Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It requires UK premises where 200 or more people may reasonably be expected at the same time, staff included, to prepare for the possibility of a terrorist attack. The duties are not in force yet: the government expects them to begin in spring 2027.
The law is named after Martyn Hett, one of the 22 people murdered in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for it for years, and the Act received royal assent on 3 April 2025 with an implementation period of at least 24 months.
If you run a pub, restaurant, hotel or events business, this guide covers what the Act asks of you, which tier your venue falls into, and what is worth doing during the implementation period. It reflects the official guidance as it stands in late July 2026.
When does Martyn’s Law come into force?
No duty applies to venues yet. The Home Office and the Security Industry Authority say the Act is expected to come into force in spring 2027, and that the exact date will be confirmed ahead of time. You may see 3 April 2027 quoted elsewhere. That is an inference from the 24-month implementation period, not an announced date.
The machinery is moving, though. Since March 2026 the government has been switching parts of the regime on:
The statutory guidance was published on 15 April 2026, giving venues the official interpretation of every duty. In June, a second set of commencement regulations brought the SIA’s guidance powers to life. On 14 July 2026 the government laid the notification regulations (SI 2026/793), which set out how venues will register with the regulator. The SIA consulted on its regulatory guidance between April and June 2026 and plans to publish the final version in autumn 2026.
So the correct reading in mid-2026 is that the Act is partially commenced: the regulator is being built, the rules are being finalised, and venue duties arrive in one go later.
Which venues does Martyn’s Law apply to?
Premises qualify when they are publicly accessible, used for a qualifying activity (hospitality is one, alongside retail, entertainment and others), and 200 or more people, including staff, may reasonably be expected to be present at the same time. The Act applies across England, Wales, Scotland and Northern Ireland.
The staff-inclusive counting matters in hospitality. A 170-cover restaurant with 35 people on shift crosses the threshold. A pub building and its beer garden count together as one premises, so a venue that runs at 120 inside but 250 across the site on a summer Saturday is in scope.
One-off events are a separate category with a higher bar: an event qualifies where 800 or more people are expected and entry conditions such as ticket checks apply. A privately invited wedding or a staff-only party is not publicly accessible, so it does not qualify no matter the size.
How do you work out your expected numbers?
The test is the greatest number reasonably expected to be present at the same time, not your fire capacity, not your licensed maximum, and not your average trade. Official guidance lets you evidence the figure with fire safety occupancy limits, historic peak attendance, fixed seating counts, ticket limits, or another justified method.
Busy nights count. A venue that hits 220 every time a major match is televised is a 220 venue, even if a quiet Tuesday sees 40 covers. What does not count is a genuinely unforeseeable one-off: an unexpected crowd does not drag you into scope if it was not reasonably anticipated and is not expected to recur.
Keep a note of how you calculated the figure. The SIA can ask how you reached it.
What does the standard tier require?
Premises expecting 200 to 799 people sit in the standard tier. The duty is to have public protection procedures covering four things: evacuation (getting people out), invacuation (getting people in or to a safe part of the building), lockdown (securing the premises against an attacker), and communication (alerting staff and customers to danger).
Two things the standard tier does not require. There is no obligation to submit or even hold a written risk assessment document, and there is no requirement to buy equipment, hire consultants or make physical alterations. The duty is workable procedures and staff who know them.
Standard-tier venues will also have to notify the SIA. The July 2026 regulations give existing venues three months from the commencement date to register, and 28 days for changes after that. The portal to do it does not exist yet, so nothing can or needs to be filed today.
Penalties at this tier are civil: up to £10,000 for a contravention, with daily penalties of up to £500 for a continuing failure to comply with a compliance notice.
What does the enhanced tier require?
Premises expecting 800 or more people generally sit in the enhanced tier, as do qualifying events. On top of the four procedures, enhanced venues must put public protection measures in place, so far as is appropriate and reasonably practicable: monitoring the premises, controlling movement in and out, physical security, and the security of information about the site.
Enhanced-tier venues must also document their compliance in a written assessment. The penalties scale accordingly: civil penalties reach £18 million or 5% of qualifying worldwide revenue, whichever is higher, with £50,000 daily penalties for continuing breaches, and the most serious offences carry up to two years’ imprisonment.
Some premises types stay in the standard tier even past 800. Places of worship and most education settings receive standard-tier treatment regardless of size. Neither is exempt, a misreading common enough that the Home Office corrected it in its own myth-busting material.
Get ahead of spring 2027
Our 30-minute Martyn's Law course walks your team through the Protect Duty, the tiers and what an evacuation, invacuation and lockdown actually involve. It is one of 130+ CPD accredited courses covered by a single £35 licence, so fire warden, food hygiene and first aid awareness training sit in the same account.
Get access for £35Pay by card. Instant access, certificate the same day. 14-day money-back guarantee.
What should venues do now?
The SIA published its own preparation list on 17 July 2026, and none of it involves spending money on security kit. In its words and ours:
Work out whether each site qualifies, and note the evidence behind your expected-numbers figure. Identify the responsible person: the duty follows operational control, which in leased or franchised sites is not always the freeholder. Read the statutory guidance against your existing fire and emergency procedures, and sketch what invacuation and lockdown would look like in your building, because they are not the same as a fire evacuation and may use different routes. Brief the people who would carry the plan out. Sign up for SIA updates so you hear when the portal opens, and register interest in testing it if you want an early look.
Two warnings from the official sources are worth repeating. You cannot notify the SIA yet, so anyone selling “Martyn’s Law registration” today is selling something that does not exist. And no product, consultant or piece of equipment is required by the Act: the government has pointedly declined to endorse any.
Is Martyn’s Law training mandatory?
No specific course or qualification is required by the Act, and the official guidance says so plainly. What the law does require is that the staff who would carry out your procedures understand their roles and can actually perform them. How you get there is up to you.
That is where structured training earns its place. A written procedure that nobody has walked through is a document, not a capability. Our Martyn’s Law course gives every team member the same 30-minute grounding in threat awareness, the four procedure types and how to respond, with a CPD certificate to evidence the briefing. Pair it with fire warden training for the people who own evacuations, and fire safety for everyone else, and the overlap between your fire plan and your Martyn’s Law procedures starts working for you rather than against you. The people who already sweep your floors on a fire alarm are usually the right people to carry the invacuation and lockdown roles too, and our fire warden duties guide sets out what that job already involves.
For a team, the sums stay small. Each £35 seat covers all of it, plus health and safety, food hygiene and the rest of the 130+ course library, for a year. Details for employers are on the team training page.
Six things venues keep getting wrong
The Home Office and ProtectUK publish corrections to the most common misreadings. The six most relevant to hospitality:
- “It is already law, so I am already liable.” Partially commenced, but no venue duty applies until spring 2027.
- “My fire capacity is my Martyn’s Law number.” The test is the greatest number reasonably expected at once, evidenced your way.
- “Only customers count.” Staff, contractors and volunteers all count towards the threshold.
- “Standard tier means a written risk assessment.” Standard tier requires procedures and notification, not a submitted document.
- “My fire evacuation plan covers it.” Evacuation is one of four procedures. Invacuation and lockdown can require the opposite instinct and different routes.
- “I need an approved course before it starts.” No course is mandated. Staff who can carry out the procedures are what counts.
Ready before the regulator is
Spring 2027 sounds distant until you divide it into rotas. A venue that writes its procedures this year, briefs its team over the winter and rehearses once before commencement will meet the start date with nothing left to buy. Put your expected-numbers evidence in a drawer, get every team member through the Martyn’s Law course on a £35 seat, and the arrival of the SIA’s portal becomes a ten-minute registration rather than a scramble.