Martyn’s Law receives Royal Assent – what do property owners and occupiers need to do now?

On Thursday 3 April, Martyn’s Law finally became enshrined in law, becoming the Terrorism (Protection of Premises) Act 2025. Named after Martyn Hett, one of the 22 victims of the 2017 Manchester Arena terrorist attack, it follows tireless campaigning by his mother, Figen Murray, and the Government’s promise to deliver this legislation to better protect the public from acts of terrorism. It is estimated that around 178,900 venues may be affected.

This is a landmark piece of legislation, creating a new legal duty for those responsible for certain public premises and events across the UK to mitigate the risk of terrorist attacks. 

What happens now?

The legislation is not yet in force, so property owners and occupiers do not yet need to comply with their new duties. A 24-month implementation period now follows to enable those responsible to assess whether they fall within the scope of the Act and to prepare accordingly before the legislation comes into force by regulations. The Government is also due to publish statutory guidance to support the implementation of the new duties. 

The legislation establishes the Security Industry Authority (“SIA”) as regulator to oversee compliance and provide guidance to those responsible for qualifying premises and events to meet their obligations. 

Which premises and events are caught?

A wide range of public “qualifying premises” are captured. These include sports, entertainment, leisure and hospitality venues, healthcare facilities, places of worship, tourist attractions and places of education, such as schools. These premises must have capacity for 200 or more individuals at any one time and must consist of a building or a building and other land. 

A building also includes part of a building or a group of buildings, so units within larger premises, such as shops within shopping centres, or restaurants within entertainment or sports stadia will be qualifying premises themselves if they fit the Act’s criteria in addition to the larger premises. 

There are various types of premises which are excluded from the new requirements due to existing legislation. 

In addition, large-scale events where at least 800 people can reasonably be expected to be present at any one time and where there are specific conditions of entry, such as purchasing a ticket to a music event, are caught under the Act. These can also include outdoor events.

What are the requirements of Martyn’s Law? 

The Act establishes a tiered approach, linked to the number of individuals it is reasonable to expect may be present at the same time at premises and events. 

Premises with a capacity of 200 – 799 individuals at any one time will fall under the “standard tier”. The requirements include putting in place appropriate public protection procedures which will reduce physical harm if a terrorist attack occurs. These are expected to be simple means of improving staff preparedness and are centred around simple, low-cost activities. There is no requirement to put in place physical measures.  Examples of measures which could be implemented include having processes in place for:

• Evacuation of the premises;
• Invacuation (moving people somewhere safe inside the premises); and
• Locking down the premises.

Premises and events with a capacity of 800 individuals or more at any one time will fall under the “enhanced tier”, with more rigorous requirements. Examples might include: 

• Monitoring the premises, such as through CCTV; and
• Strengthening security through measures such as safety glass and hostile vehicle mitigation. 

The enhanced measures that have been implemented by the responsible person will need to be documented and provided to the SIA. Compliance with enhanced requirements will be more costly and this may well be a concern for business operators.

Who is responsible?

All qualifying premises and events must have a “responsible person” to ensure that the requirements are met. For qualifying premises, this will be the person who has control of the premises in connection with the use of the premises that falls within the scope of the requirements. For qualifying events, it will be the person who has control of the premises for the purpose of the particular event. This could be the property owner or a tenant or other occupier.

How will the Act be enforced?

The SIA will have enforcement powers for persistent non-compliance, including financial penalties and, in the most severe cases, closing the premises or event. Failure to comply with an information notice request or provide false information will be a criminal offence.

Comment

Although there is a 2-year lead in period, it is important that affected owners and occupiers of premises and event operators begin to plan what appropriate procedures or measures will need to be put in place to comply with their new duties. 

What is appropriate will be tailored to individual premises and events and their assessed capacities and, until further guidance is published, it may be a time of uncertainty for many businesses considering how to comply and how much it might cost. However, cost does remain a concern; the Government has noted that 54% of standard tier premises operators/owners were at least somewhat concerned about the costs of meeting the new requirements.

It is always important to seek independent legal advice for your particular circumstances, so please do not hesitate to contact Ben Butterworth (ben.butterworth@crsblaw.com) or your usual Charles Russell Speechlys contact if you have any queries.