Martyn’s Law – What does this mean for your business?  

By Paul Street, Project Manager (Safe & Sound) at Colmore BID. 

The Terrorism (Protection of Premises) Bill, also known as Martyn’s Law, was introduced to Parliament in September 2024 with the aim of improving the UK’s preparedness for terrorist attacks. The bill required certain venues and events to take steps to reduce the risk of harm from terrorism.  

The purpose of the bill was to:

• To improve public safety by reducing the risk of harm from terrorism  
• To ensure that premises and events are better prepared to respond to a terrorist attack  
• To require larger venues and events to take steps to reduce their vulnerability to terrorist attacks  

The bill imposed a legal obligation on certain premises and events to take steps to reduce the likelihood of physical harm.  

On 3 April 2025 the bill received royal assent and became the Terrorism (Protection of Premises) Act 2025.  

In this piece, we are sharing a general overview of the new legislation to support our businesses with both information and advice leading up to the end of a proposed 24-month implementation period. For more detailed information including full legal definitions, exclusions and footnotes, please refer to the Act of Parliament. 

What is Martyn’s Law and why was it created? 

The origins for this legislation followed the series of terrorist attacks that took place in 2017, and the subsequent recommendations from the Manchester Arena Inquiry in 2021 that referenced a need for such legalisation. 

There is an acknowledgement from the UK Security Services that the changing methodologies of terrorists (no notice, spontaneous and simultaneous attacks intent on causing maximum harm) requires a more robust approach to preparing and protecting the UK from terrorism.  

What does the legislation require? 

The legislation places a duty on those responsible for certain premises or events to consider the risk of terrorism at their venue or event and how they would respond to an attack. There will be a requirement to implement reasonably practicable security and public protection procedures and/or measures, depending on the capacity of the premises or event. 

Venue qualifications 

Small premises with a capacity of 200 – 799 will be classed as Standard Tier and will be required to put in place easy-to-follow procedures that reduce the risks of physical harm to any individuals exposed to a terrorist attack.  

Larger premises and events with a capacity of 800+ will be classed as Enhanced Tier and will be required to do more to protect their users by taking further measures to stop those attacks from taking place. 

What does the Standard Tier Duty look like? 

As a minimum, Standard Tier premises should create a simple plan that includes: 

• Evacuation – the process of getting people safely out of the premises 
• Invacuation – the process of gathering people safely into or within safe parts of the premises  
• Lockdown – the process of securing the premises quickly and effectively to restrict or prevent attackers gaining entry (for example, locking doors, pulling down shutters, using barriers). 
• Communication – the process of alerting people on the premises to move away from danger. 

Most Standard Tier measures can be implemented with little or no cost to the business. Standard Tier venues should review their legal requirements as outlined on the Protect UK website and the Home Office ‘Standard Duty requirements factsheet’. 

What does the Enhanced Tier Duty look like? 

As a minimum, venues that fall within the Enhanced Tier are also required to implement the following measures: 

• Procedures to monitor – the premises or event, and their immediate vicinity, focussing on identifying and reporting suspicious activities, behaviours, items or other possible indicators of a potential or actual terrorist attack. 
• Procedures to control movement – of individuals into, out of and within the premises or event, focussing on using appropriate deterrents and mitigations to reduce vulnerabilities to attacks and to protect members of the public entering, within and exiting the premises or event. 
• Procedures for the physical safety & security methods – of the premises or event, focussing on strengthening of premises and events structures to prevent certain attack methodologies from occurring and/or to mitigate their impact. 
• Procedures for the security of information – which could aid the planning, preparation or execution of acts of terrorism, focussing on understanding the sensitivities of such information, how it is shared, why and with whom. Examples of such information could include venue and event details; general venue use and operational procedures – any of which could unwittingly disclose vulnerabilities to terrorists.  

Premises and events that fall within Enhanced Tier requirements should review their legal obligations as outlined in the Enhanced Duty requirements factsheet.  

The cost of implementing Enhanced Duty measures will be dependent on the needs of each premises or venue. The legislation requires reasonably practicable security and public protection measures.  

A recent Home Office Impact Assessment for Martyn’s Law suggests the estimated annual costs to Enhanced Tier venues (time & money) is approximately £5,200.  

This legislation is designed to be flexible and adaptable to changing threats. It has been prepared whilst the UK is at threat level – Substantial (meaning an attack is likely). There are 5 categories at which the UK threat level could be set, ranging from Low to Critical.  

The government can adjust the requirements of the Standard and Enhanced Tiers, including at a Critical threat level, to ensure that the measures in place are appropriate for the current security environment. These adjustments could include reducing the minimum capacity levels for Standard and Enhanced Tiers to include more premises and events.  

Will this new legislation be subject of regulation?

In short, yes. The government has said there will be a minimum of a two-year ‘lead in’ timeframe to allow businesses to become fully conversant and compliant with legislative requirements.  

The Security Industry Authority (SIA) is the relevant regulatory body, with an emphasis of education, before considering enforcement. The regulator will be responsible for providing supportive, high-quality advice and guidance aimed at raising knowledge and standards of protective security. The SIA sanctions will predominantly be civil action to address any non-compliance, escalating to criminal prosecution for the most serious cases.  

The first step is identifying a ‘responsible person’ (a corporate organisation or person who has control of the premises and/or event) in both Standard and Enhanced Tier premises. The ‘responsible person’ is required to register with the regulatory body (the SIA) and notify them if there are any changes to the registered details.  

Furthermore, the legislation aims to improve protective security and preparedness by launching a ‘Competent Person in the Workplace’ (CPIW) scheme to upskill people with responsibilities for identifying & assessing security risks, developing & implementing security plans and procedures, training staff on security protocols, coordinating with relevant authorities in the event of an incident, and ensuring that premises and events are compliant with the legislation.  

Will any training be provided to help businesses comply with the Act? 

The UK National Counter Terrorism Security Office (NaCTSO) and the Home Office have designed a two-tier pathway of training and specialist support: 

1. An Ofqual-Certified, Level 3 Qualification: Accessible to anyone, with the working title of Competent Person in the Workplace (CPIW). This will be based on authoritative threat and mitigation guidance from official sources at NaCTSO and other partner organisations.  

2. The Counter Terrorism Security Specialists Register (CTSSR): A register of verified counter terrorism protective security specialists. This will provide businesses and consumers with a verified list of CT protective security and preparedness specialist advisors. 

It is anticipated that further information about the CPIW training will be publicised from Spring 2025, and we will be publishing further details as soon as these are available.  

Our Observations 

Which premises are in scope?

The legislation is aimed towards premises that the public and visitors have access to, by payment or otherwise.  

1. Generally, the term ‘premises’ relates to buildings, part of a building or a group of buildings. It also relates to a building with other land, such as a pub with a beer garden or a hotel with grounds used for events. 
2. The premises must be used wholly or partly for one or more ‘qualifying activities’ which include but not confined to bars & restaurants, entertainment venues such as cinemas- theatres -music halls, sports grounds and stadia, libraries, museums and galleries, exhibition halls and conference centres, hospitals & health centres, schools, colleges, universities and places of worship. See Schedule 1 for a full list. 
3. Finally, the premises must also meet a threshold of reasonably expecting to host a capacity of over 200 individuals at any one time.   

All three elements must be present for the premises to be in scope of the legislation.  

Which events are in scope?

For an event to be in scope, it must take place: 

1. On open land (such as a field, park, or farmland), on land occupied with a building (unless that building already falls within the Enhanced Tier) or within a building that is not already captured by the legislation. A building not already captured may host occasional events where large numbers of the public gather. Under the legislation, the term ‘building’ includes part of a building or a group of buildings. 

2. Host at least 800 people at the same time 

3. Meet the ‘express permission’ criteria of having employees, or other individuals involved in the event (for example, volunteers), checking that members of the public wishing to attend satisfy a condition of entry. Specifically, this condition of entry is to check that members of the public have paid to attend the event, have an invitation granting access, or have a pass that grants access (which might include a free ticket).  

4. Be accessible to members of the public, for all or part of the event. 

Therefore, events with no boundary, checks or conditions of entry will be outside the scope of this legislation. 

What support can Colmore BID provide? 

Colmore BID is well positioned and experienced in supporting our businesses with this new legislation.  

I manage the counter terrorism workstream, and I am a retired police officer with 12 years’ experience of counter terrorism policing. During my tenure, I was ‘hands on’ for some of the UK’s most notorious terrorism investigations, receiving many decorations for my service.   

In my time with Colmore BID, I have become a member of the West Midlands Counter Terrorism Advisory Group and the Birmingham ‘Prepare & Protect’ Working Group. Both groups provide the very latest updates, guidance and consultations on counter terrorism conversations.  

Within the BID, I also organise numerous counter terrorism awareness sessions in partnership with Counter Terrorism Policing West Midlands, and co-ordinate the Colmore Prepare & Protect Forum to discuss topics such as counter terrorism, emergency planning & preparedness and business continuity with BID members. 

As the details of the legislation develop, I will be providing regular updates via our website and other marketing channels, as well as hosting a range of upskilling sessions to support our levy payers with the requirements.  

What will be the impact on businesses? 

Cost  

From the outset, this legislation was never designed to be costly, bureaucratic or restrictive to businesses. Standard Tier compliance should be achieved with little to no costs, as all the required minimum resources and advice are freely available on the Protect UK website.  

The costs associated with achieving Enhanced Tier compliance will be dependent on any requirements to enhance the existing security & public protection measures with additional reasonably practicable recommendations.  

Regulation 

The regulatory function of the SIA is weighted towards help and advice rather than ‘enforcement & sanction’. It appears that the regulator wants to be as accessible and approachable as possible. This will be welcome news to businesses.  

Training 

The Level 3 Competent Person in the Workplace (CPIW) training will likely be available from Spring 2025. The training is designed to be pragmatic and pitched at the right level to equip attendees with sufficient skills and knowledge to successfully mitigate the risks posed to them by terrorist threats.  

All indications suggest this will be a reasonably low cost to encourage as many as possible to take up the training. It is unlikely to be a mandatory requirement of the legislation but clearly is designed to assist businesses in complying with their regulatory obligations.  

Next steps

The Act will have an implementation period of at least two years. 

Whilst those that fall within scope of the Act may now wish to begin considering the requirements, they should note that there will be no legal requirement to comply until the legislation comes into force.  

The Home Office will publish statutory guidance during the two-year implementation period. This guidance will assist those responsible to understand the requirements set out in the legislation. A Martyn’s Law Factsheet and series of Terrorism (Protection of Premises) Act 2025 Factsheets were published on 3^rd April 2025. 

Should you wish to hear more details about Martyn’s Law, and the support Colmore BID can offer to businesses, please do not hesitate to contact me on paul.street@colmorebid.co.uk.  

Further references 

• Protect UK – free Counter Terrorism protective security advice https://www.protectuk.police.uk/  
• National Protective Security Authority – https://www.npsa.gov.uk/  
• MI5 The Security Service – free national security threat and risk advice https://www.mi5.gov.uk/  
• National Business Crime Centre – business support advice for preventing crime https://nbcc.police.uk/  
• Terrorism (Protection of Premises) Act 2025 – https://www.legislation.gov.uk/ukpga/2025/10/enacted