The biggest change to UK counter-terrorism regulation in a generation is on its way. Here's what it requires, who it applies to, and what to do before it takes effect.
Martyn's Law is the public name for the Terrorism (Protection of Premises) Act 2025. It's named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack, whose mother, Figen Murray, spent years campaigning for legislation that would require venues and events to be better prepared for a terrorist attack.
The Act received Royal Assent on 3 April 2025, giving it the force of law. It is not yet in force — but that doesn't mean there's nothing for businesses to do in the meantime.
The 2017 attack exposed how unprepared many public venues were to respond to a terrorist incident — not just to prevent one, but to protect the people inside if the worst happened.
Martyn's Law is designed to close that gap. It requires those responsible for certain premises and events to take proportionate, reasonably practicable steps to reduce the risk of harm to the public — both by reducing how vulnerable the premises is, and by making sure staff know how to respond if an attack occurs.
Premises used mainly for certain qualifying activities, and qualifying public events, wherever it's reasonable to expect 200 or more people to be present at the same time — staff included.
Offices and residential developments generally fall outside the Act's scope. Education settings are always treated as standard tier, regardless of how many people are on site.
What's required depends on how many people it's reasonable to expect on-site at the same time.
The regulator, the Security Industry Authority (SIA), can issue compliance notices, restriction notices and monetary penalties for non-compliance once the Act is in force.
The Act sets a minimum 24-month implementation period from Royal Assent, giving businesses time to prepare and the SIA time to stand up as regulator.
Spring 2027 is the date consistently signalled by the Home Office, the SIA and legal commentators — but it has not yet been formally confirmed by Parliament. There's no legal duty to comply until the Act formally commences.
No legal duty to comply yet doesn't mean no reason to start. Twenty-four months sounds like a long runway until it isn't — and the organisations that leave it until commencement will be preparing under pressure, not by choice.
This is exactly where an independent security survey earns its keep — identifying where your premises stands today against what enhanced duty will expect, before the SIA is asking the questions for you.
Compliance is the floor, not the ceiling.
The organisations that treat Martyn's Law as just a deadline will do the minimum required and stop. The ones that treat it as a reason to properly understand their own vulnerabilities will be the ones actually ready if it ever matters.
Fortitude Security helps organisations understand where they stand against Martyn's Law today — through independent physical security surveys that identify vulnerabilities, and penetration testing that shows whether your procedures would actually hold up under real conditions.
Try the readiness scorecard →This page is a general guide to Martyn's Law, accurate as of July 2026. It is not legal advice, and thresholds, guidance and enforcement detail may be updated before the Act commences. For advice specific to your premises, speak to a qualified adviser.
