how to comply with martyn’s law​?

Comply With Martyn's Law

To comply with Martyn's Law, first confirm whether your premises or event is in scope, then decide whether it falls into the standard tier or enhanced tier. You should create clear public protection procedures, train staff, keep records, review your plans and make practical security improvements where they are needed. If you manage a venue, school, shop, place of worship, hospitality site or public event, iSecurity Solutions can help turn the legal wording into workable security steps that make sense on site.

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. Its purpose is serious but clear. Public places should be better prepared to reduce harm if a terrorist incident happens.

The Act is not about making every organisation feel like an airport, thankfully, because nobody wants a bag search before buying a sandwich. It is about sensible planning, clear responsibilities and staff who know what to do when something does not feel right.

iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock. From CCTV and intruder alarms to fire safety, access control and construction site monitoring, the team designs reliable, tailored systems backed by responsive service and modern remotely monitored technology.

What Martyn's Law Requires In 2026

In 2026, the main task is preparation. The Government has confirmed an implementation period of at least twenty four months from Royal Assent before duties are expected to be enforced. That means enforcement is expected no earlier than April 2027, subject to Government confirmation. For a wider plain English background, you can read our overview of Martyn's Law, which explains why the legislation was introduced and who it is designed to protect.

The official statutory guidance explains qualifying premises, qualifying events, responsible persons, tier thresholds and public protection duties. You can check the latest Government position through the Terrorism Protection of Premises Act guidance, which should be your main reference for board papers, trustee meetings and internal compliance reviews.

Organisations should not wait until the last few months. The calmer route is to assess scope in 2026, write procedures, test them with staff, improve physical security where needed and keep evidence that reasonable steps are being taken.

Standard Tier And Enhanced Tier Thresholds

Martyn's Law uses capacity to decide what level of duty applies. Standard tier generally covers premises or events where 200 to 799 people may be present at the same time, while enhanced tier applies where 800 or more people may be present.

The count is not just customers or visitors, as staff are included too. A theatre with 650 seats and 60 staff on a busy night may be standard tier, while a university hall, stadium, shopping centre or large festival area could move into enhanced tier if 800 or more people can reasonably be expected.

Do you know your true maximum capacity, including staff, contractors and busy seasonal peaks? If you are unsure which level applies, our article on the standard and enhanced tiers breaks the thresholds down in a simple way. The safest approach is to record how capacity was calculated, including room layouts, normal peak attendance, seasonal events and staff numbers.

Which UK Premises And Events Are In Scope

Martyn's Law can apply to a wide range of public facing UK premises, including schools, colleges, universities, shops, restaurants, hotels, theatres, cinemas, museums, community centres, sports grounds and places of worship. It can also apply to qualifying events such as festivals, fairs, concerts and outdoor gatherings where the public has access and the capacity threshold is met.

Multi use sites need particular care because different parts of the same building may operate in different ways. A school hall used for assemblies, sports clubs and public evening events may need a more careful assessment than a simple classroom block, especially if large numbers of parents, visitors or contractors attend.

For business premises that welcome the public, a joined up approach to business security helps align Martyn's Law planning with daily operations. That means thinking about entrances, reception areas, delivery points, staff communication and how people would move if a serious incident occurred nearby.

Conducting A Terrorism Risk Assessment

A terrorism risk assessment is a structured look at what could make your premises vulnerable and what practical steps would reduce harm. It should consider the people on site, building layout, entry points, crowded areas, escape routes, security gaps, communication methods and any events that create higher risk.

Start by mapping how people enter, gather, queue and leave. Then consider possible scenarios, such as a suspicious package, hostile vehicle, armed attack nearby, threatening phone call or an incident outside the premises that makes evacuation unsafe.

The assessment should also connect with existing safety duties, but it does not need to become a standards textbook. As a practical note, fire alarms, emergency lighting, extinguishers and fire risk assessments should be maintained in line with recognised UK standards such as BS 5839, BS 5266, BS 5306, BAFE SP101 and PAS 79 where suitable.

Evacuation Invacuation And Lockdown Planning

Public protection procedures are at the heart of Martyn's Law. Evacuation means moving people away from danger, invacuation means moving people to a safer area inside the premises and lockdown means securing people inside rooms or zones when leaving could put them at greater risk.

The tricky part is knowing which response fits the situation, because a fire style evacuation is not always the safest answer during a terrorism related incident. For example, if there is a threat outside the main entrance, moving people further inside and locking external doors may be safer than sending everyone into the street.

Would your staff know when to evacuate, invacuate or lock down without waiting for a long meeting first? Procedures should set out who makes decisions, how staff are alerted, which doors are secured, where people should go, how vulnerable people are assisted and how emergency services are contacted. Keep the wording simple because, in a real incident, nobody is going to read a forty page document while calmly sipping tea.

Physical Security Measures For Standard Tier Premises

Standard tier premises are not expected to install expensive new infrastructure just because they fall within scope. The focus is on reasonable public protection procedures, staff awareness and simple actions that can be put into practice quickly.

Useful low cost measures may include clear locking routines, keeping back doors secure, improving visitor sign in processes, checking that escape routes are not blocked, briefing staff to report suspicious behaviour and reviewing how messages would be shared during an emergency. Where CCTV is used, it should be placed to support real decisions rather than simply record footage after the event.

Modern CCTV systems can help duty holders monitor entrances, queues, car parks and vulnerable areas, particularly when paired with clear staff procedures. For monitored CCTV, intruder alarms or perimeter detection that may need a Police Response URN, an SSAIB certified and Insurance-Approved system is the prerequisite. Systems should also be designed with EN 50131 grades in mind, commonly Grade 2 or Grade 3 depending on the site risk.

Enhanced Tier Requirements And Security Plans

Enhanced tier sites have more formal duties because larger crowds can create greater consequences if something goes wrong. These organisations need standard tier procedures plus suitable public protection measures, documented security plans and clear senior accountability.

A good enhanced tier security plan should describe the premises, normal and peak capacity, risk assessment findings, security measures, staff roles, communication methods, evacuation and lockdown procedures, training arrangements and review dates. It should also name a senior responsible person who has enough authority to make decisions and secure resources.

Enhanced tier measures may include access control, CCTV coverage, search policies, vehicle management, hostile vehicle mitigation, staff radios, control room procedures and contractor checks. For public facing buildings, access control can help separate public areas from staff only zones, plant rooms, offices and sensitive spaces.

Staff Training Obligations Under The Act

Staff training is not a tick box exercise because people are often the first to spot something unusual. Training should cover suspicious behaviour, suspicious items, how to raise concerns, evacuation routes, invacuation areas, lockdown steps, communication channels and the importance of staying calm.

Induction training should be given to new starters, with refresher training at least annually or whenever procedures change. Before major events, short briefings are useful because temporary staff, volunteers and contractors may not know the building as well as your regular team.

Keep training records, attendance logs, drill notes and any lessons learned. If the Security Industry Authority asks what has been done, clear records are far more persuasive than saying, we definitely talked about it in the kitchen once.

The Role Of The Security Industry Authority

The Security Industry Authority, often called the SIA, is the regulator for Martyn's Law. Its role includes receiving notifications, issuing operational guidance, authorising inspectors, gathering information and taking enforcement action where organisations fail to meet their duties.

Inspections are likely to focus on whether your arrangements are suitable and proportionate for your tier and risk level. That means you should be able to show how scope was assessed, who is responsible, what procedures exist, how staff are trained and how the plan is reviewed.

The SIA is not expected to demand identical measures from every premises because a rural community hall is not the same as a city centre arena. Proportionate compliance is the key phrase to remember, although proportionate still needs evidence behind it.

Penalties For Non Compliance

Non compliance can lead to civil sanctions, restriction notices and monetary penalties, depending on the seriousness of the breach and how the organisation responds. The regulator may consider whether action has been taken to fix problems, whether risks were ignored and whether the organisation cooperated.

There are also wider consequences beyond formal fines. Poor preparation can damage reputation, unsettle staff, concern insurers, affect stakeholder confidence and create difficult questions after an incident or inspection.

Security and safety should work together rather than sit in separate folders. If your Martyn's Law review shows gaps in fire detection, emergency communication or evacuation support, our fire safety team can help align practical improvements with recognised UK standards.

Practical Martyn's Law Compliance Checklist And Timeline

Start with scope. List every premises and event, calculate likely maximum attendance including staff, decide whether standard tier or enhanced tier applies and record your reasoning in a simple compliance file.

• First month, confirm whether each site is a qualifying premises or qualifying event.
• First month, calculate capacity using realistic peak attendance, not a quiet Tuesday afternoon.
• First month, identify the responsible person and senior decision maker.
• Next three months, write evacuation, invacuation, lockdown and communication procedures.
• Next three months, review entrances, exits, queues, delivery points and crowded areas.
• Next three months, train staff and keep attendance records.
• Before enforcement, test procedures through short drills or tabletop exercises.
• Before enforcement, review plans after major events, incidents or layout changes.

For 2026, aim to complete scope and tier assessment first, then create procedures and start staff training. In the next phase, enhanced tier premises should finalise risk assessments, security plans, senior responsibility and any proportionate upgrades before enforcement begins.

If you use alarms, CCTV, access control or site monitoring as part of your plan, a maintenance arrangement helps keep systems reliable when they are needed most. Our service contracts support regular checks, fault response and ongoing confidence across security and fire systems.

Final Thoughts On Martyn's Law Compliance

Complying with Martyn's Law is not about panic buying security equipment or producing paperwork nobody reads. It is about understanding your risk, training your people, planning sensible responses and making sure your premises can protect the public more effectively.

The organisations that start early will have a much easier time when enforcement begins. With the right support, Martyn's Law compliance can become part of normal safety management rather than a last minute scramble with too much coffee and not enough printer paper.

Frequently Asked Questions

When Does Martyn's Law Come Into Force?

Martyn's Law received Royal Assent on 3 April 2025 and has an implementation period of at least twenty four months, so enforcement is expected no earlier than April 2027, subject to Government confirmation. Organisations should use 2026 to assess scope, write procedures and train staff.

Does Martyn's Law Apply To Small Businesses?

It can apply if the premises is open to the public and 200 or more people may reasonably be present at the same time, including staff. Smaller premises below the threshold are generally outside the main duties, but basic security planning is still sensible.

What Is The Difference Between Standard Tier And Enhanced Tier?

Standard tier usually applies to premises or events with 200 to 799 people, while enhanced tier applies to 800 or more. Enhanced tier carries more formal requirements, including documented security plans and proportionate protective measures.

Do I Need CCTV Or Alarms To Comply With Martyn's Law?

Standard tier does not automatically require new CCTV or alarms, but enhanced tier sites may need proportionate measures based on risk. If monitored CCTV, intruder alarms or perimeter detection need a Police Response URN, an SSAIB certified and Insurance-Approved system is the prerequisite.

Who Enforces Martyn's Law?

The Security Industry Authority is the regulator responsible for guidance, inspections, information gathering and civil enforcement. Keeping clear records of risk assessments, procedures, training and reviews will help show that you are taking compliance seriously.