Last updated: 15 September 2026

Terrorism Protection of Premises Act 2026 summary: what UK businesses need to know

The Terrorism (Protection of Premises) Act 2026, widely known as Martyn's Law, is UK legislation that requires operators of qualifying public premises and events to prepare for a terrorist attack. It creates two duty tiers based on capacity — standard (200-799 people) and enhanced (800+) — with enhanced-tier breaches carrying fines of up to £18 million or 5% of worldwide revenue (Anderson Strathern, 2026).

Key Takeaways

• The Terrorism (Protection of Premises) Act 2026 is commonly known as Martyn's Law, named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.
• Standard Tier premises face a maximum penalty of up to £10,000 for non-compliance (Anderson Strathern, 2026).
• Enhanced Tier premises and events face maximum penalties of up to £18 million or 5% of worldwide revenue, whichever is greater (Anderson Strathern, 2026).
• The Act applies to premises with a capacity of 200 or more people, with additional measures for premises or events with a capacity of 800 or more (CMS Law, 2026).
• Schedule 1 of the Act lists seventeen categories of premises caught by the legislation, including educational establishments, shops, restaurants, places of worship and entertainment venues (Mayer Brown, 2026).

What is the Terrorism (Protection of Premises) Act 2026?

The Terrorism (Protection of Premises) Act 2026 is a UK statute that places a legal duty on operators of qualifying public premises and events to prepare for the possibility of a terrorist attack, rather than treating that preparedness as optional. It received Royal Assent in 2026 and is better known by its popular name, Martyn's Law, after Martyn Hett, who died alongside 21 others in the 2017 Manchester Arena bombing, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The campaign that put the law on the statute book was led by Martyn Hett's mother, Figen Murray, per the same guide. Counter Terrorism Policing assesses that since March 2017 there have been 15 domestic terror attacks in the UK, not including Northern Ireland-related terrorism (CMS Law, 2026). That threat record is the backdrop Parliament used to justify moving public protection duties from good practice into law.

The Act sits alongside — not instead of — existing statutory duties. It does not replace the Health and Safety at Work etc. Act 1974 or fire safety law; it adds a specific counter-terrorism layer on top.

Which premises and events fall within scope, and what are the tiers?

Schedule 1 of the Act lists seventeen categories of premises caught by the legislation, including educational establishments, shops, restaurants, places of worship and entertainment venues (Mayer Brown, 2026). Coverage depends on both the type of premises and how many people could reasonably be present, not on the sector alone.

The Act creates a two-tier system: standard tier and enhanced tier. Standard tier broadly covers premises where 200 to 799 people may be present, and it focuses on low-cost, common-sense preparedness — things any competent operator should already be thinking about, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

Enhanced tier broadly covers premises and events where 800 or more people may be present, and it carries heavier duties, including a documented risk assessment. Retail parks, shopping centres, places of worship, schools, hospitality venues and event organisers all need to check where their footprint sits against these thresholds — a shopping centre with several small units can easily aggregate past the enhanced threshold even if no single shop does.

What are the capacity thresholds for standard and enhanced duty?

The Act impacts premises with a capacity of 200 or more people, with additional measures applying to premises or events with a capacity of 800 or more (CMS Law, 2026). Below 200, a premises falls outside the Act entirely.

Capacity is judged on the maximum number who could be present — public and staff together — not average daily footfall, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. A conference venue that is usually half-empty but licensed for 900 falls into enhanced tier because of what it could hold, not what it typically does.

Events with fluctuating attendance — festivals, markets, one-off exhibitions — need a peak-capacity calculation done in advance, not a guess on the day.

Who is legally responsible for compliance under the Act?

The "responsible person" under Martyn's Law is the individual or organisation with control over the premises, and that person carries the legal duty to comply. For a single-site retailer this is usually the business itself; for a shared building — a shopping centre, a business park, a mixed-use development — responsibility can sit with multiple parties who each control part of the footprint.

This matters operationally. A landlord controlling common parts and a tenant controlling their unit may both have duties, and neither can assume the other has it covered. Facilities managers, security contractors and in-house estates teams all need clarity, in writing, on who owns which part of the Martyn's Law duty before an SIA (Security Industry Authority) inspection asks the question for them.

Pulse Operations's own compliance work with facilities teams shows this ambiguity is the single most common gap: nobody disputes that Martyn's Law applies, but two or three parties each assume someone else holds the paperwork.

What security measures must standard tier premises put in place?

Standard tier duties centre on public protection procedures: what staff do if there's an attack, not what stops one happening. That means having a plan for evacuation, invacuation (moving people to safety inside the building) and lockdown, and making sure staff know what that plan is.

In practice this covers:

• A written procedure for evacuation, invacuation and lockdown, appropriate to the premises
• Staff who know the procedure and their role in it, not just a laminated notice on a wall
• A designated responsible person named against the duty
• Basic records showing the procedure exists and staff have been made aware of it

Standard tier is deliberately low-cost. It is not asking a corner shop or a small church hall to install turnstiles and bag scanners — it is asking them to know what to do in the first ninety seconds of an incident, and to be able to show that to a regulator if asked.

What extra obligations apply to enhanced tier premises?

Enhanced tier premises must additionally hold a documented risk assessment, kept current rather than produced once and filed away, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. This sits alongside the standard tier's public protection procedures, not instead of them.

Enhanced duties typically extend to:

• A documented, regularly reviewed risk assessment covering the specific site or event
• A security plan setting out physical measures — access control, bag checks, CCTV, monitoring
• Vehicle security measures where hostile vehicle mitigation is relevant
• Evidence of staff training against the plan, not just its existence
• Governance showing the responsible person actively reviews and updates the plan

This is where the Act starts to resemble a live management system rather than a policy document — closer in spirit to a fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005 than to a one-off compliance certificate. Enhanced-tier operators who already run compliance runways for SIA licensing, BS 7858 screening or statutory building checks have a natural place to add Martyn's Law evidence rather than starting a separate system from scratch.

When does the Act come into force, and what happens if a business doesn't comply?

The Act received Royal Assent in 2026 and includes an implementation period before duties are enforced, giving businesses time to prepare rather than facing immediate liability, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. Businesses should treat the implementation window as a deadline for having evidence ready, not a reason to delay starting.

The Security Industry Authority (SIA) is the designated regulator and holds inspection and enforcement powers, including the ability to issue information notices. Failing to comply with an SIA information notice carries a penalty of up to £5,000 (Anderson Strathern, 2026).

Penalties scale sharply by tier. Standard duty breaches carry a maximum penalty of £10,000, with a daily penalty of up to £500 for continuing non-compliance; enhanced duty breaches carry a maximum of £18 million or 5% of qualifying worldwide revenue, with a daily penalty of up to £50,000 (Policy Pros, 2026). At the most serious end, non-compliance offences can be prosecuted on indictment, with sanctions including up to two years' imprisonment and/or an unlimited fine (Anderson Strathern, 2026).

How does Martyn's Law compare to existing safety obligations?

Martyn's Law is a counter-terrorism duty that sits alongside health and safety and fire safety law, not a replacement for either. The Health and Safety at Work etc. Act 1974 covers general workplace risk; the Regulatory Reform (Fire Safety) Order 2005 covers fire; Martyn's Law covers deliberate hostile acts.

Many operators already running fire risk assessments, first-aid procedures and evacuation drills will recognise the shape of Martyn's Law immediately — the difference is the specific threat being planned for and the named regulator checking it. Facilities and security teams that already track SIA licensing, DBS checks and statutory building compliance on one system have an obvious home for Martyn's Law evidence: it becomes one more expiry and one more document set on an existing compliance runway, rather than a parallel spreadsheet nobody remembers to update.

Your Martyn's Law compliance checklist

• Calculate your premises' or event's peak capacity, including staff, against the 200 and 800-person thresholds
• Confirm your Schedule 1 category and whether standard or enhanced tier applies
• Name a responsible person in writing, and resolve overlapping duties on shared or multi-occupier sites
• Draft or refresh evacuation, invacuation and lockdown procedures for standard tier
• Commission a documented risk assessment and security plan if enhanced tier applies
• Train staff against the procedure and keep dated records of that training
• Build a single evidence file the SIA can review on request, rather than scattered emails and drafts
• Set a review date so the risk assessment and plan don't go stale before the next inspection

FAQ

What is the Terrorism (Protection of Premises) Act 2026?

The Terrorism (Protection of Premises) Act 2026 is UK legislation, commonly called Martyn's Law, that requires operators of qualifying public premises and events to prepare for a terrorist attack. It was named after Martyn Hett, who died in the 2017 Manchester Arena attack, following a campaign led by his mother, Figen Murray.

What is the difference between standard and enhanced tier under Martyn's Law?

Standard tier applies broadly to premises with 200–799 people and requires public protection procedures like evacuation and lockdown plans. Enhanced tier applies to 800 or more people and adds a documented risk assessment and security plan, with far higher penalties for breach.

When does Martyn's Law come into force?

The Act received Royal Assent in 2026 and includes an implementation period before enforcement begins, giving businesses time to prepare. Businesses should use that window to build compliant procedures and evidence now rather than waiting for a fixed deadline to force the issue.

Who enforces Martyn's Law and what powers does the regulator have?

The Security Industry Authority (SIA) is the designated regulator for the Act and can issue information notices, inspect premises and take enforcement action. Failing to comply with an SIA information notice carries a penalty of up to £5,000 (Anderson Strathern, 2026).

What are the penalties for non-compliance with Martyn's Law?

Standard tier breaches carry a maximum penalty of up to £10,000, while enhanced tier breaches carry a maximum of £18 million or 5% of worldwide revenue, whichever is greater (Anderson Strathern, 2026). The most serious cases can be prosecuted on indictment, carrying up to two years' imprisonment and/or an unlimited fine.

Which premises are covered by the Act?

Schedule 1 of the Act lists seventeen categories of premises, including educational establishments, shops, restaurants, places of worship and entertainment venues (Mayer Brown, 2026). Coverage also depends on capacity, so a listed premises type below 200 people falls outside the Act.

Does Martyn's Law replace fire safety or health and safety duties?

No. Martyn's Law adds a counter-terrorism duty alongside existing obligations under the Health and Safety at Work etc. Act 1974 and the Regulatory Reform (Fire Safety) Order 2005. Operators must meet all three sets of duties, not choose between them.

Preparing for Martyn's Law with Pulse Operations

Martyn's Law turns counter-terrorism preparedness into a documented, inspectable duty, and that means the evidence has to exist somewhere a regulator can find it — not in someone's head, an old email thread, or a folder nobody's opened since the risk assessment was written. Pulse Operations's compliance runway already tracks SIA licensing, BS 7858 screening, DBS checks, right-to-work and statutory building compliance on one expiries dashboard, and Martyn's Law assessments sit on that same runway rather than in a separate system.

That approach mirrors how Pulse Operations's founding team handles multi-site accountability more broadly: at a prestige central-London estate covering 16 buildings on one nightly round, the estate asked a simple question — can you prove every building gets its patrols, every night? Pulse Operations set up each building as its own site with its own checkpoints and evidence trail, and patrols have run at 4,100+ since March 2026, with 100% of checkpoint completions photo-verified (production data, as of July 2026). The same discipline — evidence tied to a place, a time and a name, not a claim — is what Martyn's Law now asks of every enhanced-tier operator. Pulse Operations is UK-built and UK-hosted, and its guide, Martyn's Law: a readiness guide for security & FM teams, sets out a practical readiness checklist for security and FM teams.

If your premises or event sits near the 200 or 800-person threshold, get in touch with Pulse Operations to talk through where your compliance runway currently has gaps and how to close them before enforcement starts.

Related Reading

• Martyn's Law for Outdoor Events: 2026 UK Guide
• Martyn's Law Training Course: 2026 Buyer's Guide
• Martyn's Law Online Training: 2026 UK Compliance Guide