As the 2027 rollout of Martyn’s Law approaches, venues are being encouraged to review their preparedness, procedures and security. In this article, John Gregory, Fleet and Asset Manager at ProFM Group, shares his practical checklist for venues to prepare for the new requirements. John offers his own perspective on the steps venues can take now and signposts to guidance available from the Home Office, ProtectUK and the SIA.
In May 2017, a terrorist bomb at Manchester Arena took the lives of 22 people and injured hundreds more. It also set in motion a tireless period of campaigning by Figen Murray, mother of 29 year old victim Martyn Hett, calling for better protective security and organisational preparedness at venues to prevent future attacks.
Nearly a decade later, Martyn’s Law – officially called The Terrorism (Protection of Premises) Act 2025 – passed through Parliament on April 2, 2025 and is due to come into force in 2027, a full 10 years after the tragic events in Manchester. But despite being in law and with venues having fewer than 12 months to meet the new requirements, there have been concerns that venues are not prepared.
Less than a quarter (23%) of firms said they were fully confident they would comply with the law in time, according to a survey by insurance broker Gallagher. In the same survey, only 36% of hospitality operators said they had a team in place or a dedicated person.
At the time of the survey, Gallagher MD Dominic Roe said the findings were ‘concerning’, and I agree, especially with 25% of venues claiming they weren’t even planning to appoint anyone to help with the implementation.
Understanding your tier within Martyn’s Law
Martyn’s Law isn’t a blanket requirement for venues, and your capacity will ultimately determine what tier you fall into and what that means for your readiness.
To date there are two tiers that cover UK hospitality venues.
- The Standard Tier relates to qualifying venues with expected crowds between 200 and 799.
- The Enhanced Tier covers venues reasonably expected to have 800+ attendees.
For venues within the Standard tier, you’ll need to notify the Security Industry Authority of your venue, put “proportionate” protection in place like plans for what to do in an emergency, having an evacuation plan in place or when you should lock you venue down. At this level, these don’t have to formally documented or submitted in writing to a regulator, although it is always good practice to document what is in place.
At Enhanced, you have to formally document procedures and risk assessment and hand these over to the SIA if they ask for it. It’s important to understand where you fall in these categories (a Home Office impact assessment suggested close to 180,000 premises fall into one of the categories) because even a hotel restaurant that considers itself too small could pass the 200 threshold on a peak Friday and fall within the requirements.
Will the plans work in practice?
The principles behind Martyn’s Law aren’t especially new. Under the Occupiers’ Liability Act 1957, venues already have a duty to take “reasonable care” to keep people safe when using their premises.
But while Martyn’s law doesn’t necessarily introduce any new responsibilities, it does introduce a level of enforcement requiring venues to show their safety procedures and protocols work in practice and aren’t just down on paper. It makes it a statutory requirement that evacuation or lockdown procedures are in place, and that they’ll work when tested under stress.
Consider these questions when looking at your own situation:
- Could a front of house staff member start a lockdown on their own or do they have to wait for a manager if something is happening?
- Do your alerts reach the toilets or smoking areas where people are in the venue but out of the way? And if you’re a multi-tenant block in a city, who decides when procedures are in force and have your tenants agreed?
The Government’s own guidance points to the fact that most of this only works where staff are in a position to put procedures into practice. So staff awareness and training is one of the biggest things you can focus on.
Staff awareness
As outlined above, it is staff awareness and their ability to put theoretical procedures into practice that will make the most difference. Martyn’s Law doesn’t require a specific course or qualification for event security staff to hold. However, ProtectUK provide a range of free training on countering terrorism.
Another challenge is that hospitality and events depend on casual or agency staff (although I suspect Martyn’s Law will push more towards professional services), especially considering that many casual or agency security services have high turnover, requiring high levels of staff training all the time.
I’d recommend looking for any provider that is on the SIA Approved Contractors list and also review training cycles to ensure what staff know is up to date, if you’re not going to rely on your own staff. At the very least, pre-event briefs need to make responsibilities clear and provide a direct line for decision making.
Venue entry and searches
Any requirements for searches sit within the enhanced-tier only. The Government’s guidance lists bag searches, CCTV and vehicles checks as required for premises or events of 800 or more people where it’s deemed necessary. They are not needed for the standard tier.
Where this is needed, plan ahead for your queue. Additional searches and bag checks will inevitably slow down the queue and create a bottleneck around where the search is taking place. One potential problem is this just moves the risk outside if a large enough crowd is gathered while you’re moving people through a blocked queue.
Additional security personnel or systems should be considered in these cases with professional staff who understand what they’re looking for and know how to respond in line with the law and protect guests.
Working with a professional security provider
Whoever supplies your security officers at your venue or for your event, responsibility starts and ends with you when something goes wrong. Just remember, the SIA alone determines what compliant security looks like.
There’s no course or contractor promise that gets around this, so if you’re going to go down the outsourced security route, make sure your provider is SIA Approved and can clearly demonstrate compliance with the right tier of Martyn’s Law.
Outside of the security aspect, you have a commercial reason to get ahead with Martyn’s Law, because compliance failure comes with cash fines. Penalties for Standard tier breaches can go up to £10,000. For Enhanced tier venues and events, this can go as high as £18million or 5% of worldwide turnover.
Failing to comply afterwards could result in daily fines and, for extreme non-compliance, criminal prosecution.
Martyn’s Law is an important milestone in the law around event and hospitality security. But it’s more a recognition of what many have been demanding for years, rather than a complete ripping up of everything venues have been doing up to now.
Those who start putting procedures and staff awareness in place now are likely to find the compliance deadline less worrying than those who wait for the law to come into full force.
Martyn’s Law readiness checklist
- Work out whether you qualify, and at which tier
- Count the maximum number of people reasonably expected on site at the same time. This includes staff, contractors, performers and crew, not just your customers
- Use your peak, not your average. A venue running at 150 midweek but 250 on a Friday is in scope
- 200 to 799 is the standard tier
- 800 or more is the enhanced tier
- Assess each site separately if you run more than one
- Qualifying events are assessed differently from qualifying premises. Check whether you have both
- In a shared or multi-tenant building, settle who the responsible person is for common areas before anything else
- Notify the SIA
- Identify your responsible person, meaning whoever has control of the premises or event
- Notify the SIA, (once the Act comes into force). Both tiers have to do this
- Keep the confirmation and the date
- Public protection procedures, both tiers
Four procedures are named in the Act. Your fire evacuation plan covers part of one of them.
Evacuation. Getting people out and away.
- Routes mapped for the case where the usual exit is the problem
- Assembly points that don’t send a crowd onto a road or into a second risk
- Who can call it? Can a duty supervisor start an evacuation without finding a manager first?
Invacuation. Moving people to somewhere safer inside, including bringing people in from outside.
- Safe internal areas identified
- The trigger for keeping people in. Staff instinct is to push people out of the doors, so this needs teaching
- How you bring in queues, smoking areas and outdoor tables
Lockdown. Securing the site so nobody gets in or out.
- Which doors, shutters and barriers, and who holds keys and codes on every shift
- Time it. Don’t estimate it
- Lone workers in kitchens, cellars and plant rooms
Communication. Alerting people and telling them what to do.
- Does the alert reach the toilets, the kitchen, the smoking area and anywhere with no signal?
- Give staff the actual words. Under stress people either freeze or improvise badly
- Deaf and hard of hearing guests, visually impaired guests, and rooms loud enough that nobody hears an announcement
- Who is carrying a radio at 11am on a Tuesday
- Public protection measures, enhanced tier only
Monitoring
- CCTV coverage, who is watching it live, retention period
- Staff who can recognise hostile reconnaissance. ACT Awareness e-learning is free on ProtectUK and takes about 45 minutes
Movement of people
- Queue design. Searching at the door moves the dense unscreened crowd outside your perimeter, which is where the risk goes
- Bag and person searches where your assessment supports them
- Vehicle access and standoff
- Dispersal. The surge when a headline act finishes is the hardest ten minutes of the night
Physical safety and security
- Barriers, glazing, doors and locks assessed against the risks you actually identified
- An emergency vehicle lane that stays clear when 2,000 people want to leave at once
Security of information
- Who can see layouts, staffing levels, schedules and security plans
- How those are shared with contractors, and how access is removed when someone leaves
- Documentation, enhanced tier only
- Document the procedures and measures, in place or planned
- Provide it to the SIA
- Version control it and set a review date
- If the responsible person is a company, designate a senior individual for compliance and record who
- People
- Everyone knows which procedure applies and what they personally do
- Briefings cover responsibilities and who makes the call
- Agency and casual staff briefed to the same standard. High turnover is where this falls down
- A refresh cycle, with a record of who was trained and when
- SCaN training for front of house is worth looking at, also free through ProtectUK
- Test it
- Walk it through in the building, at your busiest
- Then test the bad version: manager off site, radio flat, main exit blocked
- Write down what broke and what you changed
- If you use a contracted security provider
- Check licences yourself on the SIA public register. Don’t take a copy of a card at face value
- Ask what their training covers and how often it refreshes
- Agree your procedures and theirs in writing, and make sure their officers have actually read them
- Compliance stays with you as duty holder whoever supplies the people
