What happens if a business fails to comply with Martyn’s Law?

Martyn's Law Compliance

If a business fails to comply with Martyn's Law, the Security Industry Authority can investigate, ask for information, inspect the premises, issue formal notices and impose financial penalties. In serious cases, prosecution may follow, and the business may also face reputational harm, insurance questions, licensing pressure and civil claims after an incident.

Martyn's Law is the everyday name for the Terrorism Protection of Premises Act 2025, which received Royal Assent on 3 April 2025. It was introduced after the Manchester Arena attack and is designed to help publicly accessible premises and events prepare for terrorist threats in a practical, proportionate way.

For many UK venues, the challenge is knowing what to do before enforcement begins, rather than reacting after a notice arrives. iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock with CCTV, intruder alarms, fire safety, access control and construction site monitoring. The team supports businesses, venues and site managers with reliable, tailored security measures backed by responsive service and modern, remotely monitored technology.

Why Martyn's Law Matters To UK Businesses

Martyn's Law matters because it turns preparedness into a legal duty for qualifying premises and events across England, Wales, Scotland and Northern Ireland. It does not ask every business to become a fortress, but it does expect responsible people to think ahead, brief staff and put clear public protection procedures in place.

The law sits alongside existing duties such as fire safety, health and safety, licensing and equality obligations. That means a lockdown plan, evacuation route or crowd control measure must still work safely for disabled visitors, staff, contractors and the wider public.

Who Must Comply With Martyn's Law?

Martyn's Law applies to certain premises and public events where people may reasonably be expected to gather. The key point is capacity, and that figure includes staff, contractors, volunteers and others working on site, not only customers or ticket holders.

Standard duty premises are those where 200 to 799 people may reasonably be expected to be present at the same time from time to time. These premises must notify the SIA and have suitable public protection procedures, so far as reasonably practicable.

Enhanced duty premises are generally those where 800 or more people may reasonably be expected to be present. They have extra duties, including formal public protection measures, compliance documentation, submission of that document to the SIA and the appointment of a senior individual where the responsible person is an organisation.

A qualifying public event will usually involve public access, entry controls such as tickets or payment, and at least 800 people expected at the same time. It must also take place somewhere that is not already enhanced duty premises and must not fall within an exclusion.

There are important exceptions. Places of worship, childcare premises, primary schools, secondary schools and further education premises remain within the standard tier once they meet the 200 person threshold, even if their attendance can reach 800 or more.

Who Is The Responsible Person?

The responsible person is the individual, company or organisation that controls the premises for the relevant use. In simple terms, that could be the operator, tenant, venue manager, event organiser or another party with real control over how the premises or event runs.

Legal responsibility cannot simply be handed to a security contractor, consultant or supplier. Tasks can be delegated, and specialist support can be very useful, but the responsible person remains accountable for making sure the duties are met.

If several parties share control, such as a landlord, tenant, event organiser and facilities team, they should agree responsibilities in writing. Clear coordination helps avoid the common problem where everyone assumes someone else has handled the important part.

When Martyn's Law Comes Into Force

The Act received Royal Assent on 3 April 2025 and includes an implementation period of at least 24 months. The current expectation is that commencement will be in spring 2027, although businesses should check the latest official position before relying on a final date.

The lead in period is there for a reason. It gives businesses time to confirm whether they are in scope, identify the responsible person, review capacity figures, prepare staff procedures, consider training and gather the right documentation.

You can read more about timing and preparation in our article on when Martyn's Law comes into effect, which is useful if you are planning budget, training and board approvals before commencement.

What Counts As Martyn's Law Non Compliance?

Martyn's Law non compliance can take several forms, and not all of them look obvious from the outside. A business may fail because it has not notified the SIA, has no workable emergency procedures, has not trained staff or has not prepared the required enhanced duty documentation.

Examples include failing to put evacuation, invacuation, lockdown and communication procedures in place. Evacuation means moving people away from danger, invacuation means bringing people into a safer area, lockdown means restricting movement to reduce risk, and communication means telling staff and visitors what to do quickly and clearly.

Enhanced duty premises and qualifying events can also fall short by failing to assess public protection measures. These measures may relate to monitoring, movement of people, physical safety and security, and the protection of sensitive security information.

Other serious failures include ignoring a compliance notice, failing to respond to an information notice, providing false or misleading information, obstructing an authorised inspector or failing to comply with a restriction notice.

How The SIA Identifies Non Compliance

The Security Industry Authority is the regulator for Martyn's Law and will use a risk based approach. According to official SIA guidance on Martyn's Law, regulation may include desk based assessments, information requests and on site inspections.

Desk based assessments may involve reviewing notifications, compliance documents and information supplied by the responsible person. If something looks incomplete or inconsistent, the SIA may ask for more detail before deciding what to do next.

Inspectors may visit premises, observe activities, examine documents and equipment, take photographs or recordings, ask for explanations and require reasonable assistance. In most cases, an authorised inspector will usually provide at least 72 hours' written notice before an inspection.

There are exceptions. The SIA may seek a warrant where access is refused, urgent access is needed or giving notice would undermine the purpose of the inspection. Complaints, reported concerns or incidents may also draw attention to a venue, although not every complaint will automatically lead to an inspection.

Enforcement Action The SIA Can Take

The SIA can take enforcement action where it believes a responsible person has failed to meet Martyn's Law duties. The action can range from a notice requiring improvement to financial penalties, restrictions and, in serious cases, criminal prosecution.

A compliance notice can require the responsible person to fix a breach by a set deadline. It may also require evidence that the work has been completed, such as updated procedures, training records or a revised compliance document.

A restriction notice is more serious and applies to enhanced duty premises and qualifying events. It can restrict the use of premises or the continuation of an event where that is necessary to reduce the risk of physical harm.

In practice, a restriction notice could affect opening arrangements, reduce permitted attendance, change how areas are used or disrupt an event. It is not something any venue wants to explain to customers on a busy evening, so early preparation is far better than a rushed response.

A penalty notice can require payment of a financial penalty. Continuing daily penalties may also apply in certain circumstances, especially where a business fails to comply with a compliance notice or restriction notice.

Martyn's Law Fines

Martyn's Law fines can be significant, especially for enhanced duty premises and qualifying events. The maximum penalty for failing to attend an SIA interview is £5,000, while most standard duty contraventions can lead to a maximum penalty of £10,000.

For enhanced duty premises and qualifying events, the maximum penalty is much higher. The maximum is the greater of £18 million or 5 per cent of qualifying worldwide revenue, which is designed to make sure large organisations cannot treat compliance as a small business cost.

Daily penalties may also apply. These can be up to £500 per day for standard duty breaches and up to £50,000 per day for enhanced duty premises or qualifying events, depending on the type of continuing breach.

These are maximum figures, not automatic fines. The final outcome will depend on the facts, the seriousness of the failure, whether the responsible person cooperated and the enforcement approach set through regulations and SIA policy.

Criminal Offences And Personal Liability

Some breaches can move beyond civil penalties and become criminal matters. These include failing to comply with an enhanced duty compliance notice, failing to comply with a restriction notice, giving false or misleading information, failing to comply with an information notice and intentionally obstructing an authorised inspector.

There is also an offence of pretending to be an authorised inspector. It may sound unusual, but regulators need to protect businesses and the public from people falsely claiming official powers.

A business can be prosecuted where serious offending is identified and prosecution is proportionate and in the public interest. Depending on the offence and jurisdiction, court penalties may include unlimited fines, and some offences can carry imprisonment of up to two years on conviction on indictment.

Senior individuals are not automatically personally liable for an organisation's civil penalty. However, senior officers may be prosecuted if the organisation commits a criminal offence and it happened with their consent, connivance or because of their neglect.

Wider Business Consequences

The wider consequences of failing to comply with Martyn's Law can be just as damaging as the formal penalties. A business may suffer reputational damage, especially if an inspection follows a public concern or an incident where staff appeared unsure what to do.

Insurance can also become more complicated. Policies differ, so businesses should check security conditions, reasonable care clauses, notification requirements and cooperation duties with their broker or insurer rather than assuming cover is unaffected.

Licensing may also be relevant for pubs, clubs, entertainment venues, sports grounds and event spaces. Martyn's Law does not mean every breach automatically results in licence action, but local authorities and licensing teams may take a close interest where public safety concerns overlap.

Civil claims are another risk after an incident. The Act does not create a standalone compensation claim just because a business failed to comply, but existing negligence claims remain available, and a court may consider Martyn's Law duties when deciding whether reasonable steps were taken.

How To Avoid Martyn's Law Penalties

The best way to avoid Martyn's Law penalties is to start with a clear scope assessment. Identify the use of the premises, calculate the maximum attendance that may reasonably be expected, include staff and contractors, and record how you reached the figure.

If you are not sure which tier your venue falls into, it is sensible to ask that question early because capacity, public access and control of the premises all matter. A small difference in how a space is used can change what the responsible person needs to prepare.

Next, identify the responsible person and confirm any shared responsibilities in writing. If leases, licences, event agreements or service contracts are vague, tidy them up before the law is in force rather than during an SIA enquiry.

Standard duty premises should prepare clear public protection procedures, even where a formal enhanced duty compliance document is not legally required. Written procedures help staff understand what to do and give the business evidence that it has taken the matter seriously.

Enhanced duty premises and qualifying events should assess protective security measures, prepare documentation and plan how information will be securely stored. If a measure is not reasonably practicable, record why, what alternative steps will be used, and when the decision will be reviewed.

Practical systems may also support wider site security where they are proportionate, such as access control, monitored alarms or CCTV. For businesses considering broader protection, business security systems can form part of a joined up approach, although Martyn's Law does not require every venue to install the same equipment.

Staff training is essential because even the smartest plan is not useful if it stays in a folder nobody opens. Brief employees, contractors and volunteers on evacuation, invacuation, lockdown, communication, suspicious activity reporting and who has authority to make decisions during an incident.

SSAIB Insurance Approved Security Advice

SSAIB Insurance Approved security can support wider business protection when CCTV, intruder alarms, access control or monitored systems are part of a proportionate risk plan. Martyn's Law does not force every venue to install the same equipment, but insurers may still expect professionally designed and maintained security where the risk profile calls for it.

For qualifying alarm systems, using an SSAIB certified and Insurance Approved provider can help meet insurer expectations and support Police Response URN eligibility where the system and monitoring arrangements qualify. Intruder alarm systems should also be matched to the risk and installed in line with EN 50131 grades, usually Grade 2 or Grade 3 depending on the site, contents and insurer requirements.

The aim is not to add technology for the sake of it. Good security should support people, procedures and evidence, helping staff manage access, monitor key areas, respond to alerts and keep useful records if an incident or investigation occurs.

What To Do If The SIA Contacts You

If the SIA contacts your business, treat it as a formal regulatory matter rather than a casual request. Verify the inspector's identity, read the notice carefully, preserve relevant records and respond accurately within the required timeframe.

Do not alter, hide or destroy documents, even if something is incomplete or uncomfortable to look at. A half finished training record can be corrected, but obstructing an inspector or giving misleading information can turn a manageable issue into a far more serious one.

It is sensible to involve senior management, facilities, security, legal and insurance contacts early. A calm, organised response shows that the business understands its responsibilities and is taking reasonable steps to put things right.

Final Thoughts

If a business fails to comply with Martyn's Law, the consequences can range from corrective notices to major financial penalties, restrictions and prosecution. The exact outcome will depend on the tier, the breach, the risk created and how the responsible person responds.

The good news is that compliance is not about guessing the future or buying every security product available. It is about understanding whether the law applies, assigning responsibility, preparing workable procedures, training people properly and keeping evidence that decisions were sensible, proportionate and reviewed.

If you are unsure where to start, now is a good time to review your arrangements and speak to iSecurity Solutions about practical steps that fit your premises, people and budget.

Frequently Asked Questions

What Is The Maximum Martyn's Law Fine?

The maximum standard duty penalty for most contraventions is £10,000. For enhanced duty premises and qualifying events, the maximum is the greater of £18 million or 5 per cent of qualifying worldwide revenue.

Can The SIA Close A Business Under Martyn's Law?

The SIA can issue restriction notices for enhanced duty premises and qualifying events where restrictions are needed to reduce risk. This may affect use, capacity or event continuation, but it should not be described as an automatic permanent closure power.

Does Martyn's Law Require Every Business To Install CCTV?

No. Martyn's Law requires suitable and reasonably practicable procedures, and extra measures for enhanced duty premises, but it does not force every venue to install the same technology. Where CCTV, intruder alarms or monitored systems are used, SSAIB certified and Insurance Approved installation can support insurer expectations, EN 50131 compliance where relevant, and Police Response URN eligibility for qualifying alarm systems.

Can Directors Be Personally Liable For Martyn's Law Breaches?

A senior individual is not automatically personally liable for a civil penalty issued to an organisation. However, senior officers may be prosecuted if a criminal offence happened with their consent, connivance or because of their neglect.

Do Standard Duty Premises Need A Written Security Plan?

Standard duty premises are not required to prepare the same formal compliance document as enhanced duty premises. Even so, written procedures are strongly recommended because they help staff act quickly and help the business evidence compliance.