What is Martyn's Law and what has just happened?

The Home Office has published statutory guidance under section 27 of the Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law. The guidance covers how the Act applies in practice – which properties or events are in scope, who the responsible persons are, and what public protection procedures are required. The main duties are not yet in force, and commencement is not expected until April 2027. But the guidance now gives us a clearer basis for reviewing managed properties, identifying where the Act will apply, and considering what procedures need to be put in place.

The Act applies to both qualifying premises and qualifying events. Premises fall within scope if they consist of a building, part of a building, or a building together with surrounding land; are used for one or more qualifying purposes; are accessible to members of the public; and meet the relevant attendance threshold. For managed portfolios, the most likely candidates are shopping centres, retail parks and office buildings.

There are two tiers. The standard tier applies where 200 to 799 individuals are reasonably expected to be present at the same time, from time to time – requiring appropriate public protection procedures to be in place. The enhanced tier applies where that figure is 800 or more, and carries additional requirements including documentation, submission to the Security Industry Authority (SIA), and senior accountability obligations.

The test is not limited to a single peak attendance figure. The relevant question is whether it is reasonable to expect the threshold to be met from time to time in the ordinary course of the premises’ use. For shopping centres and larger leisure destinations this is likely to be straightforward. For multi-let offices, mixed-use buildings and commercial properties with limited public access, it will need more careful consideration.

The responsible person must ensure, so far as reasonably practicable, that appropriate public protection procedures are in place. These must address evacuation (moving people away from the premises or affected area), invacuation (moving people to a safer location within the premises), lockdown (securing people in place or restricting movement to reduce exposure to danger), and communication (providing appropriate information or instructions before, during or following an incident).

Staff expected to implement these procedures must be adequately informed and, where appropriate, trained. Existing fire evacuation and emergency procedures may provide a useful starting point but should not be assumed to satisfy Martyn’s Law requirements. The Act is focused on terrorist attack scenarios, which require different planning assumptions.

Enhanced-tier premises must meet all standard-tier requirements plus further measures across four areas: monitoring (arrangements for identifying suspicious behaviour, hostile reconnaissance, security incidents or emerging threats); movement (how people move into, through and away from the premises, including crowd movement, access control and evacuation or invacuation routes); physical safety and security (arrangements such as barriers, access controls, hostile vehicle mitigation, doors, shutters and CCTV, where proportionate); and security of information (control of sensitive information that could assist a person planning or carrying out an attack).

Enhanced-tier premises must also document compliance, submit a compliance document to the SIA, keep arrangements under review, and designate a senior individual with sufficient authority to ensure compliance.

The responsible person is generally whoever has control of the premises in connection with the relevant qualifying use. In a single-occupier building this may be clear. In managed, multi-occupied or mixed-use properties, the position may be more complex. Relevant factors include who controls the premises or part of them, who controls public access, who manages common parts, who controls security arrangements, who controls means of escape or emergency procedures, who communicates with occupiers, visitors or members of the public, and who has responsibility under leases, management agreements or operating arrangements.

For multi-occupied properties, responsibility may not sit with one party alone. The statutory guidance identifies the need for co-ordination between responsible persons and co-operation from parties with control over relevant premises or parts of premises – particularly where there are shared common parts, landlord-controlled entrances and exits, reception areas, security systems, estate-wide communication arrangements or shared emergency procedures.

The Act applies to qualifying premises and qualifying events as separate assessments. A property may be out of scope as qualifying premises, or may only fall within the standard tier, but a specific event held there may still fall within scope as a qualifying event.

A qualifying event is one that is accessible to members of the public, where it is reasonable to expect 800 or more people – including staff – may be present at the same time, and where entry is controlled by a condition such as a ticket, pass, payment, membership or guest status.

This is particularly relevant to managed properties that host occasional large events. A commercial office building with a large conference or event space may not normally be a qualifying premises, but a publicly accessible conference, exhibition, product launch or occupier event may still be a qualifying event if the 800-person threshold and other criteria are met. The same issue may arise on business parks, retail parks or leisure parks where an external event is held on landlord-controlled grounds – a ticketed market, outdoor screening, promotional event, food festival or entertainment event, for example.

Where an event meets the qualifying event criteria, the Act may apply for the duration of that event. The review should consider who controls the event, who controls the event area, and whether the landlord, managing agent and occupier need to co-operate in relation to security, access, crowd movement, communication arrangements, emergency procedures and common parts.

We are undertaking property-specific impact reviews to identify which managed properties are likely to fall within scope, the likely tier, potential duty-holder arrangements, and any areas where further co-ordination, documentation or client decision-making may be required. We are prioritising retail and leisure assets, where the likelihood of falling within scope is highest, while also reviewing other managed property types where public accessibility, occupancy arrangements or shared areas may be relevant.

Where events are organised at managed properties, we will work with our Activate team – or other external marketing agency where appointed – to ensure that event planning considers the potential application of Martyn’s Law, including likely attendance, public access, entry arrangements, security, emergency procedures and communication arrangements. Where occupiers or tenants organise their own public events, we will work with them, where appropriate, to understand the event arrangements and identify any required co-ordination with landlord-controlled areas, common parts, security or estate-wide procedures.

For queries regarding this bulletin or the Martyn’s Law review programme, please contact Danny Lamar, Health & Safety Director, on +44 (0)7919 370 154 or at danny.lamar@workman.co.uk.

This advisory note is intended for general information purposes and does not constitute legal advice. Clients should obtain independent legal advice where required in relation to their specific circumstances and obligations.