What is Martyn's Law? A Complete Guide for Venue Operators (2026)

Where Martyn's Law came from

On 22 May 2017, 22 people were killed and hundreds more were injured when a suicide bomber detonated a device in the foyer of the Manchester Arena as crowds were leaving an Ariana Grande concert. Among those killed was 29-year-old Martyn Hett.

Martyn's mother, Figen Murray, began campaigning almost immediately for legislation that would require venues to take meaningful steps to protect the public from terrorist attacks. Her campaign gained significant cross-party support, and after years of consultation and parliamentary scrutiny, the Terrorism (Protection of Premises) Act received Royal Assent in April 2025.

The Act is commonly known as Martyn's Law. It is expected to come into force in April 2027, following an implementation period that gives venues time to understand their obligations and put the required measures in place.

What the Act actually says

Martyn's Law creates a legal duty on operators of qualifying premises and events to implement security measures proportionate to the terrorist threat. The duty is not to prevent every possible attack. That is not achievable. The duty is to take reasonably practicable steps to reduce vulnerability and the impact of an attack if one does occur.

The Act establishes two tiers of obligation based on capacity thresholds. The requirements differ significantly between the tiers, and the penalties for non-compliance differ too.

The Security Industry Authority (SIA) has been designated as the regulator for Martyn's Law. They will have powers to inspect premises, issue compliance notices, and impose financial penalties on operators who fail to meet their obligations.

The two tiers explained

Standard Duty (200 to 799 capacity)

Standard Duty applies to premises and events that can accommodate between 200 and 799 people. This covers a wide range of venues including medium-sized bars and nightclubs, restaurants with function rooms, conference facilities, theatres, cinemas, leisure centres, and places of worship.

Under Standard Duty, operators must implement procedures that, so far as reasonably practicable:

• Reduce the vulnerability of the premises to a terrorist attack
• Reduce the risk to individuals on the premises if an attack occurs
• Enable a timely and effective response if an attack does occur

In practice this means venues need documented evacuation and invacuation procedures, staff trained to implement those procedures, and measures in place to alert people on the premises quickly in the event of an incident. The Act does not prescribe exactly what those measures must look like. It requires operators to assess their specific premises and implement proportionate responses.

Enhanced Duty (800+ capacity)

Enhanced Duty applies to premises that can accommodate 800 or more people. This includes large entertainment venues, stadiums, arenas, large hotels, shopping centres, and major events. The requirements are more extensive.

Under Enhanced Duty, operators must:

• Conduct a terrorism risk assessment for their premises
• Develop and implement a terrorism protection plan based on that assessment
• Appoint a designated senior individual who takes personal responsibility for compliance
• Register their premises with the SIA and provide details of the measures in place
• Submit to inspection and provide evidence of compliance on request

The Enhanced Duty tier is modelled on other high-consequence regulatory frameworks. The designated senior individual is personally accountable. The terrorism protection plan must be documented, reviewed regularly, and updated when significant changes occur at the premises.

Who is in scope

The Act applies to a wide range of premises and events. The key question is whether the venue or event has a capacity of 200 or more. Capacity for these purposes means the maximum number of people who could reasonably be expected to be present at the same time, not just the number of seats.

Qualifying premises include:

• Entertainment venues: theatres, cinemas, nightclubs, live music venues, arenas
• Hospitality: hotels, restaurants, bars with function rooms, casinos
• Retail: large shops, shopping centres, markets
• Transport: airports, railway stations, bus terminals
• Education: universities, large schools, colleges
• Health: large hospitals and healthcare facilities
• Sport: stadiums, sports halls, racecourses
• Places of worship: cathedrals, large mosques, temples, and churches
• Public spaces: parks and outdoor areas used for public events

There are some exemptions. Private dwellings are excluded. Some categories of premises with specific regulatory frameworks already in place may be treated differently. The detailed guidance from the SIA will clarify edge cases.

Penalties for non-compliance

The financial penalties under Martyn's Law are significant. For Standard Duty premises, the maximum penalty is the higher of 10,000 GBP or 5% of qualifying worldwide revenue. For Enhanced Duty premises, the maximum is the higher of 18,000,000 GBP or 5% of qualifying worldwide revenue.

These figures position Martyn's Law alongside GDPR in terms of maximum financial exposure. The 18 million GBP cap for Enhanced Duty venues is not a theoretical ceiling. It is the maximum the regulator can impose without seeking a court order. For large venues and operators with multiple Enhanced Duty sites, the compliance risk is material.

Beyond financial penalties, the SIA can issue improvement notices and prohibition notices. A prohibition notice prevents a venue from operating until compliance is demonstrated. For a large hotel or entertainment venue, the commercial cost of being forced to close during a busy period would likely dwarf the financial penalty.

The timeline and implementation period

The Act received Royal Assent in April 2025. The Government has indicated that the enforcement date will be approximately two years later, placing it in or around April 2027. The implementation period is intended to give venues time to understand their obligations, develop procedures, train staff, and register with the SIA.

However, implementation periods pass quickly. The venues that use this time well will have documented procedures, trained staff, and a compliance audit trail in place well before enforcement begins. Those that wait until the deadline is close will face the cost and disruption of rushed compliance alongside the risk that they miss something material.

The SIA is expected to publish detailed guidance during the implementation period. This guidance will clarify specific requirements, provide templates for terrorism protection plans, and explain the inspection and registration process. Operators should monitor SIA communications and engage with the guidance as it is published.

What venues need to do now

The starting point is understanding which tier applies to you. If your capacity is below 200, you are not in scope. If your capacity is between 200 and 799, you are Standard Duty. If your capacity is 800 or above, you are Enhanced Duty.

For Standard Duty venues, the immediate priorities are:

• Review existing evacuation and emergency procedures against the Act's requirements
• Identify gaps in staff training on terrorism awareness and emergency response
• Document the procedures you already have in place
• Plan for how you will demonstrate compliance to the SIA when required

For Enhanced Duty venues, the priorities are more extensive:

• Commission or conduct a terrorism risk assessment for your premises
• Identify and appoint your designated senior individual
• Begin developing your terrorism protection plan
• Review your existing security technology and procedures against the Enhanced Duty requirements
• Plan for SIA registration

AI-powered behaviour detection and crowd monitoring systems are directly relevant to Martyn's Law compliance. The ability to detect crowd surges, identify suspicious behaviour, monitor entry and exit points, and alert staff in real time addresses the core requirement to reduce vulnerability and improve response capability. These systems also generate the automated documentation that demonstrates proactive compliance to regulators and insurers.

The broader context

Martyn's Law does not exist in isolation. It sits alongside existing duties under the Licensing Act 2003, the Health and Safety at Work Act 1974, and the Corporate Manslaughter and Corporate Homicide Act 2007. Compliance with Martyn's Law will not automatically mean compliance with all of these frameworks, but there is significant overlap, particularly around documented procedures and staff training.

Venue operators who have already invested in proactive security measures will find that much of their existing infrastructure maps onto the Martyn's Law requirements. Those who have relied on passive CCTV and minimal security protocols will face a more significant programme of change.

The law is named after someone who died in a preventable attack. The intent is not to create compliance bureaucracy. The intent is to make venues meaningfully safer. The operators who approach this with that understanding will arrive at the enforcement date in a better position than those who treat it as another box-ticking exercise.

For a detailed look at how Martyn's Law applies to specific sectors, see our guides for hospitality and licensed venues, hotels specifically, and large public venues and stadiums.

Two months free when you start before June 2026. Book a consultation to understand how Archangel supports Martyn's Law compliance for your venues.