Martyn’s Law: What Does Preparedness Look Like for Your Building?

For organisations responsible for public buildings and venues, Martyn’s Law raises a question that goes beyond understanding new legislation: how prepared is your building to protect the people who use it?

With the legislation expected to come into force in spring 2027, property and estates teams, facilities managers and building operators have an opportunity to examine their arrangements before the new duties take effect.

But understanding the requirements is only the beginning. Effective preparedness depends on knowing how people, procedures and supporting systems would work together during an incident.

That will look different in a civic building, university, commercial property or entertainment venue.

Rather than following a generic checklist, organisations need to consider their buildings, the people using them and the arrangements already in place.

What is Martyn’s Law, and why does it matter?

Officially known as the Terrorism (Protection of Premises) Act 2025, Martyn’s Law was introduced following campaigning by Figen Murray, whose son Martyn Hett was among the 22 people killed in the Manchester Arena attack in 2017.

The legislation aims to improve public protection by requiring those responsible for certain premises and events to establish appropriate arrangements to reduce the risk of physical harm from terrorism.

It received Royal Assent in April 2025. The Security Industry Authority (SIA), which will regulate the legislation, currently expects its main requirements to come into force in spring 2027, although the precise date has yet to be confirmed. Further information is available in the SIA’s regulatory guidance.

The Act establishes different levels of responsibility according to the premises or event. Understanding which requirements apply is an important first step.

Does Martyn’s Law apply to your building?

Martyn’s Law covers certain publicly accessible premises used for activities specified in the legislation, potentially including retail, hospitality, entertainment, healthcare and education.

However, not every building accommodating large numbers of people automatically falls within its scope.

Qualifying conditions include the premises’ use, whether it is reasonable to expect at least 200 people to be present at the same time from time to time, and whether any exclusions or special provisions apply.

Attendance includes staff as well as visitors. It is not simply a calculation based on annual footfall or seating capacity. Occasional but reasonably foreseeable periods of higher attendance may also be relevant, even where typical occupancy is lower.

Certain premises, including places of worship and premises used for childcare, primary, secondary or further education, are subject to special provisions. Where the relevant qualifying conditions are met, these premises generally remain within the standard tier even if 800 or more people may be present at the same time.

Higher education premises, including universities, are treated differently and may fall within the enhanced tier.
Qualifying events have separate criteria, including an attendance threshold of 800 people and conditions concerning public access and checks on entry.

Importantly, a qualifying premises may be a building, part of a building or a group of buildings. Organisations managing large estates should therefore establish the relevant legal boundaries rather than assume that every building must be treated separately.

The Home Office’s statutory guidance explains these conditions, exclusions and special provisions in detail.

Standard tier: establishing effective procedures

Standard-tier duties focus on having appropriate public protection procedures in place, so far as reasonably practicable.

The Act identifies four types of procedure:

• Evacuation: moving people out of the premises, or part of them, away from danger.
• Invacuation: moving people to a safer location within the premises.
• Lockdown: securing premises or areas to prevent entry or exit where appropriate.
• Communication: providing information and instructions to people during a suspected or actual incident.

The appropriate response depends on the circumstances. These are not four actions that must necessarily happen together.
For a public-facing building, preparation might involve establishing who can initiate an emergency response, how reception staff alert colleagues and how instructions reach visitors unfamiliar with the premises.

The people expected to carry out relevant procedures must be sufficiently familiar with them to do so effectively.

The standard-tier duties do not, in themselves, require physical alterations or the purchase of security equipment. The emphasis is on appropriate, reasonably practicable procedures.

Although the standard-tier duties do not require a formal compliance document, the Home Office strongly recommends documenting public protection procedures. This can help staff understand their responsibilities, support consistent implementation and provide evidence of the arrangements in place.

Recording procedures is therefore sensible preparation, even though the formal compliance-document duty applies to the enhanced tier rather than the standard tier.

The Home Office’s standard-tier factsheet provides further explanation.

Enhanced tier: additional protective measures

Enhanced-tier premises and qualifying events have further responsibilities.

Alongside the applicable procedural duties, responsible persons must assess and keep under review appropriate public protection measures relating to:

• Monitoring the premises, event and immediate vicinity.
• Controlling the movement of people into, out of and within the premises or event.
• Physical safety and security.
• Security of information relating to the premises or event.

Appropriate measures must be implemented so far as reasonably practicable.

These measures are not limited to physical security installations. They may include operational arrangements, actions undertaken by staff and supporting technologies.

Enhanced-tier responsible persons must also prepare and maintain a compliance document describing the public protection procedures in place, protective measures in place or planned, and assessments of their expected effectiveness in reducing physical harm and relevant vulnerabilities.

The document must be provided to the SIA as soon as reasonably practicable after it is first prepared and within 30 days of any revision.
Where the responsible person is an organisation, a senior individual must be designated to ensure compliance.

The enhanced tier therefore involves more extensive assessment, implementation and documentation, but it does not prescribe a universal package of security equipment or one mandatory format for the assessments.

Why the right approach depends on the building

Two premises may fall within the same tier while presenting very different operational challenges.

A local authority civic building may combine public reception areas, meeting facilities and restricted offices. Preparedness could involve understanding visitor movements, access between different areas and how instructions would reach people throughout the building.

A multi-tenant commercial building introduces the challenge of coordination. Managing agents, building operators and occupiers may control different spaces or activities.

If an incident required an urgent response, how would information reach people across those spaces? Who would initiate the relevant procedures, and how would the parties coordinate their actions?

These questions cannot necessarily be answered by examining one organisation’s arrangements in isolation.

A university may operate lecture theatres, libraries, accommodation and event facilities with different uses and attendance patterns.

Establishing which premises qualify, and what requirements apply, may therefore involve considering individual facilities and their relationships with surrounding buildings.

The Department for Education’s guidance on Martyn’s Law provides further sector-specific information for education and childcare settings in England.

An entertainment or hospitality venue may need to consider busy arrival and departure periods, crowd movement, temporary staffing and the communication of instructions to visitors.

These examples illustrate operational considerations, not automatic legal classifications.

Who is responsible?

Under Martyn’s Law, the responsible person is generally determined by who controls the premises for the relevant qualifying use, or who controls premises for the purposes of a qualifying event.

This will not necessarily be the building owner.

The Act also establishes specific duties to coordinate or cooperate in certain circumstances.

For example, where more than one responsible person is involved, or one qualifying premises forms part of another qualifying premises, the relevant responsible persons must coordinate their arrangements so far as reasonably practicable.

In certain enhanced-tier or qualifying-event circumstances, another party with control of the premises, such as a landlord, may also have a duty to cooperate with the responsible person.

These statutory duties should be distinguished from the broader good practice of communication between landlords, managing agents and occupiers, which can help avoid gaps or conflicting arrangements even where a specific legal duty does not apply.

For estates teams, identifying the responsible person and understanding how relevant parties will work together is therefore a priority.

Importantly, responsibility for compliance cannot simply be transferred to a technology provider or security consultant.

Where can technology support preparedness?

Technology can support appropriate procedures and protective measures, particularly in buildings with complex operational requirements.

But its role should be determined by what the building needs to achieve, rather than by the availability of particular products. This is a principle we explore further in our Insight, Technology Strategy: Are You Starting With The Wrong Question?

CCTV and video management may support situational awareness, helping authorised personnel understand developing circumstances.

Access control can help manage restricted areas and support relevant protective arrangements, provided its operation remains compatible with safe evacuation, accessibility and fire safety requirements.

Public address, alerting and communication systems may help deliver timely information and instructions to staff and building users.

Connectivity and system resilience also matter where protective arrangements rely on networks, electrical power or communication platforms that could be disrupted.

Why integration matters

Consider a building with CCTV, access control and an internal communications platform.

Each system may work effectively on its own. But if an incident occurs, can security personnel, facilities teams and other responsible staff coordinate their response?

Would information reach the right people quickly? Could access arrangements support the intended protective procedures without compromising safe evacuation?

These are questions about more than technology. They concern responsibilities, communication and how different arrangements operate together.

In some buildings, improvements may involve better coordination or clearer procedures. In others, changes to systems or their integration may be justified.

The measure of effectiveness is not how many technologies a building contains, but whether the arrangements can support an appropriate response when needed.

From understanding the requirements to preparing your building: a practical roadmap

Preparing for Martyn’s Law doesn’t necessarily begin with new equipment or a major security project.

A more useful starting point is to understand the premises, establish what arrangements already exist and identify what may need to change.

The following five-stage roadmap offers a practical way to approach that work. It is an iwGROUP preparation framework, not a statutory checklist or an alternative to official guidance.

 

1. UNDERSTAND YOUR SCOPE AND RESPONSIBILITIES

Identify which premises or events may qualify under the legislation and which requirements could apply.

Consider their use, expected attendance, relevant exclusions or special provisions, and the boundaries of any qualifying premises.

Establish who controls the premises for the relevant use, who may be the legally responsible person and where cooperation with landlords, occupiers or other parties may be necessary.

For larger estates, this may require examining different premises and activities rather than applying one classification across the portfolio.

THE QUESTION TO ASK: Do we know which of our premises may be in scope, which tier applies and who is responsible for taking action?

 

2. REVIEW YOUR EXISTING ARRANGEMENTS

Before deciding what needs to change, examine current procedures, staff responsibilities and communication arrangements.

• Could reception staff quickly alert colleagues?
• Would instructions reach people in meeting rooms or public areas?
• Are arrangements accessible to people with different communication or mobility needs?

Review the security, access control and communication systems that may support these procedures, including any limitations or dependencies.

This can reveal gaps without assuming that existing equipment needs replacing.

THE QUESTION TO ASK: Do our people know what to do, and could our current procedures and systems support them effectively?

 

3. ASSESS WHAT IS APPROPRIATE AND PROPORTIONATE

With a clearer picture of existing arrangements, consider what is necessary to meet the applicable duties.

A structured review of risks, vulnerabilities and operational circumstances can help inform decisions. However, Martyn’s Law does not impose a universal requirement for standard-tier premises to produce a standalone terrorism risk assessment.

Enhanced-tier premises and qualifying events have additional statutory duties concerning protective measures and assessments of their expected effectiveness. The legislation does not prescribe one universal standalone risk-assessment format.

Consider the layout, occupancy, access arrangements and activities at the premises. Identify improvements that could meaningfully reduce vulnerability or the risk of physical harm.

Proportionality is essential. What is reasonably practicable depends on the circumstances, including the nature of the premises and the cost, time and difficulty of implementing measures, balanced against their expected public protection benefits.

THE QUESTION TO ASK: Which improvements are appropriate for our building and would make a meaningful difference to public protection?

 

4. DEVELOP AND IMPLEMENT A PRACTICAL PLAN

Translate the findings into clear priorities, responsibilities and actions.

This might involve refining emergency procedures, improving staff awareness, coordinating with other occupiers or addressing justified gaps in security and communication systems.

For some premises, procedural improvements may be appropriate. Others may require more extensive planning, additional protective measures or technology integration.

Consider how arrangements interact with existing fire safety, accessibility, data protection and operational requirements.

Assign responsibility for agreed actions and establish how progress will be monitored.

THE QUESTION TO ASK: Have we identified what needs to happen, who will take responsibility and how the arrangements will work together?

 

5. TEST, REVIEW AND MAINTAIN PREPAREDNESS

Arrangements need to remain workable as circumstances change.

The Act does not prescribe a particular training course or universal exercise frequency. However, people responsible for carrying out procedures or measures need sufficient awareness, instruction and understanding to implement them effectively.

Appropriate practice, testing and review can help establish whether arrangements work in realistic circumstances and whether responsibilities remain clear.

• Check that communication arrangements remain effective and systems relied upon are maintained.
• Changes to occupancy, building layouts, tenants, operating hours or technology may justify further review.

Enhanced-tier protective measures must be kept under review under the legislation. Regular review of other arrangements can also provide useful assurance that preparedness is being maintained.

THE QUESTION TO ASK: How do we know our arrangements would work in practice, and what will help keep them effective over time?

A question worth asking now

If you needed to put your building’s protective procedures into practice tomorrow, how confident would you be that your people, processes and technology could work together effectively?

This is a question about preparedness, not a suggestion that the Act’s main duties are already in force.

Organisations can use the period before commencement to understand their responsibilities and examine their existing arrangements.

Preparedness is about more than having procedures written down. It is about whether the people responsible understand them and can put them into practice when necessary.

How iwGROUP can support your preparation

Understanding the legislation is one part of the challenge. Translating relevant requirements into practical arrangements for individual buildings can involve several disciplines.

At iwGROUP, our approach begins with understanding the organisation, its buildings, the people using them and the operational outcomes required.

Our expertise across security, connectivity, IT, integrated technologies and ongoing management allows us to consider how different systems and services can support an appropriate, coordinated approach.

That may involve reviewing existing technology, advising on suitable infrastructure, designing or integrating security and communication solutions, or supporting the continued operation of relevant systems.

Where specialist legal or regulatory interpretation is required, organisations should seek advice from appropriately qualified professionals.

Engaging a consultant or installing a technology solution does not, in itself, establish compliance with Martyn’s Law. Legal responsibility remains with the responsible person identified under the Act.

Our role is to help organisations make informed, proportionate decisions and implement appropriate arrangements within our areas of expertise.

Preparedness begins with understanding

Martyn’s Law represents an important development in protecting people at publicly accessible premises and events.

Its implementation will require organisations to look carefully at their individual circumstances, establish their responsibilities and put appropriate arrangements in place.

For some, that may involve refining procedures and improving communication. For others, more extensive protective measures and supporting technologies may be necessary.

What matters is that decisions are proportionate, responsibilities are clear and the arrangements are capable of working together.

Meaningful preparedness isn’t simply about having measures in place. It’s about being able to put them into practice when they matter most.

Preparing for what comes next

Understanding what Martyn’s Law means for your building is an important first step. Knowing how your existing procedures, people and technology can support that preparation is equally important.

If you’re reviewing your current arrangements, the iwGROUP team would welcome a conversation about your building, its requirements and where improvements may be appropriate.

By Chris Burfield, Joint CEO at iwGROUP

This Insight reflects the published legislative and regulatory position as understood on 4 November 2026. It provides general information and practical considerations, not legal advice or a determination of compliance for any particular premises or event. Organisations should consult the legislation, current official guidance and appropriately qualified advisers when assessing their obligations.