Position as at 9 September 2026.
Martyn’s Law is not yet in force. The Terrorism (Protection of Premises) Act 2025 is expected to commence in spring 2027, the exact date has not been confirmed, and the Home Office is explicit that the Act “does not require physical alterations or the purchase [of] specific equipment relating to putting public protection procedures in place.”
We sell emergency and evacuation equipment. We are opening with the Home Office’s own words because the market around this legislation has filled up with “Martyn’s Law compliant” products, and no such thing exists. The Home Office, the Security Industry Authority and the National Counter Terrorism Security Office “do not endorse any third-party products offered by the private sector in respect of compliance with this legislation.” There is no certification scheme, no approved supplier list, and no product that confers compliance.
If you are responsible for a venue, a campus, a retail estate, a hotel or a place of worship, this is written for you. What follows is what the Act actually requires, which tier your premises fall into, what the deadlines look like, and where equipment does and does not legitimately fit.
Where the law actually stands
The Terrorism (Protection of Premises) Act 2025 (c. 10) received Royal Assent on 3 April 2025. The statutory guidance states that “the implementation period is at least 24 months from Royal Assent to allow those in scope of the Act to prepare for the requirements of the Act coming into force.”
Since then:
- Section 27 statutory guidance was published in April 2026 and last updated on 25 August 2026.
- Notification requirement guidance was published on 14 July 2026, with the underpinning regulations made on 9 July 2026.
- Two commencement regulations have brought machinery provisions into force — the guidance-making powers and related SIA powers.
What has not happened is commencement of the duties themselves. The SIA’s guidance says: “It is expected that the Act will come into force in spring 2027. We will confirm the exact date ahead of when this happens.”
So the position is this. Nothing under this Act is legally required of you today — though plenty else is, from fire safety to your first aid needs assessment. A commencement date is expected but not fixed. And the guidance you are likely to be judged against is already published and has already been revised once, which means the preparation work can be done now rather than in a rush next spring.
Which tier are you in?
The threshold is capacity, and the statutory test is worth reading in full rather than in summary. Section 2 asks whether “it is reasonable to expect that from time to time 200 or more individuals may be present on the premises at the same time in connection with one or more uses specified in Schedule 1.” The enhanced tier applies the same test at 800.
| Capacity test | Tier | |
|---|---|---|
| Qualifying premises in a Schedule 1 use | 200–799 individuals | Standard duty |
| Qualifying premises in a Schedule 1 use | 800+ individuals | Enhanced duty |
| Qualifying events | 800+ individuals | Enhanced duty |
Places of worship, and education below higher education, are standard tier at any capacity — see below.
Three things people get wrong:
Staff count. The statutory guidance is explicit that the figure “must include staff working at the premises in connection with a Schedule 1 use.” It is not a public headcount.
It is a reasonable expectation, not a licensed capacity or an average. The guidance asks for “a reasonable method” to calculate “the greatest expected number of individuals at the premises at the same time.” A venue that is quiet most weeks but fills to 250 four times a year is caught by “from time to time.”
Your premises must also be in a Schedule 1 use. There are seventeen such uses, and the list is broader than most people assume: retail, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls and conference centres, visitor attractions, hotels and holiday parks, places of worship, healthcare, bus and rail stations, aerodromes, childcare, primary and secondary education, further education, higher education, and public authorities.
The special cases that catch people out
Places of worship are standard tier whatever their capacity. Under Schedule 1, premises used for communal worship are standard duty premises “regardless of how they would otherwise be treated.” A cathedral holding thousands does not become enhanced tier.
Childcare, primary, secondary and further education are standard tier by the same mechanism. Higher education is not — a university can fall into the enhanced tier on capacity.
One caveat on both. The premises stay standard tier, but a qualifying event held at them can still be caught at enhanced tier on its own capacity. If you hire your hall out, or run ticketed events at scale, check the event limb of the test as well as the premises limb.
Some premises are excluded entirely under Schedule 2, including parks and recreation grounds the public can access freely without payment, ticket or membership, and premises already covered by aviation, rail, Channel Tunnel or port security regimes.
What standard tier premises must do
Two duties. The Home Office’s position is that neither requires you to buy anything.
First, notify the SIA. Those responsible for qualifying premises when the requirement commences must notify “within a period of three months.” Those who become or cease to be responsible must notify “within 28 days,” and inaccurate information must be corrected within 28 days. For qualifying events the window is 14 days.
Second, have appropriate public protection procedures in place. Section 5 requires the responsible person to “so far as is reasonably practicable, ensure that appropriate public protection procedures are in place.” The Act describes these functionally; the Home Office guidance gives them the four names most people now use:
- Evacuation — “the process of getting people away from danger by moving them out of the premises (or part of the premises or event)”
- Invacuation — “the process of moving people away from danger to a place within the premises or event where there is less risk of physical harm being caused to them”
- Lockdown — “the process of securing the premises or event to prevent individuals entering or leaving…”
- Communication — “the process of ensuring information is provided to individuals at the premises or event…”
These are procedures — decisions, plans and briefings — not installations. The overarching factsheet states that requirements at this tier “are focused on activities to enact policies and procedures that are expected to be simple and low cost.” The Home Office myth buster, citing the government’s impact assessment, puts it at around £330 per year for standard tier premises, “which relates to management and staff time spent rather than cash expenditure.”
Note “low cost” rather than no cost. Your time is the cost.
What enhanced tier premises must do
Everything above, and then a different order of work. Standard tier is largely something you write down once and brief people on. Enhanced tier is an ongoing relationship with a regulator: a document that goes to the SIA, is revised when things change, and has a named senior person attached to it. The myth buster’s figure here is around £5,210 per year.
Public protection measures, under section 6, in four categories named in the guidance: monitoring the premises and their vicinity, movement of individuals into, out of and within the premises, physical safety and security, and security of information.
The same principle applies at this tier as at standard tier: these are things you decide, document and manage, and the guidance names no product that satisfies any of them. “Physical safety and security” covers measures as ordinary as who holds keys and how a door is controlled. What is appropriate is for the responsible person to determine, proportionately — and the SIA will be assessing the reasoning, not the receipts.
A documented assessment provided to the SIA. Section 7 requires a document setting out the procedures, “an assessment of how those procedures may be expected to reduce the risk mentioned in section 5(2),” the measures in place or proposed, and an assessment of how those measures reduce vulnerability. It goes to the SIA “as soon as is reasonably practicable after it is prepared,” and revisions within 30 days.
A designated senior individual. Where the responsible person is a body, section 10 requires designation of an individual concerned in its management or control. The guidance confirms that this person is “not personally liable for a responsible person’s failure to meet the requirements for the purposes of receiving a penalty notice.” That carve-out is specific to penalty notices and does not extend to the criminal offences at sections 24 and 25, below.
How much is enough?
The phrase doing the real work in this Act is “so far as is reasonably practicable.” It is why there is no checklist that makes you finished, and it is also why the Act is less frightening than the penalty figures suggest. What is reasonably practicable for a 250-capacity village hall and for an 8,000-capacity arena are different things, and the Act expects them to be. You are being asked to make proportionate decisions you can explain, not to reach a fixed standard.
Penalties
Worth knowing, though the SIA has said its approach will involve “desk-based assessments and on-site inspections,” and that it will “typically give at least 72 hours’ notice before an on-site inspection.”
| Breach | Maximum |
|---|---|
| Standard duty premises | £10,000 |
| Enhanced duty premises or qualifying events | £18 million, or 5% of qualifying worldwide revenue, whichever is greater |
| Daily penalty, standard | up to £500 per day |
| Daily penalty, enhanced | up to £50,000 per day |
There are also criminal offences: failing to comply with a compliance notice at enhanced tier or with any restriction notice (section 24), and knowingly or recklessly providing false or misleading information to the SIA (section 25). Both carry up to two years’ imprisonment on conviction on indictment.
The two myths that matter if someone is selling you something
The Home Office publishes a Martyn’s Law myth buster. Two entries deserve quoting, because they contradict a good deal of what is currently being sold.
Myth: “Businesses and organisations will need to buy services to comply with the Act’s requirements.” Fact: “The government’s intent is that those responsible for premises and events in scope can comply with the Act without needing to buy specialist services.” … “The Home Office, the Security Industry Authority and the National Counter Terrorism Security Office do not endorse any third-party products offered by the private sector in respect of compliance with this legislation.”
Myth: “I need to purchase Public access Trauma First Aid kits to be compliant.” Fact: “There is no specific requirement to provide medical treatment and associated equipment within the Act.”
The SIA puts it plainly too: “Neither the SIA nor the Home Office is able to endorse or recommend specific companies or services for compliance with this legislation, as it would be inappropriate for a government agency to do so.”
If a supplier tells you a product is Martyn’s Law compliant, approved, certified or required, they are describing something that does not exist. Treat it as a reason to check the rest of what they tell you.
So where does equipment legitimately fit?
Narrowly, in two places — neither of which is compliance.
Where your own operational choices leave you needing something. Suppose your invacuation procedure sends several hundred people into a basement plant room for an hour. That raises questions about the space — lighting, water, how you would talk to people in it. The first honest answer is often to choose a different space. If you conclude the space is right and something is missing, that is your operational judgement about a decision you made. The Act did not require it, and neither did the procedure; you did.
Where a different duty already applies. Trauma and bleed control provision sits under your first aid needs assessment and your health and safety duties, not under this Act — the myth buster is explicit that the Act contains no such requirement. If you decide to hold it, decide it there, on that evidence, and record it as such.
The ordering matters: procedures first, then equipment only if your own decisions leave a gap.
This is a summary of published government guidance, not legal advice. Where your tier, your responsible person or your Schedule 1 use is genuinely arguable — shared premises, hired-out spaces and multi-occupancy sites are the usual hard cases — the section 27 statutory guidance is the primary source, and your own advisers are the right people to read it with you.
What the guidance describes
The government’s position is that “whilst those that fall within scope of the Act are encouraged to begin considering the requirements, they should note that there will be no legal requirement to comply until the legislation comes into force.”
The order of work implied by the Act and the statutory guidance runs roughly as follows.
Capacity comes first, because it determines everything else. The figure is the greatest number reasonably expected to be present at the same time, staff included, calculated by a method that can be explained.
Then the Schedule 1 use, which governs whether the premises are in scope at all — and the special cases above, which can override the tier a capacity figure alone would suggest.
Then the responsible person. Responsibility follows control of the premises. It generally sits with the organisation operating the site rather than someone hiring it, but a hirer with control for the duration of an event can be the responsible person for that event, and a responsible person cannot contract the duty away. Shared and hired-out spaces are the common hard case, and the guidance deals with control at length.
The guidance itself is the SIA’s stated starting point. Its wording is that “the best first step is to review the Home Office section 27 guidance outlining the steps necessary for premises and events to comply.”
Then the four public protection procedures under section 5, drafted and understood by the people who would run them.
At enhanced tier, additionally, the documented assessment under section 7 and the designated senior individual under section 10.
Finally, commencement. The date has not been set, and the SIA has said it will confirm it in advance. The notification windows then run from that date — three months for qualifying premises, fourteen days for qualifying events.
Note what does not appear anywhere in that sequence: buying anything.
The short version
Martyn’s Law asks you to think, plan and write things down. It does not require any premises to buy any product, at either tier, and no government body will ever tell you a product makes you compliant.
We are a supplier, not an adviser. We do not assess premises, write procedures, or advise on the Act or on what your organisation should hold. The section 27 statutory guidance is the primary source, and your own advisers are the people to read it with you.
What we do is supply equipment to a specification. If that work leaves you having decided you need something, send us your specification. Tell us what you want and we will quote it, source it and supply it, including bespoke kits assembled to your own list. What goes on that list is your decision, taken for your own operational reasons and not as a compliance requirement. We have been supplying UK organisations since 2005.
Sources
All sources are UK legislation, the Home Office, the Department for Education, or the Security Industry Authority.
- Terrorism (Protection of Premises) Act 2025 (c. 10) — https://www.legislation.gov.uk/ukpga/2025/10/contents
- Section 2 (qualifying premises and capacity) — https://www.legislation.gov.uk/ukpga/2025/10/section/2
- Section 3 (qualifying events) — https://www.legislation.gov.uk/ukpga/2025/10/section/3
- Section 5 (public protection procedures) — https://www.legislation.gov.uk/ukpga/2025/10/section/5
- Section 6 (public protection measures) — https://www.legislation.gov.uk/ukpga/2025/10/section/6
- Section 7 (documented assessment) — https://www.legislation.gov.uk/ukpga/2025/10/section/7
- Section 10 (designating a senior individual) — https://www.legislation.gov.uk/ukpga/2025/10/section/10
- Section 18 (penalties) — https://www.legislation.gov.uk/ukpga/2025/10/section/18
- Section 19 (daily penalties) — https://www.legislation.gov.uk/ukpga/2025/10/section/19
- Sections 24 and 25 (offences) — https://www.legislation.gov.uk/ukpga/2025/10/section/24
- Schedule 1 (specified uses; places of worship at paragraph 9) — https://www.legislation.gov.uk/ukpga/2025/10/schedule/1
- Schedule 2 (excluded premises and events) — https://www.legislation.gov.uk/ukpga/2025/10/schedule/2
- Home Office — Statutory guidance, updated 25 August 2026 — https://www.gov.uk/government/publications/the-terrorism-protection-of-premises-act-2025/terrorism-protection-of-premises-act-2025-statutory-guidance
- Home Office — Notification requirement guidance, 14 July 2026 — https://www.gov.uk/government/publications/terrorism-protection-of-premises-act-2025-notification-requirement/terrorism-protection-of-premises-act-2025-notification-requirement-accessible
- Home Office — Overarching factsheet — https://www.gov.uk/government/publications/terrorism-protection-of-premises-act-2025-factsheets/terrorism-protection-of-premises-act-2025-overarching-factsheet
- Home Office — Standard duty requirements factsheet — https://www.gov.uk/government/publications/terrorism-protection-of-premises-act-2025-factsheets/terrorism-protection-of-premises-act-2025-standard-duty-requirements-factsheet
- Home Office — Enhanced duty requirements factsheet — https://www.gov.uk/government/publications/terrorism-protection-of-premises-act-2025-factsheets/terrorism-protection-of-premises-act-2025-enhanced-duty-requirements-factsheet
- Home Office — The regulator, sanctions and enforcement factsheet — https://www.gov.uk/government/publications/terrorism-protection-of-premises-act-2025-factsheets/terrorism-protection-of-premises-act-2025-the-regulator-sanctions-and-enforcement-factsheet
- Home Office — Martyn’s Law myth buster — https://assets.publishing.service.gov.uk/media/69281f35b3b9afff34e960f0/martyns-law-mythbuster.pdf
- SIA — Understanding Martyn’s Law and the SIA’s role as regulator — https://www.gov.uk/guidance/understanding-martyns-law-and-the-sias-role-as-regulator
- Department for Education — Martyn’s Law for education settings — https://www.gov.uk/government/publications/martyns-law-for-education-settings
- The Terrorism (Protection of Premises) Act 2025 (Commencement No. 2) Regulations 2026 — https://www.legislation.gov.uk/uksi/2026/622/made
- The Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026 — https://www.legislation.gov.uk/uksi/2026/793/made











And I’m being entirely practical, not sarcastic (and truthful) like the 

Nevertheless, the Holbon electrical fire on 01 April 2015 is a good example and here is why. In the words of Gary Squires from the London Fire Brigade (

Have a great week and good start to September – make it a Preparedness month for yourself, your loved ones and your wider communities. And if you want to delve a little deeper, watch this brilliant VIDEO by The Royal Society, an animation and briefing on unconscious bias adapted by Professor Uta Frith 


Business Continuity Management or BCM is often treated as a subset of risk management. Up to a point this holds, for in Risk Management (ISO 31000) risk identification is the first key step in risk assessment that leads to the selection of appropriate risk treatments based on the best available information. Problems arise here, however, when ‘best available information’ is not good enough or absent. This is often the case in today’s world of complex and often hidden or fast developing threats both man-made and natural disasters.


