Martyn's Law, and what it asks of the premises you manage

Martyn's Law is now on the statute book. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, and the government has confirmed an implementation period of at least twenty-four months before it takes effect, which puts the compliance point at around April 2027 (Home Office, 2025). The statutory guidance was published in April 2026, so the shape of the duty is now clear enough to plan against, well before it bites.

It is named for Martyn Hett, one of the twenty-two people killed in the Manchester Arena attack in 2017, and it exists to make publicly accessible premises better prepared to reduce harm in an attack. For anyone managing a building that the public can enter, it is a new obligation to fold into the record you already keep.

The two tiers, and who falls into them

The Act sorts qualifying premises into two tiers by the number of people who may be present at the same time. The standard tier covers premises where between 200 and 799 individuals may be present. The enhanced tier covers larger premises and events where 800 or more may be present (Home Office, 2025).

The count is about capacity, not footfall on an average day, and it includes staff as well as visitors. Offices, retail, hospitality, places of worship, visitor attractions, community and leisure premises can all qualify once they cross the 200 threshold. A building that never felt like a security concern may sit inside the standard tier simply because of how many people it can hold.

What each tier has to do

Standard tier duties are deliberately low cost. The responsible person notifies the regulator that the premises exist, and puts in place public protection procedures, the practical steps staff would follow in an attack. These cover evacuation, invacuation, moving people to safety inside, lockdown, and how a warning is communicated. No physical works are required at this tier, and no security plan has to be submitted.

The enhanced tier goes further. On top of the standard duties, those responsible have to put in place public protection measures to reduce the vulnerability of the premises, document both the procedures and the measures with an assessment of how they reduce risk, and name a senior individual accountable for compliance where the responsible party is an organisation rather than a single person.

The regulator is the Security Industry Authority, given a new function to advise, support and, where needed, enforce (Home Office, 2025). The emphasis at the outset is on guidance rather than penalties, but the duty is real and the SIA will have inspection and sanction powers behind it.

Where it meets the manager

Most of Martyn's Law is not new territory for a building manager. It is procedures, training and records, held against a specific premises. What is new is that counter-terrorism preparedness now sits alongside fire and health and safety as a documented duty, with a named regulator watching.

That makes it a good fit for the same discipline you apply everywhere else. The procedures belong with the building's other documents, so the current version is the one staff can find. The staff who need to know them are the ones you already track in training, so you can show who has been briefed and when. And for an enhanced tier site, the assessment of how each measure reduces risk sits naturally beside the building's safety case, one more strand of the same golden thread.

What to do now

You do not have to act today, but you do have time to get ahead. Work out the maximum capacity of each premises you manage and note which tier it falls into. Treat the two years to 2027 as the window to write the procedures, brief the people and file the evidence, rather than a deadline to meet in a rush. A premises that reaches the compliance date with its procedures written, its staff trained and its records in order is one that treats Martyn's Law as it was intended, as ordinary preparedness, kept up to date like everything else you look after.