Martyn’s Law: What UK Businesses and Duty Holders Need to Do Now
The introduction of Martyn’s Law, formally known as the Terrorism (Protection of Premises) Act 2025, marks a significant shift in how organisations across the UK approach public safety and security. Designed to improve preparedness for terrorist incidents, the legislation places legal responsibilities on those responsible for publicly accessible premises and events to consider the threat of terrorism and implement proportionate protective measures.
For businesses and duty holders, Martyn’s Law is not simply another compliance requirement. It is a framework intended to help organisations protect people, reduce vulnerabilities and improve their ability to respond effectively should the worst happen. Understanding the origins of the legislation, its tiered approach and the practical steps required for compliance is essential for organisations that may fall within its scope.
The Origins of Martyn’s Law
Martyn’s Law is named after Martyn Hett, one of the 22 victims of the Manchester Arena terrorist attack in May 2017. Following the tragedy, Martyn’s mother, Figen Murray OBE, launched a campaign calling for greater consistency in security preparedness across publicly accessible venues.
The campaign highlighted concerns that many organisations lacked clear plans, training and procedures to respond to a terrorist incident. Evidence presented during the Manchester Arena Inquiry and other reviews reinforced the need for a more structured approach to protecting members of the public.
After years of consultation, stakeholder engagement and legislative development, the Terrorism (Protection of Premises) Act received Royal Assent in April 2025. The legislation seeks to ensure that organisations take reasonable and proportionate steps to prepare for potential attacks and reduce the risk of harm.
Why Martyn’s Law Matters
The threat from terrorism remains a persistent concern in the UK. While attacks are relatively rare, their impact can be devastating, affecting not only victims and families but also businesses, communities and public confidence.
Martyn’s Law is built on a simple principle: organisations should not wait until an incident occurs before considering how they would respond. Instead, they should understand their risks, establish practical procedures and ensure staff know what to do during an emergency.
The legislation aims to create a consistent baseline of preparedness across sectors, helping organisations move from awareness to action.
Understanding the Tiered Approach
One of the key features of Martyn’s Law is its proportionate, tiered structure. The legislation recognises that a small community venue should not face the same obligations as a major stadium or entertainment arena.
Standard Tier
The Standard Tier applies to qualifying premises where it is reasonable to expect between 200 and 799 people to be present at the same time.
Duty holders within this category are required to:
- Notify the regulator of their premises.
- Establish and maintain public protection procedures.
- Ensure staff understand the actions required during a terrorist incident.
- Review procedures periodically to ensure they remain effective.
The focus at this level is on preparedness rather than physical security measures. Organisations are expected to have clear plans for responding to an incident and minimising harm.
Enhanced Tier
The Enhanced Tier applies to premises where 800 or more people can reasonably be expected to be present simultaneously.
In addition to the Standard Tier requirements, organisations must:
- Assess vulnerabilities to terrorist threats.
- Implement reasonably practicable security measures.
- Maintain documented evidence of compliance.
- Designate senior-level accountability for compliance.
- Cooperate and coordinate with other responsible parties where necessary.
Enhanced Tier organisations are expected to take a more comprehensive approach to security management, reflecting the greater potential impact of an incident at larger venues.
Qualifying Events
The legislation also applies to certain qualifying events attended by 800 or more people. Event organisers may have duties similar to those in the Enhanced Tier, depending on the nature of the event and the arrangements in place.
What Businesses Must Do
Although the specific requirements vary according to tier, there are several common themes that all duty holders should address.
1. Identify Responsibility
Organisations must determine who is legally responsible for compliance. This may be an individual, company, venue operator or event organiser, depending on who has control over the premises or event.
Clear accountability is essential. While tasks may be delegated, legal responsibility remains with the designated duty holder.
2. Assess the Risk
Businesses should evaluate how terrorism could affect their premises, operations and visitors. This involves understanding:
- The nature of the location.
- Visitor numbers and patterns.
- Access and egress arrangements.
- Existing security controls.
- Potential vulnerabilities.
Risk assessments should be proportionate to the size and complexity of the organisation.
3. Develop Emergency Procedures
At the heart of Martyn’s Law is the requirement for practical response procedures.
These should cover:
- Evacuation – moving people away from danger.
- Invacuation – bringing people into a safer area within the premises.
- Lockdown – securing all or part of a building.
- Communication – providing clear instructions to staff, visitors and emergency services.
Procedures should be realistic, documented and regularly reviewed.
4. Train Employees
Plans are only effective if people understand them.
Staff should receive appropriate training covering:
- Threat awareness.
- Emergency procedures.
- Individual responsibilities.
- Communication protocols.
- Incident response actions.
Training should be refreshed periodically and supported by exercises or drills where appropriate.
5. Strengthen Security Measures
For larger premises and events, organisations may need to consider additional protective measures such as:
- Access control arrangements.
- Monitoring and surveillance.
- Visitor management processes.
- Security policies and procedures.
- Protection of sensitive information.
The legislation emphasises a proportionate approach, meaning measures should be reasonable and practical for the organisation concerned.
6. Maintain Evidence of Compliance
Enhanced Tier organisations will need to demonstrate how they are meeting their obligations. Maintaining records of risk assessments, training, procedures and security measures will be crucial in evidencing compliance.
Why Organisations Should Act Now
Although implementation periods have been built into the legislation, organisations should not wait until enforcement begins to start preparing. The regulator will start inspections in the Spring of 2027 so the need to act is essential.
Early action provides several advantages:
- More time to assess compliance requirements.
- Better integration with existing health and safety systems.
- Reduced implementation costs.
- Improved staff confidence and competence.
- Stronger organisational resilience.
Businesses that begin planning now will be far better positioned to meet their obligations and protect the people who rely on them.
How Cardinus Can Help
Martyn’s Law introduces new responsibilities for many organisations, but compliance does not have to be overwhelming. The key is adopting a structured, proportionate approach that aligns legal requirements with practical operational needs.
Cardinus works with organisations across the UK to help them understand their obligations, assess vulnerabilities, develop robust procedures and deliver effective training. Whether you are determining whether your premises fall within scope, conducting a terrorism preparedness assessment or building a comprehensive compliance programme, expert guidance can make the process more efficient and effective.
If you would like to understand how Martyn’s Law could affect your organisation, contact Cardinus today. Our specialists can help you assess your readiness, strengthen your resilience and ensure you are prepared to meet the requirements of this important new legislation