Last updated: 14 September 2026

Martyn's Law compliance checklist: what UK premises and events must do

Martyn's Law compliance means meeting duties under the Terrorism (Protection of Premises) Act 2026, which applies to premises holding 200 or more people. Standard duty premises (200-799 capacity) need low-cost procedures and staff training; enhanced duty premises (800+) need a documented risk assessment. Non-compliance can cost up to £18 million.

Key Takeaways

• Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2026, named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena attack.
• Standard duty premises hold 200 to 799 people, while enhanced duty premises hold 800 or more, according to GOV.UK and the SIA.
• Enhanced duty premises and qualifying events face fines of up to £18 million or 5% of worldwide revenue, whichever is greater, per the Lexology Policy Pros FAQ.
• An estimated 178,900 premises fall within scope nationally, according to the Home Office impact assessment cited by RiskStop, though some industry estimates put it as high as 250,000.
• A Meetings Industry Association study found 43% of venues are unsure how to prepare, according to United Outcomes — a checklist closes exactly that gap.

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2026, a UK statute that places legal duties on those responsible for qualifying public premises and events to prepare for the possibility of a terrorist attack. It is named after Martyn Hett, one of 22 people killed in the Manchester Arena bombing in May 2017, following a campaign led by his mother, Figen Murray. The Act received Royal Assent in 2026 and includes an implementation period before enforcement begins in full — per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The law does not ask operators to eliminate risk. It asks them to have thought it through, written it down, and rehearsed it with staff — a materially different bar from the informal "we'd know what to do" that most venues currently rely on.

The two-tier system explained

Martyn's Law splits qualifying premises into two tiers based on capacity — the maximum number who could reasonably be present, not average daily footfall.

• Standard duty premises: 200 to 799 people. Duties focus on low-cost, common-sense preparedness — staff awareness, evacuation and invacuation (moving people to safety inside the building rather than out of it) procedures, and a designated responsible person.
• Enhanced duty premises: 800 or more people. Duties are heavier, including a documented risk assessment that must be kept current rather than written once and filed.

GOV.UK and the SIA confirm this exact capacity split. The Home Office's own impact assessment estimated around 180,000 premises nationally fall in scope, with typical annual compliance costs "of the order of £300 in the standard tier and £5,000 in the enhanced tier," according to Lexology's analysis of the impact assessment. Separately, KGFM Ltd estimates approximately 278,880 UK venues will fall into the standard tier alone — a reminder that scope estimates vary by methodology, but the direction is the same: this touches a very large number of ordinary UK venues, not just stadiums and arenas.

Who is the responsible person under Martyn's Law?

The responsible person is the named individual an organisation designates to own Martyn's Law compliance for a given premises — the person the Security Industry Authority (SIA), the statutory regulator, will expect to answer for procedures, training records and risk assessments. Every qualifying premises needs one named individual, not a committee and not "whoever's on shift."

This person doesn't need to be a security specialist. In a shopping centre it might be the centre manager; in a multi-site retail chain it might be a regional operations lead who owns the file for several locations. What matters is that the role is documented, the person understands the tier their premises sits in, and they can produce evidence of training, procedures and (for enhanced tier) a live risk assessment on request.

Pulse Operations's founder puts it bluntly:

"A checklist that just lists paperwork misses the point. Martyn's Law compliance means knowing your capacity, having a named responsible person, and training staff to run a lockdown or invacuation without waiting for instructions. Write it down, walk it through with the night team, and test it for real — a checklist nobody's practised is just a document waiting to fail." — Mo Hassan, Founder, Pulse

What are the penalties for non-compliance?

Penalties under Martyn's Law scale sharply with premises tier and are enforced by the SIA. Standard duty premises face a maximum monetary penalty of £10,000, with daily penalties of up to £500 for continued non-compliance. Enhanced duty premises and qualifying events face a maximum penalty of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000 — per Lexology / Policy Pros FAQ.

Beyond civil penalties, criminal liability is real. A conviction on indictment can result in up to two years' imprisonment and/or a fine for offences such as failing to comply with a compliance or restriction notice, or providing false information to the SIA, according to a Colwich Parish Council webinar presentation citing the Terrorism (Protection of Premises) Act 2026.

The SIA's enforcement posture is not designed to catch people out. The regulator will typically give at least 72 hours' notice before an on-site inspection, using a risk-based approach informed by intelligence and compliance assessments, according to GOV.UK. That notice period is a gift to any responsible person with their paperwork already in order — and a trap for anyone planning to assemble it after the letter arrives.

Standard tier vs enhanced tier: a comparison

Sources: GOV.UK/SIA; Lexology; Lexology impact assessment analysis.

How do you build a Martyn's Law compliance checklist?

A working Martyn's Law compliance checklist starts with correctly identifying your tier, then builds outward through a named responsible person, documented procedures, staff training and — for enhanced tier — a live risk assessment. The checklist is not a one-off form; it's a maintained record that the SIA can inspect and your own night shift can actually follow.

Step 1: Calculate your capacity correctly. Base it on the maximum number who could be present — public and staff — including occasional peak events, not typical daily footfall. A community hall that normally holds 150 people but hosts an annual event for 250 needs to plan for the enhanced footfall, not the average Tuesday.

Step 2: Confirm your tier and duties. Standard tier (200-799) needs procedures and training. Enhanced tier (800+) additionally needs a documented, kept-current risk assessment — per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

Step 3: Appoint and document a responsible person. Name them in writing. Record what they're accountable for and how they're briefed.

Step 4: Write public protection procedures. Cover evacuation, invacuation and lockdown as distinct scenarios, because the correct action differs by threat type — you don't evacuate into a car park during an active external threat.

Step 5: Train staff, then test it. Front-of-house, security and management all need to know their role without waiting for instructions. A tabletop exercise or live drill turns a document into muscle memory.

Step 6: Keep records the SIA can inspect. Training logs, procedure documents, risk assessments (enhanced tier) and evidence of review dates all need to be retrievable, not scattered across email threads and someone's desk drawer.

Step 7: Review on a schedule, not just after an incident. Enhanced-tier risk assessments in particular need to reflect current layout, current capacity and current threat guidance — not the version written the day the law commenced.

This is where a lot of organisations stumble, and the Meetings Industry Association study cited by United Outcomes found 43% of venues are unsure how to prepare for Martyn's Law — that's not a fringe number, it's close to half the sector admitting the checklist hasn't been built yet.

How Martyn's Law interacts with security operations on the ground

Martyn's Law duties don't sit in a compliance folder — they live in how a site is patrolled, staffed and supervised day to day. A responsible person can write a perfect evacuation procedure, but if nobody can prove the fire exits were checked clear last Tuesday night, or that the officer on duty actually walked the plant room they were rostered to check, the paperwork is theatre.

This is the exact gap Pulse Operations was built to close, because it was built inside a working security operation with the same problem. Priority First — the founding team's own London security and facilities management business, and Pulse's original and still-running case study — used to run patrols on paper sign-in sheets, with jobs passed around informally and expiries tracked in a spreadsheet nobody fully trusted. When a client called at 7am asking whether everything had actually been checked overnight, the honest answer was often "we believe so."

That's not good enough under Martyn's Law, and it wasn't good enough for Priority First's own clients either. Since going live in February 2026, Priority First has run its security and FM operations on one platform across 24 sites, with more than 4,900 patrols completed on the record (checked against production data, July 2026) and 100% of checkpoints backed by a watermarked photograph — up from zero. Managing Director Mo Hassan describes the shift plainly: "We used to take everyone's word for it. Now every checkpoint has a photo and the client can see it before we've finished the shift — it's changed how we win work."

For a Martyn's Law responsible person, that's the difference between a documented procedure and demonstrable compliance. Pulse Operations's photo-verified patrols work on a simple principle: the checkpoint is completed only by a mandatory watermarked photograph — officer, site, GPS, time — with no QR or NFC tag scanning by design. That means a fire exit check, a plant room walk, or a perimeter sweep during a heightened threat period generates evidence at the moment it happens, not a self-reported tick on a clipboard.

Across live operations, 96.2% of checkpoints carry a watermarked photo over a trailing 90-day window, as of the Pulse Operations benchmark published July 2026. For a shopping centre or a mixed-use development sitting in the enhanced tier, that's a record you can hand to the SIA, not a claim you have to defend.

Martyn's Law compliance for multi-site and mixed-use operators

Multi-site operators — retail chains, shopping centres, construction sites with public-facing elements — face a specific version of the Martyn's Law problem: consistency. A procedure that works in one building means nothing if the next site along the street can't produce the same evidence.

This was the exact challenge on a landmark West London mixed-use development where Priority First manages retail, residential, plant rooms and service yards on one of the area's best-known streets. Before Pulse, there was no reliable way to prove which plant room had actually been checked at 3am — a serious gap for any premises where Martyn's Law procedures depend on demonstrating that specific areas were walked, not just that a shift happened.

Pulse Operations made all 152 checkpoints across the site photo-mandatory, covering photo-verified patrols, incident logging and delivery logging on one app. Since going live in February 2026, the site has recorded more than 540 patrols in its first five months (production data, July 2026), across 11 officers inducted on one system. A missed area now shows up as a gap in the record immediately — not a dispute raised six weeks later when a client asks awkward questions.

For a mixed-use development that likely sits in the enhanced duty tier given its combined footfall, that checkpoint-level evidence directly supports the "kept current" risk assessment requirement: you can show, area by area, that the procedures written on paper are being executed on the ground.

Mobilising a new site without losing Martyn's Law continuity

Contract mobilisation is where compliance often quietly lapses — new officers arrive without site history, checkpoints aren't yet configured, and induction records live in someone's head rather than a system. Priority First added three buildings in a single July fortnight, and rather than the usual weeks of bedding in, checkpoints, site notes, prior issues and inductions were live in Pulse before officers arrived. Time to first photographed patrol dropped to days from the handshake, and site history that used to exist only in someone's head was available from day one. For an enhanced-tier site, that's the difference between a compliance gap during mobilisation and continuous evidence from the first shift.

Your Martyn's Law compliance checklist

• Calculate your premises capacity based on maximum possible occupancy, including peak events, not average footfall.
• Confirm your tier — standard (200-799) or enhanced (800+) — using GOV.UK/SIA guidance.
• Name a designated responsible person in writing and document their accountability.
• Write public protection procedures covering evacuation, invacuation and lockdown as separate scenarios.
• Complete a documented risk assessment if enhanced tier, and schedule regular reviews.
• Train all relevant staff and run at least one practical drill or tabletop exercise.
• Maintain inspectable records — training logs, procedures, review dates — retrievable within the SIA's 72-hour notice window.
• Evidence patrols and checks with photo or equivalent proof, not self-reported sign-in sheets.

FAQ

What is Martyn's Law and who does it apply to?

Martyn's Law is the Terrorism (Protection of Premises) Act 2026, applying to premises and events where 200 or more people may reasonably be present. It covers a wide range of venues — retail, hospitality, entertainment, education and public buildings — split into standard and enhanced duty tiers based on capacity, per GOV.UK.

What's the difference between standard and enhanced duty premises?

Standard duty premises hold 200 to 799 people and need proportionate procedures and staff training. Enhanced duty premises hold 800 or more and additionally need a documented, kept-current risk assessment, according to GOV.UK/SIA.

What are the penalties for non-compliance with Martyn's Law?

Standard duty premises face fines up to £10,000 plus daily penalties of up to £500. Enhanced duty premises and qualifying events face fines up to £18 million or 5% of worldwide revenue, whichever is greater, with daily penalties up to £50,000, per Lexology. Criminal conviction can also bring up to two years' imprisonment for offences like providing false information to the SIA, per the Colwich Parish Council webinar presentation.

Who is the responsible person under Martyn's Law?

The responsible person is the named individual an organisation designates to own compliance for a qualifying premises, accountable for procedures, training and record-keeping. They don't need a security background, but the role must be documented and evidenced.

How does the SIA enforce Martyn's Law?

The Security Industry Authority regulates Martyn's Law and typically gives at least 72 hours' notice before an on-site inspection, using a risk-based approach informed by intelligence and compliance assessments, according to GOV.UK.

How many UK premises are affected by Martyn's Law?

Estimates vary by methodology. The Home Office impact assessment estimates around 178,900 to 180,000 premises nationally, per RiskStop and Lexology. Separately, KGFM Ltd estimates approximately 278,880 venues fall into the standard tier alone, and some industry figures put total scope as high as 250,000.

Do I need a documented risk assessment for a standard tier premises?

No. Standard duty premises need public protection procedures and staff training but not a formal documented risk assessment. That requirement applies specifically to enhanced duty premises, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

How do I evidence Martyn's Law compliance if the SIA inspects my site?

Keep training records, written procedures, review dates and — where required — a current risk assessment readily retrievable. Operations that also log patrols and checks with timestamped, photo-based evidence (rather than paper sign-in sheets) can demonstrate that procedures are executed, not just written down.

Securing your Martyn's Law compliance with Pulse Operations

Writing a Martyn's Law procedure is the easy part. Proving it's followed — that the fire exit was actually checked, that the plant room was actually walked, that the officer on shift actually did the round the risk assessment says they should — is where most organisations have nothing but a name on a rota. Pulse Operations's compliance runway puts Martyn's Law assessments on the same expiries dashboard as SIA licensing, BS 7858 screening, DBS checks and statutory building compliance, so the responsible person has one place to see what's current and what's about to lapse.

On the ground, Pulse Operations's photo-verified patrols make every checkpoint completion a watermarked photograph — officer, site, GPS, time — the same mechanism that took Priority First from paper sign-in sheets to 100% photo-backed checkpoints across 24 sites. If you're a shopping centre, event venue, construction site or FM provider working out what enhanced-tier compliance looks like in practice, book a call with Pulse Operations to see how the platform evidences Martyn's Law duties alongside the rest of your compliance runway — no deck, no sales pitch, the pricing's published.

Related Reading

• Martyn's Law Online Training: 2026 UK Compliance Guide
• Martyn's Law for Markets: A 2026 Compliance Guide
• Martyn's Law for Outdoor Events: 2026 UK Guide