Moving closer to the implementation of Martyn’s Law

15 April 2026 was an important day for Martyn’s Law.

The Home Office published statutory guidance to assist those responsible for premises falling within the scope of Martyn’s Law in understanding and complying with their new legal obligations.

On the same day, the Security Industry Authority (“SIA”) – the UK-wide regulator which will be responsible for enforcing Martyn’s Law – commenced a public consultation on draft statutory guidance on how it intends to operate in practice when the new law takes effect.

The publication of these two documents marks a major milestone in moving towards the implementation of Martyn’s Law, due to come into force from around April 2027.

Here, we take a look at these two significant steps in a process aimed at transforming security in public facing premises and events and consider what businesses can do now to prepare for Martyn’s Law coming into force.

What is Martyn’s Law?

We have previously blogged about Martyn’s Law here:

Martyn’s Law – formally the Terrorism (Protection of Premises) Act 2025 - is named in memory of Martyn Hett who was killed in the Manchester Arena attack. It is designed to improve protective security and organisational preparedness by requiring those responsible for certain publicly accessible premises and events to consider how they would respond to a terrorist attack, and, for larger sites, to consider steps to reduce vulnerabilities.

Martyn’s Law applies to “qualifying premises” and “qualifying events” in the UK.

Qualifying premises are those used for a specified use and are divided into:

(a) standard duty premises where one can reasonably expect that 200-799 individuals may be on the premises at the same time; and

(b) enhanced duty premises where one can reasonably expect that 800+ individuals may be on the premises at the same time.

The specified uses are wide-ranging but include:

Shops and shopping centres
Food and drink venues
Nightclubs
Entertainment, leisure or recreation venues
Events venues, exhibition halls, conference centres
Hotels, hostels, holiday parks.
Sports grounds
Libraries, museums and galleries
Visitor attractions
Places of worship
Hospitals
Childcare (such as early learning, nursery, and day care), primary and secondary education, further education and higher education.

Qualifying events are those where (a) it is reasonable to expect that at some point during the event 800+ individuals may be present; and (b) there are measures in place to restrict access to the event, e.g. ticketing.

What obligations are imposed by Martyn’s Law?

Martyn’s Law is based on the assumption that a terrorist attack may occur anywhere. As a result, all qualifying premises and events must comply with Martyn’s Law, irrespective of whether they consider a terrorist attack to be probable or possible.

A ‘Responsible Person’ must ensure that a qualifying premises or qualifying event complies with Martyn’s Law. They are the party (either an individual person or organisation) who has control of the premises. For enhanced duty premises or a qualifying event, where the Responsible Person is not an individual, there will be a need to designate a senior individual to be responsible for compliance.

For all qualifying premises and events, the Responsible Person must have in place, so far as is reasonably practicable, appropriate public protection procedures for: (i) evacuation; (ii) invacuation; (iii) lockdown; and (iv) communicating with individuals on the premises during a terror attack or when one is about to occur.

In addition, those responsible for enhanced duty premises and qualifying events must assess, implement and keep under review public protection measures to reduce, so far as is reasonably practicable, the vulnerability of the premises or event to acts of terrorism.

What is the role of the Home Office’s statutory guidance?

The Home Office’s guidance fleshes out the requirements of Martyn’s Law, and what people and organisations affected by Martyn’s Law must do to comply. It details:

the definitions of qualifying premises and events;
when premises fall within the standard and enhanced tiers;
how to select or identify the Responsible Person;
regulatory responsibilities; and
consequences for non-compliance.

Three non-statutory documents accompany the guidance:

Supplementary Document A details methods for calculating the number of individuals who can be reasonably expected to be present at the same time, either at an event or from time to time at the premises;
Supplementary Document B details the type of premises and events which fall within the scope of Martyn’s Law; and
Supplementary Document C details existing training and awareness products that could be useful to the Responsible Person in implementing their statutory obligations under Martyn’s Law.

Key themes arising from the guidance are that:

Measures should be appropriate, proportionate and specific to the premises;
Co-operation among those responsible for managing qualifying premises/events and neighbouring premises/events is vital;
Staff training on the procedures and measures will be fundamental to their success.

Non-compliance

While the statutory guidance published by the SIA remains in draft form, it provides the clearest indication to date as to how the SIA proposes to operate in practice - including how it intends to monitor compliance and, where necessary, escalate matters to civil and, in some cases, criminal enforcement.

As it stands, the guidance provides that the SIA will have three civil enforcement tools:

Compliance notices: requiring specified steps to be taken by a stated deadline;
Restriction notices: available for enhanced tier premises and qualifying events only, and imposing restrictions to reduce the risk of harm; and
Penalty notices: imposing financial penalties.

The maximum civil penalties, as set out in the draft guidance, are:

up to £10,000 for standard tier premises, with daily penalties of up to £500 for continued non-compliance; and
up to £18 million or 5% of worldwide revenue (whichever is higher) for enhanced tier premises and qualifying events, with daily penalties of up to £50,000 for continued non-compliance.

New criminal offences may include:

Continued failure to comply with a compliance notice or restriction notice;
Knowingly or recklessly providing false or misleading information;
Failure to comply with information notices (requiring the provision of information by a particular date) or interview notices (requiring an individual’s attendance at interview to answer questions).

Where an organisation commits an offence, those in positions of responsibility – including the Responsible Person or the designated senior individual responsible for compliance - may face personal prosecution where the offence has been committed with their consent or connivance or has resulted from their neglect.

The maximum criminal penalties are up to two years’ imprisonment and/or an unlimited fine.

What is the SIA consulting on?

Through the consultation, the SIA is seeking views on a number of aspects of its proposed regulatory approach, including:

the use of a risk‑based and intelligence‑led approach to regulation;

how notifications and compliance documentation should be received and used;

the balance between informal engagement and the use of formal information‑gathering powers;
how compliance decisions will be made in practice; and
the proposed approach to civil enforcement, criminal investigation and the publication of enforcement decisions.

The consultation also expressly invites feedback on the clarity and drafting of the guidance itself, giving those likely to be affected by Martyn’s Law an opportunity to help shape how the regime will operate in practice.

Those responsible for public‑facing venues and events across the UK - particularly those in control of premises or events with a capacity of 200 or more people - should consider engaging with the consultation before it closes on 12 June 2026. Further details on how to do so are available on the UK Government consultation page: Martyn's Law: Draft Section 12 statutory guidance.

What should organisations do now?

Martyn’s Law requires organisations to take a proactive approach to security and incident response. Whilst Martyn’s Law is not expected to come into force until at least April 2027, organisations should prepare now. Those responsible for premises and events within the scope of Martyn’s Law should consider and reflect on the statutory guidance in order to:

consider whether standard or enhanced duties will apply to their premises;
for enhanced duty premises or events where the Responsible Person is a corporate entity: identify the relevant senior person to be responsible for compliance and ensure that person is competent to carry out the role;
carry out a risk assessment and identify any additional measures that will be necessary to comply with Martyn’s Law;
consider how and when these additional measures will be implemented; and
review any relevant contracts – both existing and standard template documentation – to ensure provision is made for the division of responsibility between, and measures for co-ordinating with, all of those with control over the premises and/or neighbouring Responsible Persons.

What next?

Over the coming months, Brodies will be running a series of webinars for those who will be impacted by Martyn’s Law. Keep an eye on our website and social media pages for updates on the webinars or sign up to our mailing list here.