Martyn’s Law
The Terrorism (Protection of Premises) Act 2025
What is the real test?
Author: Anthony Gledhill | Founder & Director, Mildot Group
Last Updated: July 2026
Notice: This short article provides commentary and opinion based on up and coming UK legislation. It is intended for educational purposes and does not constitute legal advice. Organisations should obtain independent legal advice where appropriate.
Copyright: © 2026 Mildot Group. All rights reserved.
What You’ll Learn
- Why Martyn’s Law extends beyond documentation and compliance.
- Why capability may become the defining factor following a hostile attack.
- Why organisations should prepare for operational reality rather than legal definitions.
- How adaptable capability strengthens resilience, business continuity and organisational preparedness.
.
.
Compliance Doesn’t Save Lives. Capability Does.
The operational reality behind Martyn’s Law.
.
If a terrorist attack occurred at your organisation tomorrow, what would investigators, regulators, insurers and the courts examine afterwards?
Many organisations would immediately think about policies, procedures, risk assessments and emergency plans. Those documents are essential and form an important part of Martyn’s Law – due in 2027. However, documentation alone is unlikely to answer the questions that matter most.
The real assessment will extend beyond paperwork and into the organisation’s ability to demonstrate capability before, during and after the incident.
In practical terms, what do you think the percentages are for Martyn’s Law on compliance and capability?
Most organisations naturally concentrate on the compliance element because it is visible, measurable and relatively straightforward to achieve. The real challenge lies in developing the capability that determines performance when an incident unfolds.
The 10% Compliance
Completing documentation demonstrates that an organisation has considered its responsibilities. Capability determines whether those plans actually work when people are frightened, information is incomplete, decisions must be made in seconds and lives depend upon the outcome.
A competent person from almost any industry can now complete a Level 3 awareness course and produce much of the documentation required to satisfy the administrative requirements of the up and coming legislation.
With suitable templates, many organisations can develop risk assessments, procedures, emergency plans and training records relatively quickly. That fulfils an important legal requirement, but it does not, on its own, create operational capability.
.
The Compliance Trap
Compliance establishes the foundation. Capability determines the performance.
Documentation records what an organisation intends to do. Capability determines whether its people can actually deliver what the paperwork says.
This distinction in the private sector has become far more significant because of Martyn’s Law itself.
.
The Difference Between Paperwork and Performance
The pattern is remarkably consistent across major inquiries. Organisations rarely fail because documentation did not exist. They fail because knowledge, decision making, communication and leadership are not translated into effective action under pressure.
That distinction lies at the heart of Martyn’s Law.
Every major terrorist attack investigated in the United Kingdom was examined without a specific statutory duty requiring organisations to prepare for terrorism in this way.
The Manchester Arena Inquiry, together with investigations into the Westminster Bridge, London Bridge and Borough Market attacks,(Manchester Arena Inquiry, 2021; Home Office, 2026) repeatedly identified shortcomings in preparedness, communication, leadership, exercising, interoperability, behavioural recognition and operational decision making.
They did not simply expose weaknesses in documentation if it existed. They demonstrated how organisations and responders struggled to translate plans into effective action under rapidly developing conditions.
The lesson is remarkably consistent.
Policies and plans are essential, but capability determines whether plans can be implemented successfully.
.
Martyn’s Law Changes the Rules
Martyn’s Law is not changing how terrorists attack. It is changing how organisations respond and are judged after an attack.
The legislation creates a different operating environment for organisations, regulators, investigators and the courts. Following any terrorist incident, it is reasonable to expect that investigators will examine not only what happened during the attack, but also whether the organisation fulfilled its statutory obligations and more importantly, whether those obligations were translated into genuine operational capability (Home Office, 2026).
Producing documentation is unlikely to be the deciding factor
The more significant question is whether the organisation could demonstrate capability.
Investigators may consider if suspicious behaviour was recognised early, staff and managers made reasonable and proportionate decisions, incident response plans worked in practice rather than remaining on paper, exercising had identified and corrected weaknesses before the incident, communication and coordination were effective, and the organisation successfully protected people and reduced the criticality.
The answers to those questions could influence regulatory scrutiny, civil litigation, insurance considerations, organisational reputation and long term resilience.
Another operational reality is often overlooked. During the first moments of a hostile attack, an organisation is largely responsible for its own immediate response. Emergency services will respond as quickly as possible, but their arrival may take seconds or several minutes depending on the circumstances.
Until that point, the actions of staff, security personnel and managers will largely shape the outcome. Capability therefore becomes the bridge between the start of the incident and the arrival of professional responders.
Capability represents the greatest operational challenge and fills the critical period before the arrival of the emergency services.
Some organisations may take comfort from suggestions that enforcement will be introduced pragmatically and mature over time. That may well prove to be the case from a regulatory perspective. Civil litigation, however, follows a different path.
It is reasonable to expect that claimants and legal representatives will consider all relevant statutory duties when assessing whether an organisation acted reasonably in the circumstances.
Waiting to understand enforcement action is therefore unlikely to be the most effective benchmark for preparedness.
.
The Threat Will Continue To Evolve
The threat continues to evolve and security must evolve with it.
Martyn’s Law has been written specifically to improve preparedness against terrorism (Home Office, 2026). However, the capabilities it promotes, including planning, leadership, behavioural awareness, exercising, communication, emergency response, interoperability and the consequential business continuity aspects, are equally applicable to many other forms of hostile attack.
History demonstrates that legislation evolves alongside changing threats. As attack methodologies develop and society changes, legal interpretation and legislation often adapt in response. Whether through future legislation or judicial interpretation, it is possible that the application of terrorism related legislation will continue to develop over time.
The precise direction of that evolution cannot be predicted, but organisations should recognise that legal frameworks rarely remain static.
Past Incidents
Recent incidents also demonstrate why organisations should avoid focusing solely on legal definitions.
The Southport hybrid attack in 2024 is an example.
When a hostile attack begins, nobody at the scene knows whether it will ultimately be classified as terrorism. Victims, staff and responders deal with the immediate threat as it unfolds, while the legal classification is often determined later through police investigation.
Protective security capability must therefore be built around responding effectively to hostile attacks, not around waiting for the legal definition that follows.
Is it therefore reasonable to consider as Martyn’s Law matures, organisations may increasingly be expected to demonstrate that the capabilities developed for terrorism are equally capable of supporting responses to other forms of hostile attack that create comparable risks and consequences.
Whether that expectation ultimately develops into legal precedent remains uncertain, but building adaptable capability is likely to place organisations in a stronger position regardless of how future threats are classified.
The organisations best prepared for the future will not simply comply with today’s legislation. They will build adaptable capability that enables them to recognise, potentially prevent, respond to and recover from a broad range of hostile acts.
.
The 90% Capability Rule
Capability Is Your Best Defence
Capability is no longer simply good practice.
It is becoming a matter of governance, resilience, operational effectiveness and legal defensibility.
When the next major incident occurs, investigators will undoubtedly examine the documentation. They are also likely to examine something far more important.
They will seek to understand whether the organisation’s people were genuinely capable of delivering what that documentation promised.
Martyn’s Law should not be viewed as a documentation exercise.
It should be viewed as a long term capability programme.
Compliance satisfies the legislative requirement.
Capability determines operational performance.
Capability influences resilience.
Capability supports business continuity.
Capability may ultimately become one of the strongest demonstrations that an organisation took reasonable and proportionate steps to protect people.
To end this brief article
The most effective organisations will not be those with the largest folders of documentation. They will be those that can demonstrate capability at the coal face. Building that capability requires more than compliance action.
It requires structured learning, practical application, realistic exercising and continual improvement across every level of the organisation.
Developing capability does not have to disrupt day to day operations. Short, focused sessions lasting just five to ten minutes can provide an effective way to build awareness, reinforce learning and develop capability without removing staff from their operational duties.
Mildot Group can help your organisation design practical development programmes that build genuine capability while minimising operational disruption.
Reading about capability is the first step.
Building it is what improves performance.
Whether your organisation requires an independent capability evaluation, practical staff development, implementation support or specialist consultancy, Mildot Group provides operationally focused solutions that transform compliance into genuine capability.
.
Implementation & Consultancy Support
Our consultancy capacity is limited to ensure every organisation receives direct involvement, practical solutions, and support throughout the project.
.
References
Home Office. (2026). The Terrorism (Protection of Premises) Act 2025: Statutory Guidance. London: Home Office. Available at: GOV.UK Statutory Guidance
UK Government. (2025). Terrorism (Protection of Premises) Act 2025 (Explanatory Notes). Available at: UK Legislation Explanatory Notes
Home Office. (2025). Terrorism (Protection of Premises) Act 2025: Overarching Factsheet. Available at: GOV.UK Factsheet
ProtectUK. (2026). Martyn’s Law Overview and What You Need to Know. Available at: ProtectUK Martyn’s Law Overview
Manchester Arena Inquiry. (2021). Volume 1: Security for the Arena. Available at: Manchester Arena Inquiry Volume 1
.
Why Mildot Group?
Follow this link to learn more
.
Other useful Links:
.
