Martyns Law - update

Royal assent and implementation timeline

On 3 April 2025 the Terrorism (Protection of Premises) Act 2025 (the Act), commonly known as Martyn’s Law, received Royal Assent. The purpose of the Act is to strengthen security at public venues and events. It is intended that the Act will come into force no sooner than 1 April 2027.

The origins of Martyn’s Law

The Act has been six years in the making and followed a promise made by then Home Secretary, Teresa May MP, to legislate in the wake of the Manchester Arena attack. Three years have passed since Sir John Saunders recommended the imposition of a formal protect duty in his first volume Manchester Arena Inquiry report to Government. Throughout that period Figen Murray O.B.E. has petitioned tirelessly for the imposition of a legal obligation to strengthen the security of public premises and events.  The law is named in tribute to her son Martyn Hett who was tragically killed in the Manchester  Arena attack on 22 May 2017.

A duty to strengthen public safety

The Act itself will impose a new duty on those responsible for premises and public events, requiring them to take appropriate action to strengthen public safety, with requirements reflecting the size of the venue and the activity taking place.

A tiered approach to compliance

Those responsible for publicly accessible premises will be required to fulfil necessary but proportionate steps, according to their capacity, to help keep the public safe. This includes a tiered approach, linked to the size of the venue, how many people will be there and the activity taking place, making sure undue burdens are not placed on small businesses.

Standard tier requirements

The standard tier will apply to premises with a reasonable expectation of a capacity of more than 200 people but less than 800. These premises will be asked to undertake simple yet effective procedures to reduce harm to the public in the event of an attack. These could be as simple as training staff to lock doors, close shutters and identify a safe route to cover.

Enhanced tier requirements

The enhanced tier will apply to premises and public events with a reasonable expectation of a capacity exceeding 800 individuals, given the devastating impact an attack could have in these spaces. These locations will need to put in place both public protection procedures and additionally public protection measures aimed at reducing the risk and vulnerability of premises and events to acts of terrorism.

The role of the regulator

The Regulator will be the Security Industry Authority. Those within scope of the duty will have to register with the Regulator and, in the case of enhanced tier duty holder, submit their plans and associated documents.

Why is this necessary?

Many will be asking why this is necessary? For many years the Police have held a concern that there is too much expectation placed upon them to keep the public safe from terror attacks. The Manchester Arena attack placed sharp focus upon this issue.

Lessons from the Manchester Arena attack

The stark conclusion from the Vol.1 report of the Manchester Arena Inquiry is that the Manchester Arena were not adequately prepared or equipped to respond to a terror attack on their premises. That was despite engagement with Greater Manchester Police and the Greater Manchester Resilience Forum.

Failures in risk assessment and surveillance

In the case of the Arena attack, everything went wrong in their preparation and, in particular, the risk assessment process. That risk assessment was flawed and could only ever produce an outcome that a terror attack was low risk. The national threat level on 22 May 2017 was SEVERE, meaning that an attack was highly likely to take place.

Experts advising the Inquiry noted that there had been a failure to consider pushing out the security perimeter to prevent those intent on hostile acts being able to bring large bags into crowded areas.

Security gaps and missed opportunities

There were gaps in CCTV coverage which the bomber Salman Abedi had spotted. Those gaps in coverage enabled him to hide before carrying out his attack.

The CCTV operators had not detected hostile reconnaissance conducted by Salman Abedi in the days preceding the attack.  The purpose of such reconnaissance was to plan the attack and to detect security weaknesses. 

Focus on revenue over safety

Arena security were criticised by bereaved families for having a focus on revenue protection and not event safety. Staff were not appropriately trained to deal with the possibility of a terror attack. One member of security staff who had been alerted to the suspicious behaviour of the bomber by a concerned member of the public failed to react to those concerns and valuable time was lost.

Inadequate compliance and first aid provision

There had been failures to comply with licensing conditions relating to both use and monitoring of CCTV, premises security and first aid.

The first aid provision was woefully inadequate, unsuitable and unqualified to respond to the types of devastating blast injuries which so many victims experienced. A critical recommendation of the Chairman of the Inquiry is to ensure that venues like the Manchester Arena have appropriately trained medical staff capable of the triage and treatment of such catastrophic blast injuries, where time is of the essence.

Driving change through legislation

The failures of the Manchester Arena were by no means the only failings which contributed to those devastating events but they are perhaps the best example of matters which this legislation seeks to address. The Government know that, despite efforts to the contrary, the preparedness of organisations with public premises, or those who host events, is patchy and inconsistent. They strive to introduce minimum standards.

Preparing for compliance and the role of insurers

As insurers come to terms with the imposition of a new duty upon so many of their customers it will be incumbent upon those organisations to demonstrate their preparedness for the task that they are expected to meet. Compliance with Martyn’s Law obligations will take a good deal of preparation, especially for those organisations in the enhanced tier who may need to seek external input and expertise when assessing their public protection measures. Organisations will need to identify which premises are in scope and which tier applies. The Responsible Person will also need to be identifiable and accountable to the Regulator; the Security Industry Authority.  

Defining the responsible person

Large premises and public events will often have more than one Responsible Person, perhaps charged with responsibility to discharge a specific function such as event security. It is vital that duty holders work closely to deliver a consistent and coherent response to the threat of a terror attack taking place on, or close to their premises.  

The role of legal advisors

Inevitably solicitors will also eye up their role in the process, whether that is advising upon the suitability of contractual provisions such as indemnities, or representing the interests of their customers in proceedings before the Regulator.

Looking ahead: Martyn’s Law becomes reality

There is much work left to do but no one should be in any doubt now that Martyn’s Law will become a reality.