Martyn's Law: prepare now for implementation in Spring 2027

The Terrorism (Protection of Premises) Act 2025 (often referred to as "Martyn's Law") will require those responsible for certain premises and events to take steps to prepare for potential terrorist attacks and help keep people safe if an attack were to take place. In addition, certain larger premises and events are required to consider their vulnerability to acts of terrorism, and, where appropriate, take reasonably practicable steps to reduce those vulnerabilities.

        
            In brief
        
many customer-facing premises and events will be in scope of Martyn's Law;

the key thresholds are 200+ members of the public for the standard tier and 800+ for the enhanced tier;

responsibility follows control, not preference; and

implementation planning should start now, to be ready for Spring 2027.

Now Reading

Background

The Terrorism (Protection of Premises) Act 2025 was passed in response to the 2017 Manchester Arena terrorist attack. It is known as "Martyn's Law" in honour of Martyn Hett who died in that incident. The legislation is intended to ensure that those responsible for certain types of premises take various steps with a view to protecting individuals in the event of similar terrorist activity. They must also register with the Security Industry Authority (so that it can, for example, audit compliance and contact premises directly with any updated practical guidance).

The Home Office has published statutory guidance on how those responsible for affected premises and/or events should comply. The Security Industry Authority (the "SIA") will be responsible for fulfilling the regulatory functions set out in the Act and will publish their own guidance shortly.

The legislation is expected to be implemented in Spring 2027. The new regime will affect a wide range of players in the real estate sector, including landlords, tenants, managing agents and outsourced service providers (including facility managers, event managers and security contractors). Each should consider:

whether they are in scope and, if so, under which tier;
who the responsible person is and what that means for them;
what they need to do to comply; and
who will bear the cost of any additional compliance measures.

        
            In scope?
        
Is it a qualifying type of premises?

Can 200+ people reasonably be expected at one time?

If yes, is it standard tier (200–799) or enhanced tier (800+)?

If it is an event, will 800+ attendees be expected, is it open to the public, and is entry controlled?

Which premises are in-scope?

The Act will apply to premises (a) that are used for one or more specified purposes and (b) where it is reasonable to expect at least 200 individuals to be present at one time. The following types of premises are likely to be in scope:

retail premises
restaurants and bars
theatres and cinemas
leisure centres and other entertainment or recreation facilities
sports grounds
libraries, museums and galleries
conference centres, exhibition halls and similar venues
visitor attractions
hotels
holiday parks
places of worship
hospitals and other health care facilities
transport facilities such as bus or railway stations (unless already subject to security regimes, see section 4 below)
schools, further education colleges, universities and other educational or childcare facilities
premises used by public authorities to provide facilities or services to visiting members of the public

The Home Office's guidance includes the following flowchart:

Picture1 (3)

Which events are in scope?

A qualifying event is one that:

is open to the public;
is expected to draw at least 800 attendees at one time;
has measures in place to check that entry conditions are met (for example, ticket checks); and
is held at premises not already subject to the enhanced duty.

The threshold for qualifying events (800+) is higher than for standard tier premises (200+). A premises operator subject to the enhanced duty will not separately need to assess individual events held there as the enhanced duty already covers the premises.

The Home Office's guidance includes the following flowchart:

Picture2 (1)

Are there exclusions?

Yes. Exclusions include parks, gardens and recreation grounds, and various transport facilities which are already subject to separate security regimes (such as certain airports, ports or railway stations). For the full list of exclusions, see Schedule 2 of the Act.

The exclusions from the events category are fairly limited, but events held at premises used primarily as places of worship and for primary, secondary or further education will normally be excluded. There is no exclusion for events held in parks or open spaces.

What are the standard and enhanced duties?

Premises where it would be reasonable to expect that at least 800 people might be present at one time will be subject to an enhanced duty. This will involve the responsible person taking additional measures relating to monitoring, movement of people, physical safety and security, and security of information, in order to reduce both the vulnerability of the premises to acts of terrorism and the risk of physical harm to individuals from such attacks. For more information, see our previous briefing.

For standard tier premises, the obligations are principally procedural: they involve ensuring that staff are trained and that appropriate public protection procedures (evacuation, invacuation, lockdown and communication) are in place. There is no statutory requirement for standard tier premises to make physical alterations or purchase specific equipment, although it may be reasonably practicable to do so in certain circumstances.

Standard tier vs enhanced tier and qualifying events: key differences

	Standard tier	Enhanced tier and qualifying events
Threshold	200 - 799 individuals expected at one time	800+ individuals expected at one time
Public protection procedures	Must ensure appropriate public protection procedures (evacuation, invacuation, lockdown, communication) are in place, so far as reasonably practicable	Same as standard tier but: · appropriate to the scale and nature of the premises or qualifying event; · aligned with the public protection measures in place; and · kept under review.
Staff training	Staff with responsibility for carrying out procedures should be adequately informed of the relevant procedures and, where appropriate, receive training, learning or instruction on how to implement them.	Same as standard tier
Notification to SIA	Those responsible for qualifying premises or qualifying events must notify the SIA when they become responsible and when they cease to be responsible.	Same as standard tier
Public protection measures	Not required	Must also ensure appropriate public protection measures (monitoring, movement, physical safety and security, security of information) are in place, so far as reasonably practicable, and kept under review.
Physical alterations	No statutory requirement	May be required as part of public protection measures, so far as reasonably practicable
Documentation	No statutory requirement, but recommended	Must document compliance and submit to the SIA
Senior individual	Not required	Must designate a senior individual where the responsible person is a company or organisation
Maximum financial penalty	£10,000	£18 million or 5% of qualifying worldwide revenue (whichever is higher)

Who will be responsible?

The responsible person is defined by the Act, not a matter of contractual choice, and will be the person who has control of the premises in relation to their specified use or for the purposes of a qualifying event. The responsible person cannot delegate their legal responsibility to a contracted service provider, although they may delegate tasks.

In practice, the responsible person will often be the tenant or operator in occupation. For example, the statutory guidance confirms that where a company leases a building for use as a shop, the responsible person is the retail tenant, not the landlord.

Shopping centres and premises within premises:

Tenants: The legislation recognises that qualifying premises can exist within other qualifying premises. For example, where a department store within a shopping centre meets the thresholds in its own right, both the shopping centre operator and the department store tenant will be responsible persons for their respective premises and must co-ordinate with each other, so far as is reasonably practicable, to ensure that their procedures and measures do not conflict. This might include deconflicting evacuation plans and complementing each other's lockdown and communication plans.

Smaller stores within the shopping centre that do not meet the 200-person threshold are not qualifying premises and have no direct statutory obligations, but if the shopping centre falls within the enhanced tier, the retail tenant may still be required to co-operate with the shopping centre's responsible person by, for example, participating in evacuation procedures. Landlords should consider whether their existing leases provide sufficient mechanisms to achieve this. Tenants should consider what obligations they may be asked to take on.

Landlords: While landlords who have leased out their premises will not usually be the responsible person, where the responsible person needs the landlord's permission, support or other co-operative steps to comply (for instance, by granting consent to structural alterations), the landlord must co-operate so far as is reasonably practicable. Landlords should review their leases now to understand what consent mechanisms exist and whether they are adequate.

Outsourced service providers: Even where an outsourced facilities or event management provider is not the responsible person, it is often likely to be regarded as having at least some degree of control over the premises. In that case, it will be required to co-operate with the responsible person, so far as reasonably practicable.

Where the responsible person for enhanced tier premises or a qualifying event is a company or organisation rather than an individual, a senior individual must be designated with responsibility for ensuring compliance with the Act.

Who will pay for any additional measures?

Who pays will depend on the relevant contract. Compliance costs arising from changes in law are often addressed by change-control provisions. Parties to existing leases, management agreements and outsourcing contracts should review the following provisions now:

change in law / change control;
variation mechanisms;
service charge recovery;
service level specifications;
landlord consent and co-operation obligations; and
indemnities and liability caps.

Statutory guidance and the SIA's regulatory approach

The Home Office published its statutory guidance under section 27 of the Act in April 2026, updated in August 2026. This guidance explains what responsible persons must do to comply, covering the scope of the legislation, who is responsible, the requirements for public protection procedures (standard tier) and public protection measures (enhanced tier), and the role of the SIA as regulator.

The SIA consulted on its own draft regulatory guidance under section 12 of the Act between April and June 2026. The draft guidance indicated that the SIA will take a supportive, proportionate and risk-based approach, covering guidance and tailored advice; inspections and compliance document assessment; and enforcement, including financial penalties. Their final guidance is awaited. The SIA has also confirmed that it will publish further information on its notification system — including how and when responsible persons should notify — closer to commencement.

Enforcement

The financial and criminal consequences of non-compliance are significant, particularly for enhanced tier premises. Responsible persons and senior individuals should be aware of the following:

Sanctions for breach

The SIA has powers to issue compliance notices, restriction notices and financial penalties. Maximum penalties for enhanced tier premises can be up to £18 million or 5% of qualifying worldwide revenue (whichever is higher). For standard tier premises, the maximum non-compliance penalty is £10,000. The Act also creates criminal offences - including for failing to comply with a compliance or restriction notice in relation to enhanced tier premises, and for providing false or misleading information to the SIA - carrying potential imprisonment of up to two years and unlimited fines.

If a company or other organisation has committed a criminal offence by failing to comply with a compliance, restriction or information notice, senior personnel (including the senior individual) involved in the management or control of the organisation could also be prosecuted for the offence. An offence could have been committed if it can be proved that the offence was committed with their consent or connivance, or because of their neglect. Where an organisation has committed an offence of providing false or misleading information to the SIA, obstructing an authorised inspector, or pretending to be an authorised inspector, such individuals could also be prosecuted for the offence if it can be proved it was committed with their consent or connivance.

What should you be doing now?

There is no legal requirement to comply until the Act comes into force. However, the guidance has already been published to enable responsible persons to prepare well in advance. Parties should therefore take steps now to ensure they are ready for implementation.

        
            How to prepare
        
NowAssess scope: Determine whether your premises or events are in scope and, if so, under which tier.

Identify the responsible person: Establish who has control of the premises for their qualifying use and consider whether this requires any changes to existing arrangements.

Review existing contracts: Check leases, management agreements and outsourcing contracts to understand who is currently responsible for what and who will bear the cost of compliance. Consider whether change-in-law, change control, consent, co-operation, variation or service charge provisions address the position.
Next 3-6 monthsStart planning compliance: Use the statutory guidance to begin developing public protection procedures and, for enhanced tier premises, the additional public protection measures.

Consider alterations: for enhanced tier premises, begin assessing whether any physical alterations may be required and whether landlord consent will be needed.

Designate a senior individual (enhanced tier companies and organisations only).
Spring 2027Monitor the SIA's final guidance: Review the SIA's final section 12 guidance when published, particularly regarding enforcement and financial penalties, as this may affect how compliance responsibilities and associated risks are allocated in contracts.

Notify the SIA: The SIA will publish further details on its online notification system closer to commencement.