Most organisations have an evacuation plan. Martyn's Law — the Terrorism (Protection of Premises) Act 2025 — is asking a harder question: what happens when evacuating people out of a building is exactly the wrong thing to do?
That is not a hypothetical. In a hostile incident, moving large numbers of people out into an open area can increase exposure rather than reduce it. The Act is explicit about this, and it is one of the genuinely useful things it brings into mainstream premises management.
What Is Martyn's Law?
Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, named in memory of Martyn Hett, who was killed in the Manchester Arena attack in 2017. The Act received Royal Assent on 3 April 2025.
The full operational duties are not yet in force. Implementation is expected around spring 2027, following a preparation period of at least 24 months. But the legislative framework exists, guidance has been published, and the regulator is actively preparing. Now is the right time to understand where your organisation stands.
What Happened in April 2026
Two significant things landed in April 2026:
The Home Office published its statutory guidance, setting out how affected organisations should understand and prepare for the Act's requirements.
The Security Industry Authority (SIA) opened a public consultation on its draft section 12 guidance, which covers how the SIA will regulate Martyn's Law in practice. That consultation closes at 11:59pm on 12 June 2026. If you have a view on how the regulatory framework should work, this is your window.
Who Is Likely to Be in Scope
The Act uses a tiered model based on the number of people reasonably expected at a premises at any one time. Critically, that count includes staff, contractors and volunteers — not just visitors or members of the public.
Standard tier applies where 200 to 799 people may reasonably be present at the same time. Organisations in this tier must have appropriate public protection procedures in place, so far as is reasonably practicable.
Enhanced tier applies at 800 or more people. Enhanced-tier organisations face additional requirements: documented procedures, formal review arrangements, additional protective measures, and senior accountability.
Qualifying events — typically those with 800 or more attendees, public access, and entry controls such as tickets, passes, payment or membership — may also attract enhanced-tier requirements, even if the host premises would not normally meet that threshold.
The range of premises likely to be caught is broader than many assume: venues, event spaces, leisure and sports facilities, education settings, visitor attractions, places of worship, health settings, transport hubs, public authority buildings, and mixed-use sites with significant public footfall.
The Four Public Protection Procedures
This is where Martyn's Law moves beyond the standard fire-drill mindset, and where the genuine operational challenge lies.
The Act identifies four distinct public protection procedures:
Evacuation — Moving people away from danger and out of the premises or event area. This is what most organisations already have a plan for.
Invacuation — Moving people to a safer location inside the premises, or bringing people in from outside if remaining outside would expose them to greater risk. Many organisations have never formally considered this. The word itself is unfamiliar to most.
Lockdown — Securing the premises to prevent people entering or leaving, or to restrict movement within the site. Some organisations have lockdown procedures, particularly in education and healthcare. Many do not.
Communication — Alerting people quickly and providing clear instructions where it is safe to do so. This sounds straightforward, but it is frequently the weakest link: what happens when normal communication channels are unavailable, compromised, or too slow?
The challenge the Act sets is not just having these procedures written down. It is having procedures that staff can implement rapidly and effectively under pressure. A document in a filing cabinet is not a procedure — it is a document.
Why This Is a Management System Issue
It would be easy to frame Martyn's Law as a security topic and assume it sits with whoever handles physical security. That framing will cause problems.
Implementing these requirements well touches emergency planning, event management, contractor control, public access arrangements, staff training, communications infrastructure and record keeping. In an enhanced-tier organisation, it also requires documented procedures, formal review, and named senior accountability.
That is not a security checklist. That is a management system question, and it connects directly to health and safety, quality management, and operational resilience frameworks.
What to Do Now
Full duties are not yet in force, but the practical steps to take now are clear:
Map your footprint. Do any of your premises, events, or sites reach the 200-person threshold? Include staff, contractors and volunteers in that count.
Identify the responsible person. Under the Act, there will be a requirement for a named responsible person for qualifying premises and events. Work out who that would be.
Review your existing emergency arrangements. Do you have documented procedures for invacuation and lockdown, not just evacuation? Have those procedures been tested?
Engage with the guidance. The Home Office statutory guidance is published and publicly available. Reading it now, before duties are in force, is significantly less stressful than reading it under a compliance deadline.
Consider the SIA consultation. If your organisation has a view on how the regulatory framework should operate, the consultation is open until 12 June 2026.
The organisations that start mapping their position now will be in a much more comfortable position when duties formally commence. Martyn's Law is not about creating fear — it is about making sure public-facing premises can make better decisions, quickly, when the normal emergency assumptions may not apply.
If you would like to talk through what this means for your organisation, get in touch.
Sources: