Martyn’s Law and Your Front Door: What Building Access Has to Do with the Terrorism (Protection of Premises) Act

Martyn’s Law doesn’t mention building access control by name, but the law’s whole premise is about reducing harm at the point where the public comes in — which makes your front door one of the first things worth looking at, not an afterthought once the paperwork’s done.

Illustrative diagram: Martyn's Law and building access, covering Standard Tier, Enhanced Tier, controlled entry and lockdown capability.

What Martyn’s Law actually requires

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent in April 2025. The government has said it intends an implementation period of at least 24 months before the duty becomes enforceable, so compliance is currently voluntary, with enforcement realistically expected from around spring 2027. It applies in two tiers based on the number of people reasonably expected on the premises at once: Standard Tier covers premises expecting 200 to 799 people and requires “reasonably practicable” public protection procedures; Enhanced Tier applies at 800 or more and adds a requirement to reduce the premises’ own vulnerability to an attack, documented and reported to the Security Industry Authority, who regulate compliance under the Act.

Where access control fits in

The law requires public protection procedures “reasonably expected to reduce the risk of physical harm” if an attack occurred. Evacuation, invacuation, lockdown and communication come up most often in guidance — invacuation meaning moving people to safety within the building rather than out of it — and we’ve covered the communication side in detail on our own Martyn’s Law Communication Readiness page. But knowing who’s actually in the building, controlling how people move between zones, and being able to lock a specific area down quickly are access control jobs as much as they’re communication ones. A door that only unlocks with a fob, and a system that can lock a zone from one place in an emergency, is a physical procedure in exactly the same sense that evacuation signage is.

What “reasonably practicable” means for a front door

The Act explicitly scales expectations to the premises’ size and resources — a 250-capacity venue isn’t expected to run the same measures as an 800-plus Enhanced Tier site. For most Standard Tier premises, that likely means sensible basics: controlled entry points rather than every door standing open to the public, a reasonable way of knowing roughly who’s inside at a given time, and a lockdown capability covering at least the main public areas. It doesn’t mean a fully biometric, airport-style access-controlled building for a 300-capacity venue.

What to do before enforcement starts

With implementation running to at least spring 2027, premises expecting 200 or more people have a genuine window to assess their current access arrangements against the duty, rather than scrambling once it’s actually enforceable. That means working out which tier realistically applies based on expected capacity, not maximum theoretical capacity; auditing existing entrances and access control for whether they’d actually support a lockdown or controlled evacuation if needed; and aligning that with your existing fire strategy — the subject of our guide to BS 7273-4 — rather than treating fire safety and security as two unrelated projects.

The bottom line: Martyn’s Law is a communication, procedure and physical access challenge together, not a separate access control standard on its own. If your premises expects 200 or more people, it’s worth treating entrances and access control as part of the same assessment as evacuation and lockdown procedures, with time before enforcement to fix what needs fixing rather than scrambling after the fact.

See our Building Access Systems page for how we scope door entry, access control and visitor management together, or Martyn’s Law Communication Readiness for the screens, speakers and network side of the same duty.

Questions worth asking

FAQ

Does Martyn’s Law require us to install specific access control equipment?

No — the Act doesn’t name specific technology or products, it requires “reasonably practicable” procedures proportionate to your premises. For many Standard Tier premises that’s about reviewing how entrances and existing systems would support a lockdown or controlled evacuation, not buying a prescribed access control system.

What’s the difference between Standard and Enhanced Tier?

Standard Tier applies to premises expecting between 200 and 799 people at a time and requires reasonably practicable public protection procedures. Enhanced Tier applies at 800 or more and adds a requirement to reduce the premises’ vulnerability to an attack, with documentation reported to the Security Industry Authority. Both are based on realistic expected capacity, not maximum theoretical capacity.

When does Martyn’s Law actually come into force?

The Act received Royal Assent in April 2025, and the government has said it intends an implementation period of at least 24 months before the duty becomes enforceable — meaning compliance is currently voluntary, with enforcement realistically expected from around spring 2027. Checking now gives you time to fix gaps before that point rather than after.

How does this relate to Efficient IS’s Martyn’s Law Communication Readiness work?

Communication readiness — whether your screens, speakers and network can actually deliver a lockdown or evacuation message — is one half of the picture. This covers the other half: whether your entrances and access control can physically support that same procedure. See our Martyn’s Law Communication Readiness page for the communication side specifically.

Working out what Martyn’s Law means for your premises?

Tell us your expected capacity and we’ll tell you honestly what tier applies and what’s worth doing now.

📞 0845 095 3600 · ✉ info@efficient-is.co.uk

Talk to our team

What Is Martyn’s Law? A Plain-English Introduction

Martyn’s Law Readiness · 4 min read

What is Martyn’s Law? The plain-English version.

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025 — new legislation that will require certain public premises and events to be better prepared for a terrorist attack. Here’s what it actually says, without the legal drafting.

Checklist of the four procedures Martyn's Law requires: evacuation, invacuation, lockdown and communication

Where the name comes from

The Act is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena bombing. His mother, Figen Murray OBE, spent more than five years campaigning for a law requiring venues to plan and train for a terrorist attack the way they already do for fire. That campaign became the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025.

It applies across the whole UK — England, Wales, Scotland and Northern Ireland.

What it actually requires

At its core, Martyn’s Law requires the person responsible for a qualifying premises or event to have working procedures for four things: evacuation (getting people out), invacuation (moving people to a safer part of the building rather than outside), lockdown (securing the premises), and communication (actually telling people what to do, and when).

Larger premises face additional requirements — physical and technical measures, a named senior individual responsible for compliance, and a formal compliance document held on file for the regulator. We cover exactly where that line sits in our follow-up post on who’s affected.

Who regulates it

The Security Industry Authority (SIA) — already the regulator for the private security industry — is the regulator for Martyn’s Law. It will have powers to issue compliance notices, restriction notices and financial penalties once the Act is in force.

It isn’t enforceable yet

This is worth being precise about: the Act received Royal Assent in April 2025, but the substantive duties are not yet enforceable. There’s a statutory implementation period of at least 24 months, statutory guidance was published in April 2026, and the government has said the requirements are expected to come into force in Spring 2027. We go through the exact timeline in our timeline post.

The government has also been explicit that no third party can sell you “compliance” — the duty sits with your premises’ responsible person, and stays there. What a specialist like us can genuinely help with is the technology side: making sure your screens, speakers and network can actually deliver the communication half of the duty.

The bottom line: Martyn’s Law requires evacuation, invacuation, lockdown and communication procedures for qualifying public premises and events. It received Royal Assent in April 2025 but isn’t enforceable yet — expected Spring 2027. Nobody can sell you full compliance, but the communication and alerting infrastructure is a genuine, well-scoped technology problem worth solving early.

Questions worth asking

FAQ

Is Martyn’s Law in force yet?

No. It received Royal Assent on 3 April 2025, but the substantive duties aren’t enforceable yet. The government expects the requirements to come into force in Spring 2027, following a statutory implementation period of at least 24 months.

Who enforces Martyn’s Law?

The Security Industry Authority (SIA) is the regulator, with powers to issue compliance notices, restriction notices and financial penalties once the Act is in force.

Does Martyn’s Law apply in Scotland?

Yes — the Act’s territorial extent covers England, Wales, Scotland and Northern Ireland.

How this differs from existing fire safety obligations

Martyn’s Law sits alongside existing fire safety and health and safety obligations rather than replacing them. A premises already compliant with fire safety legislation still needs to separately address the four duty areas Martyn’s Law introduces, since they cover a different category of threat and require different procedures, even though some planning and staff training can reasonably be combined across both.

Have a project in mind?

Tell us what you’re trying to fix and we’ll tell you honestly what’s realistic.

📞 0845 095 3600 · ✉ av@efficient-is.co.uk

Book a discovery call

Does Martyn’s Law Apply to You? The 200 and 800 Thresholds Explained

Martyn’s Law Readiness · 4 min read

Does Martyn’s Law apply to your premises? Here’s the actual test.

Martyn’s Law uses a single, fairly mechanical test: how many people might reasonably be expected to be in your building at the same time. Get that number right and you know exactly which duties apply.

Comparison of Martyn's Law Standard Tier (200+ capacity) and Enhanced Tier (800+ capacity) requirements

The two tiers

Standard Duty applies where 200 to 799 individuals may reasonably be expected to be present at the same time. It requires the four core procedures — evacuation, invacuation, lockdown and communication — but no specific physical equipment. It’s about having a workable plan and staff who know it, not about buying anything.

Enhanced Duty applies at 800 or more. It adds further public protection measures, requires a named senior individual accountable for compliance, and a formal compliance document provided to the SIA. Below 200, premises are outside the scope of the Act entirely.

How to count

The figure includes everyone who might reasonably be present at the same time — staff, contractors and volunteers, not just visitors or customers. A shop with a 750-person customer capacity and 60 staff on a busy shift is at 810 — Enhanced Duty, not Standard.

Assess against your realistic peak, not an average day. If your premises occasionally hosts a higher-attendance event — a school fair, a store’s Christmas trading period — that peak can bring you into scope even if a normal Tuesday wouldn’t.

The one significant exception

Education settings — schools, colleges and similar — stay in the Standard Duty tier regardless of how many people are on site, as long as they’re above the 200 threshold. A large secondary school doesn’t move into Enhanced Duty purely on numbers the way a shopping centre or arena would.

Who this actually covers in practice

In practice: shops, restaurants and bars above 200 capacity, schools and colleges, council and public buildings, leisure and cultural venues, healthcare sites, and places of worship large enough to meet the threshold (many won’t). If you’re the person who’d get asked “what happens if we have to lock this building down at 2pm on a Tuesday” and you don’t have a confident answer, it’s worth checking where you sit.

The bottom line: 200–799 people expected at once means Standard Duty (procedures only). 800+ means Enhanced Duty (procedures plus physical measures, a named senior individual and a compliance document). Count staff as well as visitors, assess against your peak, and remember education settings stay in Standard Duty regardless of size.

Questions worth asking

FAQ

What’s the capacity threshold for Martyn’s Law?

200 individuals, including staff, reasonably expected to be present at the same time. Below that, premises are outside the Act’s scope. 200–799 is Standard Duty; 800 or more is Enhanced Duty.

Do staff count towards the numbers?

Yes. The test counts everyone who might reasonably be present at once — staff, contractors and volunteers, not just customers or visitors.

Are schools always Enhanced Duty if they’re large?

No. Education settings remain in the Standard Duty tier regardless of capacity, provided they’re above the 200 threshold — they don’t move to Enhanced Duty on numbers alone the way other premises types do.

What happens if numbers sit close to a threshold

Premises with attendance figures close to 200 or 800 are worth reviewing more carefully than those clearly above or below either line. A small change, an extended opening hours trial, a seasonal event, an extra function room brought into regular use, can shift a premises from outside scope into Standard Duty, or from Standard into Enhanced Duty. Reassessing capacity whenever a premises’ use changes meaningfully, rather than treating the original assessment as fixed permanently, avoids being caught out by a duty that quietly started applying without anyone noticing.

Have a project in mind?

Tell us what you’re trying to fix and we’ll tell you honestly what’s realistic.

📞 0845 095 3600 · ✉ av@efficient-is.co.uk

Book a discovery call

When Does Martyn’s Law Come Into Force? The Spring 2027 Timeline

Martyn’s Law Readiness · 3 min read

When does Martyn’s Law actually come into force?

Martyn’s Law became law in April 2025, but “became law” and “enforceable” are different things. Here’s the actual timeline, as published by government.

Timeline showing Martyn's Law from Royal Assent in April 2025 to enforcement in Spring 2027

The key dates so far

3 April 2025 — the Terrorism (Protection of Premises) Act 2025 received Royal Assent. The government committed to an implementation period of at least 24 months from this date before the substantive duties become enforceable.

15 April 2026 — the Home Office published statutory guidance for the Act, alongside the Security Industry Authority’s draft guidance on how it intends to regulate. This guidance explains the requirements in detail, but — importantly — the requirements themselves are still not enforceable at this point.

Spring 2027 — the government’s stated expectation for when the requirements will actually come into force. This isn’t a fixed date yet; government has said it will confirm the exact commencement date separately.

There’s no duty to comply yet — but there’s a reason not to wait

While the Act isn’t enforceable, there’s genuinely no legal requirement to act right now. But two things are worth weighing up: first, the statutory guidance is already published, so the detail of what will be required is now known, not guesswork. Second, for anything involving physical infrastructure — screens, speakers, network changes — procurement and installation take time. Starting the assessment now, ahead of a Spring 2027 deadline, means the work isn’t rushed into the final few months alongside everyone else in scope.

What to actually do during this window

The honest starting point is working out whether you’re in scope at all, and if so, which tier — covered in our post on the 200/800 thresholds. From there, the four duty areas split roughly into two kinds of work: procedures and staff training (a policy and people problem), and the communication infrastructure that actually delivers evacuation, invacuation and lockdown messaging when it’s needed (a technology problem, and where we can genuinely help).

We built a free, 2-minute scorecard specifically for the second half — it checks whether your existing screens, speakers and network could deliver zone-by-zone emergency messaging today, or whether they’re currently only capable of a generic alarm. You can find it on our Martyn’s Law Communication Readiness page.

The bottom line: Royal Assent was April 2025. Statutory guidance was published April 2026. Commencement is expected Spring 2027, with an exact date still to be confirmed. There’s no legal duty to comply yet, but the guidance is published and procurement/installation takes time — starting the assessment now avoids a scramble later.

Questions worth asking

FAQ

When does Martyn’s Law come into force?

The government expects the requirements to come into force in Spring 2027, following a statutory implementation period of at least 24 months from Royal Assent (3 April 2025). The exact commencement date hasn’t been confirmed yet.

Is there a legal requirement to prepare now?

No — there’s no legal duty to comply until the Act formally commences. Statutory guidance is published, though, so premises can start preparing with a clear picture of what will be required.

What happens if we don’t comply once it’s in force?

Standard Duty breaches carry a maximum penalty of £10,000. Enhanced Duty breaches carry a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, enforced by the Security Industry Authority.

What premises can usefully do while waiting for the exact date

Waiting for a confirmed commencement date does not mean waiting to act. Reviewing existing evacuation, invacuation and lockdown procedures against the four duty areas now, and identifying any gaps in current communication infrastructure, means a premises is ready to formally comply as soon as the date is confirmed, rather than starting that review once a short countdown has already begun.

Have a project in mind?

Tell us what you’re trying to fix and we’ll tell you honestly what’s realistic.

📞 0845 095 3600 · ✉ av@efficient-is.co.uk

Book a discovery call

Find our work useful? Add us as a preferred source on Google.