Martyn’s Law Event Security: 2025 Act Requirements Explained

Martyn’s Law event security requirements are now law. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The Government has committed to an implementation period of at least 24 months before the duties take effect. In practice, venues and event organisers should plan to be compliant during 2027. This guide explains what the Act requires and who it applies to. It also covers what the two tiers mean for event security and how to prepare now.

The law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in May 2017. It exists because the public inquiry found that many venues had no legal duty to protect the public from terrorism. Often, they had no plan either.

Martyn’s Law event security: the key facts

• Legislation: Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law.
• Status: Royal Assent 3 April 2025; duties expected to commence in 2027 after a 24-month implementation period.
• Regulator: the Security Industry Authority (SIA), which gains a new regulatory function.
• Standard tier: premises and events with capacity of 200 to 799.
• Enhanced tier: premises and events with capacity of 800 or more.
• Penalties: up to £10,000 for standard tier breaches. Up to £18 million or 5% of worldwide revenue for enhanced tier breaches, plus daily penalties for continuing failures.

Why Martyn’s Law was introduced

The Manchester Arena attack showed that public venues were targets for mass-casualty attacks. Many lacked even basic protective procedures. The subsequent inquiry highlighted failings in the security response. It also found no legal framework requiring venues to plan for a terrorist incident. Figen Murray, Martyn’s mother, campaigned for six years for legislation. Consequently, the Act is intended to embed the lessons of Manchester into the everyday culture of public venues across the UK.

Who Martyn’s Law applies to

The Act covers “qualifying premises” and “qualifying events”. Premises are buildings, or land with a readily identifiable boundary, used for purposes listed in the Act. These include entertainment, retail, hospitality, sport, leisure, visitor attractions, hotels, places of worship, healthcare, education and transport hubs. Qualifying events are those where 800 or more people may be present at once with express permission to enter. Entry checks such as tickets or passes must also apply.

Importantly, capacity means the reasonable expectation of how many people may be present at the same time. It is not fire capacity alone. Places of worship and childcare and education settings fall into the standard tier regardless of capacity. Genuinely private events, for example a wedding by invitation only, are outside scope.

Standard tier: public protection procedures

Standard tier premises (200 to 799) must notify the SIA that they are in scope. They must also have public protection procedures in place. These are procedures, not physical measures. They cover four areas. Evacuation moves people out safely. Invacuation moves people into or within the premises. Lockdown secures the premises against an attacker. Communication alerts staff and the public. The procedures must be reasonably practicable and appropriate to the premises. Staff must know what to do.

For example, staff must understand when to evacuate and when to lock down. An evacuation in response to a vehicle attack outside could send people towards the threat rather than away from it. A compliant plan documents the decision, the communication chain and each role. Staff then test it.

Enhanced tier: public protection measures and a senior individual

Enhanced tier premises and events (800 or more) carry all standard tier duties plus more demanding ones. They must put in place public protection measures. These can include physical security, monitoring and checks on people entering. They must produce a document describing their procedures and measures and provide it to the SIA. In addition, an organisation must appoint a designated senior individual accountable for compliance. The Government also encourages enhanced tier operators to engage a police Counter Terrorism Security Adviser.

What Martyn’s Law event security means for organisers

Event organisers are caught in two ways. First, a temporary event with 800 or more attendees and entry checks is a qualifying event in its own right, wherever it is held. Second, an event held inside qualifying premises falls within the premises’ own duties. For example, a 300-delegate conference in a hotel ballroom means the organiser works within the hotel’s procedures.

This does not mean every event needs uniformed security. For standard tier, the requirement is a documented set of procedures and staff who understand their roles. Organisers must also show they have considered the specific risks of the event and venue. However, enhanced tier events need a security professional involved in planning. The documentation must meet a standard the SIA can inspect. Our event security service covers the advance planning and documentation. It also covers operational delivery on the day. For a wider view, see our event security planning guide.

Penalties and enforcement

The SIA will have powers to inspect, request documents and issue compliance and restriction notices. It can also impose civil penalties. Standard tier breaches carry a maximum fixed penalty of £10,000. Enhanced tier breaches carry a maximum of £18 million or 5% of worldwide revenue, whichever is higher. Certain enhanced tier failures are criminal offences, for example ignoring a restriction notice. Beyond regulation, a failure at a non-compliant venue would bring severe reputational and civil liability consequences.

How to prepare for Martyn’s Law now

The duties are not yet in force. Nevertheless, the sensible approach is to prepare during the implementation period. First, establish which tier applies by assessing realistic maximum occupancy. Second, conduct a documented terrorism threat assessment for the venue or event type. Third, write the public protection procedures covering evacuation, invacuation, lockdown and communication. Fourth, train staff and record the training. Finally, review before every significant event. Enhanced tier operators should add the physical measures review, the compliance document and the designated senior individual.

The Government’s ProtectUK platform, run with the National Counter Terrorism Security Office, offers free guidance. It includes the ACT Awareness e-learning for staff.

Common questions about Martyn’s Law event security

When does Martyn’s Law come into force?

The Act became law on 3 April 2025. The Government has said the implementation period will be at least 24 months. Therefore, duties should begin in 2027. The SIA will publish guidance before then.

Does Martyn’s Law apply to a wedding or private party?

Not if it is genuinely private, by invitation only. However, the venue itself may be qualifying premises with its own duties.

Do I need to hire security to comply?

Standard tier does not require physical security or guards. It requires procedures and trained staff. Enhanced tier may require measures such as entry checks. In practice, that often means professional event security.

Who counts as the responsible person?

The person or organisation controlling the premises for its qualifying use. For a qualifying event, it is the organiser controlling the event.

Talk to Security and Safety Solutions

Security and Safety Solutions has advised venues and organisers on Martyn’s Law event security since the Bill’s final parliamentary stages. The team is led by Tom Richmond, a former commissioned officer in the Royal Military Police with a Level 7 Diploma in Security Management. If you operate qualifying premises or plan events of 200 people or more, contact us. Every first conversation is confidential and without obligation. Related reading: Martyn’s Law in education and Martyn’s Law and the security industry.