The Terrorism (Protection of Premises) Act 2025, better known as Martyn’s Law, is expected to come into force in spring 2027. Businesses should not wait for the final guidance awaited from the Security Industry Authority (SIA) before they start preparing.

Martyn’s Law requires those responsible for certain public premises and events to take reasonably practicable steps to prepare for a terrorist attack and to help keep people safe if one occurs. Larger premises and events face additional duties aimed at reducing their vulnerability.

Step 1: Is your venue caught?

Two numbers decide whether a business is caught: 200 and 800. A premises falls within Martyn’s Law only if it is wholly or mainly used for a qualifying purpose, including retail, hospitality and entertainment (known as Schedule 1 uses), and can reasonably expect 200 or more people present at once. Below that, the Act does not apply. Cross 800 potential visitors, and the premises moves into the enhanced tier, where the duties are considerably heavier.

The test rewards a close read. A cinema is caught only where its use is principally for members of the public, so a private corporate hire falls outside scope. A sports ground escapes on training days but is caught on match days, or when it hosts a concert. Mixed-use sites are assessed by the principal use of the whole premises: a hotel with an attached restaurant and gym is assessed as a hotel, making the hotel operator the responsible person for the entire site. 

Step 2: What do you need to do?

A standard tier site must have procedures for evacuation, invacuation, lockdown and communicating with people on site, so far as reasonably practicable. No physical alterations or new equipment are required. An enhanced tier site must go further: actively monitoring the premises and its surroundings, managing how people move through it, and putting in place physical security measures such as CCTV or dedicated security staff.

Responsibility cannot be outsourced, even where day-to-day security is contracted out. It rests with whoever controls the premises for its qualifying use, usually the operator, whether owner, leaseholder or licensee. Enhanced tier organisations must also name a senior individual accountable for compliance. Where a qualifying premises sits inside another the responsible persons for each must coordinate, so far as reasonably practicable.

Most organisations will already have evacuation plans and incident procedures drawn up for other purposes. The practical task now is to review them against what the Act is likely to require and close the gaps. Enhanced tier duty holders will also need a compliance document setting out their procedures and security measures, together with an assessment of how each reduces risk and vulnerability, ready to produce for the regulator on request.

The SIA will be the relevant regulator and says it intends to support and guide in the first instance, but the penalties for getting it wrong are significant. For enhanced tier premises and events, fines can reach £18 million or five per cent of worldwide revenue, with daily penalties of up to £50,000. Standard tier penalties top out at £10,000, with daily penalties of up to £500.

None of the above depends on the final awaited guidance. The scope test, the tier, and who is responsible will be known today, and much of what an enhanced tier site needs to document will build on procedures that many businesses already have in place. Spring 2027 is not far off, and the businesses that treat this as a live operational task now, rather than a deadline to revisit later, will find the transition far less disruptive when the guidance lands.

Matthew Vernon is senior associate at Osborne Clarke. For more information, visit www.osborneclarke.com