-cost public protection procedures; costs relate primarily to staff time and there is no requirement to put in place or purchase physical measures. The government's impact assessment estimated around £330 per year for standard tier premises.
Home Office (via ProtectUK)
Do my staff have to complete training?
The Act does not require staff to complete a training course. Free awareness e-learning such as ACT Awareness and SCaN is valuable good practice for employees, contractors and volunteers, but completing it is not one of the Act's requirements. What matters is that the people expected to carry out your procedures understand them.
What the guidance says
Staff awareness can be developed through free e-learning such as ACT Awareness and See, Check and Notify (SCaN). Completing the training is valuable awareness practice for employees, contractors and volunteers, but it does not form part of the Act's requirements.
Home Office (via ProtectUK)
Who is the 'responsible person'?
Whoever has control of the premises for their main public use — typically the operator (a person, company or organisation), not the landlord and not a hirer. Legal responsibility cannot be delegated, although tasks can be shared.
What the guidance says
The responsible person is the individual or organisation with control of the premises for the Schedule 1 use (or control of the premises for a qualifying event). The responsible person must not delegate legal responsibility, although tasks may be delegated.
Home Office
If I hire out my venue, is the hirer responsible?
Usually not — the responsible person generally remains whoever controls the premises for their main use, and responsibility does not pass under a hire contract. You can require hirers to deliver parts of your procedures, but you must be able to show the requirements were clearly specified and reasonably checked.
What the guidance says
When premises are hired out the responsible person usually remains the same and may require hirers to deliver aspects of procedures or measures. The responsible person must be able to demonstrate that requirements were clearly specified and that reasonable actions were taken to ensure the hirer complied.
Home Office
Are places of worship treated differently?
Yes. Places of worship — along with childcare and primary, secondary and further education premises — remain in the standard tier even where 800 or more people are expected. Higher education is treated normally.
What the guidance says
Places of worship, childcare, primary, secondary and further education premises can remain standard tier even where 800 or more individuals are reasonably expected. Higher education is treated differently.
Home Office
Which premises are excluded?
Schedule 2 excludes certain premises — including legislatures, open-air parks and gardens where access is not checked or secured, and transport premises already covered by other security legislation.
What the guidance says
Excluded premises under Schedule 2 include legislatures and devolved administrations; parks, gardens and other open-air premises used for recreation or leisure where access is open and not secured or checked; and transport premises already subject to existing legislative requirements to consider and mitigate threats.
Home Office (via ProtectUK)
Do one-off events count?
An event can qualify in its own right where it is held at premises, is open to the public with entry checks (payment, tickets, passes, membership or guest lists), is expected to host 800 or more people including event staff at the same time at some point, and is not at an excluded location.
What the guidance says
A qualifying event takes place at premises that are not already enhanced tier, is publicly accessible, reasonably expects 800 or more individuals at the same time at some point, and controls entry by ticket, pass, membership or guest status.
Home Office
For an event to be in scope it should be reasonable to expect 800 or more individuals, including staff working at the event, to be present at the same time at some point during the event. Only those attending or working in the part of the premises connected with the event are counted.
Home Office (via ProtectUK)
What are the penalties, and is the regulator out to fine venues?
The Security Industry Authority (SIA) will regulate. Its published approach is advice and guidance first; it will not charge fees for inspections or notifications, and restriction powers are reserved for exceptional circumstances where there is a clear and specific risk of harm, with a right of appeal to the tribunal.
What the guidance says
The SIA will not charge fees for inspections, post-inspection advice or notifications. Where it has concerns it will rely on advice and guidance first; restriction powers are reserved for exceptional circumstances where there is a clear and specific risk of harm, with a right of appeal to the tribunal.
Home Office (via ProtectUK)
Do I need to notify the SIA now?
No. Notification is not required until the law comes into force, and the SIA's notification portal is not yet live. martynslaw.app tracks the official sources daily — when notifications open, your workspace will say so.
What the guidance says
Notification to the SIA is not required until the law comes into force, and the online notification portal is not yet live.
Security Industry Authority
When the Act comes into force, those responsible for qualifying premises and events must notify the regulator, the Security Industry Authority (SIA), that they are responsible for their premises or event.
Home Office (via ProtectUK)
What should venues be doing now?
Review how your existing security and emergency plans align with the Act, work out your realistic capacity with evidence behind it, and get your four procedures drafted and practised. Doing it now, calmly, beats doing it in a rush at commencement — and a dated evidence trail shows your working.
Start with the free scope check→
What the guidance says
Review how your existing security and emergency plans align with the Act. Both the standard and enhanced tier requirements include having procedures in place to respond in the event of an emergency.
Home Office (via ProtectUK)
The figure should include staff and is the number reasonably expected to be present at the same time from time to time — not average attendance. Methods are non-exhaustive and include fire safe occupancy, fixed seating/standing, licence capacity, ticketing or pre-registration, or another justified method. The assessment should be kept under review.
Home Office
Not sure where your venue stands?
The free scope check gives you an indicative tier in about five minutes, with the reasoning and sources shown.
Run the free check →What this is — and what it is not
martynslaw.app is a preparation and document-management tool. It is not legal advice, not official guidance, not official certification, not SIA approval and not a guarantee of compliance. The responsible person must review and approve all documents before use.
martynslaw.app is an independent product. It is not affiliated with, or endorsed by, the Home Office, the Security Industry Authority or any other public body. Official sources are cited as sources only.