What Martyn's Law actually is.
Martyn's Law is the working name for the Terrorism (Protection of Premises) Act 2025. The Act received Royal Assent on 3 April 2025 and is expected to enter enforcement in April 2027 after a 24-month implementation window.
It is named after Martyn Hett, one of 22 people killed in the foyer of Manchester Arena on 22 May 2017 when a bomber detonated a device as crowds were leaving an Ariana Grande concert. Martyn was 29. After the attack his mother, Figen Murray, began campaigning for legislation that would require public venues to take meaningful steps to protect the people inside them. That campaign ran for the best part of a decade. The Act is the outcome.
Before the Act, there was no consistent legal requirement in the UK for venues to plan for terrorism. Some venues did it well. Many did nothing at all. The same hotel chain might have detailed counter-terrorism procedures at one property and nothing whatsoever at another. The Act sets a clear, enforceable baseline.
The duty is not to prevent every possible attack. That is not achievable. The duty is to take reasonably practicable steps to reduce vulnerability and limit harm if something does happen. That is the legal test the Security Industry Authority (SIA) will assess against from April 2027.
Who is in scope.
The Act applies to qualifying premises and qualifying events in the United Kingdom. A premises qualifies if it has a capacity of 200 or more people at any one time, including staff.
That covers a wide range of venue types:
Capacity means the physical limit of the space. If your venue can hold 200 people, you are in scope regardless of what your average occupancy looks like. You do not get to argue that you usually only have 150 people in there.
Standard Tier vs Enhanced Tier.
The Act operates on a two-tier system designed to keep obligations proportionate to risk. The bigger the venue, the more demanding the duty.
200 to 799
Capacity
- ·Notify the SIA
- ·Documented procedures (four emergencies)
- ·Staff trained on those procedures
- ·Information sharing with staff
- ·Annual review
No requirement to
Buy new equipment or alter premises
800 and above
Capacity
- ·All Standard Tier obligations
- ·Designated Senior Individual
- ·Formal terrorism risk assessment
- ·Documented security plan to the SIA
- ·Proportionate physical measures
- ·Active monitoring of vicinity
Personal accountability
A director or senior manager is on the hook
A note on "proportionate". The Act repeatedly uses the word proportionate. It does not expect a village hall to install airport-style security. What counts as proportionate depends on venue size, location, event type, and existing measures. The test is whether you have done what a reasonable operator in your position would have done.
The Responsible Person.
Every in-scope venue must appoint a named Responsible Person. That person notifies the SIA, is accountable for compliance, and is the regulator's point of contact.
Where the Responsible Person is not an individual (because the venue is owned by a company, trust, or partnership), the venue must also appoint a Designated Senior Individual. This is a director or senior manager personally accountable for the duty. It cannot be outsourced. It cannot be delegated to a contractor.
In practical terms, this means the person who signs off on compliance is the person whose name goes on the SIA notice. If the duty is not met, the financial penalty and the regulatory exposure follow that person and the operating entity.
Who typically holds the role
- · Hotel General Manager or Director of Operations
- · Venue Operations Director or Head of Security
- · Director of Estates (for university and education venues)
- · Head of Premises or Site Director (for places of worship and community venues)
- · Head of Security or Chief Operating Officer (for large stadium and arena operators)
The four procedures every venue must run.
Standard Tier focuses on public protection procedures your staff can follow under pressure. The four are not negotiable.
01
Evacuate
Move people out of the venue, away from the threat. Clear routes. Mustered staff. Headcount at the assembly point.
02
Invacuate
Move people into a safer internal location when outside is the more dangerous place. The reverse of evacuation.
03
Lockdown
Secure the venue. Doors, windows, access points. Stop the threat moving with you. Buys time for the response.
04
Communicate
Tell staff, guests, and emergency services what is happening. Clear, calm, coordinated. The procedure that turns the other three into a plan.
The timeline. Why "we'll get to it" is wrong.
3 April 2025
Royal Assent
The Terrorism (Protection of Premises) Act 2025 became law.
April 2025 – April 2027
Implementation window
A 24-month preparation period. Government guidance is explicit: use this time as active preparation, not as a reason to wait.
April 2027 (expected)
Enforcement begins
The SIA becomes the regulator. Compliance notices, restriction notices, and financial penalties become live.
Annually after enforcement
Review cycle
Procedures must be reviewed and updated. Risk assessments must be refreshed. Documentation must stay current.
Most venues underestimate how long preparation takes. Writing procedures takes weeks. Training every member of staff takes months. Installing and tuning active monitoring takes one to four weeks depending on the venue. Starting in late 2026 is not starting early. It is starting late.
The eight-step compliance path.
This is the practical sequence we recommend to UK venue operators starting from scratch. Work through it in order. Each step builds on the last.
Confirm your tier
Use the Martyn's Law Tier Calculator at archangelprotect.ai/tools/tier-calculator. Enter your venue capacity. If you are 200 to 799 you are Standard Tier. If you are 800 or above you are Enhanced Tier.
Appoint your Responsible Person
Name a Responsible Person accountable for compliance. For Enhanced Tier, also appoint a Designated Senior Individual at director or senior manager level personally on the hook.
Document your four procedures
Write down your Evacuate, Invacuate, Lockdown, and Communicate procedures. Train staff on each. Document who has been trained and when.
Run a terrorism risk assessment (Enhanced Tier)
Identify the threats relevant to your venue, the vulnerabilities those threats expose, and the proportionate measures you will put in place. Document the assessment and review it annually.
Add active monitoring
Active monitoring of your premises and immediate vicinity is a key Enhanced Tier obligation. AI behaviour detection on existing cameras delivers this without new hardware.
Notify the SIA
Register your venue with the SIA as the Responsible Person before enforcement begins in April 2027.
Build the evidence trail
Maintain a timestamped log of safety events, alerts, and operator responses. This is the evidence an inspector will ask for.
Review annually
Set an annual review cycle. Update procedures, retrain staff, refresh the risk assessment, and verify your active monitoring is still operating as designed.
What happens if you do not comply.
Enhanced Tier penalties
Up to 18 million pounds, or 5% of worldwide revenue, whichever is the greater. The SIA also has power to issue restriction notices preventing operation until compliance is achieved.
Standard Tier penalties
Lower financial limits, but the SIA still has the power to issue compliance notices and restriction notices. Non-compliance also creates exposure under existing duty of care, licensing reviews, and insurance renewals.
Where AI behaviour detection fits.
The Act does not specify any particular technology. It requires proportionate measures. For Enhanced Tier venues in particular, active monitoring of the premises and its immediate vicinity is in scope.
Reactive CCTV (cameras that record but are only reviewed after an incident) is not active monitoring. Live human-watched CCTV is active but scales poorly. Most venues cannot afford to have someone watching every screen every minute. AI behaviour detection is the practical bridge. It watches every frame on every camera continuously and only escalates to a human when something needs human attention.
Continuous monitoring
Every camera. Every shift. No fatigue, no blind spots, no gaps.
Documented incident logs
Every detection timestamped and categorised. The audit trail the SIA will ask for.
Threat detection
Aggression, unattended items, perimeter and access anomalies flagged in real time.
No new hardware
Sits on existing IP cameras. Live in under 48 hours. No rip-and-replace.
Frequently asked questions.
What is Martyn's Law?
When does Martyn's Law come into force?
What capacity triggers Martyn's Law?
Who is the Responsible Person under Martyn's Law?
What are the four emergency procedures?
What does Standard Tier require?
What does Enhanced Tier require?
What are the penalties for non-compliance?
Does Martyn's Law require AI or CCTV?
Does Martyn's Law apply to hotels?
Does Martyn's Law apply to places of worship?
Does Martyn's Law apply to schools and universities?
Can I outsource compliance to a security contractor?
How long does it take to become compliant?
What is the difference between Martyn's Law and the Protect Duty?
Ready to find your tier and score your readiness?
Two free tools, no sign-up required. Get clear on your obligations in five minutes.