Martyn’s Law: the last six months before the clock starts
Martyn’s Law: the last six months before the clock starts
The regime is expected to commence in spring 2027. Organisations that wait for commencement to begin will be building their evidence in a hurry, and the SIA will be able to tell.
By TiNYg Editorial · 6 November 2026
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, with a minimum two-year implementation period. That runway is now short. The Home Office published its section 27 statutory guidance on 15 April 2026, and the Security Industry Authority consulted on its own section 12 guidance (how it will use its powers as regulator) between 15 April and 12 June. Notification guidance followed on 14 July, and the Principal Use of Premises Regulations came into force on 15 October. The SIA has said an online scope tool and compliance templates for both tiers will arrive in the new year.
What the guidance has settled
The architecture is now clear. Premises where 200 to 799 people may be present fall into the standard tier; 800 or more brings the enhanced tier. Standard-tier duties are largely procedural: notify the SIA, and have public protection procedures for evacuation, invacuation, lockdown and communication. Enhanced-tier duty holders must also implement reasonably practicable measures to reduce vulnerability and the risk of harm, document them, and designate a senior individual. Once the duties commence, responsible persons will generally have three months to submit their initial notification.
What has not changed
No product is “Martyn’s Law compliant”. The SIA’s executive director for Martyn’s Law, Laura Gibb, has warned venues against buying products or consultancy marketed as guaranteeing compliance. Members should treat that warning as a quality filter on their own supply chain, and as a reputational warning to any partner tempted to market that way.
Where professionals are actually struggling
In conversations across the TiNYg network, three problems recur.
1.Capacity calculation. The tier depends on the number of individuals reasonably expected to be present, not fire-certificate maximums. Mixed-use sites, multi-tenant buildings and venues whose use changes by day of the week are producing genuine disagreements about which tier applies and who is the responsible person.
2.Invacuation as an afterthought. Most organisations have rehearsed evacuation for decades. Few have rehearsed moving people inwards to safety, locking down a building with glazed frontages, or communicating with the public during a marauding attack. These are the procedures Martyn’s Law will scrutinise first.
3.Evidence, not intent. The statutory guidance expects assessments to be evidenced. A plan that exists only in a security manager’s head, or in a folder no one has opened since the last audit, will not satisfy a regulator.
The professional view
The right reading of the Act is that it codifies what good practice already looked like after Manchester Arena: know your site, know your people, train them, and be able to prove it. The organisations best placed for 2027 are those already using ACT training, ProtectUK guidance and tabletop exercises as routine.
What to do before spring 2027
■Determine tier and responsible person for every site now, and record the reasoning.
■Write and exercise the four public protection procedures, invacuation and lockdown first.
■Build a training record for front-of-house staff, including contractors and agency workers.
■Use the SIA scope tool and templates as soon as they appear, and test them against your own documents.
■Treat the SEVERE threat level as the planning baseline, not the exception.
Sources
▪ Institute of Licensing: SIA updates on Martyn’s Law implementation
▪ Institute of Licensing: statutory guidance published
▪ Thornton Tomasetti: Martyn’s Law 2026 guidance
The Conversation is TiNYg’s members’ blog. Members and premium partners are invited to respond to, extend or challenge this article. Get in touch to contribute.
The Conversation
No. 1Martyn’s Law: the last six months before the clock starts
No. 2After Leipzig: the drone threat is no longer theoretical
No. 3Sabotage-for-hire: why your company is now on a hostile state’s target list
No. 4Younger, faster, less ideological: the new radicalisation curve
No. 5The chatbot in the attack cycle: what the evidence on AI and terrorism actually shows
No. 6From Heaton Park to HAYI: the state-terror hybrid
No. 7Cars and blades: why low-tech attacks remain the hardest to stop
No. 8The executive as target: protective intelligence after Thompson
No. 9Islamic State’s southern pipeline: why the Sahel is now Europe’s problem
No. 10The hoax as a weapon: this week’s aviation bomb threats
No. 11When the freezer is the target: cyber-physical convergence
No. 12The insider for hire: how criminals and states now buy their way in
