Martyn's Law: machinery provisions commenced — prepare now for duties expected no earlier than spring 2027

What commenced on 15 June 2026 — and what did not

The Terrorism (Protection of Premises) Act 2025 (2025 c. 10), commonly known as Martyn's Law, received Royal Assent on 3 April 2025. It establishes a new counter-terrorism framework for publicly accessible premises across the United Kingdom. Counter-terrorism is a reserved matter: the Act extends to and applies equally in England, Wales, Scotland, and Northern Ireland, with no devolved variation to the duties, thresholds, or enforcement regime.

The Terrorism (Protection of Premises) Act 2025 (Commencement No. 2) Regulations 2026 (SI 2026/622 (C. 50)), made on 10 June 2026, brought into force on 15 June 2026 two narrow administrative provisions only:

• Section 12(2) and (3) (excluding section 12(2)(c)) — gives the Security Industry Authority (SIA) the power to issue guidance and advice on compliance, subject to Secretary of State approval before publication.
• Section 18(5) to (7) — requires the SIA to publish a statement setting out how "qualifying worldwide revenue" is to be determined for the purpose of the enhanced-tier penalty cap. This is an administrative precondition for the penalty regime.

These provisions enable the SIA to begin preparing and publishing practical guidance ahead of operative commencement. They do not impose any duties, obligations, or penalties on premises operators. The Home Office published statutory guidance in April 2026 following earlier commencement regulations that enabled its publication.

The two tiers — do they apply to you?

When the Act does commence, it will apply to operators of publicly accessible premises in two tiers, based on the number of individuals reasonably expected to be present at the same time:

• Standard tier (section 2(2)) — premises where 200 to 799 individuals are reasonably expected to be present at the same time.
• Enhanced tier (section 2(3)) — premises where 800 or more individuals are reasonably expected to be present at the same time.

A wide range of premises are likely to be in scope: retail centres, hospitality venues, entertainment and cultural venues, sports stadia, visitor attractions, education campuses, places of worship, healthcare facilities, transport hubs, and large office buildings that admit members of the public.

Importantly, the Act specifies that childcare premises, primary, secondary and further education premises, and places of worship remain at standard tier even where 800 or more individuals are expected (statutory guidance, paragraphs 4.36–4.39). Those premises are not upgraded to enhanced tier by their capacity alone.

What the duties will require (when in force)

Understanding the future obligations now will help you prepare before they become legally binding.

Standard tier (section 5) — the responsible person must implement public protection procedures addressing:

• evacuation of individuals from the premises or a part of the premises
• invacuation — moving individuals to a place of safety within the premises
• lockdown of the premises or a part of the premises
• communication with individuals during an attack

Enhanced tier (section 6) — the responsible person must implement all standard tier procedures plus proportionate public protection measures covering:

• monitoring the premises and their environs
• controlling the movement of individuals
• physical safety and security of the premises
• information security

The measures must be proportionate to the nature and use of the premises. The SIA will publish guidance on what is expected; operators should monitor SIA publications as they are released.

What to do now — practical no-regrets steps

None of the following steps are legally required yet. They are practical preparations that will put you in the best position when operative commencement arrives, and most are good practice regardless of the Act.

1. Determine your likely tier. Review the maximum number of individuals — including staff, customers, and visitors — who could reasonably be present at the same time. If you operate multiple premises or host varying events, assess each separately. Your tier determines the scope of your future obligations.

2. Identify your responsible person. The Act places duties on a "responsible person" for each premises. Start identifying who in your organisation will hold this role and ensure they are aware of the forthcoming obligations. Note that the "responsible person" concept under Martyn's Law is legally distinct from the responsible person role under fire safety law, though in practice the same individual may fulfil both.

3. Read the statutory guidance. The Home Office published statutory guidance in April 2026 (enabled by earlier commencement regulations). Familiarise yourself with it now. The SIA will publish further guidance and advice under the powers that commenced on 15 June 2026; monitor the SIA website for releases.

4. Draft or refresh your public protection procedures. Even without a legal obligation, begin drafting procedures for evacuation, invacuation, lockdown, and communication. Review your existing emergency and business continuity plans to identify gaps. Many premises will have fire evacuation plans that can serve as a starting point, but Martyn's Law requires additional, distinct planning for terrorist attack scenarios.

5. Enhanced-tier sites: scope proportionate measures. If you are likely to be in the enhanced tier, begin scoping what proportionate public protection measures would look like for your premises — monitoring arrangements, access control, physical security improvements, and information security protocols. This is a more significant programme of work and the earlier you start, the less disruptive it will be.

6. Build staff awareness. Ensure relevant staff understand that the Act is coming and what it will require. Consider incorporating counter-terrorism awareness into existing induction and refresher training, including any resources the SIA signposts when it publishes its guidance.

7. Integrate with existing emergency planning. Martyn's Law procedures will need to sit alongside fire safety plans, health and safety risk assessments, and any licensing conditions. A joined-up approach to emergency planning will be more efficient and more effective.

Enforcement powers — once duties are in force

When the operative provisions do commence, the SIA will have substantial enforcement tools at its disposal. These will include:

• Compliance notices (section 13) — requiring a responsible person to remedy a failure to comply.
• Restriction notices (section 14) — which can restrict or prohibit the use of premises.
• Monetary penalty notices (sections 17–21) — up to £10,000 for standard tier premises; the greater of £18 million or 5% of qualifying worldwide revenue for enhanced tier and qualifying events; and up to £50,000 per day for continued non-compliance.

These penalties are not currently applicable — they will only bite once the operative provisions are commenced by statutory instrument, expected no earlier than spring 2027.