Martyn’s Law, now being enacted as the Terrorism (Protection of Premises) Act 2025, marks an important development in UK public-safety legislation, according to risk management consultants, RiskSTOP. This new legislation aims to improve preparedness and help organisations better protect the public from the impact of terrorism and will come into force in Spring 2027.
For businesses responsible for publicly accessible premises or events, it introduces new duties that will need to be understood, owned and managed in practice. Johnny Thomson, Head of Strategic Planning at RiskSTOP said: “Martyn’s Law changes how many businesses approach security risk. For some, it will introduce formal duties they may not previously have considered, particularly around preparedness, public protection procedures and clear ownership of responsibility. It becomes law in less than a year, so now is the time to prepare.”
Who must comply?
Martyn’s Law can apply to organisations responsible for publicly accessible premises and events, depending on the type of site and the number of people reasonably expected to attend. This includes venues such as retail centres, hospitality and leisure sites, visitor attractions, sports facilities, places of worship and educational establishments. It also applies to public events and festivals
The legislation introduces two main tiers of duty based on how many people can reasonably be expected to be present at the same time: Standard Duty and Enhanced Duty.
For Standard Tier premises, the focus is on practical, proportionate preparedness, including:
- Notifying the regulator when required
- Clear procedures for evacuation, invacuation, lockdown and communication
- Making sure relevant workers understand what to do in an incident
- Keeping those procedures suitable for the premises and how it operates
Enhanced Tier premises and qualifying events face broader obligations, including:
- Documented public protection procedures
- Additional reasonably practicable protective measures
- Measures designed to reduce vulnerability and the risk of physical harm
- A compliance document that explains what is in place and why
- Clear senior-level accountability, where the responsible person is an organisation
Johnny Thomsom concludes: “In practice, implementation is less about buying a generic compliance package and more about answering clear operational questions, such as who owns the duty, how the expected attendance is evidenced, how shared or hired spaces are managed, and whether existing emergency procedures would actually work in a terrorism scenario.”
Following an incident, organisations that cannot demonstrate a clear approach to compliance may face closer scrutiny of their governance and risk-management practices.
