Where the name comes from

The Act is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena bombing. His mother, Figen Murray OBE, spent more than five years campaigning for a law requiring venues to plan and train for a terrorist attack the way they already do for fire. That campaign became the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025.

It applies across the whole UK — England, Wales, Scotland and Northern Ireland.

What it actually requires

At its core, Martyn’s Law requires the person responsible for a qualifying premises or event to have working procedures for four things: evacuation (getting people out), invacuation (moving people to a safer part of the building rather than outside), lockdown (securing the premises), and communication (actually telling people what to do, and when).

Larger premises face additional requirements — physical and technical measures, a named senior individual responsible for compliance, and a formal compliance document held on file for the regulator. We cover exactly where that line sits in our follow-up post on who’s affected.

Who regulates it

The Security Industry Authority (SIA) — already the regulator for the private security industry — is the regulator for Martyn’s Law. It will have powers to issue compliance notices, restriction notices and financial penalties once the Act is in force.

It isn’t enforceable yet

This is worth being precise about: the Act received Royal Assent in April 2025, but the substantive duties are not yet enforceable. There’s a statutory implementation period of at least 24 months, statutory guidance was published in April 2026, and the government has said the requirements are expected to come into force in Spring 2027. We go through the exact timeline in our timeline post.

The government has also been explicit that no third party can sell you “compliance” — the duty sits with your premises’ responsible person, and stays there. What a specialist like us can genuinely help with is the technology side: making sure your screens, speakers and network can actually deliver the communication half of the duty.

The two tiers

Standard Duty applies where 200 to 799 individuals may reasonably be expected to be present at the same time. It requires the four core procedures — evacuation, invacuation, lockdown and communication — but no specific physical equipment. It’s about having a workable plan and staff who know it, not about buying anything.

Enhanced Duty applies at 800 or more. It adds further public protection measures, requires a named senior individual accountable for compliance, and a formal compliance document provided to the SIA. Below 200, premises are outside the scope of the Act entirely.

How to count

The figure includes everyone who might reasonably be present at the same time — staff, contractors and volunteers, not just visitors or customers. A shop with a 750-person customer capacity and 60 staff on a busy shift is at 810 — Enhanced Duty, not Standard.

Assess against your realistic peak, not an average day. If your premises occasionally hosts a higher-attendance event — a school fair, a store’s Christmas trading period — that peak can bring you into scope even if a normal Tuesday wouldn’t.

The one significant exception

Education settings — schools, colleges and similar — stay in the Standard Duty tier regardless of how many people are on site, as long as they’re above the 200 threshold. A large secondary school doesn’t move into Enhanced Duty purely on numbers the way a shopping centre or arena would.

Who this actually covers in practice

In practice: shops, restaurants and bars above 200 capacity, schools and colleges, council and public buildings, leisure and cultural venues, healthcare sites, and places of worship large enough to meet the threshold (many won’t). If you’re the person who’d get asked “what happens if we have to lock this building down at 2pm on a Tuesday” and you don’t have a confident answer, it’s worth checking where you sit.

The key dates so far

3 April 2025 — the Terrorism (Protection of Premises) Act 2025 received Royal Assent. The government committed to an implementation period of at least 24 months from this date before the substantive duties become enforceable.

15 April 2026 — the Home Office published statutory guidance for the Act, alongside the Security Industry Authority’s draft guidance on how it intends to regulate. This guidance explains the requirements in detail, but — importantly — the requirements themselves are still not enforceable at this point.

Spring 2027 — the government’s stated expectation for when the requirements will actually come into force. This isn’t a fixed date yet; government has said it will confirm the exact commencement date separately.

There’s no duty to comply yet — but there’s a reason not to wait

While the Act isn’t enforceable, there’s genuinely no legal requirement to act right now. But two things are worth weighing up: first, the statutory guidance is already published, so the detail of what will be required is now known, not guesswork. Second, for anything involving physical infrastructure — screens, speakers, network changes — procurement and installation take time. Starting the assessment now, ahead of a Spring 2027 deadline, means the work isn’t rushed into the final few months alongside everyone else in scope.

What to actually do during this window

The honest starting point is working out whether you’re in scope at all, and if so, which tier — covered in our post on the 200/800 thresholds. From there, the four duty areas split roughly into two kinds of work: procedures and staff training (a policy and people problem), and the communication infrastructure that actually delivers evacuation, invacuation and lockdown messaging when it’s needed (a technology problem, and where we can genuinely help).

We built a free, 2-minute scorecard specifically for the second half — it checks whether your existing screens, speakers and network could deliver zone-by-zone emergency messaging today, or whether they’re currently only capable of a generic alarm. You can find it on our Martyn’s Law Communication Readiness page.