Preparing for Martyn’s Law – what organisations should do now?

Managing Public Safety and Security at Premises and Events

Since March 2017, there have been 15 domestic terror attacks in the UK and security services and law enforcement have together disrupted 43 late-stage plots. The diverse and evolving nature of the current terrorist threat makes it difficult to predict the locations that will be targeted and it is important that duty holders are prepared and ready to respond in the event of an attack. The Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, has now received Royal Assent. The Act seeks to improve public safety and security by ensuring that qualifying premises and events assess terrorism threats and implement appropriate mitigation measures that are proportionate to the risk.

Property owners and managers across diverse sectors from leisure and entertainment, retail, education, sports grounds, and places of worship could be affected.

What is the purpose of Martyn’s Law?

The Act applies across England, Wales, Scotland and Northern Ireland. The purpose is to enhance national security and organisational preparedness by requiring those responsible for qualifying premises and events to consider how they would respond to a terrorist attack.

This includes being prepared to keep people safe in the event of an attack. Some larger premises and events will also be required to assess and, where appropriate, take steps to reduce vulnerability to terrorist attacks. The Act establishes a tiered approach, with requirements linked to the number of people that may be reasonably expected to be present at the same time at a premises or event.

When does Martyn’s Law come into force?

The UK Government has confirmed there will be an implementation period of at least 24 months before the Act comes into force. The intention of the implementation period is to give duty holders sufficient time to understand and prepare for their new obligations, and to allow for the setup of the new regulatory function for enforcement. The new regulator to support enforcement of the Act, and provide support, advice and guidance, will be the Security Industry Authority (SIA).

Which premises and events are in scope for Martyn’s Law?

The Act applies to “qualifying premises” which are accessible to the public and which are used wholly or mainly for activities listed in Schedule 1 of the Act, which includes retail, hospitality, entertainment, leisure, sports, libraries, museums and educational facilities. Qualifying premises are then categorised based on capacity.

“Standard duty premises” are those locations with a capacity of 200-799 people. “Enhanced tier premises” are those where 800 or more individuals may be present at one time. The Act also applies to “qualifying events”, which are held at premises that are not enhanced tier premises but at which 800 or more people may be present at some point during the event.

Qualifying Premises are those that meet the following criteria

• There is at least one building (or the premises are in a building);
• Premises are wholly or mainly used for one or more of the uses in Schedule 1 of the Act, for example:
• Leisure and entertainment
• food, drink, and retail
• museums and galleries
• visitor attractions
• sports grounds
• places of worship
• health care
• education
• It is reasonable to expect that at least 200 individuals may be present occasionally;
• The premises are not excluded under Schedule 2 of the Act, for example:
• Premises already subject to other protective frameworks, such as airports, national rail and underground stations, port facilities
• Parks, gardens, recreation grounds
• Legislatures and devolved administrations.

Qualifying Events are those that meet the following criteria

• The event is to be held at premises that are not already designated as “enhanced duty premises”;
• The premises are accessible to members of the public for the purpose of the event;
• It is reasonable to expect that there will be at least 800 individuals present at some point during the event;
• There are measures to check entry conditions, e.g. ticket checks or similar;
• The event is not excluded under Schedule 2 of the Act, for example:

- Events held at premises that are already excluded from the Act’s requirements

- Events at places of worship, childcare facilities and primary, secondary and further educational institutions.

Enhanced duty requirements will not apply to premises used for childcare or primary, secondary or further education. It was felt that existing safety and safeguarding policies and procedures for educational premises require a range of protective measures and procedures to be in place and therefore these premises will fall within the standard tier, regardless of the number of individuals expected to be present.

Higher education premises are considered to be more openly accessible to members of the public and are treated the same as the other premises in scope.

What are the requirements for standard duty premises under Martyn’s Law?

The responsible person for standard duty premises is required to notify the SIA that they are responsible for their premises and to have in place, so far as is reasonably practicable, appropriate public protection procedures to be followed by people working on the premises.

These are procedures are expected to reduce the risk of physical harm to individuals in the event of an act of terrorism occurring at the premises or in the immediate vicinity. The focus for standard duty premises is low-cost measures to reduce the risk and there is no requirement under the Act to implement physical protection measures.

What are the requirements for enhanced duty premises and qualifying events under Martyn’s Law?

The responsible person for enhanced duty premises and qualifying events is required, in addition to the requirements for standard duty premises, to:

• Have in place, so far as is reasonably practicable, appropriate measures that could be reasonably expected to reduce both i) the vulnerability of the premises or event to an act of terrorism occurring, and ii) the risk of physical harm being caused to individuals if an attack was to occur at the premises or in the immediate vicinity;
• Document the public protection procedures and measures in place, or proposed to be put in place, including an assessment of how the public protection procedures and measures reduce vulnerability and/or the risk of harm. This documentation must be provided to the SIA.

Who is the responsible person for qualifying premises and events?

The responsible person for qualifying premises is the person in control of the premises in connection with their relevant use as listed at Schedule 1 of the Act (e.g. use of the premises as a sports ground or a hotel). Certain premises may have more than one Schedule 1 use. Where this is the case, the responsible person is the person in control of the premises in connection with whichever Schedule 1 use is the principal use.

For qualifying events, the responsible person is the person who has control of the premises at which the event will be held, for the purposes of the event.

This could be an event company if, for example, they take control of an area of a park for the purpose of holding an event, or it could be the person in control of the premises, where they maintain control of the site during an event. In situations where contractors are used to perform certain functions during an event, such as security or ticketing, the person in control of the premises would still be the responsible person.

There may be situations in which more than one person, company or organisation is responsible for a qualifying premises or event. Where this is the case, the responsible persons must co-ordinate with each other in complying with the requirements of the Act, so far as is reasonably practicable.

What steps should be taken to calculate how many people are ‘reasonably expected’ to be at a premises or event?

The duties in relation to qualifying premises and events apply where it is reasonable to expect that the specified number of people may be present at the same time, “from time to time”.

The intention is to take into account variations that may occur in the number of individuals that may be present. In situations where the thresholds of 200 or 800 individuals are only met “from time to time”, this would still bring the premises into scope.

There are a range of measures that can be used when determining the number of individuals expected to be present, including safe occupancy calculations for the premises for fire safety purposes, historic data showing the actual number of individuals present at premises or events and, in situations where attendance is limited based on ticket sales or pre-registration, the maximum number of tickets issued or individuals registered can be used to make the assessment. People working in the premises or at the event should be included in the calculation.

Is there a requirement to provide training for those working at events and premises?

The initial draft of the Terrorism (Protection of Premises) Bill included a specific requirement for terrorism protection training to be provided for those working at standard tier premises.

Following pre-legislative scrutiny, it was felt that this introduced an unnecessary burden on organisations and businesses and that a generic approach to training may not be appropriate.

The specific training requirement has therefore been removed from the legislation, however, it is recognised that training is essential to meeting the requirements of the Act and ensuring that those with responsibilities for implementing public protection procedures fully understand their role and the procedures to be followed.

The government has confirmed that further guidance and support will be provided on developing appropriate terrorism protection training.

What are the penalties for not complying?

Penalties under the Act are determined according to the tier in which the premises or event falls. For standard duty premises, the maximum fine for non-compliance is £10,000. For enhanced duty premises or events, the maximum fine is £18 million or 5% of the organisation’s global revenue, whichever is higher and there are also daily penalties for ongoing contraventions of the Act. The SIA will also be able to issue compliance notices and, for enhanced duty premises or events, restriction notices.

Will further guidance be available on how to implement the requirements of Martyn’s Law?

The Government has confirmed that it intends to publish statutory guidance to assist businesses and organisations in scope in understanding the requirements of the legislation and to provide further detail as to how the SIA will discharge its duties.

The intention is for the guidance to be easy to follow and provide those in scope with sufficient information to understand and implement the requirements of the legislation, without the need to rely on third party support or services.

What should premises and events managers do to prepare for Martyn’s Law?

While there is an implementation period for the new legislation of at least two years, this is the first time that many organisations will have had to consider and implement specific measures to prepare for and protect against terrorist attacks.

We recommend duty holders start to prepare now for the new duties. This includes identifying premises that will be in scope, reviewing risk assessments and determining training needs.

A range of online resources are available via the ProtectUK website, including Martyn’s Law factsheets and guidance on good security practice. The Government guidance, once published, will provide further assistance and support for duty holders in understanding the requirements of the Act.

Zurich Resilience Solutions can support your organisation in preparing for Martyn’s Law, reviewing existing management systems and arrangements for the prevention and control of security incidents and providing advice on terrorism risk management resources and specialist support. Please contact us for more information.