Understanding Martyn's Law and the SIA's role as regulator
Learn more about Martyn's Law and the Security Industry Authority's role as its regulator.
The Terrorism (Protection of Premises) Act 2025 is UK legislation designed to ensure the public is better protected from terrorism. It does this by requiring certain public premises and events to be prepared and ready to keep people safe in the event of an attack. The Act is commonly called ‘Martyn’s Law’ in tribute to Martyn Hett, one of the 22 people killed in the Manchester Arena attack.
The Act establishes the SIA as the regulator of Martyn’s Law. It is expected that the Act will come into force in spring 2027. We will confirm the exact date ahead of when this happens.
Understanding Martyn’s Law
If you’re looking to identify if Martyn’s Law applies to you and what the requirements are, we provide a brief explanation of the scope of Martyn’s Law below. However, we recommend reading the following:
- guidance from the Home Office on the requirements of the legislation and how to comply
- our guidance on how we will exercise our regulatory functions on Martyn’s Law
We consulted on a draft of our guidance between 15 April and 12 June 2026. We will publish the final guidance and a consultation report in autumn 2026.
You can find useful information on ProtectUK, which offers free advice and guidance to help you understand protective security and improve your response to the risk of terrorism. This includes answers to some of the frequently asked questions about Martyn’s Law.
You can also sign up for updates from the SIA.
The SIA’s role as the regulator of Martyn’s Law
The role of the regulator is to enforce Martyn’s Law by:
- helping those responsible for qualifying premises and qualifying events comply with the law
- assessing compliance
- identifying non-compliance and bringing premises and events in scope into compliance
Our approach to assessing compliance will involve desk-based assessments and on-site inspections. We will use a risk-based approach, informed by intelligence and our compliance assessments. Our focus will be on whether those in scope of the Act have taken reasonable steps to comply. We will consider the particular circumstances of all premises and each event when assessing compliance.
We will typically give at least 72 hours’ notice before an on-site inspection. We can ask a court to give us a warrant to enter premises without notice in some circumstances.
Premises and events covered by Martyn’s Law
The Home Office has produced guidance which will help you identify if your specific premises or event is in scope. There is also a helpful premises flowchart and events flowchart on ProtectUK.
Your premises are likely to be in scope if all the following apply:
- they include a building or part of a building
- they are wholly or mainly used for one of the purposes in Schedule 1 of the Act
- it is reasonable to expect that 200 or more people will be present on the premises at the same time, from time to time – that includes members of staff
- the premises are not excluded premises under Schedule 2 of the Act
Your event will likely be in scope if all the following apply:
- it is accessible to members of the public
- there will be entry checks into the event (specifically, checking if attendees have a ticket, pass, or are members or guests of a club or association)
- it is reasonable to expect that 800 or more people will be present on the premises at the same time – that includes members of staff
- the event takes place at premises that are not themselves already in scope as enhanced tier premises
- the event is not taking place at excluded premises under Schedule 2 of the Act
What you must do if you are in scope of Martyn’s Law
There are things you must do if you are responsible for premises or an event that will fall within the scope of the Act when it comes into force.
What you must do will usually depend on the number of people you can reasonably expect will be present at the same time at the busiest times. That will determine whether you are required to comply with the ‘standard tier’ or the ‘enhanced tier’ requirements (we explain both below).
An exception to this is if your premises are used for childcare, primary, secondary or further education, or as a place of worship. In such cases, you will be in the standard tier if 200 or more people may be present at the same time, from time to time. You will then remain in the standard tier even if the number of people who may be present at one time goes to 800 or more (the usual threshold for the enhanced tier).
Standard tier
Premises where between 200 and 799 people may be present at the same time, at the busiest times, will be in the ‘standard tier’.
If you are responsible for standard tier premises, you must:
- notify us who the responsible person is for your premises (once the law comes into effect)
- have in place, so far as is reasonably practicable, appropriate public protection procedures to reduce the risk of physical harm if an attack were to occur there or in the immediate vicinity
The 4 public protection procedures in the Act you will need to consider are:
- evacuation – getting people away from danger by moving them out of the premises or event (or part of the premises or event)
- invacuation – moving people away from danger to a place within the premises or event where there is less risk of physical harm being caused to them
- lockdown – securing the premises or event to prevent individuals entering or leaving
- communication – ensuring information is provided to individuals at the premises or event
Enhanced tier
Larger premises where 800 or more individuals may be present at the same time, from time to time, will be in the ‘enhanced tier’.
Qualifying events have the same requirements as enhanced tier premises.
If you are responsible for enhanced tier premises or for a qualifying event, you must do all of the following:
- notify us who the responsible person is for your premises or who the responsible person is for your event (once the law comes into effect)
- have in place, so far as is reasonably practicable, appropriate public protection procedures to reduce the risk of physical harm if an attack were to occur there or in the immediate vicinity
- have in place, so far as is reasonably practicable, appropriate public protection measures to reduce the vulnerability of the premises or event to an act of terrorism occurring
- document the public protection procedures and measures in place, assess how they reduce risk of physical harm and vulnerability of the premises or event, and then send this document to us (we will share templates to support this process before Martyn’s Law comes into effect)
The 4 public protection procedures in the Act you will need to consider are:
- evacuation – getting people away from danger by moving them out of the premises or event (or part of the premises or event)
- invacuation – moving people away from danger to a place within the premises or event where there is less risk of physical harm being caused to them
- lockdown – securing the premises or event to prevent individuals entering or leaving
- communication – ensuring information is provided to individuals at the premises or event
The 4 public protection measures in the Act you will need to consider are:
- monitoring – the monitoring of the premises or event, and the immediate vicinity (using tools like CCTV)
- movement – the movement of individuals into, out of and within the premises or event
- physical security – the physical safety and security of the premises, or the premises at which the event is to be held
- security of information – ensuring the security of information about the premises, their operation, design, usage or internal workings are not widely available and accessible to those who may use it to plan a terrorist attack
What “reasonably practicable” means
Reasonably practicable means weighing up what can be done to achieve the objectives of public protection procedures and/or measures, balanced against the cost, time and difficulty of implementation.
This means taking into account:
- the particular nature of the premises or event
- the resources available to you
What “responsible person” means for premises
You are the ‘responsible person’ for premises if you are the individual, organisation or company with control of the premises for the purpose for which it is in scope.
You have “control of the premises” if you typically have both of the following:
- possession of the premises at the time (in the sense that you are the occupant)
- the right and ability to make decisions about their management and use, particularly on who may or may not remain on site
If your premises are in the enhanced tier and you are an organisation rather than an individual, you must assign a member of staff involved in the management or control of the organisation to be responsible for ensuring compliance (referred to as the senior individual).
What “responsible person” means for events
You are the ‘responsible person’ for a qualifying event if you are the individual, organisation or company that has control of the premises where the event is taking place in connection with their use for the event.
If you are an organisation, you must assign a member of staff involved in the management or control of the organisation to be responsible for ensuring compliance (referred to as the senior individual).
Notifying the SIA
When Martyn’s Law comes into force, some people will be legally required to notify us – that is, tell us – certain things about their premises or event. Learn more about this notification requirement.
You will not need to notify us about anything unless you fall within the scope of Martyn’s Law.
If your premises or event fall within the scope of Martyn’s Law, then what you need to tell us will depend on whether you are in the standard tier or the enhanced tier. Either way, you will be able to tell us through an online portal that we are building.
From early 2027, we’ll be inviting volunteers to help us test the portal before we launch it. We will let you know when it’s open for everyone to use. Sign up to volunteer and for SIA email updates on Martyn’s Law.
Preparing for Martyn’s Law
The best first step is to review the Home Office section 27 guidance outlining the steps necessary for premises and events to comply. You can also sign up for updates from the SIA. Further useful materials can be found on ProtectUK.
If you are responsible for premises or an event in scope of Martyn’s Law, you cannot pass on that responsibility. However, you can seek advice from a suitably knowledgeable security adviser.
Neither the SIA nor the Home Office is able to endorse or recommend specific companies or services for compliance with this legislation, as it would be inappropriate for a government agency to do so.