Martyn’s Law: what security companies and venue operators should be doing now

Martyn’s Law isn’t in force yet, but the clock is running. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, the Home Office published its statutory guidance in April 2026, and the Security Industry Authority (SIA), which will regulate it, says the Act is expected to come into force in spring 2027.

If you run a venue, you have a few months left to get your procedures in order without the pressure of a regulator. If you run a security company, your clients are going to start asking you questions, and you need good answers. This article covers both.

What the law requires, in brief

The Act applies to premises where 200 or more people (including staff) may reasonably be expected to be present at the same time, and to certain events. It sets two tiers.

Standard tier: 200 to 799 people

The responsible person must have appropriate public protection procedures in place, so far as reasonably practicable. The Home Office’s statutory guidance names four procedures: evacuation, invacuation, lockdown, and communication. In plain terms, that’s getting people out, bringing people in to a safer place, stopping people getting in or out, and telling people what’s happening.

Enhanced tier: 800 or more people

This tier also covers qualifying events of 800 or more. As well as the procedures, the responsible person must put appropriate public protection measures in place, again so far as reasonably practicable. These cover monitoring, movement, physical safety, and security of information. Enhanced tier duty holders must also prepare a compliance document and, where the responsible person is an organisation, designate a senior individual.

Special cases

There are some special rules. Places of worship and premises used for childcare or primary, secondary, or further education stay in the standard tier even if they could hold 800 or more people.

“Reasonably practicable” matters here. The statutory guidance says it means proportionate: you weigh what could be done against the cost, time, and difficulty of doing it.

Who regulates it, and the penalties

The SIA will be the regulator. It’s the same body that licenses door supervisors and security officers, but in this role it regulates the venues and event organisers, not just the security industry.

The penalties are set out in sections 18 and 19 of the Act:

• Up to £10,000 for standard tier premises.
• For enhanced tier premises and qualifying events, up to £18 million or 5% of qualifying worldwide revenue, whichever is greater.
• Daily penalties for continued non-compliance of up to £500 a day for standard tier and £50,000 a day for enhanced tier.
• A separate penalty of up to £5,000 for failing to attend and answer questions when required.

The SIA can also issue compliance notices and, for enhanced tier premises and events, restriction notices. The Home Office’s factsheet says the SIA will seek to support, advise, and guide first, with enforcement reserved for serious or persistent non-compliance. The Home Office has also confirmed the SIA won’t charge fees for inspections, post-inspection advice, or notifications.

When it starts

There is no confirmed commencement date yet. The Act needs regulations to bring the main duties into force. The Home Office’s factsheet says the implementation period is expected to be at least 24 months from Royal Assent, and the SIA’s guidance says the Act is expected to come into force in spring 2027, with the exact date to be confirmed.

Two pieces of the jigsaw are still landing. The SIA consulted on its section 12 guidance (how it will use its powers) between April and June 2026 and has said it will publish the final version in autumn 2026. The notification regulations were laid on 14 July 2026, and the Home Office has published guidance on what you’ll need to tell the SIA.

What venue operators should do now

When the duty starts, premises that are already in scope will have three months from commencement to notify the SIA. Events first publicised on or before commencement will have 14 days. You’ll need to give details such as the responsible person, the premises address, the maximum expected attendance and how you worked it out, and, for enhanced tier, your senior individual.

My advice is not to wait for that date. Here’s a sensible order of work:

1. Work out your realistic maximum capacity, including staff, contractors, and volunteers, and confirm which tier you’re in.
2. Identify who the responsible person is. The guidance is clear that responsibility can’t be delegated to a contractor, even though tasks can be.
3. Write down your evacuation, invacuation, lockdown, and communication procedures. The guidance says it’s good practice to document even the simplest procedures.
4. Make sure staff know the procedures and how to put them into action. The guidance expects procedures to be capable of being implemented rapidly and effectively.
5. If you’re enhanced tier, start your compliance document now and agree who your senior individual will be.
6. Read the Home Office’s statutory guidance and use the free resources on ProtectUK.

The Home Office’s own myth buster is worth reading. It says you can comply without buying specialist products or services, and that for standard tier there’s no requirement to buy physical measures. Based on the government’s impact assessment, it estimates average costs of around £330 a year for standard tier premises (mainly management and staff time rather than cash spend) and £5,210 a year for enhanced tier premises.

If you already have a decent approach to risk assessment and emergency planning, you’re not starting from scratch. Martyn’s Law asks you to apply that thinking to a terrorist attack scenario and write it down.

What security companies should be doing now

For security businesses, Martyn’s Law is both an opportunity and a responsibility.

The opportunity is obvious. Venues will want help working out their tier, writing procedures, briefing staff, and, at enhanced tier, designing measures like search policies and monitoring. The SIA’s own guidance suggests venues seek advice from a suitably knowledgeable security adviser.

The responsibility is to give honest advice. The government has been explicit that venues don’t have to buy services to comply, and the SIA and Home Office don’t endorse particular companies. Selling standard tier clients things they don’t need will damage trust quickly, and those clients will compare notes.

A few things I’d focus on:

• Make sure your officers and supervisors understand the four public protection procedures and how they work on each site you cover.
• Update assignment instructions so your team knows exactly what they do in an evacuation, invacuation, or lockdown, and who gives the instruction.
• Brief your account managers so they can explain the tiers, the timeline, and the client’s own responsibilities accurately.
• Encourage staff to complete the ACT Awareness e-learning, which ProtectUK offers free of charge.
• Review your own contracts, so it’s clear the client remains the responsible person and what tasks you’re carrying out for them.

This is also where a good management system earns its keep. BS 10119:2026, the code of practice for providing labour to the security and events sectors, and ISO 18788:2015, the management system standard for private security operations, both give you a framework for competence, briefing, and risk management. Neither is a Martyn’s Law requirement, but when a venue asks how you make sure every officer on their site knows the lockdown procedure, being able to show a working system is a strong answer.

Related reading

• SIA Approved Contractor Scheme: what the assessor actually checks
• BS 7858 Security Screening Explained: A Practical Guide for Employers
• Martyn’s Law is coming in 2027: a practical checklist for security companies

FAQs

When does Martyn’s Law come into force?

No date has been confirmed. The SIA says the Act is expected to come into force in spring 2027, and the exact date will be set by regulations.

What are the Martyn’s Law tiers?

Standard tier covers premises where 200 to 799 people may be present at the same time. Enhanced tier covers premises where 800 or more may be present, and qualifying events of 800 or more.

What are the four public protection procedures?

Evacuation, invacuation, lockdown, and communication. These apply to both standard and enhanced tier premises.

What are the penalties under Martyn’s Law?

Up to £10,000 for standard tier premises, and up to £18 million or 5% of qualifying worldwide revenue (whichever is greater) for enhanced tier premises and qualifying events, plus possible daily penalties.

Do I have to hire a security company to comply?

No. The Home Office says those in scope can comply without buying specialist services. Some venues may still choose to get expert help, particularly at enhanced tier, and the SIA says you can seek advice from a suitably knowledgeable security adviser.

Who regulates Martyn’s Law?

The Security Industry Authority (SIA).

How CAW Consultancy can help

At CAW Consultancy we work with security companies and venue operators to get their procedures, training records, and management systems in order. For security businesses, that includes BS 10119, ISO 18788, and SIA Approved Contractor Scheme support. Our gap analysis is free.

If you’re adding staff to meet demand, Screen My Staff provides BS 7858 screening, and Compliance Master helps security businesses keep training and compliance records in one place.

Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.

Sources

• legislation.gov.uk: Terrorism (Protection of Premises) Act 2025
• Home Office: Overarching factsheet
• Home Office: The regulator, sanctions and enforcement factsheet
• Home Office: Statutory guidance
• Home Office: Notification requirement guidance
• SIA: Understanding Martyn’s Law and the SIA’s role as regulator
• SIA: Martyn’s Law, what comes next and how to get involved
• ProtectUK: Martyn’s Law myth buster
• BSI: BS 10119:2026
• ISO: ISO 18788:2015