Martyn’s Law, the Terrorism (Protection of Premises) Act 2025, is now law across the UK, kicking off what is expected to be a two-year implementation period before the main provisions come into force.

Those in control of qualifying premises, including sports and entertainment venues, hotels, student accommodation and shopping centres, should be assessing their portfolios, reviewing the requirements and preparing now to ensure they have appropriate protection against terrorist attacks for staff and the public in place.

For many businesses this may be the first time they have been required to address the risk from terrorism. For others, it represents mandating requirements for premises to consider terrorist threats and to take forward proportionate mitigations. This blog highlights the different requirements and potential impact to help understand the risks and mitigations that may be required.

What is Martyn’s Law?

The UK’s National Risk Register highlights terrorist attacks as one of the top risks facing the country. Despite several inquiries and inquests reflecting the risk in findings, there was a lack of consistent security outcomes across UK public locations. The legislation aims to address this. It comes in the wake of the of the tragic 2017 Manchester Arena attack and is named after Martyn Hett, one of the victims. The legislation requires those responsible for certain premises and events to take appropriate action (so far as reasonably practicable) to reduce the risk of harm to staff and the public, or risk enforcement which includes criminal offences for serious non-compliance.

The regulations take a tiered approach around different uses of premises and the number of individuals reasonably expected to be present on the premises or at an event. Organisations need to understand if their premises or event qualifies and then consider what tier they fall within to inform duties and any required response, recognising that larger premises and events will be impacted more by any attack and are therefore expected to do more to reduce vulnerability to acts of terrorism.

Which premises and events are included?

Premises must be publicly accessible and those within scope are prescribed in the legislation, including sports grounds, entertainment venues, shopping centres and healthcare facilities. Where the public has access to premises or part of the premises, with an expected capacity of between 200 and 799 persons they fall within the Standard Tier; an expected capacity of 800 or more takes the premises into the Enhanced Tier. Different duties apply to the different tiers.

Large-scale events fall within the scope of the legislation under the Enhanced Tier when relevant premises are accessible to members of the public for the purposes of the event with requirements for permission for entry (such as ticketing and payment) and at least 800 persons are expected to be present at some point during the event.

Both tiers require those responsible to notify the regulator (the Security Industry Authority, SIA) that they are responsible for their premises or event.

Certain types of premises are excluded under the legislation, including premises occupied by parliaments (including devolved administrations).

What are the Standard Duty requirements?

The Standard Duty requires appropriate public protection measures, so far as reasonably practicable. That means procedures which should be followed by people working at the premises if an act of terrorism were to occur there or nearby and which may reduce the risk of physical harm to individuals. That could be locking down premises, evacuating or moving people to safe places. Many organisations in the standard tier will already have policies and mitigations in place under other regulatory requirements (health and safety and fire safety for example) These are meant to be low-cost activities and there is no requirement to have in place physical measures, in contrast to Enhanced Duty premises.

What are the Enhanced Duty requirements?

The Enhanced Duty requires a more proactive approach, considering counter-terrorism measures to reduce, so far as reasonably practicable, both the vulnerability of premises or an event to an act of terrorism occurring as well as the risk of physical harm being caused to individuals if an attack was to occur there or nearby. That could include CCTV monitoring of their premises or event, installing barriers, safety glass, and bag or vehicle checks. Any procedures must be documented and submitted to the SIA. For corporates or organisations, a senior individual must be designated with responsibility for ensuring compliance.

What is reasonably practicable?

The concept of reasonably practicable is familiar and used in other regulatory regimes, including health and safety. There is no one size fits all: an appropriate assessment needs to be conducted considering the circumstances and risks relating to specific premises or an event and the resources available to inform what is appropriate in terms of mitigating procedures and measures. For Enhanced Duty premises the assessment must be documented.

Who is the responsible person for qualifying premises or events?

The responsible person is the person who has control of the relevant premises in connection with their principal use or who has control of the premises at which an event is being held.

Who will enforce Martyn’s Law and potential penalties

The regulator is the SIA. The SIA needs new regulatory capability to enforce the legislation, which must be established. That is expected to take 24 months, hence the lead in time before the new provisions kick in. The SIA will be responsible for advising on and ensuring compliance. The SIA will be empowered to take enforcement action in cases of significant or persistent non-compliance, including compliance notices, monetary penalties (with potential daily penalties) and restriction notices, with the right of appeal. There are also criminal offences for failing to comply with an enforcement notice or providing false or misleading information. There is also the possibility of individual liability where an offence is committed by an organisation with the consent, connivance or is attributable to the neglect of a person with management or control functions within the organisation. Where that occurs, then that person in addition to the organisation may be guilty of an offence.

Statutory guidance requires to be issued by the SIA and that is awaited.

What action should you take now?

The regulations aim to strike a balance between public protection and avoiding an undue burden on premises and events. Relevant organisations should understand and prepare for the legislation coming fully into force by acting now.

If you think your organisation is within scope of Martyn’s Law, it is prudent to assess portfolios to determine qualifying premises, responsible persons and relevant duties (either standard or enhanced) that will apply. Once the extent of the scope is known it will be possible to determine a strategy regarding compliance, including carrying out appropriate risk assessments, appointing relevant individuals to be responsible for compliance, allocating resources for measures that may be required and considering any changes that may be needed to existing documentation, including leases, along with legal advice.

Some organisations may choose to exercise best practice and comply even where thresholds are not met. Others may opt to prioritise and budget for enhanced duty premises only. Existing risk assessments and security audits will need to be reviewed and revised once the statutory guidance is available from the SIA.

We recommend not waiting until the guidance comes into force. Start considering now and plan and prepare for the regulations. We are here to help and can answer your questions on the potential scope, qualifying premises, responsible persons and potential exposure for non-compliance to inform your risk mitigation strategy. Please get in touch with our health and safety team or your usual Burness Paull contact for more information.

Related News, Insights & Events