Martyn’s law: Guide for Event Managers

If you run events in the UK, there’s a new piece of legislation that’s about to change the way you operate. Martyn’s law, officially the Terrorism (Protection of Premises) Act 2025, received Royal Assent in April 2025. It will not be enforced until 2027, but do not let that date fool you.

For anyone managing events, especially those with 800+ attendees, this is the most significant compliance shift since health and safety regulations were introduced. And while it is not yet in force, the time to start planning is now.

What is Martyn’s law?

Named after Martyn Hett, who was tragically killed in the Manchester Arena attack, Martyn’s law was the result of years of campaigning by his mother, Figen Murray. The aim is simple but vital, make venues and events better prepared to deal with terrorist threats.

The Act applies to an estimated 250,000+ UK premises. It introduces a clear duty of care for event organisers and businesses running public spaces. And crucially, it creates a legal expectation that you will have protective measures in place to safeguard attendees.

The timeline for implementing Martyn’s Law

• April 2025 , Martyn’s law receives Royal Assent
  
• 2025 to 2027 , 24-month implementation period for businesses to prepare and for the Security Industry Authority (SIA) to establish its regulatory framework
  
• April 2027 onwards , enforcement begins with inspections, penalties and possible event closures for non-compliance

Right now, you are not legally obliged to comply. But waiting until 2027 is a dangerous strategy. The SIA expects organisations to show “reasonably practicable” measures from the outset. Early planning will demonstrate due diligence and protect you if anything happens in the meantime.

Who does Martyn’s Law apply to?

Martyn’s law introduces a two-tier system based on how many people your venue or event expects to host at the same time.

• Standard tier (200–799 people)
  Covers retail, hospitality, entertainment, places of worship and education settings.
  Notably, events under 800 attendees are not covered in the same way, but premises in this bracket still need to consider basic protective duties
  
• Enhanced tier (800+ people)
  Applies to all qualifying events and venues with more than 800 attendees at any point.
  To qualify, an event must also have,
  
  • Public access (not private or invite-only)
    
  • Entry controls (tickets or registration)
    
  • Be held at premises not already covered by other provisions
    

For event organisers, the enhanced tier is the critical one to watch. Temporary events such as festivals, exhibitions, concerts and sporting fixtures fall under this definition if they hit that 800+ threshold.

What enhanced tier organisers must do

If your event qualifies, here are the key requirements.

• Notify the SIA , formally declare who is responsible for compliance
  
• Designate a senior individual , must be director-level if you are a company
  
• Implement public protection procedures including,
  
  1. Evacuation
     
  2. Invacuation (moving people to safety indoors)
     
  3. Lockdown protocols
     
  4. Communication systems for emergencies
     
• Put in place protection measures across four areas,
  
  1. Monitoring (CCTV, suspicious activity reporting)
     
  2. Movement control (bag checks, barriers, screening)
     
  3. Physical security (stand-off zones, hostile vehicle mitigation)
     
  4. Information security (protecting sensitive event details)
     
• Document everything , plans must be recorded and provided to the SIA within 30 days of preparation or revision
  

Enforcement and penalties

The SIA has wide-ranging enforcement powers, including,

• Inspections with 72-hour notice or unannounced visits if serious non-compliance is suspected
  
• Document checks and staff interviews
  
• Testing of systems and procedures
  

Penalties are severe,

• Up to £18 million or 5% of global turnover (whichever is higher)
  
• Daily fines of up to £50,000 for ongoing violations
  
• Event closure orders or capacity restrictions
  
• Personal liability for directors where neglect or consent is proven
  
• Reputational damage from public enforcement notices
  
• Possible invalidation of insurance policies
  

For many organisers, the financial and operational consequences could be business-ending. Compliance is not optional.

Why waiting is risky

There are three reasons event managers should not sit back until 2027.

1. Legal liability – even before enforcement, failure to show you have taken “reasonably practicable” steps could expose you to claims if an incident occurs.
   
2. False sense of time – the 24-month window is not generous once you factor in budgeting, training, supply contracts and stakeholder approvals.
   
3. Good practice now – many of the protective measures are not just about terrorism. They improve crowd safety, emergency response and overall risk management. Starting early improves your resilience
   .

What event managers must do now

Here’s a practical checklist.

• Assess your events – identify which qualify under enhanced tier
  
• Assign responsibility – designate who will act as the senior accountable individual
  
• Start planning – begin drafting evacuation, invacuation, lockdown and communication protocols
  
• Budget for compliance – security measures, training and documentation take investment
  
• Monitor updates – keep track of SIA guidance as the framework develops
  

Getting ahead of the game

For event professionals, Martyn’s law is not just another piece of red tape. It is a shift in mindset. Security is no longer something delegated to contractors at the last minute, it is a core part of event planning and delivery.

Event managers who embed this thinking early will not only avoid penalties but also position themselves as trusted operators. Clients, sponsors and attendees will all value the reassurance that comes from robust security planning.

The bottom line, whether you run festivals, exhibitions or sporting events, Martyn’s law is coming. The deadline may be 2027, but the time to act is now.

Key takeaways on Martyn’s Law

• Martyn’s law received Royal Assent in April 2025 and will be enforced from 2027
  
• It introduces a two-tier system with enhanced duties for events of 800+ attendees
  
• Enhanced tier organisers must notify the SIA, designate a senior responsible person and implement documented protective measures
  
• Non-compliance carries fines up to £18 million, daily penalties, closures and personal liability
  
• Early planning shows due diligence and strengthens overall event safety