Martyn’s Law Timeline: What You Should Be Doing Each Year

Martyn's Law Timeline

Question: What Should UK Venues And Organisations Be Doing Each Year To Prepare For Martyn's Law? The short answer is that 2026 should be the year for practical planning, because Martyn's Law has received Royal Assent, but its main legal duties are expected to commence in spring 2027, subject to the final statutory process.

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which aims to improve public safety at premises and events where people gather. If you run a venue, manage a public building, organise events or look after a busy community space, the key is not to panic, but to prepare in a steady and organised way.

iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock. From CCTV and intruder alarms to fire safety, access control and construction site monitoring, the expert team designs reliable, tailored solutions backed by responsive service and modern, remotely monitored technology.

What Martyn's Law Means In Plain English

Martyn's Law is designed to make qualifying premises and events better prepared for a terrorist attack. It does not expect every small organisation to become a counter terrorism expert overnight, which is a relief, because most venue managers already have enough on their plate without adding spy film training to the rota.

The Act focuses on public protection procedures, which are sensible, planned actions that help protect people if something serious happens. For standard duty premises, these procedures cover evacuation, invacuation, lockdown and communication. Evacuation means moving people away from danger, invacuation means moving them inside or to a safer internal area, lockdown means securing people in place, and communication means sharing clear instructions quickly.

For a wider overview of the legislation and its background, our plain English explanation of What Is Martyn's Law UK is a useful starting point before building your own timeline.

Who The Martyn's Law Timeline Applies To

The Martyn's Law timeline matters most to premises and events that are likely to fall within the Act. Standard duty premises are expected to cover locations where 200 to 799 individuals may reasonably be present at the same time, while enhanced duty premises and qualifying events apply at 800 or more. Capacity is not just about the size of the building, because staff and other people on site may be relevant depending on the circumstances.

Qualifying premises can include places such as shops, hospitality venues, theatres, sports grounds, places of worship, education settings, leisure sites and community buildings, where the public can access the premises for a relevant use. Qualifying events are treated separately, because temporary control, ticketing, stewarding and event layouts can all affect responsibility.

Public spaces can also come into the picture where they are connected with qualifying premises or events, although the detail depends on the final legal and regulatory guidance. The safest approach is to record why you think your premises or event is in scope, or why it is not, rather than relying on a quick guess made during a busy Monday morning meeting.

Key Martyn's Law Milestones So Far

Martyn's Law received Royal Assent on 3 April 2025, which means the Act became law. However, that does not mean all operational duties began immediately, and this distinction is very important for compliance planning.

The UK is now in an implementation period, which allows organisations to prepare and gives the Security Industry Authority, known as the SIA, time to develop its regulatory role. Government information currently points to expected commencement in spring 2027, but the exact date must be confirmed through the proper statutory process.

The official GOV.UK statutory guidance is the most important source to follow, because it explains the scope, duties, responsible persons and enforcement approach in detail.

2025 Awareness And Scoping

Although 2025 has passed, it remains the foundation year in the Martyn's Law timeline because this is when organisations should have started asking, "Are we in scope?" If that work was not done, do not worry, but do not leave it in the same pile as the mystery cables in the store cupboard either.

Your first task is to identify the relevant use of the premises or event. A building may host different activities during the week, and some events may push attendance above a threshold even if normal daily use does not. That is why regular operations and occasional events should be considered separately.

Next, estimate the number of people reasonably expected to be present at the same time. Keep a note of how you reached the figure, whether you used ticket sales, seating plans, room capacities, licensing figures, staff numbers, visitor flow or past attendance. A documented method is far stronger than a rounded number scribbled on a sticky note.

You should also identify the responsible person. In simple terms, this is the person or organisation with control of the premises or event for the relevant use. In leased, shared or hired spaces, this can be more difficult than it first sounds, so landlords, tenants, operators and organisers should clarify responsibilities early.

2026 Preparation And Planning

In 2026, the focus should shift from "Does this affect us?" to "What do we need to improve before commencement?" This is the right time for a gap analysis, which simply means comparing what you already have against what Martyn's Law is likely to require.

Your gap analysis should look at existing emergency plans, fire evacuation arrangements, lockdown options, communication methods, staff roles, visitor management, contractor procedures and support for disabled or vulnerable people. If you already have strong health and safety systems, you may not be starting from zero, but terrorism response can require different decisions from a standard fire drill.

Security technology may also support wider preparedness, especially for larger or more complex premises. For example, properly planned CCTV can help teams monitor entrances, crowd movement and vulnerable areas, although legal duties under Martyn's Law should always be checked against the official guidance rather than assumed from equipment alone.

Staff training is another key 2026 task. There is no single legally prescribed training certificate that every organisation must buy, but staff must understand the procedures, their roles and the tools available to them. Short briefings, induction updates, tabletop exercises and practical walk throughs can all help people respond calmly when it matters.

Procedures To Build In 2026

Evacuation procedures should explain when people may need to leave, which routes are available, who gives instructions and how staff support visitors. Terrorist incidents can create different risks from fires, so plans should allow for flexible decision making rather than automatically sending everyone to the usual assembly point.

Invacuation procedures should identify safer internal areas where people can move away from an external threat. This might involve moving people away from glass, entrances or exposed outdoor spaces, while keeping clear communication between managers, stewards, reception teams and emergency services.

Lockdown procedures should explain who can start a lockdown, how doors or access points are controlled, how people are told what to do and how updates will be shared. Communication procedures should include staff alerts, public messages, alternative methods if systems fail and simple wording that people can understand under pressure.

2027 Compliance And Enforcement Readiness

In 2027, organisations should monitor official announcements closely and confirm the actual commencement date once it is made. Spring 2027 is the current expectation, but a planning assumption is not the same thing as a legal start date.

Once the relevant provisions commence, qualifying premises will need to notify the SIA within the applicable window. Current official updates indicate that qualifying premises will generally have three months from commencement to notify, while qualifying events are expected to have shorter event related notification timescales.

Notification is likely to involve details such as the responsible person, premises information, capacity and the method used to calculate that capacity. If the information changes, organisations will need a process for keeping records current and notifying updates when required.

Enhanced duty premises and qualifying events will have extra work to do. They will need suitable security plans, evidence of appropriate protective measures and a senior responsible person where the responsible person is an organisation. This does not mean every venue needs airport style security, but it does mean decisions should be structured, recorded and reviewed.

For organisations reviewing access points, staff only areas or public entry routes, practical measures such as access control can form part of a wider protective security plan, especially where unauthorised access could increase risk.

2028 Onwards Ongoing Duties

From 2028 onwards, Martyn's Law compliance should become part of normal management rather than a one off project. Think of it like fire safety or health and safety, where plans only stay useful if someone keeps them updated and staff know what they mean.

Reviews should take place regularly and after important changes. These changes might include a new layout, higher capacity, different opening hours, new entrances, a change in ownership, a different event format, updated staffing arrangements or lessons from an exercise or real incident.

Refresher training should include new starters, managers, reception staff, stewards, contractors and anyone with a public facing role. Keep records of who attended, what was covered, what issues were found and which corrective actions were completed.

Your evidence pack should include the scope assessment, capacity method, responsible person decision, procedures, plans, training records, exercise notes, review dates, approval records and SIA notification evidence. It may sound a bit admin heavy, but future you will be grateful when someone asks, "Can you show how this was decided?"

The Role Of The Security Industry Authority

The SIA will act as the regulator for Martyn's Law. Its role will include registration or notification processes, guidance, information gathering and enforcement where organisations fail to comply.

The SIA is expected to support organisations with guidance as well as regulate them, but it will also have powers to investigate and take action. These powers may include compliance notices, restriction notices, penalty notices and daily penalties in certain cases.

It is worth separating SIA regulatory duties from security system certification. For example, SSAIB certified and Insurance Approved alarm installations are important for many insurance and Police Response URN requirements, but Martyn's Law itself has its own notification, planning and public protection duties.

Penalties For Non Compliance

The penalty figures matter because outdated summaries can cause confusion. For standard duty premises, the maximum civil penalty for most contraventions is £18,000, with daily penalties where applicable. Failing to comply with formal information or interview requirements may also lead to enforcement action.

For enhanced duty premises and qualifying events, the maximum civil penalty can be up to £10 million or 2 per cent of qualifying worldwide turnover. That is a fairly persuasive reason to keep your paperwork and procedures in good order.

These figures are statutory maximums, not automatic fines. Enforcement will depend on the facts, the breach, the organisation's conduct and the regulator's approach, but serious or repeated failure may also create criminal liability in certain circumstances. The reassuring bit is that early preparation gives you a much better chance of spotting problems before they become enforcement headaches.

Martyn's Law Timeline Checklist

Not sure where to start? Use this simple planning checklist to keep your preparations moving in the right direction. It is not a replacement for official guidance, but it gives teams a practical structure for meetings, audits and action plans.

• 2025: Confirm whether premises or events are in scope, estimate capacity, identify the tier, record the responsible person and appoint an internal lead.
• 2026: Complete a gap analysis, draft evacuation, invacuation, lockdown and communication procedures, train staff, run exercises and build an evidence pack.
• 2027: Confirm the commencement date, notify the SIA within the relevant window, finalise enhanced duty plans where required and prepare for regulatory contact.
• 2028 onwards: Review procedures, refresh training, update records after changes and keep Martyn's Law compliance within normal governance routines.

Final Thoughts On Martyn's Law Preparation

The most sensible approach to Martyn's Law is calm, early preparation. If your organisation waits until commencement to work out capacity, responsibility, procedures and staff training, the job will feel much bigger than it needs to be.

Start with scope, move into planning, test your procedures and keep evidence of your decisions. If you manage a venue, public building or event and want confidence that your arrangements are on the right track, book a Martyn's Law readiness review or compliance audit with iSecurity Solutions. It is a practical way to spot gaps, prioritise actions and prepare for the SIA notification stage without turning the process into a paperwork marathon.

Frequently Asked Questions

Is Martyn's Law Already In Force?

Martyn's Law received Royal Assent in April 2025, but the main operational duties are expected to commence in spring 2027, subject to the final statutory process. Organisations should prepare now rather than wait for the confirmed start date.

Does Martyn's Law Apply To Venues Under 200 Capacity?

Premises below 200 people are generally outside the standard duty threshold, but organisations should still check the official scope rules carefully. Capacity should be based on the number reasonably expected to be present at the same time.

Do Staff Count Towards The Capacity Threshold?

Staff may be relevant when working out how many individuals can reasonably be present at the same time. The best approach is to document your calculation method and assumptions clearly.

Do Standard Duty Premises Need Security Equipment?

Standard duty focuses on public protection procedures such as evacuation, invacuation, lockdown and communication. Security equipment may still help, but the legal requirement should be checked against official guidance and your specific risk profile.

Does SSAIB Certification Make Martyn's Law Compliance Automatic?

No. SSAIB certified and Insurance Approved systems can support wider security and may be vital for insurance or Police Response URN requirements, but Martyn's Law also requires scope assessment, notification, procedures, training and ongoing records.