Martyn's Law: What Premises Must Document & Keep (2026)
Martyn's Law requires qualifying venues to document evacuation, lockdown and communication procedures. The two tiers, the SIA's role, and the records to keep.
By Jamie Dawson · Editor
▮
Updated 15 Jul 2026
▮
3 min read
Quick answer: Martyn's Law — the Terrorism (Protection of Premises) Act 2025 — requires qualifying public premises and events to put in place, and document, procedures that reduce harm in the event of a terrorist attack. It works in two tiers: standard duty premises (200–799 people) must have documented evacuation, lockdown ("invacuation") and communication procedures; enhanced duty premises and events (800+) must also carry out and record a documented assessment and put in place monitoring measures. The Security Industry Authority (SIA) is the regulator. Statutory guidance was published on 15 April 2026 and the SIA's functions began in June 2026, with a roughly 24-month implementation period before enforcement — so the time to build your records is now.
What Martyn's Law is
Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena attack, and it places a legal duty on those responsible for certain premises and events to be prepared to keep people safe. The government published statutory guidance under the Act on 15 April 2026 to help duty holders understand what is required.
Who it applies to — the two tiers
The duty is based on how many people may be present at the same time:
- Standard duty (200–799 people) — premises such as shops, restaurants, bars, places of worship and community halls. The responsible person must put in place, and make staff aware of, procedures to follow in the event of an attack.
- Enhanced duty (800 or more people) — larger venues and qualifying events, such as concert halls, stadiums, large stores and festivals. These carry additional obligations, including documented assessments and physical/procedural monitoring measures.
What standard-duty premises must have in place
For standard-duty premises the focus is on simple, well-understood public protection procedures. In practice you should be able to evidence that you have:
- Evacuation procedures — how to get people out of the premises safely.
- Invacuation / lockdown procedures — how to bring people to safety inside and secure the premises where leaving would be more dangerous.
- Communication procedures — how staff alert people and each other quickly.
- Staff awareness — evidence that relevant staff know the procedures and their role.
What enhanced-duty premises must additionally do
- Carry out and document a risk assessment of the premises or event.
- Put in place monitoring and mitigation measures appropriate to the risk — for example CCTV, bag searches, vehicle checks or search regimes.
- Keep a documented security plan and be able to provide relevant documents to the SIA on request.
- Designate and record a responsible person accountable for compliance.
The records you should keep
Martyn's Law is, in record-keeping terms, about being able to show you were prepared. A defensible file for a qualifying premises typically includes:
- The written public protection procedures (evacuation, invacuation, lockdown, communication).
- Staff training and awareness logs — who was briefed, on what, and when.
- For enhanced premises: the documented assessment, the security plan, and records of monitoring measures and tests/drills.
- A named responsible person and a review date, so the procedures stay current.
Timeline and enforcement
Royal Assent was on 3 April 2025. The government has confirmed an implementation period of at least 24 months to give those responsible time to prepare, meaning the substantive requirements are expected to be enforced from around 2027. Statutory guidance was published on 15 April 2026, and the SIA's regulatory functions commenced in June 2026. Duty holders should use this window to put procedures and records in place rather than waiting for enforcement to begin.
FAQs
Is Martyn's Law in force now?
The Act is law, but the operational duties are being introduced over an implementation period of at least 24 months from Royal Assent (April 2025). Enforcement is expected from around 2027. Statutory guidance (April 2026) and the SIA's functions (June 2026) are already in place, so preparation should begin now.
Who is the regulator?
The Security Industry Authority (SIA) regulates Martyn's Law, with a remit to support, advise and — ultimately — enforce compliance.
Does my small venue count?
The duty starts at premises where 200 or more people may be present at the same time. Below that threshold the Act's requirements do not apply, though good practice still helps.
What happens if I don't comply?
The SIA will have enforcement powers once the regime is fully in force. Enhanced-duty premises face the most significant obligations and scrutiny. Keeping clear, dated records of your procedures is the simplest way to demonstrate compliance.