Martyn's Law for small venues: plain-English guide

The Act is known as Martyn's Law in memory of Martyn Hett, who was killed with 21 others in the Manchester Arena attack on 22 May 2017. His mother, Figen Murray, campaigned for years for venues to be better prepared.

What it is

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. It applies across the UK. Its purpose is to make sure people responsible for certain premises and events take sensible steps to reduce harm if a terrorist attack happens. The Security Industry Authority (SIA) is the regulator.

For most small venues that are in scope, the duties are about preparation and people, not expensive equipment: know what you'd do, write it down, and make sure your team knows their part.

A few parts of the Act are already in force: the statutory guidance (since April 2026) and the SIA's guidance powers (since June 2026). Regulations made in 2026 set out what you'll tell the SIA and when, and how to decide a building's principal use. The main duties aren't in force yet.

Who's in scope

Premises qualify when all of these are true:

There's a building (or buildings) on the site.
It's used wholly or mainly for one of the uses in Schedule 1 of the Act, including shops and services to the public, food and drink, entertainment and leisure, halls and venues for hire, places of worship, hotels, libraries, museums and galleries, visitor attractions, sports grounds, health care, education and childcare, and public authority buildings open to the public.
200 or more people (including staff) may reasonably be expected to be present at the same time, from time to time.

Shops, food and drink, entertainment and leisure, libraries, museums and galleries, and halls only count when they're used mainly for visiting members of the public; public authority buildings count for the parts open to visiting members of the public. Paying customers, ticket holders and club members all count as members of the public. The other uses (places of worship, hotels, visitor attractions, sports grounds, health care, childcare, schools, further and higher education) have no public-access test. Offices, workshops and warehouses that aren't open to the public aren't a Schedule 1 use, so they aren't covered.

Working out your number. Use the most people reasonably expected at once, not your average. The Home Office suggests methods such as the occupancy figure in your fire risk assessment, a licence capacity, seating plus standing space, your busiest day on record, or ticket numbers. Include staff, and record how you worked it out - you'll need it for your SIA notification.

Standard and enhanced tiers

Standard tier: 200 to 799 people.
Enhanced tier: 800 or more people. Childcare settings, schools, further education colleges and places of worship are treated as standard tier even at 800 or more.

Most pubs, cafés, village halls, churches, gyms and shops that are in scope will be standard tier. Ticketed, paid or members-only events for 800 or more people at premises that aren't enhanced tier have their own rules (qualifying events).

More than one use? If your premises have more than one Schedule 1 use (for example a church hall hired out for parties, or a school used for events), the principal use is the one that relates most closely to the purpose and nature of the premises. The Principal Use of Premises Regulations 2026, in force from 15 October 2026, set out how to decide it, looking at things like what the building was built or changed for, how it's used day to day and how the local authority treats it.

Standard tier duties

Tell the regulator. Notify the Security Industry Authority (SIA) that you're responsible for the premises - and update it within 28 days if your details change.
Have public protection procedures. Put appropriate procedures in place, so far as is reasonably practicable, for four things: evacuation, invacuation, lockdown and communication.
Part of the procedures: make sure your team knows them. The Home Office guidance expects the people working at the premises to be made aware of the procedures and their role in them. There's no statutory training requirement at standard tier.

"So far as is reasonably practicable" matters: the expectation is proportionate to your venue and resources. A village hall committee isn't expected to behave like a stadium.

The four procedures

The Home Office describes four public protection procedures. Here's what each means, with the kind of detail your own version should cover:

Evacuation

Getting people away from danger by moving them out of the premises. Which exits, who checks the toilets and back rooms, where people gather - and a back-up place if the main one isn't safe.

Invacuation

Moving people away from danger to a safer place inside, when the danger is outside. Which rooms have solid walls and lockable doors, how you get people away from windows and glass.

Lockdown

Securing the premises to stop people entering or leaving - for example locking doors, closing shutters or using barriers. Every door, how it locks, and who locks it.

Communication

Alerting people to danger quickly and telling them to stay put or move away. How staff alert each other, how you tell the public, who calls 999 and what they say.

Muster's procedures builder asks these questions one at a time and produces a printable document and a one-page staff briefing, with a sign-off link for each team member.

Notifying the SIA

Responsible persons will notify the SIA through its online portal. The Notification Requirements Regulations 2026 give existing qualifying premises three months from the day the requirement comes into force (that day is still expected, not fixed); after that, new responsible persons and changes must be notified within 28 days, and there are separate time limits for events. According to the regulations and the SIA's notification guidance, you'll be asked for things like:

Name and contact details of each responsible person, any trading names, and any company or charity number
Details of anyone else with control of the premises, anyone you must co-ordinate with, and whoever submits the notification (with confirmation they're authorised)
Whether you're responsible for other qualifying premises or events
The premises address and postcode
Your occupancy figure and the method you used
Websites and social media used to promote the premises
Licences and certificates held, applied for or notified, such as a premises licence or temporary event notice
Which Schedule 1 use applies, any seating next to the premises (including on the pavement), and confirmation the premises meet the Act's definition

When it starts

3 April 2025
The Terrorism (Protection of Premises) Act 2025 receives Royal Assent.
April to October 2026
The statutory guidance (April) and the SIA's guidance powers (June) come into force, and regulations set the notification rules (July) and how to decide a building's principal use (October).
Autumn 2026
The SIA publishes its final guidance and consultation report.
Early 2027 (planned)
The SIA invites volunteers to test its notification portal before launch.
Spring 2027 (expected)
The main duties are expected to come into force, after an implementation period of at least 24 months.
Within 3 months of commencement
Existing qualifying premises must notify the SIA (set by the Notification Requirements Regulations 2026).

Dates marked "expected" aren't fixed yet. There's no legal requirement to comply until the duties come into force - but writing procedures and briefing staff now is free, takes an afternoon, and helps your team today.

Enforcement

The SIA says it will help those responsible comply with the law, using desk-based assessments and on-site inspections with a risk-based approach - typically giving at least 72 hours' notice before an inspection. Its focus is on whether you've taken reasonable steps, given your venue's circumstances. For standard tier premises, monetary penalties can be up to £10,000, and daily penalties up to £500 while a failure continues. Enhanced tier penalties are higher. The SIA can also issue compliance notices (and, for enhanced tier premises and qualifying events only, restriction notices).

What to do now

Confirm who the responsible person is. Usually whoever controls the premises: the business owner, licensee, trustees or the hall committee.
Record how many people may be there at once. Use your fire risk assessment, licence capacity, seats or your busiest day. Include staff, and write down how you worked it out.
Walk the venue with fresh eyes. Note every exit, the rooms people could shelter in, and which doors can be locked quickly - and how.
Write simple procedures for the four situations. Evacuation, invacuation, lockdown and communication. Plain language your team can remember under pressure.
Brief your team and keep a record. Make sure everyone who works there knows the procedures and their part in them. Note who has been briefed and when.
Point staff at free ACT Awareness e-learning. ProtectUK offers free counter-terrorism awareness e-learning that helps staff feel more confident.
Gather what you'll need to notify the SIA. Contact details, address, occupancy figure and method, licences, websites and social accounts.
Set a review date. Look at your procedures again regularly (once a year is a sensible default), and whenever your layout, opening hours or events change.
Keep your fire safety records current. A separate duty that applies all year round: tests, servicing, drills, training and your fire risk assessment.

Free help and official sources

This guide is general information based on GOV.UK, SIA and Home Office guidance and legislation.gov.uk as of 15 October 2026. It isn't legal advice. Always check the official guidance for your situation. Muster customers get an email when the official guidance changes.

Martyn's Law, in plain English.