Every few months a client asks us the same question: has Martyn's Law started, and have we missed it? The answer, as of autumn 2026, is no. The Act is law, but the duties it places on premises have not been switched on. What has been switched on is the machinery behind it, and that is the signal to start work.
The Act is named after Martyn Hett, one of the 22 people killed at Manchester Arena in 2017. It puts a legal duty on those responsible for certain premises and events to plan for a terrorist attack, in much the same way the Fire Safety Order makes you plan for a fire.
Who the law applies to
The test is capacity, not floor area or sector. If it is reasonable to expect 200 or more people to be present at the same time, and the premises are used for one of the qualifying activities in Schedule 1 of the Act, you are in scope. That schedule is wide. It takes in shops, food and drink venues, entertainment and leisure, sports grounds, visitor attractions, hotels, places of worship, libraries, museums, halls of residence, health care and education.
Two tiers follow from the headcount.
| Tier | Capacity | What is required |
|---|---|---|
| Standard | 200 to 799 people | Notify the SIA of the responsible person. Put public protection procedures in place so far as is reasonably practicable. |
| Enhanced | 800 or more people | Everything in the standard tier, plus public protection measures, documented procedures, an assessment of how far they reduce risk, and a submission to the SIA. |
Capacity here means the number of people who could reasonably be expected on site at one time, including staff. Venues that sit just under 200 on a normal day but tip over it for an event need to think about the event, not the average.
What standard tier premises have to do
Two things. Tell the Security Industry Authority who the responsible person is, and have public protection procedures that could reasonably be expected to reduce harm if an attack happened at or near the premises.
Those procedures fall into four groups:
- Evacuation. Getting people out of the building safely.
- Invacuation. Bringing people into the building, or moving them to a safer part of it, when outside is the more dangerous place to be.
- Lockdown. Securing the site to stop an attacker getting in, which means knowing which doors lock, who has the keys and how long it takes.
- Communication. Getting information to staff and to the public quickly, including how you would tell people to do something they have never been asked to do before.
There is no requirement to buy equipment at the standard tier, and no requirement to produce a formal risk assessment. The duty is about procedures and about people knowing them.
What enhanced tier premises add
Larger venues carry a heavier duty. As well as the four procedures, they must put in place public protection measures covering monitoring the premises and the immediate area, controlling the movement of people into and out of it, physical safety and security, and the security of information that could be useful to an attacker. All of it has to be documented, assessed for how much it actually reduces risk, and provided to the SIA.
That documented assessment is the part most enhanced tier operators underestimate. It is not a form. It is a reasoned account of your premises, the people in it and what you have decided to do about them.
What has already commenced
On 15 June 2026 the second commencement regulations brought the SIA's own duties into force, including its statutory duty to produce guidance under section 12. The regulator is being built now, and the guidance that tells duty holders what "reasonably practicable" looks like in practice is being written now. The duties on premises follow in spring 2027, with the exact date still to be confirmed.
The government has been consistent that there will be an implementation period of at least 24 months from Royal Assent before the duties bite, precisely so that operators have time to prepare. That period is now more than half gone.
What to do in the next six months
Nothing here needs the final guidance to be published.
- Work out your capacity honestly. Not licensed capacity, not fire capacity. The number of people reasonably expected at the same time, staff included, on your busiest realistic day.
- Name a responsible person. Someone with the authority to make decisions about the premises, not the person with the most spare time.
- Write down what you would actually do. Walk the site and answer four questions: how do we get everyone out, where do we put them if outside is worse, how do we lock this place down, and how do we tell people. Most sites find at least one door that will not lock and one route that leads somewhere unhelpful.
- Train the people on shift. Procedures held by the duty manager and nobody else are procedures that will not run at nine on a Saturday night.
- Fold it into what you already do. Your fire evacuation plan, your first aid arrangements and your incident reporting all overlap with this. Running them as separate systems is how they go stale.
Where this sits next to your existing duties
Martyn's Law does not replace anything. Your duties under the Health and Safety at Work etc. Act 1974 and the Regulatory Reform (Fire Safety) Order 2005 are unchanged. What it does is add a threat you have probably never planned for to a set of arrangements you already have, which is why the sites that handle it well are the ones that treat it as an extension of emergency planning rather than a new compliance project.
The lockdown procedure is the one that tends to expose the gaps. Fire planning is built entirely around moving people out. Lockdown asks you to keep them in and keep something else out, and buildings designed for easy egress are rarely good at that. Finding out which of your doors are outward-opening and free-swinging is a useful hour.
Getting ready
York Green's consultants are professionally qualified safety practitioners who spend their working lives assessing real premises against real duties. If you want a view on which tier you fall into, or a walk through your site with the four procedures in hand, we can help. The guidance may not be final, but the questions it will ask are already clear.
You can read the government's own overview at Understanding Martyn's Law and the SIA's role as regulator.
To talk it through, see our outsourced health and safety consultancy, or email enquiries@yorkgreen.uk.