Martyn’s law – what it means for businesses

Martyn’s Law was developed following the 2017 terrorist attack at Manchester Arena.¹ (external link) A subsequent public inquiry concluded that serious failures in venue security, emergency response, and intelligence handling contributed to the attack and the deaths of its 22 victims.² (external link) 

The legislation was named after Martyn Hett, a victim of the attack. The campaign for the new law was spearheaded by his mother, Figen Murphy OBE, alongside others who called for stronger safety measures at public venues and events.³ (external link) 

The Act forms part of CONTEST (external link), the Government’s wider counter-terrorism strategy.⁴ (external link) This law aims to ensure publicly accessible locations are better prepared for terrorist threats. It requires those in charge of venues or events to consider terrorism-related risks and implement appropriate security measures to help prevent or manage incidents, potentially saving lives.⁵ (external link) 

Who does Martyn’s Law apply to? 

Martyn’s Law covers public premises and events with a capacity of 200 or more people. Some of these include: 

• Retail stores and shopping centres.
• Restaurants, pubs, nightclubs, and public clubs.
• Arenas, concert halls, cinemas, and theatres.
• Sports venues, leisure centres, ice rinks, and gyms.
• Educational institutions. Temporary public events such as festivals and fairs. 

The law applies across the UK in England, Northern Ireland, Scotland, and Wales.

The Security Industry Authority (SIA) (external link) has been appointed as the regulator and will oversee compliance.⁶ (external link) 

SIA’s role is to provide guidance and help ensure that the legal requirements are being met. It will support those responsible for qualifying venues and events in understanding their duties, as well as identifying appropriate and practical safety measures.7 (external link)

The law introduces two categories for businesses based on capacity: standard and enhanced. Businesses with qualifying venues or events will be expected to act in accordance with their tier. 

Although standard and enhanced tiers differ, common responsibilities may include: 

• Risk assessments - evaluating site-specific threats and identifying areas of vulnerability.
• Security measures - implementing practical safeguards such as controlled access, surveillance, or staff deployment.
• Staff training - ensuring employees can identify potential threats and respond according to protocol.
• Emergency procedures - developing clear plans for lockdowns, evacuations, and other response scenarios.
• Record-keeping - maintaining documentation of training, procedures, and risk assessments. 

Those responsible for premises or events in either tier must notify the SIA of their role. 

Standard tier (200-799 capacity) 

Venues and events that can host between 200 and 799 people fall into the standard tier. This category focuses on straightforward, low-cost steps that can help staff and organisers reduce harm and protect lives in the event of an attack.⁸ (external link) Examples include: 

• Locking doors.
• Lowering shutters.
• Identifying safe routes to cover.
• Preparing emergency response plans. 

These measures aim to ensure that fundamental safeguards are in place. Non-compliance in the standard tier can result in fines up to £10,000.⁹ (external link) 

Enhanced tier (800 or more capacity) 

Premises with a capacity of 800 or more are classed in the enhanced tier, which includes additional and more detailed requirements beyond those of the standard tier. For example: 

• Bag checks.
• CCTV.
• Monitoring systems.
• Vehicle security checks.
• Documenting the public protection procedures and measures in place, or proposed to be put in place, and providing this information to the SIA. 

Enhanced tier organisations can face bigger penalties for non-compliance – up to £18 million or 5% of global turnover, whichever is higher.¹⁰ (external link) These requirements reflect the increased complexity and greater risks associated with larger venues and events.

How Martyn’s Law will apply depends on the type of business or premises. Each sector faces unique operational challenges that can impact compliance. 

The SIA has not released detailed guidance, but businesses can begin preparing by identifying which tier they fall under, conducting risk assessments, and reviewing existing procedures. 

Retail and shopping centres 

Retail environments with high foot traffic and complex layouts may need to consider how to monitor entry points, communicate with tenants, and control evacuation routes. Coordinating among multiple units or stores can require additional planning. 

Hospitality venues 

Pubs, restaurants, and nightclubs may need to adapt security planning to accommodate flexible staffing models, late operating hours, and varied capacity levels. These venues often rely on part-time or temporary staff, so they can benefit from ensuring consistent training and awareness across all employees. 

Sports, leisure, and entertainment venues 

Venues hosting large or high-profile events may already have security basics in place. Under Martyn’s Law, these sites will be expected to formalise planning, coordinate with external agencies, and document risk and response strategies thoroughly. 

Education and healthcare facilities 

Schools, universities, hospitals, and care settings serve vulnerable groups and generally allow open access for students, patients, and visitors. Security plans will be expected to balance accessibility with safety and emergency preparedness. 

Early years, primary, secondary, and further education settings will have special consideration. This will also be extended to DfE-funded independent training providers. They will stay in the standard tier, even with 800 or more people, and will not be expected to comply with enhanced duty requirements; however, higher education and private institutions will not receive special consideration if they fall under the enhanced tier.¹¹ (external link)

In addition to legal obligations, Martyn’s Law may contribute to broader organisational goals related to safety, continuity, and reputation. Establishing clear security procedures can help businesses respond effectively to a range of incidents and improve their overall resilience. 

Compliance can also help build stakeholder trust. Customers, employees, and partners may view visible efforts toward public safety as an indicator of strong operational standards and a commitment to their well-being.

When considering terrorism insurance, many businesses focus on protecting their property from physical damage. However, it's also important to think about potential liability claims that could arise if a business fails to meet its duties during a terrorist incident, such as: 

• Implementing sufficiently robust security measures.
• Acting in a timely manner in response to a threat of terrorism.
• Establishing suitable evacuation procedures.
• Providing adequate first aid. 

Do insurance policies include terrorism cover? 

The extent of terrorism cover varies significantly depending on the type of insurance. 

In the UK, most employers’ liability insurance policies include a sub-limit for claims brought by employees against their employer for bodily or mental injury arising from terrorism. However, public liability policies typically do not always provide equivalent cover for claims brought by members of the public. This creates a potential gap in protection, as businesses could face claims from customers, visitors, or other third parties without suitable insurance in place. 

Many standard public liability policies, including some Hiscox wordings, exclude terrorism-related claims by the public. This cover can often be added on referral, usually for an additional premium. 

"Businesses operating from locations subject to Martyn's Law should review their insurance coverage. This can help ensure they are adequately protected against claims by employees or members of the public if they fail to act appropriately in the event of a terrorist incident. If unsure about their coverage, they should speak to their insurer or broker." - Simon Ratcliff, Commercial Property and Liability Underwriting Manager at Hiscox UK

The legislation received Royal Assent on 3 April 2025. However, it is not yet in effect at the time of writing. The government has announced an implementation period of at least 24 months, allowing affected businesses and organisations time to prepare.¹² 

During this transitional phase, businesses can review their operations, conduct risk assessments, and begin implementing relevant procedures. Additional guidance is expected to be published by the Government and the SIA in the lead-up to enforcement. 

Support available for businesses 

A range of free and government-supported resources is available to help organisations meet their responsibilities under Martyn’s Law: 

• ProtectUK (external link) – a national platform operated by Counter Terrorism Policing that offers guidance, training tools, and sector-specific advice. This includes the ACT Awareness e-learning program, (external link) which provides counter-terrorism awareness for front-line and operational staff.
• SCaN (See, Check and Notify) (external link) - a training programme focused on behavioural detection and incident reporting.
• Pool Re Martyn’s Law Hub (external link) - offers planning templates, threat assessments, and legal guidance tailored to different sectors. 

These resources can support businesses at different stages, from early awareness to practical implementation. Engaging with these tools may help organisations tailor their security response to suit their size, setting, and risk profile.