If 200 or more people can reasonably be expected to be at your school, site or workplace at the same time, you may have a new legal duty coming your way. It’s called Martyn’s Law.

Schools, colleges, councils, care settings and plenty of other organisations are potentially in scope. Here we take a look at what it actually means, whether it applies to you, and what to do about it before the Act comes into force – it’s expected to do so in spring 2027.

What is Martyn’s Law?

Martyn’s Law puts a legal duty on those responsible for qualifying premises and events to take steps to reduce harm if a terrorist attack happens. For standard duty premises, this doesn’t mean expensive security kit. It means having reasonably practicable procedures in place for evacuation, invacuation (moving people to a safer place inside a building), lockdown and communication.

The law is named after Martyn Hett, one of 22 people killed in the Manchester Arena bombing in 2017. His mum, Figen Murray, spent years campaigning for a change in the law. This campaign became the Terrorism (Protection of Premises) Act 2025. It received royal assent on 3 April 2025, and the main duties are expected to come into force in spring 2027.

Does it apply to you?

Martyn’s Law doesn’t automatically apply to every workplace or public space with 200 or more people. Your premises need to meet a few conditions first.

In simple terms, you’re likely to be in scope if:

• Your premises include a building. This could be a whole building, part of one, or a group of buildings. It can also include surrounding land, such as the grounds of a school.
• They’re mainly used for one of the activities covered by the law. This includes education and childcare, as well as shops, restaurants and pubs, entertainment and leisure venues, sports grounds, libraries, museums and galleries, hotels, places of worship, healthcare settings and certain public authority buildings.
• 200 or more people could reasonably be expected to be there at the same time. This includes staff as well as visitors and other people using the premises.
• The premises aren’t specifically excluded from the law. There are some exemptions, which are covered in more detail in the official guidance.

So, for example, a school with 500 pupils and staff would potentially be in scope because education is one of the activities covered by Martyn’s Law and it meets the 200-person threshold. But a workplace doesn’t automatically qualify simply because 200 people work there. What the premises are mainly used for matters too.

Once you’ve established that your premises are in scope, the next question is which tier you’re in.

• Standard tier (200 to 799 people): qualifying premises in this tier need to notify the Security Industry Authority (SIA) and put sensible procedures in place for evacuation, invacuation, lockdown and communication.
• Enhanced tier (800+ people): if you qualify for this tier, you’ll have additional responsibilities. These include taking reasonably practicable public protection measures and documenting how you are complying with your duties, including sending your compliance document to the SIA.

If you work in education, qualifying childcare, primary, secondary and further education premises remain in the standard tier – even if 800 or more people can reasonably be expected to be there at the same time. So, a secondary school with 1,200 pupils isn’t automatically required to introduce measures such as CCTV, bag searches or new barriers just because of its size. The focus is on proportionate procedures rather than a costly security overhaul.

By contrast, higher education premises don’t have this exemption and may fall within the enhanced tier. You can find out more at the Department for Education.

For more detail on which premises are covered by Martyn’s Law, GOV.UK has further guidance on the scope of the Act.

Why now’s the right time to start

Martyn’s Law received royal assent in April 2025, but its main legal duties aren’t yet in force. The Home Office has now published statutory guidance explaining the requirements. The SIA expects to publish final guidance on how it will regulate Martyn’s Law in autumn 2026, with the Act expected to come into effect in spring 2027.

This might sound like plenty of time. But working out what your procedures should look like, communicating them properly and making sure the right people understand what to do isn’t necessarily a last-minute job.

What happens if you don’t act?

Once the Act is in force, the SIA will assess compliance through desk-based checks and site visits, typically with at least 72 hours’ notice for an on-site inspection, although inspections without notice may be possible in some circumstances. Non-compliance can mean penalties of up to £10,000 for standard tier premises. For enhanced tier premises and qualifying events, the penalty is either £18 million or 5% of qualifying worldwide revenue – whichever is greater.

But the real reason to get this right isn’t about avoiding penalties. It’s knowing that if something ever did happen at your premises, the right people would know what to do.

Common questions about Martyn’s Law

Does it apply to primary schools? It can. Qualifying education premises where 200 or more people, including staff, can reasonably be expected to be present at the same time will generally fall within the standard tier.

Do premises always need CCTV and bag searches? Not necessarily. Standard duty premises are required to have reasonably practicable procedures for evacuation, invacuation, lockdown and communication. The Act doesn’t automatically require you to install new security equipment.

Who counts as the ‘responsible person’? This is the person or organisation that has control of the premises and how they’re used. Depending on your setting, that might be an employer, academy trust, governing body or another organisation. Importantly, despite the name, the ‘responsible person’ doesn’t have to be one individual – it can be an organisation.

What if you run more than one site? Each site is generally assessed on its own against the qualifying criteria and 200-person threshold. This means a trust or organisation with several sites may find some are in scope and others aren’t.

When do you need to be ready by? The Act is expected to come into force in spring 2027. Currently, there’s no legal requirement to comply with the main duties – but preparing your procedures and making sure the right people understand them takes time. Starting now avoids a last-minute rush.

How to prepare for Martyn’s Law

Here’s where to begin:

1. Check whether your premises are in scope. Use the criteria above to check whether your premises qualify and how many people could reasonably be there at the same time. Then establish whether the standard or enhanced duty applies.
2. Identify your responsible person. Who has overall control of the premises and how they’re used?
3. Map your current procedures. What is already documented for evacuation, lockdown, invacuation and communication? Where are the gaps?
4. Make sure your staff know what to do. Martyn’s Law doesn’t prescribe a particular training course, but anyone expected to put your procedures into practice needs to understand exactly what’s required.
5. Set a review date. Buildings, staff and operating arrangements change over time, so set a reminder to revisit your procedures regularly.

Looking for guidance?

Our Martyn’s Law and Emergency Preparedness course helps staff understand emergency preparedness, including the ETHANE framework, lockdown procedures and how to build a full emergency plan. It’s online, CPD-certified and takes around 1.5 hours to complete.

Whatever sector you’re in, if you think your premises may fall within scope, it’s worth getting ahead of the new requirements now, while there’s still time to put practical procedures in place properly.

Please note: This article provides general information about Martyn’s Law and isn’t intended as legal advice. Organisations should seek appropriate advice about how the requirements apply to their individual circumstances.

Found this useful? Get practical guidance like this sent straight to your inbox, every month. Sign up here.