Public events (and premises) that attract large crowds carry an inherent security risk, a danger brought sharply into focus by the tragic 2017 Manchester Arena attack. Martyn’s Law, formally known as the Terrorism (Protection of Premises) Act 2025 (the “Act”) and named after a 2017 victim, Martyn Hett, is in view and requires your attention now.
In a nutshell, the new law requires owners and organisers of large public premises and events to help reduce vulnerability to terrorist incidents by introducing new mandatory duties for those “responsible” for affected public premises and crowded events. The Act received Royal Assent on 3 April 2025 and is expected to come into force in Spring 2027, so we are in the implementation phase, and the Government have recently issued comprehensive statutory guidance to the new regime, with useful practical examples.
.
At Tees, we can help you prepare by assessing your current position and providing guidance to help you comply with the statutory requirements once they are in full force. This may include:
- determining if your premises or event(s) may be affected (and if so which level of obligations will apply)
- helping you plan for compliance
What Premises and events will be caught?
The Act targets both ‘qualifying’ premises and events as set out in the table below. New statutory duties will be imposed on those “responsible” for affected premises or events (tiered according to capacity and use) which will require them both to think about keeping people safe from terrorist attacks, and consequently to put in place measures to mitigate those risks.
Qualifying Premises | Qualifying Events |
A building, or a building and other land where there is public access and it is reasonable to expect that from time to time 200 or more individuals may be present at the premises at the same time. | An event with public access where it is reasonable to expect at some point 800 or more individuals may be present at the same time, and which have measures to check that attendees satisfy entry conditions (e.g. ticketing requirements). Open access events without tickets may be exempt |
| includes festivals, concerts, football matches etc |
What requirements apply to qualifying premises and events?
Standard Tier (Premises) | Enhanced Tier (Premises and Events) |
Affects relevant premises with capacity for 200 to 799 individuals | Affects relevant premises and events (ticketed) events with capacity for 800 or more individuals |
Notify Security Industry Authority (“SIA”) of “responsible person” | |
senior individual at “responsible person” not mandatory | “senior” responsible individual must be assigned |
Mandatory “Public protection procedures” must be considered, and responsible person must put such procedures in place, including:
| |
“Public protection measures” are not mandatory | Reasonably practicable “public protection measures” are mandatory, such as:
|
Premises used for childcare, primary, secondary or further education, or a place of worship will always be standard tier premises even if the capacity exceeds 800 individuals | |
Who is the responsible person?
The Act identifies the ‘responsible person’ for qualifying premises and events as follows:
- Premises – the individual, company or organisation with “control” of the premises for the purpose of the Schedule 1 use. Where there is more than one use, it will be whoever controls the ‘principal use’ of the premises. This ‘principal use’ should be determined in accordance with new regulations that came into force on 15 October 2026.
- Events – the entity with “control” over the premises in relation to its use for the event (i.e. if a concert, run by Music Ltd, is held at a stadium that is not owned by Music Ltd, Music Ltd will nevertheless be responsible).
The responsible person is the person with control of the premises for the relevant use/event. This is likely to be either the legal owner or occupier, but note that there may well be more than one responsible person if different entities own or occupy premises and/or run events. If so, all responsible persons must coordinate with one another.
Duties of Responsible Persons
- Co-ordinate with other responsible persons where required; and
- Notify SIA (within time limits below) of becoming, or ceasing to be, “responsible” for a qualifying premises or event (providing any other information required by regulations):-
- For qualifying premises – within 3 months of the notification requirements coming into force.
- For qualifying events – within 14 days from the date the event is first publicised.
Enforcement
The SIA will oversee compliance, with powers to inspect premises and issue civil sanctions (or even pursue criminal penalties) for non-compliance including:
- Fines – for enhanced tier premises and events this may be up to £18 million or 5% of the person’s qualifying worldwide revenue for the most recent accounting period (whichever is higher); and
- Criminal penalties – reserved for exceptional cases of non-compliance.
How can Tees get involved?
Martyn’s Law is broad, and will capture a wide range of individuals, businesses, and organisations who own qualifying premises and/or run qualifying events. To hit the ground running when this Act comes into force, early thinking and preparation are essential. We can assist you with that thinking during the pre-commencement period and help make sure you are ready for compliance in relation to any relevant premises and events once the Act comes into force next Spring.
If you believe Martyn’s Law may impact you or would like to know more, then please do not hesitate to contact one of our legal advisors for detailed and tailored guidance.
This article is intended for general information purposes only and does not constitute legal advice. Readers should consult the relevant legislation and current Home Office guidance, and seek independent legal advice where appropriate.
