Martyn’s Law: Practical Preparation for UK Venues

A security folder does not establish readiness for Martyn’s Law. Operators need clear responsibilities, workable protective procedures and staff who can use them under pressure.

As at October 2026, the Terrorism (Protection of Premises) Act 2025 has been enacted, but its main operator duties have not commenced. Preparation should reflect the venue’s use, attendance and operating arrangements, rather than assumptions about guard numbers or equipment.

Start by separating future statutory requirements from practical improvements that can be made now. This article provides general information, not legal advice.

Key takeaways for venue operators

• Royal Assent on 3 April 2025 established the Act, but did not bring its main venue and event duties into operation.
• Qualifying premises generally enter the standard tier at 200 people, with enhanced duties generally applying at 800 or more.
• Qualifying events have a separate 800-person threshold and additional conditions, including public access and checks on entitlement to enter.
• The responsible person depends on control of the premises or event, rather than the job title appearing on a security plan.
• Standard-tier preparation should prioritise appropriate emergency procedures; enhanced duties add protective measures, documentation and senior-level oversight.
• Training, exercises and records should establish whether arrangements work, rather than merely show that documents or equipment exist.

Capacity alone does not settle every question. Premises use, exclusions, special treatment and shared control can change the assessment.

What Martyn’s Law requires, and when

Enactment is different from commencement

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The Home Office’s Martyn’s Law factsheet explains the legislation and its implementation approach.

The announced implementation period is at least 24 months after Royal Assent. That minimum period should not be presented as a fixed commencement date or a guaranteed deadline for operators.

As at October 2026, the main duties for responsible persons remain uncommenced. Preparatory provisions and regulatory development do not, by themselves, activate the operational requirements for venues and events.

Existing safety, licensing and security obligations continue to apply. The implementation period does not suspend responsibilities that arise under other legislation or an existing premises licence.

Guidance explains the framework

Home Office statutory guidance was published on 21 April 2026. Its publication explains the enacted framework; it did not bring the main operator duties into force.

Keep three categories separate within internal reports: what the Act provides, what official guidance explains, and what the organisation chooses as practical preparation. This prevents recommendations becoming incorrectly described as present statutory requirements.

Record the basis of important decisions, including the guidance version used. Assign responsibility for updating that assessment when legislation, official guidance or operating arrangements change.

A supplier’s interpretation is not a commencement instrument. Nor does purchasing a security package establish that the correct duties have been identified.

Establish whether the premises qualify

Apply the premises test first

Qualifying premises generally need to comprise a building, or a building with other land, used mainly for a purpose listed in the Act. Public access, expected attendance and statutory exclusions also matter.

Relevant uses include shops, restaurants, theatres, museums, libraries and entertainment venues. The Act’s overarching factsheet describes the framework for premises and events.

A building’s commercial description is not enough. Record what activities take place, which areas the public can access, and how rooms or adjoining land operate together.

For mixed-use premises, identify the actual boundaries under consideration. A public hall, adjoining offices and separately operated restaurant may require more careful treatment than a single address suggests.

Count people on a reasonable basis

The general premises threshold is 200 or more people reasonably expected at the same time in connection with the relevant use. Qualifying premises below 800 generally fall within the standard tier; 800 or more generally brings enhanced duties.

Staff count towards attendance. A calculation based only on tickets sold or customer seating can therefore understate the relevant number.

Use credible operating evidence: room layouts, booking records, staffing patterns, standing areas, simultaneous activities and attendance at busy periods. Record assumptions where reliable information is incomplete.

A licensed maximum is useful evidence, but it does not replace the statutory test. Neither does average daily footfall establish how many people may be present simultaneously.

Review the calculation when layouts, opening patterns or permitted activities change. A previous assessment may no longer describe the current operation.

Recognise special treatment and shared-site boundaries

Education and worship require separate attention

Places of worship and specified education premises receive special standard-tier treatment, even where 800 or more people may be present. This is not a blanket exemption from Martyn’s Law.

The government’s guidance for education settings explains how the framework applies in that sector. Do not extend a special rule automatically to every university building, commercial training centre or separately operated venue.

Record the legal category supporting the decision. A familiar building name does not establish its treatment under the Act.

Shared land does not create one automatic category

An open-air retail park should not simply be treated as one qualifying premises because its combined attendance exceeds a threshold. Individual buildings, their uses and control arrangements need separate consideration.

Shopping centres, business estates and multi-occupancy buildings can involve different responsibilities for units, common areas and events. Leases provide evidence about control, but operational arrangements also need examination.

Map who controls entrances, service roads, common foyers and public announcements. Record where one operator depends on another to close access, communicate instructions or manage an emergency.

Obtain qualified legal advice where boundaries or control remain disputed. An unresolved ownership chart can leave a practical response gap.

Assess temporary and qualifying events separately

A qualifying event generally needs to be open to the public, involve checks on entitlement to enter, and expect 800 or more people simultaneously at some point. The location and statutory exclusions also matter.

There is no equivalent standard-tier event category beginning at 200. That lower threshold concerns qualifying premises, not every gathering described commercially as an event.

Free admission does not automatically remove an event from scope. Free tickets can still involve entitlement checks, whilst a gathering without controlled entry may fall outside the qualifying-event definition.

Events held at enhanced duty premises are treated within that premises framework rather than automatically attracting a duplicate qualifying-event regime. Establish the location’s status before assigning responsibilities.

Temporary events also change how a site operates. A familiar venue may acquire additional entrances, temporary structures, restricted areas and contractors who have never worked together.

Integrate terrorism preparedness into the wider event security planning process. Attendance management, fire precautions, medical response and emergency communications need compatible arrangements.

Record who controls the event during installation, public opening and removal. Those phases can involve different people, access arrangements and vulnerabilities.

The event plan should explain how the organiser and venue exchange changes before opening. Increased registrations, revised staging or an additional public area can alter assumptions made during the initial assessment.

An event outside this Act’s definition still needs appropriate safety and security arrangements. Falling outside one statutory regime does not establish that its risks are adequately managed.

Identify the responsible person and operational owners

Assign responsibility according to control

The responsible person is generally the person with control of the premises in connection with the relevant use, or control of the qualifying event. Depending on the arrangement, that person may be an organisation rather than an individual manager.

A landlord, occupier, promoter and facilities contractor can each control different activities. Record those arrangements rather than assigning the entire duty to whichever team already manages security.

Separate legal responsibility from operational delivery. A duty manager may implement procedures without being the responsible person under the Act.

Contracts should describe who provides plans, staffing, communications and access to relevant information. They should also describe how changes are approved and passed between organisations.

Appointing a security contractor does not automatically transfer statutory responsibility. The operator still needs to understand what the contractor delivers and where its authority ends.

Give shared decisions a named owner

Where the Act requires cooperation and coordination, shared arrangements need to work across organisational boundaries. Conflicting instructions can delay protective action even when each organisation has its own plan.

Assign owners for pausing admission, issuing public messages, contacting emergency services and authorising operational changes. Give each role a deputy who can act during absence or shift changes.

Enhanced duty arrangements also require a designated senior individual where the responsible person is not an individual. That designation provides senior oversight; it does not replace the responsible person’s duties.

Record the escalation route for decisions beyond the duty manager’s authority. Budget approval, unresolved building defects and changes affecting tenants should not disappear into an unassigned action log.

Prepare the standard-tier public protection procedures

Cover the four protective functions

Once the relevant duties commence, standard duty premises will need appropriate public protection procedures, so far as reasonably practicable, to reduce physical harm from a terrorist incident.

The procedures cover four practical functions.

The appropriate response depends on the incident and its location. Automatically sending everyone outside can expose people to a threat near the exits or assembly area.

Explain who decides, what information they need, and how instructions reach staff and the public. A procedure should remain usable when the usual manager is unavailable.

Keep requirements proportionate

The standard tier does not impose a requirement to install physical security measures or commission a formal written terrorism risk assessment. It also does not prescribe a compulsory commercial training course.

Practical preparation can still include a short written plan, site briefing and recorded exercise. These can support consistent delivery without being misrepresented as separate standard-tier statutory duties.

Use existing emergency arrangements where they perform the required function. Revise gaps rather than creating a second, conflicting set of instructions.

Check whether doors can support the intended response, whether announcements are audible, and whether staff understand alternative routes. Explain how protective actions interact with fire safety arrangements.

A standard-tier procedure needs an available decision-maker and a usable means of communication. A document cannot supply either during an incident.

Avoid unnecessary complexity. Staff should not need to interpret a long policy before understanding their immediate role.

Understand what enhanced duties add

Select measures against identified exposure

Enhanced duty premises and qualifying events will need appropriate public protection measures as well as procedures, so far as reasonably practicable. These address vulnerability and the consequences of an attack.

The relevant areas include monitoring premises and their immediate vicinity, controlling movement, physical safety and security, and protecting information that could assist an attack.

Suitable measures depend on the setting. Access control may address an uncontrolled staff entrance, whilst better queue arrangements may reduce exposure outside the public doors.

CCTV has a limited protective function without observation, escalation and response arrangements. Record who monitors it, when monitoring occurs and what happens after a concern is identified.

Information security also belongs in the assessment. Detailed floor plans, access codes and staff routines should be available according to operational need.

Document the arrangements and oversight

Enhanced duties include documented compliance arrangements and provision of required information to the SIA. The Martyn’s Law statutory guidance explains the framework for procedures, measures, documentation and oversight.

Preparation should connect each important measure to the exposure it addresses. Record the reason for selecting it, its limitations, its maintenance needs and the person responsible for keeping it operational.

Include an assessment of how procedures and measures work together. A controlled entrance can fail operationally if delivery staff routinely bypass it.

The designated senior individual needs reliable reporting about unresolved weaknesses. A monthly dashboard that omits failed equipment or vacant supervisory posts provides an incomplete picture.

Keep planned improvements distinct from completed controls. A purchase order or approved budget does not establish that a measure is available for use.

Carry out a proportionate terrorism risk assessment

Examine credible threats and existing weaknesses

Begin with how the venue operates, including public arrival, deliveries, staff access and closing arrangements. Identify where an attacker could exploit uncontrolled movement, crowded areas or delayed reporting.

A practical assessment connects a threat with a vulnerability and a possible consequence. Listing attack types without examining the site produces little useful direction.

Review existing controls before recommending additional spending. Access permissions, door management, reporting procedures and supervision may provide improvements without major construction work.

A structured security vulnerability assessment can help identify weaknesses across physical protection, people and procedures. Its findings should lead to assigned actions rather than a generic equipment list.

Avoid unsupported numerical precision. A risk score needs an explained basis and should not conceal uncertainty about attendance, building use or response capability.

Record decisions and remaining exposure

Give each improvement a named owner, target date and completion evidence. Record temporary arrangements where permanent work cannot be completed immediately.

Explain why a proposed measure was selected, modified or rejected. Cost matters, but a decision should also address effectiveness, practicality and any new risks created.

Separate terrorism preparedness from unrelated asset-protection priorities. A camera selected mainly to investigate stock losses may not address the area’s principal risk to people.

Review the assessment after material changes, exercises and relevant incidents. Repeat the site walk when temporary works, relocated entrances or new tenants alter how people move.

The assessment should describe current conditions. Carrying forward an old rating without examining changed circumstances creates a misleading record of control.

Map the full public and service journey

Assess the areas where people gather before they enter and after they leave. Queues, taxi collection points, smoking areas and coach drop-offs can carry different exposure from the main auditorium.

Record the operating boundary and the areas immediately beyond it. The operator may not control a public highway, but should understand how an incident there could affect entry or evacuation.

Loading bays need clear arrangements for expected vehicles, waiting positions and delivery access. Drivers and contractors need a direct route for reporting concerns without searching for an unfamiliar manager.

Include plant rooms, roofs, temporary works and contractor access. Maintenance can change door security, obstruct routes or give unfamiliar personnel access to restricted areas.

Assess the busiest transitions, including doors opening, intervals and simultaneous departure. An apparently clear foyer during a daytime inspection may function differently when several rooms empty together.

Assign responsibility for adjoining areas shared with another operator. A gap between two contracts can become a gap in observation, communications or crowd management.

Show these relationships on a controlled site plan. Keep detailed security information restricted, whilst giving operational staff the route and location information needed for their duties.

The useful test is whether the plan describes movement during a busy event. A drawing that records walls but omits queues, temporary barriers and service activity provides only part of the picture.

Make communication and accessibility workable

Give instructions a reliable route

The incident lead needs a dependable way to reach security, venue staff, contractors and the public. A radio network alone may leave catering teams, tenants or temporary staff outside the information chain.

Assign radio channels, call signs and plain-language escalation rules. Test coverage in service corridors, toilets, plant areas and external queue positions.

Prepare short public messages for the protective actions the venue may use. Avoid ambiguous instructions that require visitors to understand internal security terminology.

Record who can issue announcements and what happens if the public-address system fails. Emergency messaging should remain possible during power loss, equipment failure or an absent keyholder.

Separate incident reporting from public instruction. Staff need to pass accurate observations without broadcasting speculation to visitors or unrelated teams.

Include people who need assistance

Assess how disabled visitors, people with limited mobility and people with sensory or communication needs receive instructions and move to safety. Do not assume that the normal evacuation route answers every protective scenario.

Consider accessible internal locations as well as exits. An invacuation arrangement may fail if the intended space cannot be reached or lacks enough room.

Explain assistance roles and their limits. Staff should understand the agreed arrangements without improvising manual handling or entering danger beyond their competence.

Include children, vulnerable adults and people separated from their group where the venue’s activities require it. Reunification arrangements should avoid directing people back towards an unsafe area.

Test accessibility arrangements during exercises. Written assurances provide limited evidence if the route, message or assigned assistance has never been examined in practice.

Train staff for their assigned role

Use role-based briefings

Staff need to recognise concerns, report them promptly and follow the venue’s protective procedures. The required depth depends on their role, authority and likely decisions.

Reception teams need clear escalation routes and public-facing instructions. Supervisors need decision authority, communication responsibilities and a clear handover process.

Security officers need site assignment instructions that reflect the venue’s emergency plan. Their evacuation duties should be coordinated with facilities staff, stewards and the incident lead.

Include agency workers, cleaners, catering staff and contractors where their presence or duties affect the response. Another employer’s payroll does not remove an operational dependency.

Brief difficult interactions as well as emergencies. Staff should understand refusal procedures, de-escalation limits and when to seek police assistance rather than attempt an unsafe intervention.

Establish understanding, not attendance alone

A course certificate records completion of a course. It does not establish that a worker understands the venue’s doors, alarm arrangements or reporting chain.

Use short scenario discussions and supervised familiarisation to identify gaps. Ask staff to explain who they contact, which information they provide and where their responsibility ends.

Record the briefing date, role covered and any follow-up required. Rebrief staff when entrances, procedures or command arrangements change.

Make handovers part of the process. Outstanding faults, closed routes and temporary arrangements should reach the incoming supervisor before they take responsibility.

Avoid treating general awareness training as authority to investigate suspicious items or confront suspected attackers. Role limits should be explicit, with protective action and reporting taking priority over unnecessary intervention.

Commission security against tasks, not headcount

A security quotation should define the work required at each location and operating period. Headcount alone does not establish adequate entry control, observation, supervision or emergency support.

Describe public entrances, staff access, deliveries, restricted areas and queue positions. Assign coverage during breaks, shift changes and periods when an incident draws officers away from their normal posts.

Separate stewarding from activities requiring an SIA licence. The licensing requirement depends on the activity and circumstances; not every person assisting at an event requires the same licence.

Specify the supervisor’s authority and the route for escalating concerns to venue management. Instructions to “manage security” are too broad to establish who may pause entry or request additional support.

Assess event security staffing and procedures together. Officers need usable instructions, reliable communications and an agreed relationship with the wider event team.

Contracts should cover absence, replacement staff, incident reporting and changes to the deployment. A replacement officer still needs an appropriate site briefing.

Tie performance evidence to the task. Useful records include completed handovers, reported defects, response logs and corrective actions, rather than patrol totals without context.

A contractor’s licence or accreditation can support procurement decisions. It does not establish that a particular venue’s legal responsibilities, staffing requirements or emergency procedures have been satisfied.

Practise procedures and maintain useful records

Test decisions before testing movement

Begin with a discussion exercise involving the people who would make and communicate decisions. Use credible situations linked to the site, such as an external threat affecting the normal assembly area.

Test what happens when information is incomplete, a radio fails or the incident lead is unavailable. These conditions reveal dependencies that a straightforward evacuation drill may miss.

Movement exercises should be planned and controlled. Protect participants, avoid unnecessary alarm and account for the effect on neighbouring occupiers and public access.

Record what the exercise established and what remains untested. Successful movement through one exit does not demonstrate that every protective procedure works.

Close actions and control documents

Keep approved plans, current site drawings, briefing records, exercise findings and action logs together under controlled access. Staff should know where to obtain the operational version.

Mark superseded documents clearly and remove obsolete copies from routine use. Conflicting plans can create uncertainty about routes, contacts and decision authority.

Assign each exercise finding to someone able to resolve it. Record completion evidence and test important corrections rather than closing actions on an assurance alone.

Use proportionate review triggers, including changed layouts, contractors, attendance patterns and relevant incidents. Add a scheduled review so the plan is not left untouched between changes.

Preserve a concise decision history. It should explain what was known, what was decided and who approved unresolved exposure.

Exercise records provide evidence of learning and follow-up. Their value depends on whether identified failures lead to changes in the operation.

Build a preparation programme with a controlled budget

Sequence preparation around dependencies. Expensive purchases made before scope, responsibility and operating requirements are established can leave important weaknesses unresolved.

1. Establish the premises or event category, attendance basis and responsible person. Record special treatment, exclusions and shared control arrangements before approving a compliance project.
2. Review protective procedures, communication routes and staff roles. Resolve obvious operational gaps, including missing deputies, incompatible instructions and inaccessible routes.
3. Assess enhanced-tier measures where relevant, then prioritise procurement, exercises and documentation. Assign owners, completion evidence and reporting arrangements for work that remains outstanding.

There is no universal Martyn’s Law package price. Costs depend on existing capability, site constraints, staff turnover, communications, building work and the measures justified for the operation.

Separate initial spending from continuing costs. Equipment maintenance, radio support, refresher briefings, document control and supervisory time need an ongoing budget.

Do not approve equipment solely because it is marketed under the legislation’s name. Record the problem it addresses and the practical response that follows its use.

Set a reporting route for blocked actions and changing assumptions. Senior management needs to know when a planned measure cannot be delivered or a new event changes the assessment.

Procurement should follow the operational requirement. A completed purchase does not establish that installation, familiarisation, maintenance and response arrangements are complete.

Understand the SIA’s role and prospective enforcement

The Security Industry Authority is the regulator under the Act. Its published regulatory role covers the framework for supporting, supervising and enforcing compliance.

Once the relevant duties commence, responsible persons will need to notify the SIA as required. Enhanced duty arrangements also involve required documentation and senior oversight.

The Act provides inspection and information-gathering powers. Operators should prepare records that explain their actual arrangements, rather than assemble a separate presentation disconnected from daily practice.

Prospective financial penalty ceilings include £10,000 for certain standard-tier contraventions. For certain enhanced-tier and qualifying-event contraventions, the ceiling is the higher of £18 million or 5% of qualifying worldwide revenue.

These are maximum figures within the future enforcement framework, not automatic fines for every deficiency. They should not be described as current operator penalties whilst the relevant substantive duties remain uncommenced.

The responsible person needs a clear route for handling regulatory correspondence and requests for information. Assign ownership, deputies and access to relevant records before that process is needed.

Avoid treating enforcement preparation as a document exercise. Records should agree with staffing, equipment availability, training and the procedures followed on site.

Existing SIA security licensing requirements are separate from its role under Martyn’s Law. Buying licensed security services does not, by itself, discharge the responsible person’s future duties.

Frequently asked questions

Is Martyn’s Law already in force?

The Act received Royal Assent on 3 April 2025, but its main operator duties have not commenced as at October 2026. The announced implementation period is at least 24 months. That minimum period should not be treated as a confirmed commencement date.

Preparatory work is sensible, whilst existing safety and licensing duties continue.

Does a venue with fewer than 200 people have duties under the Act?

Premises below the general 200-person threshold will generally fall outside the premises regime. Establish the correct boundaries and reasonable simultaneous attendance before reaching that conclusion.

Existing responsibilities under other legislation still apply. A location may also require separate assessment if it hosts an event meeting the qualifying-event conditions.

Does the standard tier require guards or CCTV?

The standard tier does not impose a blanket requirement to employ guards, install CCTV or make physical security upgrades. Its focus is appropriate public protection procedures, so far as reasonably practicable.

Other risks, licensing conditions or existing responsibilities may justify security staffing or equipment independently of Martyn’s Law. Record that separate basis clearly.

Can a security contractor take responsibility for compliance?

A contractor can deliver agreed tasks, contribute to assessments and support emergency procedures. Appointment does not automatically transfer the responsible person’s statutory position.

Record who controls the premises or event, who authorises protective decisions and who provides the required information. Contract wording and operational responsibility need to support each other rather than leave gaps.

Prepare arrangements that staff can use

Readiness depends on correct scope, clear responsibility and protective action that works under realistic conditions. Equipment, certificates and approved plans provide only part of that evidence.

Start with the attendance assessment and control arrangements. Then connect procedures, staff roles, communications and proportionate measures, with records showing what has been tested and what remains unresolved.

Keep future statutory duties distinct from existing obligations and voluntary preparation. The practical standard is an operation that can explain its decisions and carry them out.