Martyn’s Law: The Countdown to 2027 — Is Your Venue Ready?

For a long time, Martyn’s Law was something most businesses could quietly file under “deal with it later.” That window has now closed. The official guidance is published, the regulator’s enforcement consultation has just finished, and the deadline is under a year away. If your premises welcome the public in any number, this is the moment to move from “we’ve heard of it” to “we know exactly what we need to do.”

 

What Martyn’s Law is

Martyn’s Law — formally the Terrorism (Protection of Premises) Act 2025 — received Royal Assent on 3 April 2025. It’s named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack; his mother, Figen Murray, campaigned for years to make it happen. The aim is straightforward: to ensure that premises and events open to the public are prepared and ready to keep people safe if a terrorist attack occurs.

 

Why now is the moment — the timeline that makes this urgent

The law passed over a year ago, so “brand-new legislation” isn’t the story. What’s changed is that the preparation runway is now well past halfway, and the detail businesses were waiting for has landed:

3 April 2025 — Royal Assent. The clock on a minimum 24-month implementation period starts.

15 April 2026 — the Home Office publishes its Section 27 statutory guidance, giving the first official detail on what meeting the requirements actually looks like.

12 June 2026 — the Security Industry Authority’s consultation on its enforcement guidance closes, meaning the regulator’s approach is now being finalised.

Spring 2027 (expected) — the duties become enforceable and the SIA’s regulatory function goes live.

Nothing is enforceable yet, and there’s no need to panic. But the relaxed part of the timeline is over: Government, the regulator and sector bodies now expect in-scope organisations to be actively preparing through 2026 — not waiting for the SIA to start knocking.

 

Does it apply to you?

Martyn’s Law applies across the UK to qualifying public premises and events — typically retail, hospitality, leisure and entertainment venues, sports grounds, places of worship, healthcare and education — wherever 200 or more people may be present at the same time. It works in two tiers:

Standard tier: premises where between 200 and 799 people may be present.

Enhanced tier: premises, and qualifying events, where 800 or more people may be present.

If you operate more than one site, each one needs assessing on its own — a portfolio can contain both tiers, and some sites that fall below the threshold entirely.

 

What you’d actually have to do

Standard tier is deliberately light-touch. You notify the SIA that you’re responsible for qualifying premises, put in place public protection procedures — what your people would do to reduce harm if an attack happened at or near your premises, covering evacuation, lockdown or invacuation, and communication — and make sure staff are trained to carry them out. There’s no requirement to install equipment, make physical alterations, or predict specific threats.

Enhanced tier adds more: documented risk assessments, public protection measures so far as is reasonably practicable (which can extend to physical measures), and a compliance document made available to the SIA on request.

On penalties, the published framework sets standard-tier breaches at up to £10,000, and enhanced-tier breaches at up to the greater of £18 million or 5% of worldwide revenue, with criminal offences for the most serious failures. The headline numbers are large, but for the vast majority of in-scope businesses — the standard tier — the practical bar is procedures and trained staff, not heavy spending.

 

You don’t need to buy “compliance”

Here’s something a lot of the noise around Martyn’s Law won’t tell you: you are not required to spend money on consultants or specialist products to meet the law. The Government has been explicit that neither the Home Office nor the SIA endorses any third-party “compliance” product, and that standard-tier requirements are designed to be low-cost and achievable in-house. Treat anyone selling you “Martyn’s Law compliance in a box” with healthy scepticism.

Better still, if you already take fire safety and health and safety seriously, you’re further along than you think. Standard-tier preparation leans on the same instincts as a good fire evacuation plan: clear procedures, people who know their roles, and practised communication. Free counter-terrorism awareness resources are also available through the Government’s ProtectUK platform.

 

Where the real work actually is

With the box-buying myth set aside, the genuine effort sits in two places:

Your people knowing what to do. Procedures on paper protect no one. Staff have to understand them and be able to act under pressure, which means proper awareness and preparedness training tailored to your premises.

Joining it up with what you already have. The common mistake is treating Martyn’s Law as a separate bolt-on. Done well, your public protection procedures sit alongside your existing fire and H&S arrangements as one coherent plan your team can actually follow.

 

What to do now

1. Work out whether any of your premises or events are in scope — the 200-plus capacity test.

2. Classify each in-scope site as standard or enhanced tier.

3. Designate the responsible person who will own this.

4. Read the Section 27 statutory guidance — it’s published and free.

5. Draft or update your public protection procedures, aligning them with your existing fire evacuation and H&S plans rather than starting from scratch.

6. Train your staff so they understand and can carry out those procedures.

7. Enhanced tier only: prepare your documented risk assessments and compliance document.

8. Don’t wait for Spring 2027 — prepare now, while there’s time to do it calmly.

 

Prepare properly — without the scare tactics

Martyn’s Law is a serious, sensible step, and for most businesses it’s more manageable than the headlines suggest. The organisations that handle it well won’t be the ones who spent the most — they’ll be the ones whose staff genuinely know what to do, with procedures that fit naturally into the safety arrangements they already run.

Talk to Office Test about staff preparedness training and aligning your procedures with your existing fire and H&S plans —  we’ll help your people know exactly what to do.