Martyn's Law: what to do before the regulator's guidance lands

800

or more at once, staff included [3]

2027

spring, expected start [2]

£18m

maximum penalty, or 5 percent of qualifying worldwide revenue if greater [9]

“Neither the SIA nor the Home Office is able to endorse or recommend specific companies or services for compliance with this legislation…”

SIA, Understanding Martyn's Law, section Preparing for Martyn's Law [2]

By OTAS Insights · Published by OTAS Live Ltd

The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent on 3 April 2025. It is named in tribute to Martyn Hett, one of the 22 people killed in the 2017 attack in Manchester [2][23]. The UK threat level from terrorism has been SEVERE since 30 April 2026. That means an attack is highly likely [36]. The duties are not yet in force. The Home Office has said there will be an implementation period of at least 24 months [2][19]. The SIA, the regulator, expects the law to come into force in spring 2027 [2][19]. On 15 April 2026 the Home Office published its statutory guidance on what those in scope must do [19]. The SIA consulted on its own guidance on how it will regulate. It planned to publish the final version in autumn 2026 [6]. On 9 November 2026 it had not yet been published [4]. His mother campaigned for the law. In a trade interview on 9 November 2026, she said organisations should prepare using authoritative guidance [1]. The same day, the SIA published a planning tool for standard tier premises and a template for enhanced tier premises and qualifying events [25][26]. This Insight is about what event teams can do now, while the final guidance is still to come.

In short: you do not need the regulator's final guidance to start. The Home Office guidance already sets out what the law requires. Check whether each event is in scope, name the responsible person, draft your evacuation, invacuation, lockdown and communication procedures, and brief your staff. Then check it against the SIA planning tool or template now, and against the final guidance when it lands.

Where things stand on 9 November

What has been published, and what has not, as of 9 November 2026. Each point carries its own source. Not legal advice.

The law and the guidance

• Royal Assent 3 April 2025. The duties are not in force until regulations bring them in [3].
• Home Office guidance Statutory guidance under section 27, on what those in scope must do, published 15 April 2026 with supporting documents [16][17][19].
• Notification rules The Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026, SI 2026/793, were made on 9 July 2026. They set when to notify the SIA and what to give. They apply once the notification duty is in force [33].
• SIA guidance The SIA consulted on its draft section 12 guidance, on how it will regulate, from 15 April to 12 June 2026 [5]. It received nearly 200 detailed responses and engaged over 1,800 people and organisations [6][7].
• Still to come The final section 12 guidance and a consultation report, planned for autumn 2026 [6]. Not published as of 9 November [4].

What the regulator has said

• Start date Expected in spring 2027. The SIA will confirm the exact date ahead of time [2].
• Tools A planning tool for standard tier premises and a template for enhanced tier premises and qualifying events, published 9 November 2026. Using them is not required. A qualifying event uses the enhanced tier template [25]. Standard tier premises will not need to send compliance documents unless asked [32]. An online scope tool is expected in the new year [8][25][26].
• Inspections Desk based assessments and site inspections, usually with at least 72 hours written notice. With a court warrant the SIA does not need to give notice [2][21].
• 9 November The SIA published its planning tool and template, and asked for feedback before 23 December 2026 [27].

What the law says about events

In brief, from the Act and the Home Office guidance. Each point carries its own source. Not legal advice.

Is your event in scope?

• An event is a qualifying event if all of these apply [10][28]. The public can attend. There are checks that people have paid, have a ticket or pass, or are members or guests. It is reasonable to expect that 800 or more people may be there at the same time at some point. It is not at enhanced tier premises, and it is not an excluded event under Part 2 of Schedule 2. Events in parks can still qualify [28].
• Free events count if there is a specific check on entry, such as wristbands, QR codes or tickets. A suggested donation, a dress code or a search does not count [3].
• For an entry check to count, the event needs a well defined and secure perimeter [21].
• The 800 figure includes staff, and only needs to be reached at some point during the event [3][18].
• Where only parts of an event have entry checks, each part is treated as a separate event [10]. Open streets and towpaths are out of scope unless in the immediate vicinity [3].
• Private events, such as a wedding reception or a staff party not open to the public, are not qualifying events [3].

Who is responsible?

• The responsible person is whoever will have control of the premises for the event [11]. In a park hired by an event company, that is the company, not the council [16].
• For a qualifying event or enhanced tier premises, if the responsible person is an organisation, it must name a senior individual who is responsible for making sure it complies [16][29].
• You can give tasks to a contractor. You cannot give away the legal responsibility [16].
• For a qualifying event or enhanced tier premises, others with any control, such as a landowner, must cooperate so far as is reasonably practicable [24].
• A one off event of 800 or more at a standard tier venue does not make the venue enhanced tier. But the event itself can be a qualifying event [16][21]. If a venue hosts such events from time to time, even once a year, the venue itself can become enhanced tier [16]. If you hire a venue that is already in scope, the venue operator usually stays the responsible person. The exception is a qualifying event at a standard tier venue. Then the responsible person for the event is whoever controls the venue for the event, often the organiser, and the two must coordinate [16][21].

What you must do

• Have four procedures, so far as is reasonably practicable. They are for evacuation, invacuation, lockdown and communication [12].
• For qualifying events, also assess measures on monitoring, movement, physical safety and security, and the security of information. Keep them under review, and put them in place so far as is reasonably practicable [13].
• Prepare a document that sets out the procedures and measures, and how they reduce risk. Send it to the SIA as soon as reasonably practicable after you first prepare it. Send any revisions within 30 days [14][25]. Do not send it before the law is in force. The SIA has asked people not to send anything until then [25].
• Notify the SIA when you become or stop being responsible, and when details you gave change [15][33]. For a qualifying event, notify within the 14 days beginning with the day the event date is first publicised. If it was first publicised on or before the day the notification duty starts, the 14 days begin on that start day [33][34].
• First publicised means the date is first made public to advertise the event, by you or with your authority. For example, on a website, social media, posters or a mailing list. Telling only club members or guests counts. Material not yet released, and disclosures you did not authorise, do not count [33][34].

The maximum penalty for standard tier premises is £10,000. For enhanced tier premises and qualifying events it is £18 million or 5 percent of qualifying worldwide revenue, whichever is greater [9].

Why waiting is the risk

The guidance still to come is about enforcement. The work is the same either way. OTAS guidance.

Four tests make an event qualifying

1Publiccan attend

2Entrychecks

3800 ormore at once

4Not atenhanced tieror excluded sites

5Qualifyingevent

• The requirements are already set. The Home Office guidance sets out what the law requires. The SIA guidance will explain how it regulates [5]. Waiting for one does not change the other. The Government says the requirements are intended to be proportionate. They can be tailored to the size, nature, layout and resources of each event [39].
• Spring is close. Many events for summer 2027 are being contracted now. Contracts decide who has control of the premises, and so who is responsible [11][16].
• Procedures take people. Written procedures only work if the staff who run them know their role. That takes briefing and practice, not a download [16].
• Buying is not complying. Neither the SIA nor the Home Office endorses any company. The guidance says you do not need to buy services or training to comply [2][16][19]. The SIA says its own tools are not a definitive checklist, and preparations will look different for every event [27].
• Fire plans are not enough. Evacuating for a fire and moving people away from an attack can need different routes and decisions. The guidance says it must be clear which is which [21]. Home Office guidance says you should consider how your measures interact with sector guidance such as the Green Guide or the Purple Guide, so they do not conflict. It also says security measures must not impede the safe entry or exit of attendees [16].

The responsible person card

Use one card for each event. Fill it in. Keep it with your safety plan. Change it when a contract changes. It says who is in charge. It says who you work with. It says when to tell the SIA. OTAS guidance unless a source is shown.

Who is it?

• Responsible person Whoever will control the premises for the event [11]. This is usually the organiser who hires and controls the site [16].
• Senior individual Needed if the responsible person is an organisation and the enhanced tier duties apply. It must be someone involved in managing or controlling that organisation, not a junior member of staff [16][29].
• Not delegable You can give tasks to a security firm or contractor. You cannot give away the legal duty [16].

Who do they work with?

• Others in control For a qualifying event or enhanced tier premises, landowners, venue operators and others with any control must cooperate with the responsible person [24].
• Other responsible persons Where premises sit inside other qualifying premises, those responsible must coordinate [24].
• The duties to cooperate and to coordinate both apply so far as is reasonably practicable [24].
• The regulator Once the duty is in force, tell the SIA within 14 days of first publicising each event. Also tell it within 14 days if you stop being responsible, or if a detail you gave changes [15][33].

Signs you are not ready

Each of these is OTAS guidance, drawn from the Act and the Home Office guidance.

Signs you are not ready

1. 01No scope check

   Nobody has tested each event against the qualifying event criteria [3][10].

2. 02No named person

   Nobody knows who has control of the premises for each event [11].

3. 03Fire plan only

   There is an evacuation plan for fire, but nothing for invacuation or lockdown [12].

4. 04Staff not told

   Stewards and staff do not know their role in each procedure [16].

5. 05Waiting to buy

   The plan is to buy a product or course rather than think it through [2][16].

A 20 week plan to spring 2027

Five stages over 20 weeks from 9 November 2026. OTAS guidance unless a source is shown.

20 weeks, from scope to briefed staff

Stage 1ScopeWeeks 1 to 4

Stage 2ResponsibilityWeeks 5 to 8

Stage 3ProceduresWeeks 9 to 12

Stage 4MeasuresWeeks 13 to 16

Stage 5Brief, checkWeeks 17 to 20

Scope

Weeks 1 to 4. Test each event against the qualifying event tests. Count the most people you expect at once, staff included [3][18]. Use the ProtectUK flowcharts [20], and its event scope infographic, myth buster and short videos [38].

Responsibility

Weeks 5 to 8. Write down who has control of the premises for each event. Name the senior individual, if the responsible person is an organisation and the enhanced tier duties apply [29]. Check your contracts with venues and landowners: who has control, and how you will work together [11][16][24]. Start a notification record for each event [33]. Write down who has control, the expected peak number and how you worked it out, and the licences. Add the websites and social accounts used to advertise it, any senior individual [29] and the date the event is first publicised [33].

Procedures

Weeks 9 to 12. Draft the four procedures: evacuation, invacuation, lockdown and communication [12]. Include the queues and the immediate vicinity [12][16].

Measures and document

Weeks 13 to 16. For qualifying events, assess monitoring, movement, physical safety and security, and the security of information [13]. Then draft the compliance document [14]. For each procedure and measure, note the options you ruled out as not reasonably practicable, and why. The SIA tools ask for this [25][26].

Brief and check

Weeks 17 to 20. Brief staff on their roles and use free awareness training [22]. Test the procedures. Then check everything against the SIA planning tool or template [25][26], and against the final SIA guidance once published [4]. The SIA template is optional and is not a checklist. The SIA says completing and sending it does not of itself mean you comply. What counts is having appropriate procedures and measures in place, so far as is reasonably practicable [25]. Once complete it holds sensitive information, so store it securely and limit who can see it [25].

The four procedures

Every event in scope needs these, so far as is reasonably practicable [12]. You do not need a separate plan for every type of attack. The SIA notes that if a threat seems to be inside, evacuation may suit better, and if it seems to be outside, lockdown may suit better. Staff may need to act before they have full information [25]. The examples are OTAS guidance for events.

Evacuation

• Getting people away from danger by moving them out of the event or part of it [2].
• For events, think about which exits lead away from the threat, not just the nearest.

Invacuation

• Moving people to a safer place within the event [2].
• For outdoor events, list the structures that can take people in, and how many.

Lockdown

• Securing the event to stop people entering or leaving [2].
• For a fenced site, know who closes which entry gates, how fast, and how exits stay staffed so people can still be moved away from danger. OTAS guidance [31].
• The immediate vicinity has no fixed distance. You do not have to put procedures or measures in place in areas you do not control [25]. But you should think about how yours would work if an attack happened there, for example in the queue outside [25].

Communication

• Making sure information reaches people at the event [2].
• Agree the words for staff and the public, and how you reach the queues outside [16].
• For a suspicious item, staff do not touch it and move at least 15 metres away before they use a radio or phone [30].
• Keep people back: at least 100 metres from a bag sized item, 200 metres from a car or large item, and 400 metres from a larger vehicle [30]. Follow police and supervisor directions.
• These distances are ProtectUK police guidance, not law [30].

Action box

Operational

• Know the procedures
• Report concerns
• Free awareness course

Know the four procedures and your role in each. Know how to report something suspicious, and do the free awareness course [22].

Tactical

• Draft procedures
• Include the queues
• Brief and test

Draft the procedures for your area, including queues and the space outside. Brief your teams on their roles and test the procedures with them.

Strategic

• Check scope
• Name the person
• Prepare the document

Check scope for every event and name the responsible person. For qualifying events, if it is an organisation, name the senior individual too [29]. Fix who has control in your contracts. For qualifying events, prepare the document for the SIA.

Readiness checklist

OTAS guidance unless a source is shown. Completing it does not mean you comply.

Scope

• Each event tested and counted, staff included [3][18].
• Each venue marked as out of scope, standard tier or enhanced tier [2].
• Each qualifying event marked. It has the enhanced tier duties [2].

People

• Responsible person named, and senior individual if needed [11][29].
• Contracts checked for control and cooperation [24].
• Staff know their role in each procedure [16].
• A notification record for each event, with the date it is first publicised [33].

Paper

• Four procedures written [12].
• Measures assessed and the document drafted, for qualifying events [13][14].
• Plan checked against the SIA planning tool or template [25][26], and the final SIA guidance when published [4].

What we do not know yet

• When the SIA's final section 12 guidance and consultation report will be published. It was planned for autumn 2026 [6].
• The exact date the duties come into force. Spring 2027 is expected [2].
• How the SIA's notification portal will work in practice. The timings and the information needed are already set by regulations made in July 2026 [33][34].
• Whether the SIA will change its planning tool and template after feedback. It has asked for feedback before 23 December 2026 [27].

Coming up: the final guidance and the start date

The SIA has said it will publish its final section 12 guidance and a consultation report [6]. It published its planning tool and template on 9 November 2026 [25][26]. A scope tool and a notification portal are to follow [2][8]. On 9 November 2026 the SIA said it was about to test its new digital service with users. It had lined up over 30 more premises and events for pilot inspections [27]. The SIA is asking for volunteers from one off events of all sizes to help test its tools and services [27]. Each step is a moment to check your plan, not to start it.

Frequently asked questions

Do we have to comply now?

No. The duties are not in force until regulations bring them in, expected in spring 2027 [2][3]. You can prepare now using the Home Office guidance.

When do we tell the SIA about an event?

Once the duty is in force, within the 14 days beginning with the day you first publicise the event date. If the date was first publicised on or before the day the duty starts, notify within the 14 days beginning with that day. Events held before the duty starts are not notified. Someone you authorise can submit, but the legal responsibility stays with you [33][34].

Is a free event in scope?

It can be, if three things are true. The public can attend. There is a specific check on entry, such as wristbands or QR codes. It is reasonable to expect 800 or more people at once at some point, staff included. Then it is likely to be a qualifying event, unless it is at enhanced tier premises or is an excluded event [3][10][28].

Who is the responsible person for an event in a park?

Whoever has control of the area for the event. If an event company hires and controls it, that is the company. If the council keeps control, it is the council [16].

Do we need to buy training or a product?

No. There is no requirement to buy services or training, and neither the SIA nor the Home Office endorses any company [2][16]. Staff must know the procedures and their role [16]. Free modules are on ProtectUK and the NPSA site, including ACT Awareness, aimed mainly at staff working in venues and public spaces [22][27]. The Home Office guidance points CCTV operators to the NPSA See, Check and Notify training, where available [16].

Does Martyn's Law mean we must cancel a community event or fireworks display?

No. The SIA says not every public gathering or fireworks display will be a qualifying event. Many traditional Christmas markets may not meet the test because they do not control entry. It says the law does not require organisers to employ expensive security staff, buy new technology or hire specialist consultants. Check your scope first [27]. The SIA has also said Martyn's Law is not about stopping events from happening [37].

Will the SIA inspect us?

It may. It will use desk based assessments and inspections, usually with at least 72 hours written notice, and no fees. With a court warrant the SIA does not need to give notice [2][21].

Has the SIA published its final guidance?

Not as of 9 November 2026. It planned to publish in autumn 2026 [4][6]. We will update this Insight when it does.

Related OTAS Insights

These are links to other OTAS Insights pieces, not to any OTAS Live product or service.

• Evacuating a venue late at night
• When everyone is told to come in at once

Interest: OTAS Live Ltd, which publishes OTAS Insights, sells event operations services, handbooks and training related to this topic.

Law: this Insight summarises the Terrorism (Protection of Premises) Act 2025, Home Office statutory guidance and SIA guidance as published on 9 November 2026. It is not legal advice, and following it does not mean premises or an event comply. The SIA assesses and enforces compliance. Read the Home Office guidance and the SIA guidance, and take legal advice where you need it.

References

Web sources opened 9 November 2026 and labelled by source type. Links are for checking only. Listing a source does not mean it endorses OTAS or has worked with OTAS.

1. Trade news interview on preparing for Martyn's Law, Emergency Services Times, 9 November 2026 emergencyservicestimes.com
2. SIA, Understanding Martyn's Law and the SIA's role as regulator, 17 July 2026 gov.uk
3. Home Office, Terrorism (Protection of Premises) Act 2025 factsheet, scope (events), updated 24 July 2026 gov.uk
4. SIA, Martyn's Law and the SIA's role as regulator, collection page, last updated 9 November 2026 gov.uk
5. SIA, Martyn's Law draft section 12 statutory guidance, consultation page gov.uk
6. SIA, consultation on its Martyn's Law guidance closes, 16 June 2026 gov.uk
7. Counter Terror Business, SIA's Martyn's Law consultation closes, 18 June 2026 counterterrorbusiness.com
8. SIA, Martyn's Law: scope, support and what's next, 11 September 2026 gov.uk
9. Terrorism (Protection of Premises) Act 2025, section 18, maximum amount of a penalty legislation.gov.uk
10. Terrorism (Protection of Premises) Act 2025, section 3, qualifying events legislation.gov.uk
11. Terrorism (Protection of Premises) Act 2025, section 4, persons responsible legislation.gov.uk
12. Terrorism (Protection of Premises) Act 2025, section 5, public protection procedures legislation.gov.uk
13. Terrorism (Protection of Premises) Act 2025, section 6, public protection measures legislation.gov.uk
14. Terrorism (Protection of Premises) Act 2025, section 7, documenting compliance legislation.gov.uk
15. Terrorism (Protection of Premises) Act 2025, section 9, notification requirements legislation.gov.uk
16. Home Office, Terrorism (Protection of Premises) Act 2025 statutory guidance (accessible) gov.uk
17. Home Office, The Terrorism (Protection of Premises) Act 2025, guidance and supporting documents gov.uk
18. Home Office, supplementary document A, methods for assessing the number of people present, updated 25 August 2026 gov.uk
19. Home Office, Martyn's Law guidance published to help businesses, 15 April 2026 gov.uk
20. ProtectUK, Martyn's Law scope protectuk.police.uk
21. ProtectUK, Martyn's Law frequently asked questions, 27 October 2026 protectuk.police.uk
22. ProtectUK, ACT Awareness e-learning protectuk.police.uk
23. Manchester Arena Inquiry, Volume 1, Security for the Arena, GOV.UK page gov.uk
24. Terrorism (Protection of Premises) Act 2025, section 8, requirements to coordinate and cooperate legislation.gov.uk
25. SIA, Martyn's Law: enhanced tier template, 9 November 2026 gov.uk
26. SIA, Martyn's Law: standard tier planning tool, 9 November 2026 gov.uk
27. SIA, Martyn's Law: working together to prepare, 9 November 2026 gov.uk
28. Terrorism (Protection of Premises) Act 2025, Schedule 2, excluded premises and events legislation.gov.uk
29. Terrorism (Protection of Premises) Act 2025, section 10, senior individual legislation.gov.uk
30. ProtectUK, unattended and suspicious items protectuk.police.uk
31. HSE, event safety, incidents and emergencies hse.gov.uk
32. SIA, New tools to support preparation for Martyn's Law, 9 November 2026 gov.uk
33. The Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026, SI 2026/793 legislation.gov.uk
34. Home Office, Terrorism (Protection of Premises) Act 2025: notification requirement, 14 July 2026 gov.uk
35. Terrorism (Protection of Premises) Act 2025, section 36, extent legislation.gov.uk
36. MI5, Terrorism threat levels mi5.gov.uk
37. SIA, Martyn's Law: keeping up the momentum, 5 August 2026 gov.uk
38. ProtectUK, Martyn's Law resources, 27 August 2026 protectuk.police.uk
39. UK Parliament written answer 34237, 19 October 2026 questions-statements.parliament.uk

If your biggest event next summer were inspected tomorrow, who in your team would answer for it?

If you need support getting your events ready for Martyn's Law, reach out to us to see how we can support you.

Events industry since 2008, internationally since 2015. OTAS Live Ltd. By OTAS Insights. Edited by Kris Dailly.