Martyn’s Law: surprise, your premises probably needs assessing

What you were told: "Martyn’s Law is for stadiums and big arenas. A place like yours has nothing to worry about."

What the law says: Surprise, surprise. If you run a pub or a hotel or a church or a school there is a very good chance you will need to assess your premises. It only takes one busy day a year.

Why it exists

The law is named after Martyn Hett. He was one of 22 people killed in the Manchester Arena attack in May 2017. His mother Figen Murray campaigned for years to make venues plan for what they would do if it happened to them. The Terrorism (Protection of Premises) Act 2025 became law on 3 April 2025. It applies across the UK.

It only takes one busy day

Most owners count a normal night. The law does not. The question is how many people you can reasonably expect at the same time from time to time.

What ProtectUK says

The term ‘from time to time’ is a common term and is generally understood to mean occasionally.

ProtectUK gives once a year as an example of occasionally. The Home Office guidance makes the same point with a shop. It is usually quiet but it passes 200 people on Black Friday and in the January sales. That shop is in scope.

Everyone on the premises counts. Customers and guests. Your staff. Volunteers and contractors. Add them all up for your busiest day of the year.

Who is likely to need an assessment

The Act lists the kinds of premises it applies to. Hospitality is all over it. So are places of worship and schools and hotels.

Pubs and bars. New Year’s Eve. A big match on the screens. A wedding party or a wake in the function room. If you can get 200 people in at once on your busiest night you are in scope.

Hotels. Guests plus a wedding or a conference in the function suite plus the staff to run it. Most hotels with event space will pass 200.

Places of worship. Christmas and Easter. Eid and Diwali. A big wedding or a funeral. A church or mosque or temple that fills once a year is in scope. Places of worship always stay in the standard tier however big they get.

Church halls and village halls. Halls are on the list too. The duty sits with whoever runs the hall and not the group that hires it for the night.

Schools and nurseries. Count every pupil and every member of staff. Then add the parents at the nativity or sports day. Most secondary schools and many primary schools will pass 200. Schools and childcare settings also stay in the standard tier however big they are.

Restaurants and gyms and shops. A busy Saturday service or a January rush or a big class timetable can all take you over the line.

Could it drop to 100?

It could. Today the law says 200. The Act gives the government power to lower that figure to 100 by regulations. It must decide that the change is necessary for public protection and it must consult first. If that happens a lot more small pubs and halls and churches will need an assessment too. Plan as if it might.

What the assessment involves

The law asks you to do two things that only work if you assess your premises. First you must work out the most people you can expect at once. You must be able to show how you got that number. Second your procedures must be appropriate to your premises. You cannot know what is appropriate until you have walked the building and thought it through. Where are the exits? Where could people shelter? Which doors lock? How would you warn everyone?

That is a terrorism risk assessment in all but name. For a standard tier premises the law does not say it has to be written down. Enhanced tier premises must write down their measures and how they reduce the risk. They must send that document to the regulator.

When it starts

What the Home Office says

The implementation period is at least 24 months from Royal Assent.

Twenty four months from 3 April 2025 takes you to April 2027. The regulator is preparing for the duties to start in spring 2027. No exact date has been set. That gives you a few months to count your numbers and get ready.

The tiers

Under 200 people at once, even on your busiest day: not in scope today.

200 to 799 people: standard tier. This is where most pubs and churches and schools and hotels will land.

800 or more people: enhanced tier. Big venues and large shops and stadiums.

What a standard tier premises must do

Two things. First you tell the Security Industry Authority about your premises. It is the regulator for this law and it does not charge a fee.

Second you put simple procedures in place for what staff do if an attack happens at or near the premises. There are four of them. Evacuation means getting people out. Invacuation means bringing people inside to safety. Lockdown means securing the building. Communication means warning staff and the public. You do these so far as is reasonably practicable. That means in proportion to your business.

What the Home Office says

There is no requirement to put in place or purchase physical measures.

The government’s own estimate of the cost for a standard tier premises is about £330 a year. Almost all of that is staff time. Fines for ignoring it go up to £10,000 plus £500 a day.

What an enhanced tier premises must do

Everything above plus more. These premises must put measures in place to make an attack less likely and less harmful. That can mean monitoring the area around the building or controlling how people move through it. It can mean physical security or protecting sensitive information. They must write it all down and send it to the regulator. A company must name a senior person who is responsible. Fines go up to £18 million or 5 per cent of worldwide revenue. This is where outside help is worth paying for.

What Wolly will try to sell you

Meet Wolly. Wolly is our name for the compliance salesman who always says the wrong thing. He is not a real person but you will have met him. Once owners realise they need an assessment Wolly will be waiting.

Wolly says: "You need a Martyn’s Law certificate." There is no such thing. The Home Office and the regulator do not endorse any private products. The government says you do not need specialist products or services to comply.

Wolly says: "You need CCTV and bag searches." Not for the standard tier. Those are examples of what an enhanced tier venue might choose.

Wolly says: "You need trauma kits by law." The Act does not require them. The government encourages them as good practice.

Wolly says: "Registering costs money." The regulator charges nothing for notifications or inspections.

Wolly says: "Sign up now or you will be breaking the law." There is no legal duty until the law comes into force. You have time to do this properly.

Wolly says: "It needs a three year contract." It needs a plan and a trained team. Neither comes with a contract.

What I think

Surprise, surprise. If you run a pub or a hotel or a church or a school you should assume you need an assessment until your numbers prove otherwise. Count your busiest day of the year and not your average. Count your staff too. Write the number down and how you got it.

This is a good law with a good reason behind it. The work is real but it is not expensive. It is the same as any other compliance service. If you want to be protected use an expert unless you know what you are doing. Get someone competent to help you assess your premises and record it. Call it what it is. A terrorism risk assessment. It is your proof that you thought it through. A fire risk assessment works the same way. You already plan how to get people out for your fire risk assessment. Use that as your starting point. Then add what you would do to bring people in and lock the doors and warn everyone. ProtectUK runs free online training for staff.

Competent here means someone trained in counter terrorism security who has assessed buildings like yours before. Get it wrong and your staff will not know what to do on the worst day of their working lives. A local expert can do it for a one off fee. Do not let Wolly sell you a certificate or a long contract for it. If you are enhanced tier get proper help. Just make sure you are paying for advice and not for a badge.