What Martyn's Law Means for Security Companies (2026)

Last updated: 25 October 2026

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, and for security companies it means new contracted duties: helping clients assess risk, train staff, and evidence preparedness against terrorism, with enforcement expected from spring 2027 and fines of up to £18 million for non-compliant premises, per Zems Academy (2026).

Key Takeaways

Martyn's Law — the Terrorism (Protection of Premises) Act 2025 — received Royal Assent on 3 April 2025, with enforcement expected around spring 2027 after a 24-month implementation period, per GOV.UK (2026).
The Act's Standard Duty tier covers premises holding 200–799 people, while the Enhanced Duty tier covers premises or events holding 800 or more, per SFJ Awards (2026).
The Home Office estimates the law will affect around 169,000 premises across the UK, including many schools, per Signinapp (citing Home Office) (2026).
Non-compliance can carry fines reported at up to £18 million or 5% of worldwide revenue for some premises, per Zems Academy (2026).
Security companies are not usually the legal "responsible person" under the Act, but they are the contractor most clients will lean on to deliver the duty in practice.

What is Martyn's Law?

Martyn's Law is the Terrorism (Protection of Premises) Act 2025, UK legislation that places new legal duties on operators of qualifying public premises and events to prepare for the possibility of a terrorist attack. It is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack, and the campaign for the law was led by his mother, Figen Murray, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The Act received Royal Assent on 3 April 2025 and carries an implementation period of at least 24 months before enforcement begins, expected in spring 2027, per GOV.UK (2026). The Security Industry Authority (SIA) — the UK's regulator for private security — has been named as the regulator for Martyn's Law, giving it a role beyond licensing individual officers. Michelle Russell, Chief Executive of the SIA, said: "Today is an important milestone. As the regulator of Martyn's law, the SIA's approach will be driven by public protection objectives."

Which premises does Martyn's Law cover, and what does that mean for contracts?

Martyn's Law applies on a two-tier model based on the maximum number of people a premises could hold, not average footfall. The Standard Duty tier applies to premises with a capacity of 200 to 799 individuals, while the Enhanced Duty tier applies to premises or events with capacity of 800 or more, per SFJ Awards (2026).

This distinction matters directly for security contracts. Enhanced-tier sites must maintain a documented risk assessment that is kept current rather than a one-off exercise, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. Schools sit squarely in scope: the average primary school has 281 pupils and the average secondary school has 948 pupils, meaning most schools fall into the standard or enhanced duty category, per SFJ Awards (2026). Shopping centres, cinemas, venues, places of worship and visitor attractions are all potentially in scope too.

Estimates of total scale vary. The Home Office's own impact assessment puts the figure at approximately 178,900 premises, though some estimates suggest over 250,000 premises will be affected UK-wide, per RiskStop (2026).

Who is the "responsible person", and where do security companies sit?

The responsible person is the individual or organisation legally accountable for meeting Martyn's Law duties at a given premises — typically the freeholder, tenant, or event organiser, not the security contractor. Security companies are rarely the responsible person themselves, but they are almost always the delivery arm the responsible person relies on to satisfy the duty day-to-day.

That reframes what a security contract needs to specify. A responsible person must appoint a designated individual, train and inform staff, maintain public protection procedures such as evacuation and lockdown, and keep records to cooperate with the regulator, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. For a shopping centre, that ownership question gets harder because the site is a cluster of tenants under one roof, not a single occupier.

Security companies that can name the responsible person on every contract, and evidence the training and drills behind it, are the ones clients will retain through enforcement.

What new duties fall on security company staff and training?

Martyn's Law creates a direct training obligation that runs through frontline security staff, not just management. Operators must ensure relevant staff — including contracted security officers — are trained and informed on public protection procedures such as evacuation, invacuation, lockdown and communication, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

This lands at a difficult moment for workforce supply. Nationally, 74% of apprenticeship completions in the sector sit at Levels 2 and 3, highlighting their importance as primary entry and progression routes into the security industry, per CLH News (2026). Satia Rai, CEO of IPSA, has warned that "these apprenticeships represent the foundation of a professional security industry" — meaning any squeeze on entry-level training routes lands directly on the pipeline of officers security companies need to deliver Martyn's Law duties.

Michael Kill, CEO of the Night Time Industries Association, has separately called funding cuts to related training "a short-sighted decision at a critical time." Security companies should expect Martyn's Law training records to become a standard tender question, alongside SIA licensing and BS 7858 vetting.

What does enforcement and non-compliance look like under Martyn's Law?

The SIA will hold civil enforcement powers under Martyn's Law, with the ability to issue compliance and restriction notices and, ultimately, monetary penalties. Reported guidance around the Act includes fines that can reach up to £18 million or 5% of worldwide revenue for some premises, per Zems Academy (2026).

Jon Savell, Senior National Coordinator for Protect and Prepare at Counter Terrorism Policing, framed the stakes plainly: "This is legislation borne out of tragedy, and from the tenacity of people personally affected by horrific events, and we remain humbled by their drive to work with authorities to ensure what they went through won't happen to others." Michael Kill, also Chair of the UK Door Security Association, has said the published guidance "marks an important step forward in strengthening the safety and resilience of public spaces across the UK."

For security companies, the practical exposure is reputational and contractual before it is ever a direct fine: a client fined under Martyn's Law will ask hard questions of the contractor who was supposed to be delivering its procedures on the ground.

Standard Duty vs Enhanced Duty: what changes for a security contract

Requirement	Standard Duty (200–799 capacity)	Enhanced Duty (800+ capacity)
Risk assessment	Not formally mandated	Documented, kept current
Procedures required	Evacuation, lockdown, communication	Same, plus more detailed planning
Responsible person	Must be named	Must be named
Staff training	Basic awareness and instruction	Fuller training and drills
Regulator focus	Proportionate, common-sense checks	Closer scrutiny, higher penalty exposure

Table built from SFJ Awards (2026) and Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

Proving Martyn's Law duties were actually delivered

Naming a responsible person and writing a plan is only half the job — Martyn's Law duties also need evidence they were carried out, and this is where many security contracts are currently weak. A tag scan or a paper sign-in sheet cannot show a lockdown drill happened, an evacuation route was walked, or a welfare check was made on time.

This is the same evidence problem Pulse Operations built its platform to solve, starting inside its own founding operation. Priority First, the founding team's own London security and facilities management business, moved 24 sites onto one system after February 2026, replacing paper sign-in sheets and jobs passed around on WhatsApp with photo-mandatory checkpoints. As Mo Hassan, Managing Director, put it: "We used to take everyone's word for it. Now every checkpoint has a photo and the client can see it before we've finished the shift — it's changed how we win work." Pulse Operations's checkpoint system captures a watermarked photograph — stamped with the officer, site, GPS location and timestamp — at every patrol point, by design without any QR or NFC tag scanning. Across live operations, 96.2% of checkpoints carry a watermarked photo over a trailing 90-day period, as of July 2026 (see Pulse Operations's benchmark). Read more in Pulse Operations's guide, How to prove patrols actually happened.

Your Martyn's Law readiness checklist for security companies

Confirm which of your clients' sites fall into Standard Duty (200–799) or Enhanced Duty (800+) capacity.
Name the responsible person on every relevant contract, in writing.
Agree evacuation, invacuation, lockdown and communication procedures with the client, not just head office.
Record staff training against Martyn's Law duties alongside existing SIA licence, BS 7858 and DBS records.
Build a documented, current risk assessment for every Enhanced Duty site.
Capture evidence — photos, timestamps, GPS — that procedures and patrols were actually delivered, not just planned.
Give clients visibility of compliance status rather than making them ask.
Track implementation dates: expect enforcement from spring 2027, per GOV.UK (2026).

FAQ

What does Martyn's Law mean for security companies?

Martyn's Law means security companies must help clients deliver documented risk assessments, evacuation and lockdown procedures, and staff training, and evidence that all of it actually happened. Contracts will increasingly specify Martyn's Law duties alongside standard security KPIs.

When does Martyn's Law come into force?

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, with an implementation period of at least 24 months, meaning enforcement is expected in spring 2027, per GOV.UK (2026). It is not yet in force as of this writing.

Which premises are covered by Martyn's Law?

Standard Duty covers premises with a capacity of 200 to 799 people, and Enhanced Duty covers premises or events with a capacity of 800 or more, per SFJ Awards (2026). The Home Office estimates around 169,000 premises will be affected, including many schools, per Signinapp (2026).

Who enforces Martyn's Law?

The Security Industry Authority (SIA) has been named the regulator for Martyn's Law, with civil enforcement powers including compliance notices and monetary penalties. SIA Chief Executive Michelle Russell has said the regulator's approach "will be driven by public protection objectives."

What are the penalties for non-compliance?

Reported guidance suggests fines can reach up to £18 million or 5% of worldwide revenue for some premises, per Zems Academy (2026). The exact penalty framework is subject to finalised SIA guidance ahead of enforcement.

Is the security company or the client legally responsible under Martyn's Law?

The "responsible person" — usually the freeholder, tenant or event organiser — carries the legal duty, not the security contractor. In practice, however, the security company is often the party delivering training, procedures and evidence on the client's behalf.

Do security companies need new qualifications for Martyn's Law?

There is no separate Martyn's Law licence for individual officers, but training on evacuation, lockdown and public protection procedures will become a standard client requirement. Apprenticeship routes matter here too: 74% of security apprenticeship completions sit at Levels 2 and 3, the primary entry route into the sector, per CLH News (2026).

Getting Martyn's Law-ready with Pulse Operations

Martyn's Law turns "we have a plan" into "prove the plan happened" — the same evidence gap security companies already face with patrols, incidents and compliance expiries. Pulse Operations's compliance runway brings SIA licensing, BS 7858 vetting, DBS checks, right-to-work records, training and Martyn's Law assessments onto one expiries timeline, so nothing lapses quietly before an inspection.

Pulse Operations was built inside Priority First, the founding team's own London security and FM operation, precisely because that business needed to prove work to clients rather than ask to be believed — the same standard Martyn's Law now sets in law. Every checkpoint on the Pulse app is completed by a mandatory watermarked photograph, and every compliance record sits on one expiries runway rather than a spreadsheet.

If your contracts now need to show Martyn's Law readiness on top of standard patrol and compliance evidence, get in touch with Pulse Operations for a walkthrough of the compliance runway and a look at published pricing at /pricing.

Explore Pulse Operations services

Take the 2-minute tour Pulse for security companies Pulse for facilities management Mobile patrol & keyholding

Written by

Lauren Dawkins — Founder, Pulse

Lauren Dawkins is a founder of Pulse, the operations platform for UK security and facilities companies. Pulse was built inside the founding team's own security and FM operation — real patrols, real clients, real compliance — before being opened to other operators.

Founding team, Pulse · UK security & facilities operations