Martyn's Law Readiness

The Terrorism (Protection of Premises) Act 2025 places new legal duties on qualifying venues. Preparation costs a fraction of what late compliance does.

Page reviewed September 2026. Updated as SIA guidance develops.

What the Act requires

Two tiers, one duty holder, no ambiguity.

Martyn's Law applies to qualifying premises and events based on the number of people who may reasonably be expected to be present. Which tier you fall into determines what you must do.

Standard Tier (200 to 799): you must put in place public protection procedures and notify the regulator. The emphasis is on preparedness, not physical investment.
Enhanced Tier (800 and above): procedures plus public protection measures, a documented assessment, and a named senior individual accountable for compliance.

Tier is not fixed by your everyday footfall alone. Recurring large events can reclassify premises to the Enhanced Tier, which catches out venues that assess themselves on a quiet Tuesday rather than a full house.

Martyn's Law readiness review at a hotel venue

Venue procedures and evacuation planning

The four procedures

Four procedures every qualifying venue must consider.

The Act requires appropriate public protection procedures to be put in place so far as reasonably practicable for your premises, and staff must be capable of carrying them out. Written plans that nobody has walked through do not meet the standard.

Evacuation: getting people out of the premises safely.
Invacuation: bringing people into the premises, or moving them to a safer part of it.
Lockdown: securing the premises against a person attempting to enter.
Communication: alerting staff and the public, and moving information to where decisions are made.

Where more than one responsible person operates within shared premises, the Act creates a duty to co ordinate. Multi occupancy sites, shopping centres and shared event spaces need to resolve who owns what before the regulator asks.

Enforcement

What happens if you are not ready.

The Security Industry Authority is the regulator. Its approach is worth understanding before you rely on being told when something is wrong.

Assessment is silent. The SIA does not audit on a published schedule and will not tell you in advance that it is looking at you.
No tailored advice, no endorsed advisers. The regulator will not review your plans for you, and it endorses no consultancy. Anyone claiming SIA approval does not have it.
Restriction notices can halt operations. The power exists to restrict the use of premises, which for a venue means closed doors and cancelled bookings.
Penalties are set against the business, not the task. Non compliance penalties reach £10,000 for Standard Tier premises. For Enhanced Tier premises and qualifying events the maximum is the greater of £18 million or 5% of qualifying worldwide revenue, with daily penalties of up to £500 and £50,000 respectively where non compliance continues.

In Scotland, enforcement proceeds through the Procurator Fiscal rather than the route that applies elsewhere in the UK. Scottish venues should not assume that guidance written for England and Wales describes their position.

Table top exercise testing venue procedures

How we work

A four stage readiness programme.

Most venues do not need everything at once. The programme is designed so you can stop at any stage and still be better off than when you started.

1. Establish position: confirm whether the Act applies, which tier you fall into, and where you stand today against the requirements.
2. Assess risk: a structured terrorism risk assessment across recognised attack methodologies, producing a prioritised action plan for your premises.
3. Build the documentation: the four statutory procedures written for your venue, your layout and your staffing, not adapted from someone else's template.
4. Test and assure: a table top exercise that puts the plans in front of the people who would use them, followed by independent assurance review.

How we can help

Support shaped around your tier

Most venues do not need everything at once. Start with the piece that answers your most pressing question, and build from there only if it is warranted.

Gap Analysis

Where you stand today against the requirements that apply to your premises, with a prioritised list of what to address first.

Terrorism Risk Assessment

A structured assessment of threat, likelihood and impact across your site, producing a documented risk action plan.

Assessment Combined

Both assessments delivered in a single visit and a single report. The usual starting point for most venues.

Standard Tier Readiness

The full package for Standard Tier premises: assessment, the statutory procedures written for your venue, and a staff briefing.

Enhanced Tier Readiness

For premises at 800 capacity and above, including public protection measures, documented assessment and support for your named senior individual.

Ongoing Support

Retained advisory support, or an annual compliance review to keep your documentation current as guidance develops.

Every venue is different, so each engagement is scoped and quoted on its own footprint and complexity. Get in touch and let us discuss how we can help.

Make an Enquiry

Straight answer

What we will not tell you

No consultancy can guarantee your compliance, and you should be wary of any that says otherwise. The regulator endorses nobody. What we provide is informed, practical preparation aligned with official guidance as it develops, delivered by an adviser who has spent over twenty years in security and risk rather than someone who read the Act last month. If a short conversation establishes that you need less than you thought, we will tell you that too.