The Terrorism (Protection of Premises) Act 2025, better known as Martyn’s Law, received Royal Assent on 3 April 2025. Its purpose is to improve protective security and preparedness across the UK by requiring those responsible for certain premises and events to consider how they would respond to a terrorist attack and reduce the risk of physical harm.
Martyn’s Law is not yet in force. The legislation is expected to come into effect in 2027, giving organisations that may fall within scope time to understand the requirements and prepare.
For directors and business owners, now is the right time to establish what applies, identify gaps and make proportionate changes without a last-minute rush.
Here are five practical steps to begin your Martyn’s Law readiness.
Step 1: Establish Whether You Are in Scope and Determine Your Tier
Before writing new procedures or investing in security measures, establish whether Martyn’s Law applies to your premises or events.
Broadly, premises may qualify where they are used wholly or mainly for one or more activities specified in the Act, and it is reasonable to expect 200 or more people, including staff, to be present at the same time, from time to time.
Qualifying premises will generally fall into two tiers:
- Standard tier: 200–799 people.
- Enhanced tier: 800 or more people.
There are exceptions. Qualifying childcare, primary and secondary education, further education and places of worship remain in the standard tier even where 800 or more people may reasonably be expected.
Qualifying events are treated differently. Broadly, an event may fall within scope where 800 or more people may reasonably be expected to attend at the same time, members of the public have access and entry is controlled, for example through tickets, passes or invitations.
Why this matters
Martyn’s Law is not simply based on a building’s maximum occupancy. You need to consider the greatest number of people reasonably expected to be present at the same time, alongside the other qualifying criteria.
For organisations with several locations, the position may differ from site to site.
Practical question: Which of our premises and events are potentially in scope, and what evidence supports our assessment?
Step 2: Identify the Responsible Person and Establish Senior Accountability
Once you know which premises or events may fall within scope, establish who the responsible person is.
This is generally the individual or organisation with control of the premises for the use that brings it within scope. For qualifying events, it is the person or organisation controlling the premises for the purposes of that event.
This is particularly important where premises are leased, shared or involve several organisations. Where there is more than one responsible person, the Act also requires them to co-ordinate with each other so far as reasonably practicable.
For enhanced-tier premises and qualifying events, where the responsible person is an organisation, a Senior Individual must also be designated. This must be someone involved in the management or control of the organisation and sufficiently senior to provide meaningful oversight.
You can use competent employees or external specialists to support the work, but legal responsibility remains with the responsible person.
Practical step: Put Martyn’s Law readiness onto the leadership agenda now, with clear ownership, actions and oversight. This should form part of your wider health and safety governance, emergency planning and business continuity arrangements.
Step 3: Develop Your Four Public Protection Procedures
Both standard and enhanced-tier premises must have appropriate public protection procedures, so far as reasonably practicable.
The Act identifies four:
- Evacuation – moving people out of all or part of the premises and away from danger.
- Invacuation – moving people to a safer location within the premises.
- Lockdown – securing premises to prevent people entering or leaving.
- Communication – providing information, warnings and instructions to people on the premises.
These arrangements also need to consider incidents occurring in the immediate vicinity.
Martyn’s Law does not require an elaborate procedure for every conceivable terrorist attack. Procedures should instead be appropriate to the premises and capable of being implemented quickly and effectively.
Why this matters
Your existing fire evacuation plan will not necessarily be enough.
If a threat is outside, evacuating everyone could potentially move them towards danger. Equally, lockdown will not always be the right response.
Practical step: Review your existing fire, emergency, security and business continuity arrangements against all four communication procedures and identify any gaps or conflicting instructions.
Your review should consider whether people understand who makes decisions, how instructions will be communicated and how visitors, contractors and members of the public will be supported.
Step 4: Understand the Additional Enhanced-Tier Requirements
For enhanced-tier premises and qualifying events, the requirements go further.
Responsible persons must also have appropriate public protection measures, so far as reasonably practicable, covering:
- Monitoring the premises, event and immediate vicinity;
- Movement of people into, out of and within the premises;
- Physical safety and security; and
- Security of information that could assist an attacker.
This does not mean every organisation needs expensive barriers, extensive CCTV or major structural alterations. Measures should be proportionate to the circumstances and what is reasonably practicable.
Enhanced-tier responsible persons must also document their compliance. This documentation should set out their public protection procedures and measures and assess how they are expected to reduce vulnerability and the risk of physical harm. It must be provided to the Security Industry Authority and kept up to date.
Why this matters
The requirement is not simply to buy more security equipment. Organisations need to demonstrate what they have decided to do, why it is appropriate and how it reduces risk.
Practical step: Map what you already have across security, emergency planning, health and safety, fire safety and business continuity before creating anything new.
This approach can help prevent duplicated work, unnecessary expenditure and conflicting arrangements across different areas of your organisation.
Step 5: Inform Your People, Test Your Arrangements and Prepare for SIA Notification
Martyn’s Law does not require businesses to buy a particular Martyn’s Law training course or qualification.
What matters is that people responsible for implementing public protection procedures or measures have the information, instruction and, where necessary, training they need to do so effectively.
That might include:
- Inductions;
- Briefings;
- Tabletop exercises;
- E-learning;
- Supervised practice; or
- More formal training where appropriate.
Procedures should also be tested and reviewed. A simple tabletop exercise can quickly expose practical gaps:
- Who decides to lockdown?
- How are visitors informed?
- What if the normal evacuation route takes people towards the threat?
- Who contacts the emergency services?
Don’t Forget SIA Notification
Once the relevant provisions of Martyn’s Law come into force, responsible persons will need to notify the Security Industry Authority (SIA) about qualifying premises and events.
Current SIA guidance indicates that qualifying premises will have a three-month window following commencement of the relevant provisions to submit their initial notification. Qualifying events will generally need to be notified within 14 days of the event date being made publicly available.
Further information on the SIA notification process will be provided ahead of commencement. Organisations should monitor the latest official Martyn’s Law and SIA guidance as the regulatory arrangements develop.
Martyn’s Law: Proportionate Preparedness, Not Box-Ticking
There is a danger whenever new legislation arrives that businesses start buying solutions before understanding what they actually need.
That is not what Martyn’s Law requires.
For standard-tier premises, many arrangements may be straightforward and relatively low-cost. Enhanced-tier organisations have additional responsibilities, but these are still based on what is appropriate and reasonably practicable.
For directors, the sensible approach is neither to panic nor to wait until the legislation comes into force.
Start with five questions:
- Are we in scope?
- Who is responsible?
- What arrangements do we already have?
- Where are the gaps?
- Can our people actually put those arrangements into practice?
Answer those properly and you have already made meaningful progress towards Martyn’s Law compliance and readiness.
How accuSafe Can Support Your Martyn’s Law Preparation
At accuSafe, we help organisations understand what Martyn’s Law means for their premises and translate the requirements into proportionate, workable arrangements.
Our support can include:
- Martyn’s Law scope and tier assessments;
- Gap analysis against standard- and enhanced-tier requirements;
- Review and development of evacuation, invacuation, lockdown and communication procedures;
- Integration with existing emergency, health and safety, fire safety and business continuity arrangements;
- Enhanced-tier governance and documentation support;
- Tabletop exercises and scenario testing; and
- Tailored staff and management training where appropriate.
Our wider health and safety consultancy support can help you connect protective security with your existing compliance systems, while our training services can support the information, instruction and training needs of your people.
Martyn’s Law is not yet in force, but organisations now have detailed statutory guidance on which to begin preparing.
Think your premises or events may fall within Martyn’s Law? Contact accuSafe for a confidential discussion about your current arrangements and what you may need to have in place.
This article reflects the Terrorism (Protection of Premises) Act 2025, Home Office statutory guidance and SIA information available as at 23 August 2026. Guidance and regulatory arrangements may continue to develop ahead of commencement, so organisations should refer to the latest official guidance when making compliance decisions.
Frequently Asked Questions
What is Martyn’s Law?
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is intended to improve protective security and preparedness by requiring those responsible for certain premises and events to consider how they would respond to a terrorist attack and reduce the risk of physical harm.
Is Martyn’s Law currently in force?
No. Martyn’s Law is not yet in force. It is expected to come into effect in 2027.
What are the standard and enhanced tiers?
Qualifying premises will generally be in the standard tier where 200–799 people may reasonably be expected to be present at the same time. The enhanced tier generally applies where 800 or more people may reasonably be expected.
Some qualifying childcare, education and places of worship remain in the standard tier even where 800 or more people may be present.
What are the four public protection procedures?
The four procedures are evacuation, invacuation, lockdown and communication. They should be appropriate to the premises and capable of being implemented quickly and effectively.
Who is the responsible person?
The responsible person is generally the individual or organisation with control of the premises for the use that brings it within scope. For qualifying events, it is the person or organisation controlling the premises for the purposes of that event.
When will SIA notification be required?
Once the relevant provisions come into force, responsible persons will need to notify the SIA about qualifying premises and events. Current SIA guidance indicates a three-month window for qualifying premises following commencement, while qualifying events will generally need to be notified within 14 days of the event date being made publicly available.
Does Martyn’s Law require a specific training course?
No. Martyn’s Law does not require businesses to buy a particular training course or qualification. People responsible for implementing public protection procedures or measures should receive the information, instruction and, where necessary, training they need to do so effectively.
SEO meta title: Martyn’s Law: 5 Steps for Directors | accuSafe
SEO meta description: A practical guide to Martyn’s Law for businesses, covering scope, standard and enhanced tiers, responsible persons, public protection procedures and SIA notification.
Suggested URL slug: /blogs/martyns-law-quick-start-guide-directors
