On 22 May 2017, a suicide bomber detonated a device in the foyer of the Manchester Arena as thousands of people left an Ariana Grande concert. Twenty-two people were killed. One of them was Martyn Hett. In the years since, his mother, Figen Murray, has turned an unimaginable loss into one of the most determined safety campaigns this country has seen. The result is the Terrorism (Protection of Premises) Act 2025, known to almost everyone as Martyn’s Law.
The Act received Royal Assent on 3 April 2025. For the first time, the law places a clear, statutory duty on those responsible for qualifying premises and events to consider the risk of a terrorist attack and to take proportionate steps to keep people safer. It is a significant shift. Counter-terrorism protective security has, until now, been a matter of guidance and good intentions. From the point the Act comes into force, it becomes a legal obligation.
At Redline Assured Security, we have spent more than two decades preparing people to meet demanding security requirements, from aviation regulation to major events. Martyn’s Law is new, but the underlying discipline is not. This guide explains what the law actually requires, who it applies to, when it lands, and what sensible preparation looks like now.
The Thinking Behind the Law
Martyn’s Law exists to close a gap that the Manchester Arena Inquiry exposed in stark terms. Public venues and events are, by their nature, places where large numbers of people gather in predictable patterns. That openness is part of what makes them valuable to communities and part of what makes them attractive to those who would do harm. For too long, the level of preparedness across the sector was inconsistent. Some operators had thought carefully about how they would respond to an attack. Many had not.
The Act does not promise to prevent every attack. No law can. What it does is raise the floor. It requires those in scope to think ahead, to plan, and to make sure the people working in a venue know what to do in the moments that matter most. The premise is simple: preparedness saves lives, and preparedness should not be optional.
Who the Law Applies To
The starting point for Martyn’s Law is capacity. The Act applies to qualifying premises and events where a certain number of individuals may reasonably be expected to be present at the same time. Crucially, that figure includes staff, not just members of the public.
The Act creates two tiers, and the tier a premises falls into determines what is required of it.
Standard-tier premises are those where between 200 and 799 individuals may reasonably be expected to be present. This captures a very broad range of locations: village halls, places of worship, smaller bars and restaurants, community centres, visitor attractions, shops and offices that meet the threshold. The duties here are deliberately light-touch and focus on planning and procedures rather than physical investment.
Enhanced-tier premises and events are those where 800 or more individuals may reasonably be expected to be present. Larger venues, stadiums, concert halls, major retail sites and significant events sit here. The expectations are correspondingly higher, because the potential consequences of an attack are greater and the resources available to manage them are usually greater too.
It is worth stressing that the capacity figure is about what could reasonably be expected, not the maximum a fire certificate allows or the number who happen to attend on a quiet day. Working out which tier you fall into, or whether you are in scope at all, is one of the first and most important judgements an organisation will need to make.
What Standard-Tier Premises Must Do
For standard-tier premises, the emphasis is on procedures rather than hardware. The Act requires those responsible to put in place public protection procedures: the things staff would do to reduce the risk of physical harm if an attack were to happen at or near the premises.
In plain terms, that means having a considered answer to a small number of critical questions. How would people be evacuated from the premises? How would people be moved to safety inside the building if leaving is more dangerous than staying, often described as invacuation? How would a lockdown be achieved to keep an attacker out or away from people? And how would information be communicated quickly to staff and the public during an incident?
What the standard tier does not require is the documentation of those procedures or the installation of physical security measures. This is a deliberate decision to keep the burden proportionate for smaller organisations. The expectation is that procedures can be put in place at little or no cost, drawing on existing staff and existing layouts. The point is not paperwork. The point is that the people on site have thought it through and know what to do.
What Enhanced-Tier Premises and Events Must Do
Enhanced-tier duty-holders must do everything expected at the standard tier, and then go considerably further.
Alongside public protection procedures, they must put in place public protection measures. These are the more substantive steps that reduce both the vulnerability of the premises to an attack and the harm an attack could cause. The Act groups them around monitoring, the movement of people into and out of and within the premises, physical safety and security, and the security of information that could be useful to an attacker.
Enhanced-tier organisations must also document their procedures and measures and provide that documentation to the regulator, and they must designate a senior individual with responsibility for ensuring the duties are met. This brings counter-terrorism preparedness into the same accountable, evidenced framework that mature organisations already apply to fire safety, health and safety, and other statutory obligations.
For many enhanced-tier operators, the challenge will not be starting from nothing. It will be drawing together security measures that already exist, identifying the gaps, and demonstrating that the whole adds up to a coherent and proportionate response.
The Regulator and How Enforcement Will Work
Martyn’s Law will be overseen by the Security Industry Authority, the SIA. This is a notable expansion of the SIA’s remit, which has historically centred on the licensing of the private security industry. The regulator’s role under the Act is to support those in scope to understand and meet their obligations, and to take enforcement action where there is serious or persistent failure to do so.
The approach signalled so far leans towards advice and engagement rather than immediate sanction, particularly in the early period. That said, the Act does provide for enforcement powers and penalties, and enhanced-tier breaches carry the more significant consequences. The sensible reading is that the regulator wants compliance, not punishment, but that those who ignore the law entirely should not expect to do so indefinitely.
When Martyn’s Law Comes Into Force
This is the question we are asked most often, and the answer matters for how you plan. Royal Assent in April 2025 made Martyn’s Law an Act of Parliament, but it did not switch the duties on. The Government committed to an implementation period of at least 24 months before the requirements come into force, to give those in scope, and the regulator, time to prepare.
The working expectation is that the duties will commence in spring 2027, subject to formal confirmation. That timeline can feel comfortably distant. It is not. For any organisation that needs to assess its premises, decide on procedures, brief and train staff, and, at the enhanced tier, document and potentially invest in measures, the preparation window is now. The organisations that treat 2026 as preparation time will find spring 2027 straightforward. Those that wait will be doing in weeks what should have been done over many months.
Turning the Law Into Practical Readiness
The instinct on reading new legislation is to reach for a document template. Resist it. Martyn’s Law is not, at heart, a paperwork exercise. It is about whether the people in your venue would know what to do, and would do the right thing, in the worst few minutes imaginable.
That is why preparation should start with an honest assessment of your premises and the risks specific to it, move through clear and rehearsed procedures, and rest on staff who have been properly trained rather than simply handed a leaflet. Physical measures, where they are needed, follow from that understanding rather than preceding it. Good security has always worked this way: people, process and technology in balance, with people first.
Redline Assured Security has built its reputation on exactly that approach. As TrustFlight’s security capability, we are security specialists with hands-on expertise in protective security, behavioural awareness, threat detection and search, and training delivered to CAA-recognised standards. Martyn’s Law poses a serious responsibility for the people who would have to respond in an incident, and preparing those people well is exactly the kind of work we do.
Trust in your security is not built by reacting to a deadline. It is built by preparing the people who deliver it before it arrives. If you would like to talk through how training and staff preparedness can support your readiness for Martyn’s Law, please get in touch with our team.
For organisations that want to build this capability in their people, Redline’s Level 3 Award in Counter-Terrorism, Protective Security and Preparedness provides accredited training aligned directly to these duties.
Frequently Asked Questions
What is Martyn’s Law in simple terms? It is the common name for the Terrorism (Protection of Premises) Act 2025, a UK law that requires those responsible for certain premises and events to plan and prepare for the possibility of a terrorist attack, so that people are kept safer if one occurs.
Who does Martyn’s Law apply to? Qualifying premises and events where 200 or more individuals, including staff, may reasonably be expected to be present at the same time. Premises expecting 200 to 799 fall into the standard tier, and those expecting 800 or more fall into the enhanced tier.
When does Martyn’s Law come into force? The Act received Royal Assent on 3 April 2025, followed by an implementation period of at least 24 months. The duties are expected to commence in spring 2027, subject to confirmation, which makes 2026 the time to prepare.
What is the difference between the standard and enhanced tiers? Standard-tier premises must put in place public protection procedures such as evacuation, invacuation, lockdown and communication, with no requirement to document them or install physical measures. Enhanced-tier premises must also implement public protection measures, document their approach, provide it to the regulator, and appoint a responsible senior individual.
Who enforces Martyn’s Law? The Security Industry Authority (SIA) is the regulator responsible for supporting compliance and taking enforcement action where necessary.
What should organisations do now? Confirm whether you are in scope and which tier applies, assess the risks specific to your premises, put in place clear procedures, and make sure your staff are trained to act on them. Starting in 2026 leaves ample time to be ready for commencement.