Martyn's Law: What Employers Need to Know About the New Premises Duty

Martyn's Law — formally the Terrorism (Protection of Premises) Act 2025 — introduces new legal duties on certain premises and events to have procedures in place for reducing the risk of harm from a terrorist attack, and for responding if one happens. It's named after Martyn Hett, one of the twenty-two people killed in the 2017 Manchester Arena attack, and it followed years of campaigning by his family for venues to take public protection more seriously. For employers running qualifying premises, it represents a genuine new compliance obligation — but it's important to understand exactly who it applies to, because it isn't universal.

Who Is In Scope — This Is Not Every Workplace

Martyn's Law applies specifically to premises used for certain qualifying activities — broadly, places the public can access, such as venues, retail premises, hospitality, entertainment and leisure locations, and certain public premises — where the capacity of the premises meets a defined threshold. It does not apply to every business or every office simply because members of the public occasionally visit. The duty is built around two tiers based on how many people the premises can reasonably hold at once: a standard tier for smaller qualifying premises, and an enhanced tier with more extensive obligations for larger premises above a higher capacity threshold. Employers should check the current gov.uk statutory guidance to confirm exactly where their premises falls, since the precise thresholds and the list of qualifying activities are defined in detail there and are the authoritative reference — not a summary like this one.

What the Standard Tier Broadly Requires

For premises in the standard tier, the emphasis is on relatively low-cost, procedural measures: having simple, practical procedures in place covering what staff should do if there's an attack — how to evacuate or invacuate people, how to lock down, and how to communicate during an incident — along with ensuring staff have a basic level of awareness of those procedures. It is about reasonably practicable preparedness, not about installing expensive security infrastructure.

What the Enhanced Tier Adds

The enhanced tier applies to larger qualifying premises above the higher capacity threshold, and adds more substantial obligations — including a requirement to assess what physical, procedural, or other measures would reduce the risk of harm and reduce the vulnerability of the premises, and to document that assessment along with the procedures put in place as a result. This is a materially bigger undertaking than the standard tier, and enhanced-tier premises should expect more detailed record-keeping and a more thorough approach to risk assessment.

Where Implementation Stands

The Act received Royal Assent in April 2025, and statutory guidance has since been published to help organisations understand and prepare for their obligations. As of September 2026, the framework is in a preparation and guidance period ahead of full commencement, with the Security Industry Authority (SIA) set to act as the regulator once the duties come into force. Employers with qualifying premises should treat this as a live compliance deadline to prepare for, not a distant hypothetical — but should also check the current gov.uk guidance for the confirmed commencement date and any transitional arrangements, since exact timing is a matter of public record that can be verified directly rather than assumed.

What This Means Practically for Employers

If you run or manage qualifying premises, the sensible starting point is working out which tier applies, based on the current statutory thresholds and the nature of the activity carried out there. From there, standard-tier premises need clear, simple, well-communicated procedures and a staff team who genuinely know what to do — not just a policy document filed away and forgotten. Enhanced-tier premises need that plus a documented risk assessment covering the physical and procedural measures the premises has in place. Staff awareness is the common thread across both tiers: procedures that exist only on paper, with no one on the floor able to explain what they'd actually do, don't meet the spirit of the duty even where a document technically exists.

An Important Clarification: This Is Not a Mandate for Paid Training

It's worth being direct about something that gets misrepresented: Martyn's Law requires reasonable, proportionate procedures and staff awareness appropriate to the premises — it does not mandate that employers purchase a specific paid external training course or certification. Some organisations will reasonably choose to bring in outside expertise to help design procedures or train staff, and that can be a sensible way to meet the duty efficiently, but the legal requirement itself is about having adequate procedures in place and staff being aware of them, achieved by whatever proportionate means suit the organisation. Be wary of anyone suggesting the law itself requires a particular paid product.

Frequently Asked Questions

Does Martyn's Law apply to ordinary office workplaces?

Generally not, unless the office falls within one of the qualifying activities and meets the relevant capacity threshold — the duty is targeted at premises the public can access for qualifying purposes, such as venues, retail, and entertainment, rather than at workplaces in general.

What's the practical difference between the two tiers?

The standard tier, for smaller qualifying premises, focuses on having simple procedures and staff awareness of what to do in an attack. The enhanced tier, for larger premises above the higher capacity threshold, adds a more detailed documented risk assessment of physical and procedural measures to reduce vulnerability.

Who enforces Martyn's Law?

The Security Industry Authority (SIA) is set to act as the regulator for Martyn's Law once the duties come into force, alongside the statutory guidance published on gov.uk.

Do I need to buy a specific training course to comply?

No — the law requires reasonable procedures and staff awareness appropriate to your premises, not a specific paid course or product. How you achieve that awareness is up to your organisation, provided the outcome is genuinely adequate.

Getting premises security procedures right overlaps with a lot of wider workplace compliance work, including how organisations think about security policies for remote and hybrid working and the broader shifts under the Employment Rights Act 2025. Treat Martyn's Law as one strand of a wider duty of care to people on your premises, rather than an isolated tick-box exercise.