Martyn's Law questions, answered plainly.
Questions and answers
What is Martyn's Law?
Twenty-two people were killed in the Manchester Arena attack in 2017. One of them was Martyn Hett.
His mother, Figen Murray, campaigned for years for a law requiring venues to be prepared for an attack, alongside the recommendations of the Manchester Arena Inquiry. That campaign became the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025 and is known as Martyn's Law.
The Act requires venues above a capacity threshold to have procedures in place to reduce the risk of harm to the public if an attack occurs. Duties are expected to commence in spring 2027.
Does it apply to my venue?
It applies if your premises are used for one of the purposes the Act lists (shops, food and drink, entertainment, halls, sports grounds, libraries and museums, visitor attractions, hotels, places of worship, healthcare, childcare and education among them) and you could reasonably expect 200 or more individuals present at the same time, from time to time. That count includes your staff and volunteers, which catches a lot of venues out. Between 200 and 799 you're Standard Tier; 800 or more is Enhanced Tier, except places of worship, childcare and education premises, which stay Standard Tier at any size. The free check works it out in two minutes.
What does Standard Tier actually require?
Four public protection procedures, appropriate for your specific premises: evacuation, invacuation, lockdown and communication. Then staff who are aware of those procedures and their own role in them, notification to the regulator, and keeping the procedures under review.
It's worth being equally clear about what Standard Tier does not require: no physical security equipment, no security guards, no consultants, and no plan submitted to anyone for approval. The duty is about procedures and awareness, not spending.
Who is the SIA, and what will an inspection look like?
The Security Industry Authority is the regulator for Martyn's Law. Its published approach is a mix of desk-based reviews and site visits, typically with around 72 hours' notice. The test it has described has three parts: do the procedures exist, do they make sense for that specific building, and can staff and volunteers explain them. Where a venue falls short the SIA can issue compliance notices and, for continued failure, penalty notices.
When do I have to notify the SIA?
The notification portal opens in 2027, alongside commencement. Notification is free, and you make it yourself. Be wary of anyone offering to "register" your venue for a fee, because there is nothing to pay. We prepare every detail the portal will ask for so that submitting it takes minutes, and we never record a venue as notified until you confirm you've done it.
Can't I just use a free template?
You can, and it will produce a document. What it can't produce is site-specificity or proof of staff awareness, which are two of the three things the regulator's test checks. If you'd rather do it yourself from the guidance, that's a legitimate route and the guidance is genuinely good: here it is, free. It's 129 pages. We read it professionally so you can meet it practically.
I'm under 200. Should I do anything?
Legally, no: the Act doesn't apply to you, there's nothing to register and no deadline. Some smaller venues put the same procedures in place anyway, because staff knowing what to do isn't a duty question. We'll confirm you're out of scope free, in writing, either way. More on the voluntary route.
What's invacuation?
The guidance defines it as "moving people away from danger to a place within the premises… where there is less risk". It keeps people inside, in a safer part of the building, rather than sending them out. It's the procedure staff most often can't explain, because it's the opposite of the fire-drill instinct everyone has been trained into. That's exactly why inspectors ask about it, and why your procedures have to address the tension head-on rather than assume it away.
Do volunteers count as staff?
Yes, on both counts that matter. They need to be aware of the procedures and their role in them just as paid staff do, and they count toward the capacity figure that decides whether you're in scope at all. For a lot of village halls and churches, remembering to count the volunteers is what moves them over 200.
What happens when I have new staff?
Add them to the roster and they attest before their first shift; the log updates itself. The record follows the people, not the paper. That's the point, because a folder on a shelf can't tell you that three of your six Saturday staff started after it was written.
Coming Staff attestation launches before duties commence in spring 2027; it's included in your price from day one.
Is my venue "compliant" once I buy this?
No, and we'd rather say so plainly than sell you a word we can't stand behind. Compliance is a state of your venue, not a property of a document. We give you everything the duty asks for and the evidence to show it; keeping it true in the building is, and legally must be, yours.