Martyn's Law for Security Companies: A Guide
Published 19 October 2026
What Martyn's Law (the Terrorism (Protection of Premises) Act 2025) means for security companies: scope, the two tiers and how to prepare clients.
Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It requires certain public premises and events to be prepared to keep people safe in the event of an attack. It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack, and it received Royal Assent on 3 April 2025. The Security Industry Authority (SIA) is the regulator. This guide explains the basics for security companies, whose clients will be asking for help.
This is a summary for information. It is not legal advice. The official guidance is on GOV.UK: Understanding Martyn's Law and the SIA's role as regulator.
When does it start?
The SIA expects the Act to come into force in spring 2027 and says it will confirm the exact date ahead of time. The SIA consulted on its draft regulatory guidance in spring 2026 and plans to publish the final guidance in autumn 2026. Treat the next months as the preparation window.
Which premises and events are in scope
Premises are likely to be in scope if all of these apply:
- they include a building or part of a building
- they are wholly or mainly used for one of the purposes listed in Schedule 1 of the Act
- it is reasonable to expect that 200 or more people will be present at the same time, from time to time, including staff
- they are not excluded premises under Schedule 2 of the Act
An event is likely to be in scope if it is open to the public, has entry checks (checking a ticket, pass or membership), and it is reasonable to expect 800 or more people at the same time, including staff, at premises that are not already in the enhanced tier.
The two tiers
| Standard tier | Enhanced tier | |
|---|---|---|
| Who | Premises where 200 to 799 people may be present at the same time | Premises where 800 or more may be present, and qualifying events |
| Notify the SIA of the responsible person | Yes | Yes |
| Public protection procedures, so far as reasonably practicable | Yes | Yes |
| Public protection measures, so far as reasonably practicable | No | Yes |
| Document and assess procedures and measures, and send to the SIA | No | Yes |
| Senior individual named for an organisation | No | Yes |
Premises used for childcare, education or worship are in the standard tier if 200 or more people may be present, and stay in it even if the number reaches 800.
The four public protection procedures
Both tiers must consider these:
- Evacuation: getting people away from danger by moving them out.
- Invacuation: moving people to a place inside where there is less risk of harm.
- Lockdown: securing the premises to stop people entering or leaving.
- Communication: making sure information reaches people at the premises.
The four public protection measures (enhanced tier)
Monitoring (for example CCTV), movement of people in, out and within the premises, physical security, and security of information about the premises that could help someone plan an attack.
Reasonably practicable and the responsible person
The Act asks for what is "reasonably practicable", which means weighing what can be done against the cost, time and difficulty, taking account of the premises and the resources available. The responsible person is the individual, organisation or company with control of the premises: usually the occupier who decides how the premises are managed and who may stay. For enhanced tier premises an organisation must name a senior individual, a member of staff involved in its management or control, who is responsible for compliance.
How the SIA will regulate
The SIA will help those responsible to comply, assess compliance and bring non-compliant premises and events into line. It will use desk-based assessments and on-site inspections, with a risk-based approach, and will usually give at least 72 hours' notice before an inspection. Its focus is whether reasonable steps have been taken.
What security companies can do now
- Map your clients. List each site and estimate the number of people who can be present at once, staff included. That shows who is likely to be standard tier, enhanced tier or out of scope.
- Talk to clients early. Venues will look to their security provider for evacuation, invacuation, lockdown and communication procedures that officers can actually carry out.
- Make procedures part of the post. Put the procedures in site instructions, brief every officer, and record who has read and acknowledged them.
- Train and record it. Keep dated training records for officers and for the client's staff where you provide it. ProtectUK offers free guidance and training material.
- Keep evidence. Patrol logs, incident reports, the daily occurrence book and drill records are the evidence that reasonable steps were taken.
- Plan to revisit. When the SIA publishes its final guidance, review your procedures against it.
How GuardFlow helps
GuardFlow cannot make a premises compliant, and it does not decide what is reasonable for you. What it does is keep the records that show what was done: documents officers must read and acknowledge, patrol checkpoints, incident reports and the daily occurrence book, all dated and attributed. See how it works or talk to us. Free advice and guidance is also available from ProtectUK.