Martyn's Law Training: What UK Premises Need Staff to Know Before 2027

Martyn's Law is expected to come into force in spring 2027. If you run a pub, restaurant, school, shop or other public-facing premises where 200 or more people may be present at the same time, now is the time to understand what it means for your staff.

Preparing doesn't necessarily mean purchasing expensive security equipment or specialist training courses. For many organisations, it starts with something much simpler: making sure employees understand their responsibilities and know how to respond if a serious threat occurs.

This guide explains who Martyn's Law applies to, what the legislation requires, what staff need to know and how to prepare using our practical 10-point checklist.

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It is named in memory of Martyn Hett, one of the 22 people killed in the Manchester Arena terrorist attack in 2017. His mother, Figen Murray OBE, campaigned for legislation to improve security and preparedness at public premises.

The Act aims to reduce the risk of physical harm from terrorism by requiring those responsible for certain premises and events to establish appropriate protection procedures and, for larger premises, additional security measures.

The government committed to an implementation period of at least 24 months following Royal Assent. The Security Industry Authority (SIA) expects the legislation's main requirements to come into force in spring 2027, although the exact commencement date has not yet been confirmed.

The government will bring the relevant provisions into force, and the SIA will announce the date in advance.

Does Martyn's Law apply to your premises?

Martyn's Law introduces two levels of requirements: the standard tier and the enhanced tier.

For most qualifying premises, the tier depends on the greatest number of people reasonably expected to be present at the same time.

Which types of premises are affected?

The Act covers many types of publicly accessible premises, including hospitality, retail, education, places of worship, entertainment venues and community facilities.

Here are some illustrative examples.

*These examples assume that the premises meet the other qualifying conditions under the Act.

For education, the distinction is particularly important. Department for Education-funded independent training providers can benefit from the special standard-tier treatment, but employer providers and private, non-government-funded further education training providers are excluded from it. Higher education premises, including universities, are also subject to the normal thresholds.

Is the number of people the only consideration?

No. To qualify under the Act, premises must generally meet four conditions:

1. Include a building or part of a building, potentially together with associated land.
2. Be wholly or mainly used for one or more purposes listed in Schedule 1 of the Act.
3. Reasonably expect at least 200 people to be present at the same time, from time to time, in connection with the qualifying use.
4. Not fall within an exclusion under Schedule 2.

Separate rules apply to qualifying events, including certain publicly accessible events involving 800 or more people with entry checks.

How do you calculate attendance?

It's not simply the number of seats, employees or customers on an average day.

The Act considers the greatest number of people who can reasonably be expected to be present simultaneously, from time to time.

This includes relevant employees, customers, visitors, contractors and other individuals.

For example, a pub might usually have 80 customers but regularly accommodate 250 customers and staff on busy weekends. That could place it within the standard tier.

Even occasional busy periods or annual events may be relevant if attendance at that level is reasonably foreseeable.

Organisations should use reliable information, including normal operating patterns, booking records, attendance figures and relevant capacity information, rather than relying only on a quiet weekday or an unrealistic theoretical maximum.

For mixed-use buildings and more complex premises, refer to the Home Office statutory guidance.

What are the standard tier requirements?

If your premises fall within the standard tier, the two main duties are:

• Notify the SIA when the relevant requirement comes into force.
• Ensure appropriate public protection procedures are in place, so far as is reasonably practicable, to reduce the risk of physical harm if a terrorist attack occurs at or near the premises.

There are four types of public protection procedure to consider.

1. Evacuation: getting people away from danger

Employees need to understand how people can safely leave the premises or an affected area.

This may include alternative exits and routes that avoid a threat.

An evacuation route suitable for a fire may not be appropriate during a terrorist incident, particularly if the danger is outside the building.

2. Invacuation: moving people to safety inside

Invacuation means moving people to a safer place within the premises.

For example, if a serious incident is occurring outside a restaurant, it may be safer to move customers away from entrances and windows and towards an appropriate internal location.

Staff should understand the relevant procedure and which internal areas may be suitable.

3. Lockdown: securing the premises

Lockdown involves securing all or part of a premises to prevent people entering or leaving.

Depending on the building and circumstances, designated staff might need to secure doors, shutters or other access points.

Employees responsible for these actions must understand how to carry them out safely and when they should follow instructions from emergency services.

4. Communication: giving people clear instructions

During a serious incident, people need accurate, timely instructions.

Procedures should explain how employees alert colleagues, contact emergency services and communicate with customers, visitors, pupils or other people present.

Communication might involve radios, public address systems, verbal instructions or another appropriate method.

Does the standard tier require a written security plan?

There is no specific statutory requirement for standard-tier premises to produce the detailed compliance document required of enhanced-tier premises.

However, the Home Office recommends documenting public protection procedures. Written instructions can help employees understand their responsibilities and make it easier to demonstrate that effective arrangements are in place.

Standard-tier premises are not automatically required to install new security equipment or make physical alterations.

The principle is to establish procedures that are appropriate and reasonably practicable for the particular premises.

What are the enhanced tier requirements?

Premises in the enhanced tier have additional responsibilities because larger numbers of people could potentially be affected by an incident.

Alongside SIA notification and public protection procedures, responsible organisations must:

Implement public protection measures. These must be appropriate and reasonably practicable and cover four categories: monitoring, movement, physical safety and security, and security of information.

Prepare a compliance document. This records the procedures and measures in place or planned, and assesses how they are expected to reduce vulnerability and the risk of physical harm. It must be provided to the SIA, and revised versions must be submitted within the applicable deadline, generally 30 days after revision.

Designate a senior individual. Where the responsible person is an organisation rather than an individual, a senior individual involved in its management or control must be designated to ensure compliance.

Certain qualifying events involving 800 or more people are also subject to enhanced requirements.

The appropriate measures will depend on the nature, size and circumstances of the premises or event. A large entertainment arena and a busy restaurant will not necessarily need identical arrangements.

Martyn's Law training: what do staff actually need to know?

This is where written procedures become practical preparedness.

Martyn's Law does not require employees to complete a particular training course, obtain a named counter-terrorism qualification or purchase third-party training.

However, the Home Office statutory guidance makes an important distinction.

Employees and others responsible for carrying out public protection procedures must be made aware of those procedures and their specific responsibilities. They also need the understanding, experience and tools necessary to implement them effectively.

A procedure that nobody understands or knows how to follow is unlikely to be effective.

This is why appropriate instruction and staff awareness are important, even though the legislation does not mandate a particular course.

1. Know who does what in an emergency

Not every employee needs the same responsibilities.

A duty manager might initiate a procedure, while reception employees communicate with visitors, security personnel manage access points and other staff guide people towards safer locations.

Employees should understand:

• Who can activate emergency procedures.
• Who is responsible for particular actions.
• Who they should report concerns to.
• What happens when the usual manager or designated person is absent.

These arrangements need to work across different shifts, including evenings, weekends and periods involving temporary workers.

2. Recognise and report suspicious activity

Employees should understand how to recognise and report potential security concerns.

Examples might include unattended suspicious items, unusual attempts to access restricted areas or behaviour indicating a possible threat.

Staff should focus on observable activity rather than assumptions based on a person's appearance, identity or background.

They should also understand how to report concerns promptly without placing themselves at risk or attempting to investigate a dangerous situation.

The free ProtectUK ACT Awareness e-learning course is a useful resource for general counter-terrorism awareness. For the everyday reporting habits that sit alongside it, see workplace security and staff awareness.

3. Understand lockdown and invacuation procedures

Employees with relevant responsibilities should know what the organisation expects them to do when moving people inside or securing the premises is appropriate.

That may involve knowing:

• Which internal areas have been identified as potentially safer.
• Who is authorised to initiate lockdown.
• How designated access points are secured.
• How instructions reach people with different accessibility or communication needs.

Generic instructions such as "go somewhere safe" are less useful than clear, site-specific arrangements.

4. Know the evacuation options

Staff should understand relevant exits, alternative routes and what to do when a normal exit cannot be used safely.

They should also recognise that a threat outside the premises may mean immediate evacuation is not the safest response.

The correct action depends on the circumstances, the organisation's procedures and instructions from emergency services.

5. Communicate clearly with the public

Customers, visitors and pupils may look to employees for guidance during an incident.

Staff should know how to deliver clear, calm instructions without unnecessary speculation or delay.

Communication arrangements should also consider people with disabilities, children and others who may need additional support.

How should Martyn's Law awareness be delivered?

The Home Office recognises that learning and instruction can take several forms.

These include team briefings, inductions, refresher sessions, supervised practice, e-learning and more structured training.

An appropriate approach might combine general counter-terrorism awareness with specific instruction for employees who have responsibilities under your premises' emergency procedures.

Staff with more demanding responsibilities, such as managers or security personnel, may need additional practical instruction.

The important question is not whether everybody has a certificate. It's whether the people responsible can understand and carry out the procedures effectively.

General counter-terrorism awareness across the wider workforce is also recommended where reasonably practicable.

Martyn's Law: 10-point staff preparedness checklist

Use this checklist to identify areas where your organisation's staff preparedness could be improved.

1. Staff know who is in charge

Employees can identify who activates emergency procedures, who gives instructions and who takes responsibility when the usual manager is unavailable.

2. Staff know how to raise an alarm

Relevant employees understand how to report a potential threat and alert colleagues quickly and safely.

3. Staff recognise and report suspicious activity

Employees understand what may constitute suspicious activity, who to inform and why they should not investigate potentially dangerous situations themselves.

4. Staff understand evacuation options

Employees with evacuation responsibilities know the relevant exits, alternative routes and arrangements for avoiding a known threat.

5. Staff know the invacuation arrangements

Relevant employees understand which areas may provide greater safety and when moving people inside may be appropriate.

6. Designated staff understand lockdown

Those with specific responsibilities know which access points they may need to secure and how to implement the relevant procedure safely.

7. Staff know how to contact emergency services

Relevant employees know when and how to call 999, what information to provide and how to follow instructions from emergency responders.

8. Staff can communicate with visitors

Employees with public-facing responsibilities understand how emergency instructions will be communicated and what alternative methods may be available.

9. Procedures consider people who need assistance

Arrangements take account of disabled visitors, children, people with limited mobility and anyone who may struggle to hear or follow instructions.

10. Procedures have been explained and reviewed

Relevant employees have received appropriate briefings or instruction, procedures have been reviewed and practical arrangements have been checked where appropriate.

How many of these can you confidently answer today?

If your staff cannot explain their responsibilities without searching through a lengthy policy document, that may be a useful starting point for improving preparedness.

This is TrainMeUK's practical preparedness checklist, not an official SIA checklist. It combines statutory considerations with recommended good practice and should be used alongside the Home Office guidance.

How does Martyn's Law fit with your existing fire safety and first aid training?

Many organisations already have emergency arrangements through their health and safety responsibilities.

Existing fire safety awareness training may cover exit routes, alarms, staff responsibilities and helping people leave safely.

First aid arrangements may also establish responsibilities for assisting injured people once it is safe to do so.

These are useful foundations, but there are important differences.

Fire safety plans commonly prioritise evacuation, whereas a terrorist incident may require evacuation, invacuation or lockdown depending on the circumstances.

An existing fire evacuation procedure should not automatically be treated as a complete response to every security threat.

Organisations should review whether their current procedures can be adapted and whether additional instructions are needed.

For sites managing large numbers of people, our guide to evacuation roll calls and fire registers explains some of the practical challenges of keeping track of people during emergencies.

You can also use your existing staff induction and training arrangements to communicate relevant procedures to new starters.

For wider workplace obligations, read our guide to mandatory training requirements for UK businesses. Restaurants and pubs also have a separate food hygiene duty. That training does not replace these procedures. See our food safety training requirements.

Martyn's Law enforcement: inspections and penalties

The Security Industry Authority will regulate Martyn's Law once the relevant requirements come into force.

Its approach will include desk-based assessments, on-site inspections and proportionate enforcement.

The SIA has indicated that its regulatory approach will be risk-based and will consider the circumstances of individual premises and events.

However, organisations that fail to meet their obligations may face significant penalties.

There is also a separate maximum penalty of £5,000 for failing to comply with a requirement to attend an interview.

These figures represent statutory maximums, not automatic fines.

Daily penalties apply in specified circumstances involving continuing failure to comply with a compliance or restriction notice, rather than automatically whenever a requirement is missed.

The SIA may also issue compliance notices and, for enhanced tier premises or qualifying events, restriction notices. Certain serious breaches can result in criminal proceedings.

Failing to produce an individual training certificate does not automatically trigger a Martyn's Law fine. The regulator will assess compliance with the Act's actual requirements, including whether appropriate procedures and measures are in place.

For further detail, consult the Home Office enforcement factsheet.

Do you need to notify or register with the SIA?

If you are responsible for qualifying premises, you will need to notify the SIA once the notification requirements come into force.

The SIA is developing an online notification portal. As of November 2026, the portal has not yet opened for ordinary notifications.

The Home Office has published the notification deadlines that will apply once the relevant requirement commences.

Different notification deadlines apply to qualifying events.

You can read the official Home Office notification guidance for the full requirements.

Free Martyn's Law training and official resources

You don't need to purchase a commercial training course to begin preparing.

Several useful resources are already available free of charge.

ProtectUK ACT Awareness e-learning

Access free ACT Awareness training

The Action Counters Terrorism (ACT) Awareness course is available through ProtectUK.

It covers subjects including suspicious activity, security vulnerabilities and responses to terrorist threats.

The main course takes approximately 45 minutes. Registration is required, and completion certificates are available.

It is a useful starting point for general awareness, although employers still need to ensure relevant personnel understand their own premises' procedures.

Home Office Martyn's Law statutory guidance

Read the official statutory guidance

This is the primary reference for identifying qualifying premises, understanding responsibilities and implementing the Act's requirements.

Chapter 7 is especially relevant to standard-tier public protection procedures and staff awareness.

SIA regulatory guidance

Understand Martyn's Law and the SIA's role

The SIA explains how the legislation will be regulated, what responsible organisations need to do and how to prepare for implementation.

Department for Education guidance

Read the education and childcare guidance

Published on 3 November 2026, this provides additional explanations for schools, childcare providers, colleges and other education settings in England.

How TrainMeUK helps with staff preparedness

Once your organisation has established its procedures, the next challenge is making sure the right employees understand them and keeping that knowledge current.

TrainMeUK helps organisations deliver, manage and track staff preparedness training without relying on spreadsheets or manual chasing.

You can customise training with relevant site-specific instructions, emergency responsibilities and procedures, then assign learning to the employees who need it.

Automated reminders encourage employees to complete their assigned training, while overdue notifications can escalate to managers.

Completion records and reporting provide visibility of who has completed the relevant learning and where further attention may be required.

For organisations managing multiple premises, site-level reporting can help monitor training activity across different locations.

Sensitive security arrangements should only be shared with individuals who need access to that information, in line with your organisation's security procedures.

TrainMeUK does not replace a site's security assessment, emergency planning or statutory responsibilities. It helps organisations communicate relevant instructions and maintain evidence of the learning they deliver.

See how TrainMeUK works

Frequently asked questions about Martyn's Law

Last reviewed: 6 November 2026.

This article provides general information about Martyn's Law and practical preparation considerations. It is not legal advice or a security assessment of any particular premises. Organisations should refer to the latest Home Office and SIA guidance when determining their responsibilities.

Related articles