Martyn's Law UK: What It Means for Venue and Event Insurance

Introduction

Martyn's Law represents a significant new legal responsibility for a very wide range of UK venues, from restaurants and shops to event spaces and entertainment venues, and its implementation over 2026 and 2027 has direct relevance to how businesses think about premises safety, event planning and the insurance that sits behind both. This guide explains what Martyn's Law actually requires, who it applies to, and how it connects to our existing guides on public liability insurance and event insurance.

Key Terms Explained

Martyn's Law

The popular name for the Terrorism (Protection of Premises) Act 2025, named in memory of Martyn Hett, who died in the 2017 Manchester Arena attack.

Standard Tier

The lower tier of duty under the Act, applying where a premises or event could reasonably expect between 200 and 799 individuals present at the same time.

Enhanced Tier

The higher tier of duty, applying where a premises or event could reasonably expect 800 or more individuals present at the same time, carrying additional requirements beyond the standard tier.

Public Protection Procedures

The core response procedures required under the Act, covering evacuation, invacuation, lockdown and communication in the event of a terrorist attack.

Security Industry Authority (SIA)

The regulator given responsibility for enforcing compliance with the Terrorism (Protection of Premises) Act 2025.

Why This Matters

For any business responsible for a premises or event that could reasonably attract 200 or more people, Martyn's Law introduces a genuine new compliance obligation with real enforcement consequences, and it changes the practical risk and preparedness landscape that public liability and event insurers are also interested in. Understanding your obligations well ahead of the expected 2027 enforcement date allows time to put procedures in place properly, rather than scrambling as the deadline approaches.

Overview of Martyn's Law

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, following a long campaign led by Figen Murray, the mother of Martyn Hett, who was killed in the 2017 Manchester Arena bombing. The Act requires those responsible for certain premises and events to take steps to prepare for a potential terrorist attack and to help keep people safe if one occurs, and requires larger premises and events to go further, considering their specific vulnerability to attack and taking reasonable steps to reduce it. The government built in a substantial implementation period, at least 24 months from Royal Assent, specifically to give businesses time to understand and prepare for their new obligations before enforcement begins.

Who Is In Scope: Premises and Events

Martyn's Law applies broadly across premises and events open to the public, rather than being limited to any single sector. This includes venues such as bars, restaurants, retail premises, places of worship, sports grounds, entertainment venues, visitor attractions and event spaces, provided the relevant capacity threshold could reasonably be met. Whether a specific premises or event falls into scope depends primarily on the number of people who could reasonably be expected to be present at the same time, rather than the type of business itself.

Standard Tier Duties (200-799)

Standard tier duties apply where a premises or event could reasonably expect between 200 and 799 individuals present at the same time. Under section 5 of the Act, those responsible for standard tier premises must put in place reasonably practicable public protection procedures, covering what to do in the event of an attack across four core areas: evacuation, invacuation, lockdown and communication. The standard tier is intended to be a proportionate, achievable set of expectations focused on procedures and preparedness rather than significant capital investment.

Enhanced Tier Duties (800+)

Enhanced tier duties apply from 800 individuals upward and build on the standard tier requirements. Under section 6 of the Act, enhanced tier premises must additionally implement specific public protection measures, going beyond procedures to consider physical and organisational measures that reduce vulnerability to an attack. Enhanced tier premises must also produce a documented security assessment, provide a compliance document to the regulator, and appoint a designated senior individual responsible for compliance where the responsible person for the premises isn't an individual.

Standard vs Enhanced Tier at a Glance

The Four Public Protection Procedures

Both tiers are built around the same four categories of public protection procedure, though enhanced tier premises must go further within each. Evacuation covers how people would be moved safely away from a threat. Invacuation covers how people would be moved to safety within the premises itself, where evacuating outside isn't the safest option. Lockdown covers securing the premises to prevent an attacker gaining further access. Communication covers how staff and the public would be informed and coordinated during an incident. Together, these four areas form the practical core of what a business needs to plan for, train staff on, and be ready to put into action.

Calculating Your Capacity Correctly

Capacity for the purposes of Martyn's Law is assessed against your premises' or event's realistic peak attendance, including staff, rather than a typical or average day. This means a venue that occasionally hosts larger events, such as a function room used for weddings or conferences alongside its everyday use, needs to consider its capacity at those busier peak moments, not just its usual footfall. Getting this calculation right matters, since incorrectly assuming you fall below a threshold based on average rather than peak attendance could leave a business non-compliant without realising it.

The Security Industry Authority's Role

The Security Industry Authority (SIA), better known for regulating the private security industry, has been given regulatory and enforcement responsibility for Martyn's Law. This includes providing guidance to help businesses understand and meet their obligations, and enforcement powers where premises fail to comply once the Act's duties come fully into force. The SIA published detailed statutory guidance on 18 May 2026 to help businesses prepare ahead of enforcement.

Implementation Timeline

Following Royal Assent on 3 April 2025, the government committed to an implementation period of at least 24 months before the Act's duties come fully into force, with full enforcement generally expected around April 2027. Statutory guidance was published on 18 May 2026, giving businesses in scope a genuine window to review their premises, plan and implement procedures, and prepare any necessary documentation well ahead of enforcement beginning. Businesses shouldn't treat this window as a reason to delay, given the scale of planning some premises, particularly enhanced tier ones, may need to undertake.

How This Relates to Public Liability and Event Insurance

Martyn's Law doesn't create a new compulsory insurance product, and it isn't a substitute for public liability or event insurance, which respond to a different kind of risk: third-party injury or property damage claims rather than the specific duty to prepare for a terrorist threat. However, the two are connected in practice. Insurers assessing public liability or event insurance risk for a venue increasingly take account of the premises' general safety, security and emergency preparedness, and demonstrating clear compliance with Martyn's Law obligations may become a relevant factor in how some insurers view a venue's overall risk profile over time. Our public liability insurance and event insurance guides cover these separate but related types of cover in full.

Insurers, Risk Assessment and Security Documentation

Some insurers may, over time, begin asking venues about their Martyn's Law compliance status as part of underwriting for public liability, event or commercial property insurance, particularly for larger enhanced tier premises where a documented security assessment already exists. Keeping this documentation current and readily available isn't just a regulatory necessity; it can also support a smoother, more informed conversation with your insurer or broker about how your premises manages this category of risk.

Exemptions and Sector-Specific Considerations

Certain premises and circumstances are expected to be treated differently under the Act, including some specific exemptions and sector-adjusted guidance reflecting the particular nature of certain venues, such as places of worship. Given the detail and ongoing refinement of statutory guidance, businesses should check the SIA's official guidance directly for how their specific type of premises is treated, rather than assuming a general rule applies uniformly across every sector.

Multi-Use and Shared Venues

Venues that host multiple different organisations or businesses, such as shopping centres, markets, or shared event spaces, raise particular questions about who holds responsibility for compliance, since more than one party may have some degree of control over parts of the premises. Where you operate from, host events in, or share responsibility for this kind of multi-use venue, clarify early who is responsible for which aspects of Martyn's Law compliance, ideally in writing, rather than assuming responsibility sits with someone else.

Places of Worship and Community Venues

Places of worship, and some community venues, are treated with particular care under Martyn's Law, reflecting both their community significance and, historically, their status as targets for certain forms of extremist violence. Statutory guidance provides sector-adjusted detail for places of worship on how to interpret and apply the standard and enhanced tier duties in a way that's practical for their specific circumstances, such as buildings that host worship, community events and occasional larger gatherings such as festivals. Community venues and voluntary organisations relying heavily on volunteer staff, rather than paid employees, should pay particular attention to how the guidance addresses staff training and designated responsibility in this context.

How This Differs from Existing Health and Safety Duties

Many businesses already have well-established health and safety obligations, fire risk assessments, and general emergency evacuation procedures, and it's worth understanding how Martyn's Law relates to, rather than duplicates, this existing framework. General health and safety and fire safety obligations are principally concerned with a much broader range of everyday risks, such as fire, structural safety and workplace hazards. Martyn's Law is specifically focused on preparedness for a terrorist attack, a distinct and more specialised category of risk requiring its own dedicated procedures, even where some crossover exists, such as evacuation planning. Existing fire evacuation procedures can be a useful starting point when developing Martyn's Law evacuation and invacuation procedures, but shouldn't be assumed to already satisfy the new duty without a proper review.

Martyn's Law vs the Prevent Duty

It's worth distinguishing Martyn's Law from the separate Prevent Duty, which requires certain organisations, particularly in education, local authorities and healthcare, to have due regard to preventing people being drawn into terrorism in the first place. The Prevent Duty is principally about early intervention and safeguarding, focused on preventing radicalisation, while Martyn's Law is about physical premises and event preparedness for responding to an attack that's already underway. Some organisations, particularly larger public sector bodies and universities, may find themselves subject to both duties, which serve genuinely different, complementary purposes rather than one replacing the other.

Staff Training and Ongoing Preparedness

Having written procedures in place is only part of genuine compliance; staff need to actually understand and be able to act on them. This means building Martyn's Law awareness into staff induction and ongoing training, running periodic practical exercises where appropriate, and ensuring temporary, casual and agency staff working at your premises or event also receive at least a basic briefing on the relevant procedures. For venues with high staff turnover, such as hospitality and events, embedding this training into a repeatable, low-effort onboarding process makes ongoing compliance considerably more manageable than treating it as a one-off exercise.

Costs and Resourcing Compliance

The practical cost of complying with Martyn's Law varies considerably depending on tier and existing preparedness. For many standard tier premises, compliance centres on staff time to develop, document and train on procedures, which the government has specifically designed to be achievable without significant capital spending. Enhanced tier premises face a somewhat higher resourcing requirement, given the need for a documented security assessment, and larger organisations may choose to commission specialist security consultants to support this work. Smaller businesses concerned about resourcing should start with the SIA's free statutory guidance and template materials, which are specifically designed to make standard tier compliance achievable without necessarily needing paid external support.

Franchises and Multi-Site Businesses

Businesses operating multiple premises, including franchises, chains and multi-site operators, need to assess Martyn's Law obligations on a premises-by-premises basis, since capacity, layout and risk can vary significantly between individual sites even under the same brand. A franchisor or head office can usefully provide template procedures and training materials to support consistency across sites, but the responsible person for each individual premises generally retains responsibility for ensuring that premises' specific compliance, rather than assuming a group-wide policy automatically satisfies the duty everywhere.

Reviewing and Updating Your Plan Over Time

Public protection procedures and, where applicable, security assessments shouldn't be treated as a one-off exercise completed ahead of the 2027 enforcement date and then left unchanged. Premises change layout, capacity, staff and usage patterns over time, and procedures should be reviewed periodically, and specifically after any significant change to the premises or how it's used, to ensure they remain accurate and genuinely workable. Building a simple annual review into your compliance routine, alongside reviews triggered by major changes, is a practical way to keep this current without it becoming a significant ongoing burden.

Practical Steps for Affected Businesses

Businesses that may fall within scope should start by realistically assessing their peak capacity, including staff, against the standard and enhanced tier thresholds, then review the SIA's statutory guidance for the specific procedures and, where applicable, measures required for their tier. Building the four public protection procedures into staff training, and for enhanced tier premises, commissioning a proper security assessment and appointing a designated senior individual, are practical next steps well worth starting ahead of the 2027 enforcement date rather than waiting until it arrives.

Enforcement and Penalties

Once the Act's duties come fully into force, the SIA will have enforcement powers to address non-compliance, which can include compliance notices, monetary penalties, and, in more serious cases, restriction notices affecting how a premises can operate. The exact scale of penalties and the SIA's practical enforcement approach are set out in the statutory guidance, and businesses should treat compliance as a genuine legal obligation with real consequences rather than an optional best-practice exercise.

Common Mistakes to Avoid

• Assuming your venue is out of scope without properly calculating peak capacity including staff.
• Waiting until closer to the expected 2027 enforcement date to begin preparing.
• Treating Martyn's Law compliance as equivalent to, or a replacement for, public liability or event insurance.
• Failing to clarify compliance responsibility clearly in multi-use or shared venues.
• Overlooking the additional enhanced tier requirements if your venue's peak capacity crosses 800.

Common Myths

• Myth: Martyn's Law only applies to large venues like stadiums and arenas. It applies from 200 people, which covers many smaller venues at peak capacity.
• Myth: Public liability insurance already covers Martyn's Law compliance. They address different risks; compliance is a separate legal duty, not an insurance product.
• Myth: Capacity is based on your average or typical attendance. It's based on realistic peak attendance, including staff.
• Myth: The Act is already being enforced. Full enforcement is expected around April 2027, following the 24-month implementation period.

Real-World Examples

Frequently Asked Questions

References and Editorial Standards

Conclusion

Martyn's Law introduces a genuine new compliance obligation for a very wide range of UK venues and events, built around realistic peak capacity rather than venue type, with standard tier duties from 200 people and enhanced tier duties from 800. While it doesn't create a new insurance product, it reshapes the safety and preparedness expectations that sit behind public liability and event insurance risk, and businesses have a meaningful window before the expected April 2027 enforcement date to assess their capacity, build the required public protection procedures, and, for larger premises, commission a proper security assessment.

Next Steps

• Assess your premises' or event's realistic peak capacity, including staff.
• Review the SIA's statutory guidance for your specific tier's requirements.
• Begin building the four public protection procedures into staff training.
• For enhanced tier premises, commission a security assessment and appoint a designated senior individual.