Martyn’s Law: a practical guide for installers and integrators

Two facts are worth knowing before any sales conversation. A standard tier client does not have to buy equipment to comply: the Home Office factsheet says the Act does not require physical alterations to premises or the purchase of equipment to have the procedures in place. Official endorsement is not available either. ProtectUK states that neither the Home Office nor the SIA endorses third-party products, and the SIA says neither it nor the Home Office can endorse or recommend specific companies or services for compliance.

Who is in scope

Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It puts duties on the person who controls certain public premises or events. It puts none on the companies that supply them.

Section 2 sets the test for premises. They must be a building, or a building with other land. They must be wholly or mainly used for one of the uses listed in Schedule 1. And it must be reasonable to expect that 200 or more people may be present at the same time, from time to time. The Home Office factsheets say that count includes staff. Premises listed in Schedule 2 are excluded.

Schedule 1 is broad. It runs through shops; food and drink; entertainment and leisure; sports grounds; museums and galleries; halls and conference centres; hotels; places of worship; health care; stations; education; and more.

From 800 people the premises become “enhanced duty premises”. Below that they are “standard duty premises”. Government guidance calls these the enhanced tier and the standard tier. Schedule 1 also writes in one exception. Places of worship and childcare stay in the standard tier whatever the numbers, and so do schools and further education.

Events are a separate route in. Under section 3 an event qualifies if 800 or more people may be present and the public has access. Entry has to depend on payment, or on holding a ticket or membership. And the venue must not already be premises in the higher tier. The SIA says qualifying events have the same requirements as higher tier premises.

The duty holder is whoever has control of the premises for the relevant use (section 4). The SIA is blunt on this point: the responsible person cannot pass that responsibility on, though they can take advice from a security adviser.

Where one building has two or more Schedule 1 uses, the use that counts is the principal one. The Principal Use of Premises Regulations 2026 (SI 2026/1005), in force since 15 October 2026, treat as principal the use that relates most closely to the purpose and nature of the premises. If that does not settle it, regulation 2(3) says to weigh all the circumstances, such as the share of the premises used for each purpose and the time spent on each. The Home Office guidance of 10 September 2026 works through examples. In its examples a restaurant inside a hotel is part of the hotel premises, and a village hall used as a rugby clubhouse, with a small café, is still a hall. Both examples are standard tier, and the guidance says its examples are illustrations, not instructions. For a client with a mixed-use site, this decides who the responsible person is.

Part 1 of the Act extends to England and Wales as well as Scotland and Northern Ireland.

Standard tier and enhanced tier side by side

	Standard tier	Enhanced tier and qualifying events
Threshold	200 to 799 people	800 or more people
Notify the SIA (s. 9)	Yes	Yes
Public protection procedures (s. 5)	Yes	Yes
Public protection measures (s. 6)	No	Yes
Compliance document sent to the SIA (s. 7)	No	Yes, and within 30 days of any revision
Designated senior individual (s. 10)	No	Yes, where the responsible person is an organisation
Maximum penalty (s. 18)	£10,000	The greater of £18 million and 5% of worldwide revenue
Maximum daily penalty (s. 19)	£500	£50,000
Restriction notice (s. 14)	No	Yes

The procedures in section 5 are things staff do when an attack is suspected: evacuate, move people to a safer place inside (the guidance calls it invacuation), lock down, and communicate. Everything is qualified by “so far as is reasonably practicable”.

For the standard tier, the Home Office factsheet is plain. The Act does not require physical alterations or the purchase of equipment to have these procedures in place. It adds that in certain circumstances it may be reasonably practicable to do so. The requirements are expected to be simple and low cost. There is also no statutory requirement for specific training, although the people who carry out the procedures must understand them.

The higher tier adds measures under section 6, in four areas: monitoring of the premises and the immediate vicinity; movement of people in and out; physical safety and security; security of information. The Home Office factsheet for that tier gives examples. CCTV and other monitoring systems. Searching, screening, barriers. Stand-off zones, safety glass, hostile vehicle mitigation. Floor plans held securely with restricted access. Its worked example of a 1,200-capacity theatre includes effective CCTV with an adequately staffed control room. The factsheet calls that list non-exhaustive.

The SIA, the timetable and the penalties

The Security Industry Authority is the regulator (section 12). It will assess compliance through desk-based assessments and on-site inspections, using a risk-based approach. It says it will typically give at least 72 hours’ notice of an inspection. The factsheet on enforcement notes that inspectors can look at documents and inspect equipment on the premises. For who it licenses today, see our private security figures for the UK, Spain and Italy.

The dates need care.

• Royal Assent was on 3 April 2025.
• The Home Office says it expects the implementation period to be at least 24 months from that date.
• The SIA says the Act is expected to come into force in spring 2027, and that it will confirm the exact date beforehand. As of 12 November 2026 we found no regulations fixing that date, and the SIA’s statement of 9 November 2026 still says “expected to come into force in spring 2027”.
• Commencement regulations have so far brought in only section 27 on guidance, from 10 April 2026, and parts of sections 12 and 18, from 15 June 2026. The duties themselves are not in force. The principal use regulations are a separate instrument. The Home Office guidance on them says the requirements on those responsible are not expected to come into force until spring 2027. The notification regulations (SI 2026/793) take effect only when section 9(1) comes fully into force.

The Home Office published its section 27 statutory guidance on 15 April 2026. The current page is marked updated 25 August 2026, with a correction slip dated 6 August. It matters in a dispute: under section 27(5), proof that a person followed it may be relied on as tending to show there was no contravention. The SIA consulted on its own section 12 guidance between April and June 2026 and said the final version would follow in autumn 2026. As of 12 November 2026 its Martyn’s Law collection on GOV.UK still lists only the consultation draft.

On notification, Home Office guidance says those responsible for qualifying premises on the commencement day will have three months to notify the SIA through an online portal. After that the deadline is 28 days. For events it is 14 days.

On 9 November 2026 the SIA released a planning tool for the standard tier and a template for the tier above it. It says they are not a definitive checklist, and it had already said there is no requirement to use them. The SIA also says an online scope-checking tool will be available in the new year.

Enforcement runs from compliance notices to penalty notices and, for the higher tier, restriction notices. These can limit how the premises are used and when, or how many people attend, for up to six months, a period the SIA can extend. Failing to comply with a restriction notice is a criminal offence. So is ignoring a compliance notice in the higher tier, or knowingly or recklessly giving the SIA false or misleading information. On indictment the maximum is two years’ imprisonment. The Home Office expects penalty notices to be the main enforcement tool.

What you can offer, and what not to promise

What follows is our reading of the sources above. It is not official guidance.

Do not sell compliance. ProtectUK states that neither the Home Office nor the SIA endorses any third-party products, and that premises do not need to spend money on consultants to comply. The SIA says it cannot recommend specific companies or services. We found no approval scheme for products or systems in any source. “Martyn’s Law compliant” on a datasheet has nothing behind it.

Do not tell a standard tier client they must buy equipment. The factsheet says the Act does not require it. If a public address upgrade or better door hardware would make a lockdown or communication procedure workable, say so as a way to support the procedure, and let the client judge what is reasonably practicable.

For enhanced tier clients, design to the four areas. Those four headings come from the Act itself. The client has to assess how the measures are expected to reduce vulnerability and risk, and send that assessment to the SIA. A system with a clear purpose makes that document easier to write. Coverage drawings and a maintenance record help too. If CCTV is part of the design, our piece on pixels per metre and DORI shows how to state what a camera is meant to detect or identify.

Treat your own drawings as sensitive. The factsheet’s example for information security is floor plans. As-built drawings deserve the same care. So do camera layouts and network diagrams.

Keep the dates honest in proposals. Write “expected spring 2027, date to be confirmed”. Point clients to the section 27 guidance and the SIA tools first, then talk about systems.