Martyn's Law: What the Protect Duty Means for Venues and Employers

Martyn's Law — the popular name for the Terrorism (Protection of Premises) Act 2025 — creates a new statutory duty on the people who run publicly accessible venues and events to plan and prepare for a terrorist attack. It's named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena bombing, and it followed a long campaign by his mother, Figen Murray, for venues to take basic, proportionate steps toward public protection rather than treating attack preparedness as optional.

For employers, facilities managers, and anyone responsible for a venue, shop, place of worship, or event, this is a genuinely new legal duty rather than an extension of existing fire or general health and safety obligations. This guide sets out who's covered, what each tier requires, and when the duty takes effect.

When does Martyn's Law take effect?

The Act received Royal Assent, but the substantive duties are not yet in force. The government has indicated it expects the Act to come into force in spring 2027, with the exact commencement date to be announced in advance to give duty holders time to prepare. This runway is deliberate — earlier consultation responses flagged that many smaller venues would need real lead time to put procedures in place, and the government has committed to giving 24 months' notice before the duty becomes enforceable, which is part of why the spring 2027 timeline has been set.

Who is covered: Standard Tier vs Enhanced Tier

Martyn's Law applies on a two-tier basis, with the tier determined by how many people the premises or event is reasonably expected to have present at the same time at peak times — not by the type of venue itself.

• Standard Tier: premises or qualifying events expecting 200 to 799 people present simultaneously at peak times. This captures a very wide range of everyday premises — pubs, small venues, community halls, retail premises, places of worship, and similar.
• Enhanced Tier: premises or events expecting 800 or more people present simultaneously at peak times. This covers larger venues such as stadiums, arenas, and major event spaces.

One notable carve-out: childcare premises, educational premises, and places of worship remain in the Standard Tier regardless of their actual capacity, even where that capacity would otherwise put them into the Enhanced Tier bracket — reflecting the different nature of those settings.

What Standard Tier premises must do

Standard Tier duty holders must notify the regulator of who the "responsible person" is for the premises, and must put in place "appropriate public protection procedures" — covering evacuation, invacuation (moving people to a place of safety within the premises), lockdown, and communication — to the extent that doing so is reasonably practicable. Critically, this is procedural: Standard Tier premises are not required to invest in additional physical security measures, only to have thought through and documented what staff would actually do in the event of an attack.

What Enhanced Tier premises must do

Enhanced Tier duty holders face a materially higher bar. In addition to the same notification and procedural requirements as Standard Tier, they must also implement "appropriate public protection measures" — covering monitoring of premises and surrounding areas, controlling the movement of people, physical security measures, and information security. Enhanced Tier duty holders must document both their procedures and their measures, assess how those measures reduce risk, and submit that documentation to the regulator.

Who regulates and enforces Martyn's Law?

The Security Industry Authority (SIA) — already familiar to many venues as the licensing body for door supervisors and security personnel — has been designated as the regulator for Martyn's Law. The SIA's stated enforcement approach combines desk-based assessments of duty holders' documentation with risk-informed on-site inspections, typically carried out with at least 72 hours' notice, with statutory powers including warrants available where needed.

What venues and employers should be doing now

With the duty not yet in force, there is no immediate compliance deadline — but the spring 2027 target and the 24-months'-notice commitment mean the runway is shorter than it looks once a commencement date is actually announced. Venues expecting to fall into Standard or Enhanced Tier should start now by establishing their expected peak capacity (which determines the tier), identifying who the responsible person will be, and reviewing existing evacuation and lockdown procedures — much of which overlaps naturally with existing fire safety and evacuation planning that many premises already have in place.

Frequently asked questions

When does Martyn's Law come into force?

The government expects the Act to come into force in spring 2027, with the exact date to be announced in advance and at least 24 months' notice given before duties become enforceable.

What's the difference between Standard and Enhanced Tier?

Standard Tier covers premises expecting 200–799 people at peak times and requires public protection procedures. Enhanced Tier covers premises expecting 800 or more people and requires both procedures and additional physical and information security measures, plus documentation submitted to the regulator.

Who regulates Martyn's Law?

The Security Industry Authority (SIA), which already regulates security personnel licensing, has been designated as the regulator.

Martyn's Law represents a genuinely new category of workplace and venue safety duty, sitting alongside — rather than replacing — existing fire safety and general health and safety obligations. Employers who treat the spring 2027 timeline as an opportunity to prepare early, rather than a deadline to react to once announced, will find the transition considerably smoother. Learnsignal's CPD courses cover UK workplace safety and compliance developments as they are confirmed through 2026 and 2027.