Martyn's Law: what the standard tier actually asks of a venue

Martyn's Law is on the statute book and most venues are treating it as a problem for later. It is worth getting ahead of, because for the majority of venues the duty is not about bollards and bag searches. It is about whether your team knows what to do in the first five minutes.

Where things stand

The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025. It is named for Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. It exists because his mother, Figen Murray, campaigned for it for years.

The Home Office published its final statutory guidance in April 2026. The Security Industry Authority, which will regulate the new duties, consulted on its own draft guidance on how it will regulate and enforce until June 2026. The Act itself is not yet in force: commencement is currently expected from spring 2027 at the earliest, after a minimum two year implementation period.

That sounds like a long runway. For a venue that has never written a lockdown procedure, let alone rehearsed one, it is not.

Two tiers, based on how many people may be there

The test is how many people it is reasonable to expect could be on the premises at the same time.

• Standard tier, 200 to 799 people. Notify the SIA that you are responsible for the premises and have public protection procedures in place. That means planned, practised responses for evacuation, invacuation (bringing people inside to safety), lockdown and communicating with the people on site. No physical security measures are required.
• Enhanced tier, 800 people and above, plus qualifying events. Everything in the standard tier, plus public protection measures that reduce vulnerability to an attack, a documented assessment of how you meet the duty and a designated senior individual where the responsible person is a company.

Penalties are civil and issued by the SIA. At the enhanced tier they reach £18 million or 5% of worldwide revenue, whichever is higher. Criminal offences also apply.

The part people miss

The standard tier is mostly about people, not paperwork. A procedure that lives in a folder in the office and has never been walked through by the Saturday night team does not protect anyone. The question an inspector will eventually ask is the same question a good duty manager asks now: if something happened at the front door at midnight, who does what, in what order and how does everyone else find out?

A written plan nobody on the floor has rehearsed is not compliance. It is a document.

What to do now

• Work out your tier honestly. It turns on the number of people you can reasonably expect at peak, which is not always the number on your fire certificate or your licence.
• Start from what you already have. Fire evacuation plans, Ask for Angela, door team briefings and incident logs already cover part of the ground.
• Write the four procedures. Evacuation, invacuation, lockdown and communication. Short, specific to your building and usable at two in the morning.
• Train and rehearse. Walk the team through each one, then do it again with the next intake. Keep a record that you did.
• Keep an eye on the SIA. Its final regulatory guidance and the notification process will set the detail of what inspection looks like.

Free training and guidance is available through ProtectUK. Figen Murray's own story is at figenmurray.co.uk. If you want help working out your tier or writing procedures your team will actually use, that is the kind of preparation we do.