Martyn’s Law in Practice
Strategic Insight on Operationalising Current Guidance
Practical answers to the how, why and what next
.
By Anthony Gledhill | Updated September 2026
.
Purpose
Martyn’s Law establishes what organisations in scope will be required to do. The critical question is whether those requirements will actually work when people need them.
That is the purpose of this article.
It looks beyond the legislation and considers how organisations turn legal requirements into decisions, actions and protective security capability.
There is an important distinction throughout
The law establishes what must be done. Procedures provide structure. Documentation helps communicate and evidence the arrangements.
Capability is whether people can actually make them work when needed.
For Enhanced Tier premises and qualifying events, specified documentation is itself a legal requirement. For Standard Tier premises, the position is different.
Understanding that distinction helps prevent one of the easiest mistakes under a new regulatory regime, building the paperwork and assuming you have built the capability.
When the Incident Starts, if you start looking for folders you have lost
Imagine a knife attack begins at the main entrance of a busy shopping centre.
One member of staff activates the normal fire evacuation procedure. Security tries to stop people moving towards the entrance. One tenant locks its doors while another evacuates customers into the open areas. The control room receives conflicting information while managers wait for confirmation.
Everyone is trying to help. The problem is that their actions are out of sync.
The shopping centre may have plans, trained staff, radios, CCTV and experienced security officers. None of those things independently creates capability.
People need to understand the available options, their responsibilities, who can make decisions, how information moves and how their actions affect everybody else.
That is the operational challenge behind the Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law.
The substantive requirements are not yet in force. Current government and SIA planning is for commencement in spring 2027.
Organisations therefore still have time to prepare.
First Establish What You Are Responsible For
Before writing a Martyn’s Law policy, buying equipment or arranging training, establish the legal and operational position.
The sequence should be:
- define the premises and relevant Schedule 1 use
- establish the number of people reasonably expected
- determine principal use where necessary
- identify the Responsible Person
- establish the applicable tier
- identify coordination and cooperation requirements
This matters because if the premises boundary, use, attendance assessment or Responsible Person is wrong, everything built afterwards could be based on the wrong assumption.
Premises can include a building, part of a building, a group of buildings or a building together with other land. There must be a building accessible to the public to some extent and the premises must be wholly or mainly used for a Schedule 1 use.
Payment, tickets, passes or membership do not automatically mean premises are outside scope. Premises can also exist within other premises, making the boundaries particularly important on complex sites.
Government reference: Home Office Statutory Guidance, Chapter 4.
Attendance and Tier
For qualifying premises, it must be reasonable to expect at least 200 people, including staff, to be present at the same time.
Generally, 200 to 799 places premises within Standard Tier, while 800 or more places them within Enhanced Tier.
Places of worship and premises used for childcare, primary, secondary and further education receive special treatment and remain Standard Tier where they otherwise qualify, even at 800 or more.
The assessment is not simply average attendance or theoretical maximum capacity. Predictable peaks can matter.
Historic attendance, ticketing, fixed seating, licensing, occupancy information and reliable operational records may all provide evidence.
The important point is that the organisation should be capable of explaining the number, the evidence and the reasoning behind it.
Government reference: Home Office Supplementary Document A, Methods for Assessing the Reasonable Expectation of Individuals Present at Premises and Events.
Principal Use
The Home Office published dedicated Principal Use guidance in September 2026.
It becomes relevant where an individual premises has two or more Schedule 1 uses and its principal use needs to be determined. It does not apply merely because a larger site contains several separate premises with different uses.
The assessment considers the purpose and nature of the premises, including what they were built or modified for, their continuing use, physical characteristics and relevant planning or licensing treatment.
The practitioner point is simple: follow how the premises actually operate and record the reasoning.
Government reference: Home Office, Principal Use of Premises, September 2026.
The Responsible Person
The Responsible Person is determined by control, not simply ownership or whoever an organisation chooses to nominate.
For qualifying premises, it is generally the person or organisation controlling the premises in connection with the relevant Schedule 1 use.
The corrected Home Office guidance gives a useful example. A pub is owned by a brewery or pub company and leased to a tenant. Although the brewery or pub company holds the licence, the tenant controls the premises for the relevant use and is therefore the Responsible Person.
Tasks can be delegated. The statutory responsibility cannot simply be transferred for convenience.
Government reference: Home Office Statutory Guidance, Chapter 6 and corrected Example 3, page 58.
Standard and Enhanced Tier: The Important Difference
For Standard Tier premises, the Responsible Person must notify the SIA as required and ensure appropriate public protection procedures are in place, so far as reasonably practicable. Applicable coordination requirements must also be met.
Those procedures concern four areas:
- evacuation
- invacuation
- lockdown
- communication
There is no legal requirement within the Standard Tier requirements to prepare the section 7 compliance document required for Enhanced Tier premises and qualifying events.
Paragraph 7.32 of the statutory guidance is clear on this.
However, the Home Office says the Responsible Person should document the procedures because this helps staff understand them and may be important when demonstrating compliance during an SIA inspection.
The distinction is therefore important:
Standard Tier: the operational procedures are legally required. Proportionate documentation is strongly recommended to support and evidence them.
Enhanced Tier premises and qualifying events go further.
Appropriate public protection measures must also be in place, so far as reasonably practicable. Where the Responsible Person is an organisation, a Senior Individual must be designated, and section 7 documentation is a legal requirement.
That document must set out the procedures and measures in place or planned and assess how they are expected to reduce physical harm and vulnerability. Deferred measures must also be addressed. The document must remain current, be provided to the SIA as soon as reasonably practicable after first preparation and within 30 days of revision.
Legal reference: Section 7, Terrorism (Protection of Premises) Act 2025.
Government reference: Home Office Statutory Guidance, paragraphs 8.56 to 8.67.
In practice
An Enhanced Tier venue records that its public entrances can be rapidly secured during lockdown. During an exercise, the duty manager discovers that nobody on the current shift has access to one of the controls needed to secure a major entrance.
The procedure is documented. The measure exists. The capability does not.
Testing has exposed the difference between what the organisation believed it could do and what it could actually do.
That is why documentation should evidence capability, not be mistaken for it.
Procedures Have to Work Together
Evacuation, invacuation, lockdown and communication are not four isolated procedures.
A hostile incident could require one part of a premises to evacuate while another invacuates or locks down. Normal fire evacuation routes could even move people towards the threat.
Organisations therefore need to understand where people can safely move, what areas can realistically be secured, who can make those decisions and how instructions will be communicated.
Communication connects the entire response. Who sends the warning? What do people need to know? Can different areas receive different instructions? What happens if the primary communication method fails?
The question is not simply whether four procedures exist. It is whether they can operate together as circumstances change.
In practice
Return to the knife attack at the shopping centre entrance.
Security is trying to stop movement towards the attack. One tenant locks down. Another evacuates into the mall. Staff begin following the fire evacuation procedure while managers wait for more information.
Individually, people may believe they are doing the right thing.
Collectively, they are creating confusion.
Capability means people understand the options, their authority and how their actions affect the wider response.
Coordination Can Prevent Unnecessary Chaos
Shopping centres have tenants. Events use contractors. Hotels can contain independently operated businesses. Landlords, operators and security providers may control different systems.
Martyn’s Law recognises these dependencies through coordination and cooperation requirements.
The practical issue is not simply exchanging plans. Organisations may share evacuation routes, alarms, public address systems, vehicle entrances, control rooms and emergency exits. Their actions need to make sense together.
In practice
A large event receives a credible bomb threat.
Security starts moving people away from one area. A contractor closes an access point and unknowingly redirects people towards the area being cleared. Front of house staff continue admitting customers because nobody has told them to stop. One stakeholder wants to evacuate while another wants everyone kept inside until police arrive.
Each organisation may have a procedure.
But there is no coordinated capability.
People can follow their own plans correctly and still collectively make the situation worse. Capability means stakeholders understand not only what they do, but how their actions fit into the wider response.
Decision Making Needs Authority
Hostile incidents rarely begin with complete information. People may hear a bang, see people running or receive a fragmented radio message. Someone has to interpret what is happening, decide and communicate. Others then have to act.
That requires authority.
Ask the person running the premises today
If something happens now, what decisions can you make without asking anyone else?
If the answer is unclear, you have identified a vulnerability.
The Manchester Arena Inquiry demonstrated how weaknesses in security, communication, command, information sharing and decision making can affect the response to an attack.
London Bridge and Borough Market demonstrated how rapidly an incident can move across locations and organisational boundaries.
The objective is not to predict the next attack.
It is to provide enough structure to give direction and enough capability to adapt when reality does not follow the plan.
Training Must Develop Capability
Martyn’s Law does not prescribe a particular training course, qualification, certificate, provider or number of training hours.
That does not make staff capability optional.
Those responsible for implementing procedures need sufficient understanding, experience and access to the necessary tools. The Home Office warns that where people are not informed or trained, it may be difficult to demonstrate that appropriate procedures are genuinely in place.
The better question is therefore not:
Has everybody completed Martyn’s Law training?
It is:
Can the people with responsibilities actually perform them?
Training should reflect the role. A receptionist, security officer, control room operator and duty manager do not require identical capability.
An attendance record proves somebody attended training. It does not prove they can act.
Give a duty manager a simple scenario: there is a suspected attack outside the main entrance.
Ask:
What would you do?
Their answer will quickly reveal whether they understand the procedure, their authority, responsibilities and communication route.
Government reference: Home Office Statutory Guidance, paragraphs 7.51 to 7.62 and Supplementary Document C.
Practise Before Reality Tests the System
Testing does not always require a major exercise.
A short tabletop discussion can expose significant weaknesses if the scenario is realistic and people are allowed to make decisions rather than being coached towards the answer.
Test communication, decision making and assumptions. Where appropriate, test physical actions such as securing doors or accessing equipment.
Did a decision take too long? Was a message misunderstood? Could the door actually be secured? Did two stakeholders take conflicting action?
Correct the weakness and test again.
Capability develops through use, not assumption.
This matters because there will always be a period during a serious incident before specialist emergency responders can take effective control.
People already at the premises will be making decisions during that period.
The objective is not to turn employees into emergency responders or expose them unnecessarily to danger. It is to give them sufficient understanding to recognise what is happening and take reasonable protective action within their responsibilities.
Enhanced Tier: Measures and Professional Judgement
Enhanced Tier premises and qualifying events must consider appropriate public protection measures, so far as reasonably practicable, across four areas:
- monitoring
- movement
- physical safety and security
- security of information
Measures may involve people, policies, processes and physical mitigations.
There is no universal Enhanced Tier security package. Not every premises requires identical CCTV, barriers, searches, access control or security staffing.
The organisation needs to understand its environment, vulnerabilities and existing protection before selecting additional measures.
Security of information is particularly easy to overlook. Floor plans, access arrangements, security layouts, CCTV locations, emergency procedures, staff instructions, delivery information and technical documents can all potentially assist hostile planning.
The organisation should consider what information genuinely needs to exist, who needs access and what is being published unnecessarily.
Reasonably Practicable Requires Judgement
Reasonably practicable does not mean doing everything imaginable.
Nor does it mean doing nothing because the ideal solution is difficult or expensive.
The organisation should identify the protective objective, consider realistic options and balance the expected benefit against factors such as cost, time and difficulty.
In practice
A venue identifies vehicle access close to an area where large numbers of people gather. Permanent hostile vehicle mitigation would be difficult and disproportionate at that stage.
That should not end the assessment.
Could vehicle access change? Could deliveries move to different times? Could queues be repositioned? Could temporary measures or another entrance reduce exposure?
The question is not simply:
Can we afford the first solution?
It is:
What reasonably practicable options can achieve the protective outcome?
Then record the judgement: what was identified, what was considered, why decisions were made and when they should be reconsidered.
Good documentation records professional judgement.
It does not replace it.
Review, Notification and Regulatory Assurance
For Standard Tier, keeping procedures under review is not itself a separate statutory requirement under section 5. The Home Office nevertheless says they should be reviewed so they remain current, appropriate and reasonably practicable.
For Enhanced Tier, public protection measures must be kept under review and the section 7 document must remain current.
This matters because buildings, attendance, entrances, contractors, technology and operating conditions change. A procedure can remain perfectly written while no longer reflecting reality.
Ask:
Does what we have written still describe what would actually happen today?
Notification to the SIA will also be a legal requirement when the Act comes into force. The Home Office published dedicated Notification Requirement guidance in July 2026 and the SIA is developing the GOV.UK notification portal.
Notification matters, but notifying the regulator does not make premises prepared.
The SIA’s regulatory approach includes desk based assessment and onsite inspection. For Standard Tier, organisations may need to demonstrate that required procedures are genuinely in place. For Enhanced Tier and qualifying events, section 7 documentation forms part of the statutory requirement.
The strongest assurance is therefore not simply a complete file.
It is being able to show what was identified, what was decided, why decisions were made, how people were prepared, what was tested and what changed as a result.
Enforcement Is Significant, But Protection Is the Goal
The SIA will have enforcement powers including information notices, compliance notices and, for Enhanced Tier premises and qualifying events, restriction notices.
Relevant Standard Tier financial penalties can reach £10,000. For Enhanced Tier premises and qualifying events, penalties can reach £18 million or 5 per cent of qualifying worldwide revenue, whichever is higher. Criminal offences can also apply in certain circumstances.
Those figures matter.
But fear of enforcement is a poor foundation for protective security.
The objective should be arrangements that protect people and withstand scrutiny because they genuinely work.
What Good Capability Looks Like
Return once more to the shopping centre.
A serious incident is reported at the main entrance. Information is incomplete, but the duty manager understands their authority and prevents further movement towards the affected area.
Security redirects people. The control room sends one clear instruction. Tenants understand what is expected because arrangements have previously been coordinated. Relevant doors are secured. Emergency services receive a concise update and the response changes as better information becomes available.
Nobody needs to find the policy.
Nobody needs to telephone head office for permission.
Nobody acts independently without understanding the consequences for others.
The procedure provided structure.
Training developed understanding.
Practice exposed weaknesses.
Documentation recorded the arrangements.
Capability brought everything together when it mattered.
That is the outcome organisations should be working towards.
What Organisations Should Do Now
Use the implementation period to establish the premises, relevant use, attendance, Responsible Person and tier.
Understand dependencies with landlords, tenants, contractors and neighbouring stakeholders.
Then look at the environment as it actually operates.
Develop workable procedures and, where required, appropriate measures. Give people clear responsibilities and authority. Train for the role rather than the certificate. Practise the arrangements, identify weaknesses, correct them and ensure the documentation reflects reality.
The sequence is straightforward:
Understand. Assess. Decide. Develop. Practise. Test. Evidence. Improve.
That is how a legal requirement becomes operational capability.
The Legal Threshold Is Not the Limit of Protective Security
Martyn’s Law establishes a legal minimum standard for preparedness.
It should not become the limit of professional judgement.
The legal question is:
Are these premises in scope and what does the Act require?
The wider protective security question is:
Where could people be harmed and what can we reasonably do about it?
Queues form outside entrances. Crowds disperse after events. Deliveries arrive. Staff change shifts. Shared areas become busy.
Vulnerability changes throughout the operating day.
The boundary of legislation should not become the boundary of protective security thinking.
Final Thought for Leadership Teams
During the first moments of a hostile incident, the organisation may not know whether it is dealing with terrorism, serious violence, criminal activity or something else.
That classification may come later.
The immediate requirement is recognition, decision making and proportionate action.
That is why effective procedures, clear authority, coordinated stakeholders and practised decision making have value far beyond Martyn’s Law.
The objective should not be an organisation capable of producing the right document when the regulator arrives.
It should be an organisation whose people understand what to do when the incident arrives.
A policy cannot evacuate a building.
A certificate cannot initiate lockdown.
A compliance document cannot communicate a warning.
People do those things.
Policy, procedures, training, testing and documentation all matter.
But capability is what brings them together.
Because in those first critical moments, people do not experience legislation.
They experience the incident.
Choosing External Support
Organisations can seek external support, but the Responsible Person remains responsible for meeting the requirements of the Act.
Before appointing an adviser, establish whether they understand the operational environment as well as the legislation.
Have they worked in the private sector and held positions that designed and implemented protective security arrangements in organisations? Can they explain how their recommendations will work under stress? Can they assess capability rather than simply confirm that training or documentation exists?
The final question is perhaps the simplest:
If an incident happened tomorrow, would their advice still make sense when people had to use it?
Anyone can read guidance.
Professional value comes from understanding why it matters, what needs to be done and how to make it work.
About the Author:
Anthony Gledhill
Over 20 years in private sector security, from frontline media operations through to designing and delivering capability development within government VIP protection units, and leading security systems across defence, construction, and oil & gas in benign, active insurgent, terrorist, and hybrid threat environments. Trained thousands of private sector security staff for armed and unarmed operations.
.
References
Home Office. Terrorism (Protection of Premises) Act 2025: Statutory Guidance. April 2026, corrected August 2026.
Home Office. Non statutory Supplementary Document A: Methods for Assessing the Reasonable Expectation of Individuals Present at Premises and Events.
Home Office. Non statutory Supplementary Documents B and C.
Home Office. Terrorism (Protection of Premises) Act 2025: Notification Requirement. July 2026.
Home Office. Terrorism (Protection of Premises) Act: Principal Use of Premises. September 2026.
Home Office. Terrorism (Protection of Premises) Act 2025 Factsheets.
Security Industry Authority. Understanding Martyn’s Law and the SIA’s Role as Regulator.
Security Industry Authority. Martyn’s Law: Draft Section 12 Statutory Guidance.
National Protective Security Authority and ProtectUK. Protective security and counter terrorism guidance.
Manchester Arena Inquiry. Volume One: Security for the Arena.
Home Office. Lessons Learned Review of the Terrorist Attacks in London Bridge and Borough Market.
.
Useful LInks:
.
