Martyn's Law: what you need to know

Martyn’s Law: all you need to know

00:00:04 David Lee, Podcast host

Hello and welcome to Podcast by Brodies. I'm your host, David Lee, and today we're discussing a new piece of legislation which has become known as Martyn's Law. It's named after Martyn Hett, one of 22 victims of the Manchester Arena terror attack after a concert by Ariana Grande. More than a thousand people were also injured.

The attack led to widespread debate about improving protective security and preparedness for potential attacks. The legislation was originally called the Terrorism Protection of Premises Act 2025 but is now better known as Martyn's Law. It's due to come into force across the UK from April 2027.

And I'm joined today to discuss a range of issues around Martyn's Law by two Brodies’ experts. Partner and criminal solicitor advocate Clare Bone and senior associate Amy Anderson, who are both specialists in regulatory defence.

Welcome to you both. So, first of all, let's recap on the circumstances leading to the legislation.

Claire, coming to you first, what issues does the legislation aim to address that were highlighted specifically by the Manchester Arena attack?

00:01:26 Clare Bone, Partner

David, I'm sure every one of our listeners will remember the horror of that attack. It led to a public inquiry which was held in 2020, and the inquiry's findings revealed a number of shortcomings in how public venues prepare for and respond to the threat of terrorism. So, the legislation aims to address several of those key issues that were highlighted.

And if we touch on the key ones that I see for now, one of the key lessons was that responsibility for counterterrorism preparedness was not always clearly defined.

Now within Martyn's Law, we see for the first time the creation of the role of a named responsible person who has a legal duty to plan and prepare for terrorist threats. So, this will provide clear accountability for protecting members of the public and ensuring that venues are prepared for terrorist incidents.

Another issue that the inquiry identified was that risk assessments were inconsistent and often insufficient right across the board. Also, they were very frequently not adequately communicated to staff.

Now there are requirements to risk assess that risk of terror. Staff training was also an issue at Manchester Arena. The inquiry identified that staff had varying levels of awareness about how first of all to identify suspicious behaviour and secondly how to respond to a terrorist incident.

Now it's important to stress that Martyn's Law doesn't impose a statutory requirement for staff to undertake a particular training course that's not that prescriptive.

However, the responsible person must ensure that any individuals who have a responsibility for implementing public protection procedures are appropriately instructed and where necessary they have training so that they can properly carry out those procedures in the event of a terrorist attack, basically so that they know what they are to do.

Another key issue worth mentioning as well is the inquiry's findings on compliance with the existing licensing regime for security personnel under the Security Industry Authority, that is the SIA, who is the regulator for the private security industry. The inquiry identified weaknesses in overall security operation, stewarding levels were inadequate and existing licensing conditions and security arrangements were not effectively managed.

Also, compliance with existing requirements was not sufficiently scrutinised. So, it's hoped that the legislation will address all of these issues and more.

00:04:10 David Lee, Podcast host

Great stuff, thanks Claire. That's a great overview and we'll come back to a lot of those issues in more detail throughout the podcast.

Amy, coming to you, just explain a little bit about the background again. Why did this legislation become known as Martyn's Law?

00:04:24 Amy Anderson, Senior associate

Well, as you mentioned, David, it's named after Martyn Hett, who was one of the individuals who died in the Manchester Arena attack. Following the attack, Martyn's mum, Fegan Murray, campaigned to bring in a new law that required basic security to ensure the safety of fans at concerts and other big events. And it was this campaigning that led to the new Act being passed by Parliament, hence it being known as Martyn's Law.

00:04:53 David Lee, Podcast host

Okay, thank you. Claire's given us that overview of what the new legislation aims to address. Can you sort of summarise how it's building on what legislation we've already got in this area?

00:05:07 Amy Anderson, Senior associate

Sure. Well, safety regulation in the UK is nothing new. The UK has one of the strictest health and safety legislative frameworks in the world. So, we have the Health and Safety at Work Act 1974, the cornerstone of health and safety regulation at work in the UK. And that contains the overarching duty on all employers to ensure, so far as is reasonably practicable, the health and safety of their employees and those affected by the organisation's activities, including members of the public.

And flowing from that Act, there's a whole host of health and safety regulations that impose duties that are specific to certain work activities or specific sectors. So, for instance, construction works, offshore works, working at height, working with hazardous substances. And within that context, we see various duties on organisations to ensure people's safety.

So more generally, we see the likes of the duty to risk assess and to implement control measures, the duty to provide staff with adequate training and instruction. And more specifically, we see the duty to have in place emergency plans to protect staff from serious and imminent danger. And all of this is regulated and enforced with the possibility of penalties and criminal prosecution where those duties are breached.

So, as I say, safety regulation is nothing new, but this is the first time we've seen these duties in the context of terror and security. So, what Martyn's Law does is it builds upon the existing framework, it extends the duties that are already incumbent upon organisations to enhance public safety in the UK in the face of the growing threat of terrorism.

00:07:12 David Lee, Podcast host

Okay, thanks very much Amy. Let's now look at the nuts and bolts, Claire. Can you tell us what specific premises Martyn's Law will apply to?

00:07:25 Clare Bone, Partner

The types of premises the law will apply to will be publicly accessible venues that provide in the main leisure or service-based activities, where it's reasonable to expect that 200 or more people may be present in that venue at the same time. Martyn's Law divides those venues into two distinct categories.

First of all, we have the standard tier premises, where you can reasonably expect between 200 to 799 individuals in the premises at one time.

And then we have the second category, the enhanced tier premises, where you can reasonably expect 800 or more individuals on the premises at that same time.

Now the list provided within the Act is really wide and varied and covers a large number of sectors. Qualifying premises will cover, for instance, retail, so that's your shops and your shopping centres, hospitality, food and drink venues, bars and nightclubs. We also see within the list hotels, holiday parks, libraries, visitor attractions, as well as places of worship, healthcare and education. And on the education piece, that's right through from early learning to higher and further education.

It's worth noting though that we're not just looking at bricks and mortar. The Act also covers qualifying events. So those are events where it's reasonable to expect that at some point during the event, 800 or more people will be present and there are measures in place to restrict access to the event so that it's not a freely available event. So, we're talking here about ticketed events, festivals, outdoor concerts, sporting events, they are all the kind of events that you would see falling in scope.

00:09:16 David Lee, Podcast host

Okay, so that's quite widely drawn and we'll come back to some of those specific premises later, but you talked there about, you gave us some numbers, Claire, about the size of premises. How is the legislation specifically tailored to those premises of different sizes?

00:09:32 Clare Bone, Partner

So, there is a difference in requirements depending on whether you are a standard or enhanced duty, premise or event. What's important to note is that with both, you must have in place public protection procedures for responding to a terrorist attack. So that's going to include procedures that cover, for instance, evacuation, invacuation, lockdown and communication with staff, visitors and emergency services.

But enhanced premises go one step beyond. They require additional protective security measures. That includes conducting a terrorism risk assessment specific to the venue and implementing reasonably practicable public protection measures to respond to the risk of terror.

00:10:20 David Lee, Podcast host

Okay, thanks very much. And coming back to you, Amy, we'll just go into some of the more slightly complex areas here.

Claire mentioned retail and obviously if we've got a big retail premises, a big retail centre or retail complex, lots of different premises within there, potentially cinemas, restaurants, large shops, whatever. How should those premises kind of collaborate if they're within the same larger building, do they need to work together on the plan to comply with the legislation or work individually?

00:10:54 Amy Anderson, Senior associate

Yeah, absolutely. Cooperation and coordination among those responsible for and in control of qualifying premises are key tenets of the Act.

So, the success of the Act will very much depend on the practical implementation of the required measures and much of that will come down to how those responsible for qualifying premises work together.

So, the Act imposes a specific legal duty on those responsible for qualifying premises that form part of wider qualifying premises to coordinate with each other so far as is reasonably practicable.

So, if we look at the example you've just given, say a restaurant or a cinema that sits within a larger shopping centre, those responsible for the restaurant or for the cinema will be under a specific legal duty to coordinate with those responsible for the shopping centre in terms of compliance with the Act.

Now, how that works in practice will depend on the particular circumstances of each case, but for the most part, it will likely require coordination on things like risk assessments, staff training and emergency drills.

00:12:11 David Lee, Podcast host

Okay, thanks very much. Still with you Amy, earlier on Claire mentioned educational establishments, schools, colleges and universities are covered by this legislation. What do they need to be aware of specifically?

00:12:24 Amy Anderson, Senior associate

Well, first of all, if we look at why they are covered by the legislation, we know that over the last few years there have been increasing security threats to educational establishments. We know that knife crime is the single most acute security threat within the school environment. So, in the year from January 24, there were 150 stabbings in schools.

But there are also other threats, things like bomb hoaxes and threats from protests that are facing the education sector. But despite that increased risk profile, research has shown that 26% of primary schools and 19% of secondary schools had no lockdown procedures in place. So that's part of the reason why they're covered by the Act.

But to move on to what educational establishments should be aware of, Claire has set out the usual rules that will apply under the Act, but there are special rules that will apply to educational settings. So, schools, nurseries, colleges and government funded independent training providers will always be classed as standard tier where they have a capacity of over 200.

Even if they have a capacity of 800 or more, which would ordinarily put them in the enhanced tier. And where events are held in educational settings, they won't be classed as qualifying events, again, even if their capacity is 800 or more.

Now that exemption won't apply to higher education settings, so universities, or to privately owned independent training providers. So those establishments will have to comply with the enhanced tier requirements if they fall within that category.

But for the others that I've just mentioned, they will never fall into that enhanced tier category. They will always be standard tier.

00:14:33 David Lee, Podcast host

Okay, excellent. Thanks for explaining that.

And Claire, we've talked there about educational establishments. Hospitals and churches are included too.

How does a piece of legislation like this try to get the balance between making sure that everybody is ready, the preparedness is there, without imposing unnecessarily onerous admin and regulatory burdens on the public sector and religious groups, for example?

00:15:03 Clare Bone, Partner

So, there has been some criticism levelled at the scope on exactly those points that it's creating administrative and regulatory burden for public sector religious groups who maybe don't have the funds in place to carry out what is required.

But we need to balance that against the fact that these types of venues share the characteristics with other types of premises that can make them vulnerable. They are open to the public, they attract large groups of people, and they may have very limited security controls.

If we look at places of worship as an example, we have seen attacks in the UK in recent times. We can cast our minds back to the Finsbury Park mosque attack in 2017 which left one dead and 11 seriously injured. And more recently the Manchester synagogue attack in 2025 which killed two and injured several more, which suggests that a balance does have to be struck. It is prudent to bring such premises into scope.

00:16:07 David Lee, Podcast host

And we've talked about education, we've talked about hospitals, we've talked about religious buildings.

Do any premises at all, Claire, fall outside the scope of the legislation?

00:16:19 Clare Bone, Partner

Yes, there are premises that do specifically fall outside scope. Open air spaces are excluded and we're talking here about parks and gardens, municipal areas where the public are free to wander around. They have to be free open access spaces.

If, however, a park is then to hold a ticketed event, such as a concert, that would have it falling back into scope, so it's worth remembering that.

There are also premises that will be excluded by virtue of the fact that they are already subject to an existing legislative requirement to mitigate threat. And here we're talking about the likes of airports, ports, railway stations where existing aviation or transport security legislation is already existing. The same can also be said for some secure government sites and buildings such as the Houses of Parliament, Scottish Parliament and GCHQ. They too are excluded for the same reasons.

So, there are premises that do fall outside of scope and that's why it's so important to consider the premise you have and identify whether it is within or out with scope.

00:17:31 David Lee, Podcast host

Thanks very much Claire.

And within a specific premises or organisation, Amy, who takes responsibility for compliance with the new law? Does there have to be a named individual?

00:17:43 Amy Anderson, Senior associate

So, for each qualifying premises or qualifying event, there will be a responsible person who will have to ensure that those premises or that event complies with the requirements of the Act. The responsible person is the party who has control over the premises and that could be either an individual person or a company. Now for some premises it might be obvious who the responsible person is. So, for example for a hospital it may be the NHS trust.

For others it may be less obvious. So, for commercial premises it could be the landlord, it could be the tenant or the operator, the facilities manager or the managing agent.

So, what we would say to all those parties who have any degree of control over qualifying premises is that they should be looking at their contracts to ensure that the division of responsibility in terms of the requirements of the Act are reflected accurately within those contracts. And they should be ensuring that everyone involved in the management of premises knows where that responsibility lies.

And finally, I should say that for enhanced duty premises or for a qualifying event, where the responsible person is not an individual, so where it's a corporate entity, they will need to designate a senior individual who will be responsible for ensuring compliance with the Act. And whilst that individual will be able to delegate certain actions or tasks to others, they will maintain overall responsibility for compliance on behalf of the organisation.

00:19:33 David Lee, Podcast host

Great stuff. Thanks very much, Amy.

And going back to something you touched on at the very start, Claire, the overall regulation of the new legislation and ensuring compliance, who is responsible for that and what guidance has already been published to help premises to comply?

00:19:51 Clare Bone, Partner

So, the Security Industry Authority or SIA, as some of our listeners might hear them referred to, already regulate the private security industry and it has been decided that they will be the regulator for Martyn's Law.

There has actually been quite good guidance issued from two different sources to assist would-be duty holders.

The first main practical compliance guidance comes from the Home Office statutory guidance, which was published in April this year.

It is really good at explaining who is in scope, the role of the responsible person, standard and enhanced duty requirements, talks about procedures such as evacuation, evacuation, lockdown, and also focuses on enhanced duty terrorism risk assessments and protective measures.

So, a lot of the subjects that we've been talking about on this podcast are covered in that guidance. The Security Industry Authority has also issued guidance, although that's currently in draft form, that will set out how it intends to regulate and enforce compliance rather than telling premises exactly what security measures require to be implemented.

That guidance was put out for public consultation in April and the consultation closed on the 12th of June. So, we do wait to see what form the final guidance will take, but we don't imagine that it will depart terribly much from the draft guidance that is currently available.

So, reading both the Home Office guidance and the regulator's guidance is going to give premises a really good start in understanding what is required of them and what the consequences might be where they fail to comply.

00:21:39 David Lee, Podcast host

And straight on from there, Amy, what happens if organisations and premises don't comply? What are the sanctions?

00:21:45 Amy Anderson, Senior associate

Well, as Claire has mentioned, the guidance from the regulator, the Security Industry Authority, is still in draft form. So, we don't know exactly what options will be open to them. But certainly, the draft guidance sets out three civil enforcement tools that we may ultimately see being made available to the regulator.

So, the first is a compliance notice and that will require organisations to take specific steps by a particular deadline.

The second is a restriction notice and that will impose restrictions to reduce the risk of harm, although that will only be available for enhanced tier premises and qualifying events.

And the third type of enforcement notice will be a penalty notice and that will impose a financial penalty on the duty holder.

And in terms of those financial penalties, the maximum penalties currently set out in the draft guidance for standard tier premises, it's up to 10,000 pounds with daily penalties of up to 500 pounds for continued non-compliance.

And for enhanced tier premises and qualifying events, the maximum penalty will be the higher of up to 18 million pounds or 5% of worldwide revenue with daily penalties of up to 50,000 pounds for continued non-compliance. So, some really serious penalties that can be imposed.

And in addition to that, The Act creates new criminal offences for which organisations can be prosecuted. So, the first is the continued failure to comply with a compliance notice or a restriction notice. The second is knowingly or recklessly providing false or misleading information to the SIA, their regulator. And the third is the failure to comply with a request for information or interview from the regulator. And it's not just the organisations who will be open to criminal prosecution. You'll recall we spoke earlier about the designated senior individual responsible for compliance for enhanced tier premises and events. They too could be personally prosecuted where an organisation commits one of these offences and it's found to have been committed with their consent, connivance or due to their neglect.

And in terms of the penalties that can be imposed upon conviction, the maximum penalties for these offences will be up to two years imprisonment and or an unlimited fine.

00:24:43 David Lee, Podcast host

OK, thanks very much. So yes, some quite potentially onerous sanctions there.

In the light of everything we've talked about so far, Amy, is the timetable of legislation being introduced in April 2027 realistic, do you think?

00:25:00 Amy Anderson, Senior associate

I'd say so, yes. The Home Office guidance was published in April of this year, which was a full year ahead of the proposed commencement date.

So, there's a good amount of time for organisations to understand what's expected of them and to implement any necessary changes.

And what we're hearing from a lot of organisations, particularly the bigger ones, is that they're already considering what they have to do and putting plans in place to make those changes.

In terms of the enforcement regime, the consultation on the regulator's guidance has now closed, as Claire mentioned. So, I don't think it will be too long before we see the finalised guidance being published.

So, I think, yes, overall, we're in a good position in terms of being ready for implementation in April next year.

00:25:57 David Lee, Podcast host

Okay, thanks very much. And Claire, just taking a step back from the detail, when legislation follows harrowing events like this, it is sometimes criticised for being a bit rushed, a bit incomplete. Amy's maybe covered off some of this in a previous answer, but do you think Martyn's Law has avoided being rushed and incomplete? And do you think it is, broadly speaking, a good piece of legislation?

00:26:23 Clare Bone, Partner

So, taking your last question first, I don't think we'll know until the legislation comes into force whether it actually achieves its aims fully and it's not going to be overly burdensome.

But what I would observe just now is that I don't believe this has been a rushed and incomplete piece of legislation. Rather than being a knee jerk reaction, the legislation has followed a lengthy process after the Manchester Arena inquiry. It had a large public consultation at pre-drafting stage. There was significant parliamentary scrutiny and there were several amendments made to the draft legislation before it became an act of Parliament in 2025. So, it has been several years in the making. Obviously, the proof will be in the pudding.

00:27:09 David Lee, Podcast host

Anything to add to that, Amy?

00:27:10 Amy Anderson, Senior associate

Yes, I would agree with that consultation process that Claire has mentioned there, that has continued since the law was passed by Parliament.

So, we've spoken about how the regulator has consulted on their draft guidance. And in addition to that, they've also hosted a series of webinars for duty holders and for stakeholders where they have discussed the new requirements and what will be expected of them. I have to say that level of engagement and consultation that we've seen throughout this process is quite unusual and I think that is in recognition of the significantly enhanced regulatory burden that there is going to be on organisations.

00:27:54 David Lee, Podcast host

Okay, thank you very much. So just moving towards kind of wrapping up now.

Claire, a final piece of advice to those who are within the scope of the new legislation. What do they need to do as of now?

00:28:11 Clare Bone, Partner

Martyn's Law requires proactivity to security and instant response. Now, as Amy has said, it's not expected to come into force until at least April 2027, but organisations really need to prepare now to ensure that they will be compliant by the time it does come into force. I would suggest that those responsible for premises and events within the scope of Martyn's Law should consult the statutory guidance that we've referred to.

First of all, to consider whether standard or enhanced duties will apply and where there are enhanced duty premises or events where the responsible person is a corporate entity. Identify the relevant senior person who will be responsible for compliance and ensure that person is competent to carry out the role.

They should be looking at carrying out risk assessments to identify any additional measures that will be necessary to comply and consider how and when those measures will be implemented.

It's also worth stressing too, as Amy mentioned earlier, that people should review any relevant contracts to ensure that provision is made for the division of responsibility between and measures for coordinating with all of those who might have control over premises and or neighbouring responsible persons. That is key.

00:29:33 David Lee, Podcast host

Okay, thank you. And finally, Claire, if there are premises and organisations out there who are still a little bit uncertain as to their responsibilities under the new law, what's your simple piece of advice?

00:29:47 Clare Bone, Partner

Really simple piece of advice, take advice, don't delay. Our specialist team are here to advise on premises, regulatory responsibilities, whatever stage of the journey they might be on, whether that's advanced in preparation and they want advice on the measures they have taken so far, or if they're at the very start of the journey not really knowing what they need to do, either way we can assist in achieving compliance with this new regime.

00:30:16 David Lee, Podcast host

Thank you very much, Claire, and also to Amy for your time and your excellent and really clear insights today.

You've been listening to podcasts by Brodies, where some of the country's leading lawyers and special guests share their expertise and insights about major issues and developments in the legal sector and how they might affect businesses, organisations, and individuals in the UK and beyond.

And if you'd like to hear more, you can subscribe to Podcast by Brodies on all your favourite podcast platforms.

And for more information and insights, please visit brodies.com.