On 15 June 2026 the Security Industry Authority gained preparatory powers under the Terrorism (Protection of Premises) Act 2025 (Martyn's Law), but the substantive duties on operators of publicly accessible premises are not yet in force and are expected no earlier than spring 2027. Operators should use the runway now to determine their tier, identify their responsible person, and draft public protection procedures.
The Terrorism (Protection of Premises) Act 2025 (2025 c. 10), commonly known as Martyn's Law, received Royal Assent on 3 April 2025. It establishes a new counter-terrorism framework for publicly accessible premises across the United Kingdom. Counter-terrorism is a reserved matter: the Act extends to and applies equally in England, Wales, Scotland, and Northern Ireland, with no devolved variation to the duties, thresholds, or enforcement regime.
The Terrorism (Protection of Premises) Act 2025 (Commencement No. 2) Regulations 2026 (SI 2026/622 (C. 50)), made on 10 June 2026, brought into force on 15 June 2026 two narrow administrative provisions only:
These provisions enable the SIA to begin preparing and publishing practical guidance ahead of operative commencement. They do not impose any duties, obligations, or penalties on premises operators. The Home Office published statutory guidance in April 2026 following earlier commencement regulations that enabled its publication.
The core obligations under sections 5 and 6 of the Act — the public protection procedures and measures that will apply to standard and enhanced tier premises — have not been commenced. No commencement statutory instrument has been made for those provisions. The Government has stated its intention to allow an implementation period of at least 24 months from Royal Assent (3 April 2025), meaning operative commencement is expected no earlier than spring 2027.
Nothing in the 15 June 2026 commencement regulations creates a legal obligation on any premises operator. However, the runway is finite: the time to prepare is now.
When the Act does commence, it will apply to operators of publicly accessible premises in two tiers, based on the number of individuals reasonably expected to be present at the same time:
A wide range of premises are likely to be in scope: retail centres, hospitality venues, entertainment and cultural venues, sports stadia, visitor attractions, education campuses, places of worship, healthcare facilities, transport hubs, and large office buildings that admit members of the public.
Importantly, the Act specifies that childcare premises, primary, secondary and further education premises, and places of worship remain at standard tier even where 800 or more individuals are expected (statutory guidance, paragraphs 4.36–4.39). Those premises are not upgraded to enhanced tier by their capacity alone.
Understanding the future obligations now will help you prepare before they become legally binding.
Standard tier (section 5) — the responsible person must implement public protection procedures addressing:
Enhanced tier (section 6) — the responsible person must implement all standard tier procedures plus proportionate public protection measures covering:
The measures must be proportionate to the nature and use of the premises. The SIA will publish guidance on what is expected; operators should monitor SIA publications as they are released.
None of the following steps are legally required yet. They are practical preparations that will put you in the best position when operative commencement arrives, and most are good practice regardless of the Act.
1. Determine your likely tier. Review the maximum number of individuals — including staff, customers, and visitors — who could reasonably be present at the same time. If you operate multiple premises or host varying events, assess each separately. Your tier determines the scope of your future obligations.
2. Identify your responsible person. The Act places duties on a "responsible person" for each premises. Start identifying who in your organisation will hold this role and ensure they are aware of the forthcoming obligations. Note that the "responsible person" concept under Martyn's Law is legally distinct from the responsible person role under fire safety law, though in practice the same individual may fulfil both.
3. Read the statutory guidance. The Home Office published statutory guidance in April 2026 (enabled by earlier commencement regulations). Familiarise yourself with it now. The SIA will publish further guidance and advice under the powers that commenced on 15 June 2026; monitor the SIA website for releases.
4. Draft or refresh your public protection procedures. Even without a legal obligation, begin drafting procedures for evacuation, invacuation, lockdown, and communication. Review your existing emergency and business continuity plans to identify gaps. Many premises will have fire evacuation plans that can serve as a starting point, but Martyn's Law requires additional, distinct planning for terrorist attack scenarios.
5. Enhanced-tier sites: scope proportionate measures. If you are likely to be in the enhanced tier, begin scoping what proportionate public protection measures would look like for your premises — monitoring arrangements, access control, physical security improvements, and information security protocols. This is a more significant programme of work and the earlier you start, the less disruptive it will be.
6. Build staff awareness. Ensure relevant staff understand that the Act is coming and what it will require. Consider incorporating counter-terrorism awareness into existing induction and refresher training, including any resources the SIA signposts when it publishes its guidance.
7. Integrate with existing emergency planning. Martyn's Law procedures will need to sit alongside fire safety plans, health and safety risk assessments, and any licensing conditions. A joined-up approach to emergency planning will be more efficient and more effective.
When the operative provisions do commence, the SIA will have substantial enforcement tools at its disposal. These will include:
These penalties are not currently applicable — they will only bite once the operative provisions are commenced by statutory instrument, expected no earlier than spring 2027.
Both the Terrorism (Protection of Premises) Act 2025 and the fire safety regime (the Regulatory Reform (Fire Safety) Order 2005 in England and Wales, with equivalents in Scotland and Northern Ireland) use the concept of a "responsible person" and require emergency procedures for premises. However, they are entirely separate legal regimes with different scopes, regulators, and obligations. Fire safety compliance does not satisfy Martyn's Law, and Martyn's Law compliance does not replace fire safety duties. Your fire risk assessment and evacuation plan are a useful foundation, but you will need distinct public protection procedures for Martyn's Law purposes.
How to comply with fire safety law for your business premises — who is the responsible person, how to conduct a fire risk assessment, and implementing fire safety measures. A useful starting point for emergency planning that sits alongside Martyn's Law preparation.
Step-by-step guidance on conducting a fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005. Evacuation planning covered here is complementary to, but legally distinct from, the public protection procedures required by Martyn's Law.
Your legal duties as the fire safety responsible person. Note that the 'responsible person' under fire safety law and under Martyn's Law are distinct legal roles, though the same individual may hold both.
Security requirements for business premises including physical security measures and CCTV compliance. Physical security improvements required under Martyn's Law enhanced tier can build on this foundation.