Martyn's Law Training Requirements for Staff (2026 Guide)

Last updated: 25 October 2026

Martyn's Law training requirements for staff mean giving employees enough awareness to recognise a threat, respond calmly and know the venue's procedures — not necessarily a formal certificate. **The Terrorism (Protection of Premises) Act 2025 treats training as one of several "reasonably practicable" public protection measures, expected to be enforced from Spring 2027, per GOV.**UK (2026).

Key Takeaways

Pulse Operations notes that Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, named after Martyn Hett, who died in the 2017 Manchester Arena attack.
Standard Tier covers premises with a capacity of 200 to 799 people, while Enhanced Tier covers premises and events with a capacity of 800 or more, per Sheffield City Council (2026).
Standard Tier non-compliance carries a maximum monetary penalty of £10,000 plus daily penalties up to £500, per Lexology/Foot Anstey's legal analysis (2026).
Enhanced Tier non-compliance carries maximum penalties of £18 million or 5% of worldwide revenue, whichever is greater, per Foot Anstey (2026).
Figen Murray, the campaigner behind the law, has described the minimum acceptable standard as 45 minutes of free e-learning giving staff a basic understanding of the dangers, per IFSEC Insider (2023).

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, a UK statute that places legal duties on operators of qualifying public premises and events to prepare for the possibility of a terrorist attack. It is named after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena bombing, and its passage was driven by a campaign led by his mother, Figen Murray, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The Act received Royal Assent on 3 April 2025, triggering a minimum 24-month implementation period before enforcement begins, per ProtectUK (2025). During this window, the Home Office and the Security Industry Authority (SIA) — the body that will regulate the Act — have been publishing guidance rather than issuing penalties. The SIA is the same regulator that already licences door supervisors and CCTV operators under the Private Security Industry Act 2001, so operators dealing with SIA licensing already know the organisation that will police this new duty.

Does Martyn's Law legally require staff training, or just awareness of procedures?

Martyn's Law does not mandate a specific certificated training course; it requires operators to ensure staff have appropriate awareness of public protection procedures, which in practice means training. The Act's core duties, set out in Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams, include understanding the risk, having procedures such as evacuation and lockdown, appointing a designated responsible person, and training and informing staff.

The statutory language is deliberately proportionate rather than prescriptive. The Home Office published its section 27 statutory guidance on 15 April 2026, alongside the SIA's draft section 12 regulatory guidance, which stayed open for consultation until 12 June 2026, per GOV.UK (2026). That consultation process is exactly why "training" under Martyn's Law means demonstrable staff competence in procedures — evacuation, lockdown, invacuation and reporting — rather than a specific pass/fail exam. A fire warden certificate proves someone attended a course; Martyn's Law wants proof staff would actually act correctly.

Which venues and organisations fall under the scope of Martyn's Law?

Martyn's Law applies to any premises or event that is publicly accessible and meets the capacity threshold, regardless of sector. Standard Tier applies to premises with a capacity of 200 to 799 people; Enhanced Tier applies to premises and events with a capacity of 800 or more, per Sheffield City Council (2026).

Capacity is judged on the maximum number who could be present — including staff and event peaks — not average daily footfall, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. That single distinction catches out plenty of operators who assume they're exempt.

In practice, this covers a wide sweep of UK premises types:

Shopping centres, retail parks and high street stores above the threshold
Hospitality venues — pubs, bars, restaurants, hotels
Sports stadiums, arenas and outdoor event sites
Places of worship, community halls and visitor attractions
Further and higher education campuses, and some large schools
Residential estates and mixed-use developments with publicly accessible areas

Pulse Operations's own case work spans several of these categories. A landmark mixed-use development in West London — retail, residential, plant rooms and service yards on one of the area's best-known streets — has been live on Pulse since February 2026, with 152 checkpoints and 11 officers inducted onto one system. Sites of this type, with genuine public footfall across multiple use classes, sit squarely inside Martyn's Law scope once capacity is assessed properly.

What is the difference between Standard Tier and Enhanced Tier duties regarding training?

Standard Tier duties are deliberately light-touch: procedures and staff awareness, with no mandatory documented risk assessment. Enhanced Tier duties are heavier: a documented, continually updated risk assessment plus more formal public protection procedures, per Pulse Operations's guide.

Training obligations scale with the tier. A Standard Tier corner shop or community hall needs staff who know where to direct people and who to call. An Enhanced Tier stadium or shopping centre needs a designated senior individual accountable for procedures, layered training across security, front-of-house and management, and evidence that training has actually happened — not just that a policy exists.

Factor	Standard Tier (200–799 capacity)	Enhanced Tier (800+ capacity)
Risk assessment	Not mandatory	Documented and kept current
Training depth	Basic awareness of procedures	Structured, role-specific training
Accountability	Responsible person	Designated senior individual
Max penalty	£10,000 + up to £500/day (Lexology/Foot Anstey, 2026)	£18m or 5% of worldwide revenue + up to £50,000/day (Foot Anstey, 2026)
Record-keeping	Light	Detailed, audit-ready

Who within an organisation is responsible for ensuring staff receive appropriate training?

The designated responsible person or senior individual named under the Act carries accountability for making sure staff training happens and is fit for purpose. For Standard Tier sites this is typically a manager or owner; for Enhanced Tier sites, the Act expects a named senior individual whose remit specifically includes public protection procedures.

In multi-site operations — shopping centres, residential estates, FM contracts spanning several buildings — this accountability easily gets lost between head office and the person actually on shift. That's the exact gap Pulse Operations was built to close. On a prestige central-London residential estate running sixteen buildings on one nightly round, Pulse Operations set each building up as its own site with its own checkpoints and evidence trail, so accountability sits with named individuals rather than a vague "someone checked it" assurance. Since going live in March 2026, the estate has logged over 4,100 patrols with 100% of checkpoint completions photo-verified — evidence the responsible person can actually point to.

What specific topics should staff training cover?

Staff training under Martyn's Law should cover recognising suspicious behaviour, invacuation and evacuation procedures, lockdown protocols, and knowing who to report concerns to. Figen Murray, the campaigner whose son Martyn Hett died in the Manchester Arena attack, has set out what the minimum should look like in practice: "As a very minimum, venue staff will have 45 minutes of free e-learning training to give them a basic understanding of the dangers," per IFSEC Insider (2023).

A practical curriculum should include:

How to spot suspicious items, packages or behaviour
Evacuation routes and assembly points for the specific building
Invacuation (moving people to safety within the building) versus full evacuation
Lockdown procedures and who has authority to trigger them
Reporting lines — internally and to the police via 999 or the Anti-Terrorist Hotline (0800 789 321)
Communicating with the public calmly under pressure

For most Standard Tier premises, this is genuinely achievable in under an hour using free resources rather than a bespoke course.

When does Martyn's Law come into force and by what date must staff be trained?

Martyn's Law received Royal Assent on 3 April 2025 and carries a minimum 24-month implementation period, per ProtectUK (2025). The Act is expected to come into force in Spring 2027, with the SIA confirming the exact date ahead of commencement, per GOV.UK (2026).

That means UK operators have a defined but shrinking runway. Staff should be trained and ready before commencement, not scrambling once enforcement begins — the Home Office's section 27 statutory guidance published on 15 April 2026 already signals what enforcement will expect, per GOV.UK (2026). Waiting for the exact commencement date to start training is the single most avoidable mistake an operator can make.

What are the penalties for failing to provide adequate training?

Failing to meet Martyn's Law duties, including staff training and awareness, exposes operators to civil monetary penalties tied to their tier. Standard Tier premises face a maximum monetary penalty of £10,000, with daily penalties of up to £500, per Lexology/Foot Anstey's legal analysis (2026).

Enhanced Tier premises and qualifying events face far steeper exposure: maximum penalties of £18 million or 5% of worldwide revenue, whichever is greater, with daily penalties up to £50,000, per Foot Anstey (2026). These figures mirror the scale of penalties under UK data protection law enforced by the ICO, and are designed to make non-compliance a board-level financial risk rather than an operational footnote for large venues.

Your Martyn's Law training checklist

Confirm your capacity tier against the 200–799 (Standard) and 800+ (Enhanced) thresholds
Name a responsible person or designated senior individual accountable for training
Build a short training module covering suspicious behaviour, invacuation, evacuation and lockdown
Set a target completion date ahead of the expected Spring 2027 commencement
Keep dated training records for every member of staff, not just security personnel
Refresh training on a recurring schedule and after any procedure change
Include agency, seasonal and contractor staff who work on-site, however briefly
Store risk assessments, procedures and training logs together for regulator inspection

How much does compliant staff training typically cost?

Costs vary hugely depending on tier and delivery method, and the research base doesn't yet contain a settled UK benchmark figure. As a general guide, free e-learning modules — the kind Figen Murray describes as the acceptable minimum — cost nothing to license but still require paid staff time to complete. Bespoke, trainer-led sessions for Enhanced Tier venues will cost more per head and take longer, reflecting the extra depth required around risk assessment and command structures.

For most Standard Tier businesses, the realistic outlay is staff time rather than licence fees: a typical illustrative range might be an hour or less per employee, repeated periodically, rather than a large one-off spend.

What free resources does the government provide for training staff?

The UK government and counter-terrorism policing bodies provide free e-learning specifically built for this purpose. ProtectUK, run by counter-terrorism policing, hosts ACT (Action Counters Terrorism) Awareness e-learning, which many local authorities — including Sheffield City Council and Liverpool City Council — point businesses toward as a starting point for Martyn's Law readiness.

The SIA itself, as the confirmed regulator, is expected to publish further regulatory guidance once its section 12 consultation concludes; that consultation ran until 12 June 2026, per GOV.UK (2026). Operators shouldn't wait for a final SIA-branded course to exist before starting — the free ACT Awareness e-learning already meets the "basic understanding of the dangers" bar that Figen Murray describes as the minimum standard.

What common mistakes do businesses make when preparing for Martyn's Law?

The most common mistake is treating training as a one-off box-tick rather than a repeated habit. A second is confusing "we have a policy document" with "our staff know what to do" — Martyn's Law is about demonstrable readiness, not paperwork sitting in a drawer. A third is miscalculating capacity by using average footfall instead of peak capacity, which can wrongly place a venue outside scope entirely.

Multi-site operators face a fourth, quieter risk: training records, risk assessments and incident history scattered across spreadsheets, email threads and individual managers' memories. This is precisely the gap Pulse Operations's compliance runway is built to close — SIA licensing, BS 7858 screening, DBS checks, right-to-work evidence, training records and Martyn's Law assessments sitting on one expiries runway rather than in a dozen places. When a contract mobilised across three London buildings in a single fortnight in July 2026, Pulse Operations had checkpoints, site notes, prior issues and induction history live in the platform before officers arrived — so training and site knowledge started on day one rather than living in someone's head.

FAQ

Do all staff need Martyn's Law training, or only security staff?

All staff who work at a qualifying premises need some level of awareness, not just dedicated security personnel. Front-of-house, retail, hospitality and facilities staff are often the first to notice something wrong, so the Act's intent is broad awareness across the workforce, scaled to each person's role.

Is a specific certified course required under Martyn's Law?

No single certified qualification is currently mandated. The Act requires operators to ensure appropriate awareness of procedures; free e-learning such as ACT Awareness, hosted via ProtectUK, is widely accepted as meeting a basic standard while the SIA's own guidance is finalised.

How often should Martyn's Law training be refreshed?

The Act doesn't specify a fixed refresher interval, but good practice is annual retraining plus refreshers after any change to procedures, premises layout or staff turnover. Training that happens once and is never repeated is unlikely to satisfy a regulator reviewing your records after an incident.

What happens if my venue is just under the 200-person threshold?

Premises below 200 capacity currently fall outside Martyn's Law's Standard Tier scope, but operators should still assess capacity carefully, since it's based on the maximum number who could be present, not typical footfall. Many venues that assume they're exempt discover they cross the threshold during busy periods or events.

Does Martyn's Law apply to schools, places of worship and community venues?

Yes, in principle, if their capacity meets the Standard or Enhanced Tier threshold. There's no blanket sector exemption; the trigger is publicly accessible capacity, so a large church, community centre or school hall can fall into scope just as a shopping centre does.

Who enforces Martyn's Law and issues penalties?

The Security Industry Authority (SIA) is the confirmed regulator for Martyn's Law, per GOV.UK's guidance (2026). The SIA will inspect compliance and can issue civil monetary penalties, ranging from £10,000 for Standard Tier breaches up to £18 million or 5% of worldwide revenue for serious Enhanced Tier failures.

What should I do now, given the law isn't fully in force yet?

Start training now rather than waiting for Spring 2027 commencement. Confirm your tier, name a responsible person, run free ACT Awareness e-learning for staff, and keep dated records — the 24-month implementation period from Royal Assent on 3 April 2025 was designed for exactly this preparation window, per ProtectUK (2025).

Preparing your team with Pulse Operations

Martyn's Law training only holds up if you can prove it happened, for which staff, and when it needs refreshing — the same challenge Pulse Operations already solves for SIA licensing, BS 7858 screening and DBS checks. Pulse Operations's compliance runway puts training records, risk assessments and Martyn's Law readiness alongside every other expiring credential your team holds, so nothing lapses quietly across multiple sites.

Pulse Operations was built inside a working London security and FM operation, Priority First, before being opened to other operators — which is why the compliance tooling reflects real mobilisation pressure rather than a theoretical checklist. If you manage a qualifying premises and want training and compliance evidence in one place ahead of Spring 2027, get in touch with Pulse Operations for a walkthrough of the compliance runway, or see published pricing to compare against your current setup.

Explore Pulse Operations services

Take the 2-minute tour Pulse for security companies Pulse for facilities management Mobile patrol & keyholding

Written by

Lauren Dawkins — Founder, Pulse

Lauren Dawkins is a founder of Pulse, the operations platform for UK security and facilities companies. Pulse was built inside the founding team's own security and FM operation — real patrols, real clients, real compliance — before being opened to other operators.

Founding team, Pulse · UK security & facilities operations