What is Martyn's Law? A plain-English guide for UK venues

The Act places duties on the people responsible for qualifying premises and qualifying events. What those duties look like depends on how many people are reasonably expected to be present at the same time, including staff.^[2]

Premises where 200 to 799 individuals are reasonably expected fall into the standard tier. The duties here are deliberately low cost. The responsible person must notify the regulator and put in place public protection procedures, so far as reasonably practicable, covering four things: evacuation (getting people out), invacuation (moving people to safety inside the premises), lockdown (securing the premises against entry or exit), and communication (alerting people and giving instructions).^[2] There is no requirement to buy equipment, hire security staff or make physical changes to the building.^[3]

Premises where 800 or more individuals are reasonably expected fall into the enhanced tier. Enhanced duty premises must do everything in the standard tier, and in addition put in place public protection measures to reduce their vulnerability to an attack, document their procedures and measures, provide that document to the regulator, and designate a senior individual responsible for compliance where the responsible person is an organisation.^[2] You can read more in our guide to the enhanced tier requirements.

A premises qualifies if it is a building (or building and land together), it is used for one or more of the public-facing activities listed in Schedule 1 of the Act (for example hospitality, entertainment, retail, leisure, healthcare or education), it is reasonable to expect at least 200 individuals to be present at the same time at least occasionally, and it is not excluded under Schedule 2.^[1]

Some premises are treated differently. Places of worship, childcare and primary, secondary and further education premises stay in the standard tier even where 800 or more people are expected.^[2] Certain premises, such as Parliament and some transport infrastructure already covered by other security regimes, are excluded altogether.^[1]

Large events on otherwise out-of-scope land can also qualify. An event qualifies where 800 or more individuals, including staff, are expected at the same time at some point during the event and entry is controlled by tickets, payment, passes or membership checks.^[2]

Not sure where you fall? Our free eligibility checker walks you through the two questions that matter, and our guide to whether Martyn's Law applies to your venue covers the edge cases.

The Security Industry Authority (SIA) is the regulator for Martyn's Law.^[5] The Home Office has been clear that the SIA's first job is to support, advise and guide responsible persons, with enforcement reserved for serious or persistent non-compliance.^[3]

Where enforcement is needed, the SIA will be able to issue compliance notices, restriction notices and monetary penalties. Non-compliance penalties can reach £10,000 for standard duty premises and £18 million or 5% of worldwide revenue, whichever is greater, for enhanced duty premises and qualifying events.^[3] Our article on preparing for SIA enforcement covers this in detail.

The Act is law, but its duties are not yet in force. The Government has committed to an implementation period of at least 24 months from Royal Assent, which means the substantive requirements are expected to commence from 2027. No commencement date has been confirmed.^[3]

Preparation is well under way. The Home Office published statutory guidance under the Act in April 2026, and the SIA's regulatory function is being established.^[2] The guidance exists precisely so that venues can get ready before the legal duties begin.

There is no legal requirement to comply until the Act is in force, but the Home Office encourages those in scope to start preparing now.^[2] A sensible order of work:

• check_circleWork out whether you are in scope and which tier applies. Our free eligibility checker takes about a minute.
• check_circleEstablish who the responsible person is for your premises.
• check_circleAssess how many people, including staff, are reasonably expected to be present at the same time, and keep a record of how you worked it out.
• check_circleDraft your four public protection procedures. See our guide to writing Martyn's Law procedures.
• check_circleBrief the staff who would carry those procedures out.
• check_circleIf you expect to be enhanced tier, start thinking about monitoring, movement of people, physical security and information security, and how you will document it all.