3 July 2026
Contributor: Paul Donald
30 June 2026
Contributors:
Iain Drummond, Alejandro Coghill
Browse our articles, insights and guides.
The Terrorism (Protection of Premises) Act 2025 – commonly known as Martyn’s Law – will introduce new legal duties for organisations responsible for publicly accessible premises and events. It has been passed, but is not yet in force. Implementation is expected after a transition period (probably around April 2027).
The Act aims to make organisations more prepared for terrorist incidents, and ensure that they are better equipped to protect people and reduce harm. If your premises or event can reasonably expect 200 or more people to be present, you will probably be affected.
Our specialist Health and Safety team has all the insight and expertise required to help you understand your new duties and make the necessary preparations.
The Home Office has published statutory guidance (April 2026), and the Security Industry Authority (SIA) has issued draft guidance for consultation.
The detail may change before implementation. The information below reflects the current direction of travel and should be treated as guidance only.
If your venue capacity is…
Your premises are unlikely to be affected
Standard duty premises
Organisations must implement simple, low-cost procedures to improve preparedness
Enhanced duty premises
Organisations must go further and implement additional measures
The statutory guidance indicates that organisations should be able to implement four key types of public protection procedures.
1. Evacuation
Safely moving people away from danger.
2. Invacuation
Bringing people into a safer area.
3. Lockdown
Restricting access or movement to prevent exposure to a threat.
4. Communication
Providing clear channels of communication with staff and the public. Staff need to understand their responsibilities and what they should do in any given situation; members of the public need to be able to report concerns in a way that ensures they will reach the correct people, and that the situation will be dealt with appropriately.
This aspect of the Act applies to premises and events in both the ‘standard duty’ tier and the ‘enhanced duty’ one. People in control of these will be designated as a ‘Responsible Person’, who will have certain legal duties. To be precise, that might include owners of a venue or premises, occupiers or tenants, facility managers, local authorities or employers.
Responsible Persons must take reasonable steps to reduce the vulnerability to terrorism attacks, and to mitigate harm to individuals if a terrorist attack were to occur. The Home Office guidance is clear that they “cannot delegate their legal responsibility”, although they can “delegate tasks”.
Where there is more than one Responsible Person, procedures should be in place to ensure coordination between them.
Anyone designated as Responsible Person is also legally required to notify the SIA of their role. (We don’t yet know the details of this, including the required timescale or procedure.)
The Responsible Person can be an organisation. If so, a senior individual who is responsible for compliance must be designated.
Standard duty premises (200–799 people)
Organisations in this tier must implement simple, low-cost procedures to improve preparedness for an emergency event, including:
They must also provide training and counter-terrorism awareness for staff. This must be appropriate to the level of risk at the particular premises or event.
No specific physical security measures (e.g. scanning equipment) are required at this level.
Enhanced duty premises (800+ people)
Organisations in this tier are required to go further: they must implement all reasonably practicable additional measures. Depending on the particular premises, these might include:
Organisations in the enhanced tier also have a duty to document their compliance with the Act, in particular as regards what public protection procedures are in place, and assessments of how these are expected to mitigate risks.
At this level, senior individuals may carry greater accountability for compliance at this level – and more serious consequences if things go wrong. This particularly applies to designated senior individuals (see the end of the ‘Designated ‘Responsible Persons’ section above). But other members of senior management could still be prosecuted if an offence is committed with their consent, connivance or neglect.
How will the different sectors be impacted?
Often fall within scope due to public access and capacity. Challenges include multiple access points and transient guests.
Focus areas
Many will fall within the standard duty tier.
Focus areas
Likely to fall within the enhanced duty tier.
Focus areas
Often operate as both premises and event organisers.
Focus areas
Includes universities, schools and colleges.
Focus areas
We’ve put together a checklist of the key first steps for all organisations that may be affected.
Note that having a capacity of over 200 means that you will probably be affected – but this is not 100% certain.
Our specialist Health and Safety team can support with all aspects of your preparation, including:
If you would like to discuss how the Act may affect your organisation, please contact our Health and Safety specialists or your usual Shepherd and Wedderburn contact.
The Act received Royal Assent in April 2025, and we are expecting a transition period of at least 24 months, so implementation is likely to be in April 2027 or fairly shortly afterwards.
The individual or organisation with control of the premises or event, such as an owner, operator or employer. Legal responsibility cannot be delegated, although tasks may be.
Organisations should be able to implement procedures covering:
Organisations in the enhanced tier will have additional requirements around monitoring, movement, information and physical security.
Not necessarily. The Act does not mandate specific measures, but it instead requires a risk-based, proportionate approach.
Yes. Draft guidance indicates that responsible persons will need to notify the Security Industry Authority (SIA) when they take on or cease responsibility for premises.
The SIA will take a supportive, proportionate and risk-based approach, but it has powers to inspect and take enforcement action where needed.
Enforcement and penalties
The SIA will regulate compliance and has powers to:
Serious breaches may result in fines of up to £18 million or 5% of global turnover (whichever is greater), alongside potential criminal liability for organisations and senior individuals.
Although the Act is not yet in force, organisations should begin to:
