On 3 April 2025, the Terrorism (Protection of Premises) Act 2025 — widely known as Martyn's Law — received Royal Assent. Named after Martyn Hett, one of the victims of the 2017 Manchester Arena attack, the legislation represents the most significant change to venue security requirements in the UK for decades.
If you manage a venue, public building or commercial premises, it's time to understand what this law requires of you — and start preparing now, while the implementation window is still open.
Martyn's Law has an implementation period of at least 24 months from Royal Assent (April 2025), meaning businesses should expect enforcement to begin no earlier than mid-2027. However, waiting until the deadline is not advisable — the changes required for some premises are significant.
What is Martyn's Law?
Martyn's Law places a legal duty on those responsible for certain premises and events to take steps to protect the public from terrorist attacks. The Act creates two tiers of duty, based on the size and capacity of the venue.
| Tier | Capacity threshold | Requirements |
|---|---|---|
| Standard Tier | 200 – 799 people | Procedures and staff training to protect the public in the event of an attack. No physical security measures required at this tier. |
| Enhanced Tier | 800+ people | All Standard Tier requirements plus a formal security plan, vulnerability assessment, and physical security measures including CCTV, access control and document management. |
Who does it apply to?
The Act applies to a wide range of premises and events, including:
- Entertainment venues — theatres, concert halls, cinemas, sports grounds
- Hospitality venues — hotels, restaurants, bars and nightclubs
- Retail premises — shopping centres, markets and large shops
- Education — schools, colleges and universities
- Healthcare — hospitals, large GP surgeries and health centres
- Places of worship — churches, mosques, temples
- Outdoor events and festivals
It is worth noting that many premises with fewer than 200 regular occupants will fall outside the scope of the Act entirely — but the principles of protecting staff and visitors from security threats remain good practice regardless.
What physical security measures are required at Enhanced Tier?
For Enhanced Tier premises (800+ capacity), the Act requires a documented security plan and the implementation of proportionate physical security measures. In practice, this typically means:
- CCTV: Coverage of entry and exit points, public areas and perimeter, with appropriate recording and retention policies
- Access control: Managed entry to staff and restricted areas, with audit trails of access events
- Intruder detection: Systems that alert staff or security to unauthorised access outside of operating hours
- Hostile vehicle mitigation: For premises with significant footfall near public roads, physical barriers may be required
- Vulnerability assessment: A documented review of how the premises could be targeted and what measures are in place
The physical security requirements under Martyn's Law are not dramatically different from what a well-managed venue should already have in place. The key change is the requirement to document, assess and formally manage security — not just have cameras on a wall. If your current CCTV and access control systems are old, undocumented or poorly maintained, now is the time to address that.
What should you do now?
With at least 24 months before enforcement begins, you have time to prepare properly — but not time to be complacent. Here's a sensible approach:
- Establish which tier you fall into. Work out the maximum capacity of your premises and identify whether you're Standard or Enhanced Tier.
- Conduct a security review. Walk your premises with fresh eyes. Where are the vulnerabilities? How are entry points managed? What CCTV coverage do you have?
- Identify gaps. Compare your current security provision against the requirements for your tier. Note what's missing or inadequate.
- Plan the investment. Physical security upgrades take time to specify, procure and install. Build that into your planning cycle now rather than scrambling in 2026.
- Start training staff. Even Standard Tier premises need staff trained in protective procedures. Start building that awareness now.
What happens if you don't comply?
The Act creates a new regulator — the Security Industry Authority (SIA) — with enforcement powers including improvement notices, prohibition notices and financial penalties. For Enhanced Tier premises, fines can be substantial. More importantly, a failure to comply that contributes to harm during a security incident will carry serious legal consequences for the Responsible Person.
How Erif can help
We help premises at both tiers prepare for Martyn's Law compliance through security reviews, CCTV upgrades, access control installation and documentation support. If you're not sure where to start, book a free survey and we'll give you an honest picture of where you stand.