Martyn’s Law is coming in 2027: a practical checklist for security companies

Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It’s named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017, and for those of us based in Greater Manchester it carries real weight. The Act received Royal Assent on 3 April 2025 and is expected to come into force in spring 2027. The SIA, which will regulate it, has said it will confirm the exact date ahead of time.

If you run a security company, the legal duty mostly won’t sit with you. It sits with the venues and event organisers you work for. But when the law switches on, your clients will look to you for procedures, trained officers, and evidence. Here’s what the law asks of them, and a checklist to get your business ready to support them.

Who the law applies to

The Act works on tiers, based on how many people can reasonably be expected on site at the same time, including staff.

• Standard tier: premises where 200 to 799 people may be present at the same time, at the busiest times.
• Enhanced tier: premises where 800 or more people may be present at the same time, from time to time.
• Qualifying events: publicly accessible events with entry checks where 800 or more people are expected. These carry the same duties as enhanced tier premises.
• Childcare settings, schools, further education, and places of worship stay in the standard tier even if numbers go above 800.

The legal duty falls on the “responsible person”, meaning whoever controls the premises or event. The SIA is clear that a responsible person can’t pass that responsibility on, although they can take advice from a suitably knowledgeable security adviser. That’s where you come in.

What venues and events will have to do

Every responsible person in scope must notify the SIA and have appropriate public protection procedures in place, so far as is reasonably practicable. The Act names four procedures:

• evacuation: getting people out of the premises or away from danger
• invacuation: moving people to a safer place inside the premises
• lockdown: securing the premises to stop people entering or leaving
• communication: giving people information during an incident

Enhanced tier premises and qualifying events must also put public protection measures in place to reduce their vulnerability to an attack. Those cover monitoring of the site and its immediate surroundings, the movement of people in and out, physical security, and the security of information about the premises. They must document their procedures and measures, assess how they reduce risk, and send that document to the SIA. Organisations in the enhanced tier must also name a senior individual responsible for compliance.

How the SIA will regulate it

The SIA will use desk-based assessments and on-site inspections, with a risk-based approach informed by intelligence. It will typically give at least 72 hours’ notice before an on-site inspection, though it can ask a court for a warrant to enter without notice in some circumstances.

The penalties are significant. Standard tier premises face penalties of up to £10,000, plus daily penalties of up to £500 while non-compliance continues. For enhanced tier premises and qualifying events, the maximum is £18 million or 5% of worldwide revenue, whichever is higher, plus daily penalties of up to £50,000.

The SIA has said it will publish its final regulatory guidance and consultation report in autumn 2026. Notifications will be made through an online portal, which it plans to test with volunteers from early 2027.

A practical checklist for security companies

None of this needs you to wait for a commencement date. These are the steps we’d take now.

1. Map your contracts by tier. List every site and event you cover, the realistic peak numbers including staff, and whether it falls into the standard tier, the enhanced tier, or neither. Your clients may not have done this yet, and it’s a useful conversation to start.
2. Rewrite assignment instructions around the four procedures. For each site, the assignment instructions should say what your officers do in an evacuation, an invacuation, and a lockdown, and how they communicate with the public, the venue, and the emergency services. A vague line like “follow site procedures” won’t stand up.
3. Brief and train your officers. Make sure they understand what’s expected of them on each site and how to report suspicious behaviour. ProtectUK offers free guidance and counter-terrorism awareness material you can build into inductions and refreshers. The SIA’s proposed new licence qualifications also add awareness of Martyn’s Law to the common unit.
4. Exercise the procedures with the venue. Agree when you’ll run drills or table-top exercises with the client, and record what happened, what went wrong, and what changed afterwards. Evidence of testing carries far more weight than a procedure nobody has tried.
5. Tighten your control room and reporting chain. If you provide CCTV monitoring or patrols, be clear how your role supports the client’s monitoring and movement measures, who calls the police, and how information reaches officers on the ground quickly.
6. Protect site information. Security of information is one of the four enhanced tier measures. Control who sees site plans, rotas, and assignment instructions, and make sure staff understand why they shouldn’t post site details or photos on social media.
7. Keep your evidence in one controlled place. Assignment instructions, training records, drill logs, and incident reports all need to be current and easy to produce. A management system built to ISO 9001, or to BS 10119 if you supply security labour, gives you document control and records that hold up when a client or the SIA asks.
8. Stay inside your role. You can advise and support, but the responsible person keeps the legal duty. Be careful how you describe your services, too. The SIA has said that neither it nor the Home Office can endorse or recommend specific companies for Martyn’s Law compliance, so avoid any wording that suggests official approval.

Why this is a commercial opportunity

Buyers will soon be asking how your officers support their Martyn’s Law duties. Companies with clear assignment instructions, trained staff, and test records will be easier to choose, and the same evidence strengthens your tender answers and your ACS submissions.

At CAW Consultancy, we help security companies get their management systems, assignment instructions, and training records ready for exactly this kind of scrutiny. If you’d like a review before spring 2027, call 01257 824481 or email Craig@cawconsultancy.co.uk.

Related reading

• BS 7858 Security Screening Explained: A Practical Guide for Employers
• ISO 22301 in Plain English: Business Continuity That Actually Works When Things Go Wrong
• Martyn’s Law: what security companies and venue operators should be doing now