Martyn’s Law 2026: New Guidance & Compliance Requirements for UK Venues

What Has Changed Under Martyn’s Law in 2026? 

The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law, received Royal Assent on April 3, 2025. It will establish new preparedness and protective-security requirements for certain publicly accessible premises and events across England, Scotland, Wales, and Northern Ireland. 

A major step toward implementation came on April 15, 2026, when the Home Office published statutory guidance under Section 27 of the Act. The guidance provides greater detail on which premises and events fall within scope, how the standard and enhanced tiers apply, and how responsible persons can meet their duties in a proportionate way. 

Further guidance has since clarified notification requirements and how to determine the principal use of premises with multiple uses. The Security Industry Authority, which will regulate Martyn’s Law, is also developing its regulatory framework and supporting tools ahead of commencement. 

The underlying thresholds have not changed. Instead, the 2026 guidance provides organisations with a clearer framework for moving from understanding the legislation to preparing for implementation.

Who Is in Scope of Martyn’s Law? 

Martyn’s Law applies to qualifying premises where it is reasonable to expect at least 200 people, including staff, to be present at the same time from time to time and where the premises meet the other scope criteria set out in the Act. 

Standard tier premises generally include qualifying premises where 200 to 799 people may reasonably be expected to be present at the same time.

Enhanced tier premises generally include qualifying premises where 800 or more people may reasonably be expected to be present at the same time. 

Qualifying events are treated differently. There is no standard tier for events. An event may fall within scope where 800 or more people may reasonably be expected to be present, it is accessible to the public, it is not already taking place at enhanced-tier premises, and entry is subject to a condition such as a ticket, payment, pass or membership. 

The assessment is not simply a calculation of theoretical maximum capacity. The Home Office allows organisations to use reasonable, evidence-based methods such as fire-safety occupancy figures, historical attendance information, and other appropriate data to determine how many people can reasonably be expected to be present.

What Do Standard and Enhanced Tier Premises Need to Do? 

All qualifying premises and events will be required to notify the Security Industry Authority and have appropriate public protection procedures in place, so far as is reasonably practicable. 

These procedures address how people working at the premises would respond if they suspected that an act of terrorism was occurring or about to occur. They include evacuation, invacuation, lockdown, and communication. 

For standard-tier premises, the emphasis is primarily on organisational preparedness. The legislation does not automatically require physical alterations or the purchase of security equipment simply because premises fall within the standard tier. People expected to implement the procedures must, however, understand what they are expected to do and be able to put those procedures into practice. 

Enhanced-tier premises and qualifying events have additional obligations. Responsible persons must ensure that appropriate public protection measures are in place, so far as reasonably practicable, to reduce vulnerability to terrorist attacks and reduce the risk of physical harm if an attack occurs. 

Depending on the premises and its circumstances, measures could involve monitoring, access arrangements, movement of people, physical security, policies for suspicious items, CCTV, or other protective design security strategies. The guidance does not impose a universal checklist. The central test is whether the measures are appropriate and proportionate to the particular premises or event.

Enhanced-tier duty holders must also document their public protection procedures and measures and assess how they are expected to reduce vulnerability and the risk of harm. Where the responsible person is an organisation rather than an individual, a designated senior individual must oversee compliance, reinforcing that Martyn’s Law is a senior governance responsibility rather than solely an operational security function.

New SIA Notification Requirements 

The 2026 guidance also gives organisations greater clarity about how they will notify the Security Industry Authority. 

Once the relevant provisions of Martyn’s Law commence, responsible persons for qualifying premises will generally have three months to submit their initial notification. Changes to previously notified information will generally need to be reported within 28 days. 

For qualifying events, the responsible person will in most cases need to notify the SIA within 14 days of the event date being made publicly available. The SIA is developing an online notification portal that will be accessible through GOV.UK. 

Responsibility itself cannot be outsourced. A responsible person may authorise another party to submit information or provide specialist advice, but legal responsibility for complying with Martyn’s Law remains with the responsible person.

Clarifying Responsibility at Complex and Mixed-Use Premises 

New Home Office guidance published in September 2026 also addresses an important issue for complex buildings and venues: determining the principal use of premises. 

Where an individual qualifying premises has two or more uses identified in Schedule 1 of the Act, its principal use may need to be established to determine who is the responsible person. Factors can include what the premises were designed or modified for, their physical characteristics, licensing and planning treatment, the amount of space devoted to different activities, and how frequently those activities occur. 

This can be particularly relevant for stadiums, hotels, cultural venues, campuses, and other assets where multiple public-facing activities take place within a single premises. 

For premises involving multiple responsible persons or areas of shared control, the Act also requires relevant parties to coordinate and cooperate in meeting their respective duties. 

For owners and operators of complex estates, establishing control and responsibility early will be an important part of implementation planning.

How Should Venue Owners and Operators Prepare for Martyn’s Law? 

For organisations likely to fall within scope, the implementation period is an opportunity to establish who will be responsible, confirm whether premises are standard or enhanced tier, review existing evacuation, invacuation, lockdown, and communication procedures, and determine whether current protective-security measures can be clearly explained and documented. 

For complex or enhanced-tier assets, this review may also involve examining how building design, access and egress, public circulation, perimeter conditions, monitoring, security operations, and emergency planning work together. 

The objective should not be to add security measures for their own sake. Martyn’s Law is built around the principle of what is appropriate and reasonably practicable for each premises or event. Effective preparation therefore requires an integrated understanding of risk, operations, people, and the built environment. 

Need help preparing for Martyn’s Law? Talk to our protective security experts