Martyn's Law: Your Pub or Restaurant Needs a Terrorism Preparedness Plan. Most Operators Don't Know This Yet.

Most pub owners think Martyn's Law doesn't apply yet. They're right that enforcement isn't until 2027. They're wrong that it doesn't need attention now. Here's why waiting 12 months is the mistake.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The compliance deadline is expected in the 2027–2028 window — the Home Office will publish statutory guidance in 2026, after which the SIA will consult on its own enforcement guidance before the commencement date is confirmed. That window closes faster than you think, and the businesses that leave it until enforcement begins will face the same scramble that hit everyone when GDPR came into force in 2018.

If you run a pub, restaurant, hotel, event venue, or any premises where 200 or more people can gather at any time, this law applies to you — and the clock is already running.

---

What Is Martyn's Law?

Martyn's Law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena bombing in 2017. The legislation was championed by his mother, Figen Murray, and passed into UK law after a multi-year campaign.

The Act creates a legal framework requiring venues and public spaces to have terrorism preparedness measures in place. For the first time, it places a formal legal duty on venue operators — not just large stadiums or government buildings, but ordinary pubs, restaurants, and event spaces used by the public every day.

The regulator is the Security Industry Authority (SIA).

---

The Two Tiers: Which One Applies to You?

The Act divides premises into two tiers based on capacity.

Standard Tier — 200 to 799 people

This is where most hospitality businesses sit. If your pub garden fills up on a Friday night, your restaurant takes large bookings, or your hotel hosts events — you may be Standard tier.

What Standard tier requires:

• A written terrorism preparedness procedure — a documented plan for what your staff do if there is a terrorist attack at or near your premises
• Staff terrorism awareness training — all customer-facing staff must be trained on the procedure
• A designated responsible person — someone at the venue who owns the plan and ensures training happens
• Record-keeping — evidence that training has been completed

The Standard tier is deliberately designed to be proportionate. It is not asking you to install airport-style security. It is asking you to have a written plan and trained staff. That is the entire requirement.

Enhanced Tier — 800+ people

Large venues — stadiums, arenas, major conference centres — fall into Enhanced tier. This requires full security plans, trained security personnel, physical security measures, and regular reviews. Most pub, restaurant, and hotel operators will not reach this threshold.

---

Why "Not Until 2027" Is the Wrong Way to Think About This

The implementation period exists to allow businesses to prepare. It does not mean you should begin in 2026.

Here is why starting now matters:

1. The designated responsible person must be trained. The SIA is expected to publish approved training pathways before the compliance deadline. If you wait until early 2027, you may find training providers oversubscribed and waiting lists that stretch past the deadline.

2. Your staff turnover creates a continuous obligation. Once the law is in force, your terrorism preparedness training must be current for all staff. If you build your programme now, you can integrate it into onboarding. If you build it in March 2027, you are doing emergency remediation while running a business.

3. The SIA has enforcement powers. The Act gives the SIA authority to issue compliance notices, monetary penalties, and — in serious cases — prohibition notices that can close your venue. Getting this wrong is not a theoretical risk.

4. Your premises insurance may require it. Several commercial insurers in the hospitality sector are already moving to require evidence of terrorism preparedness documentation as a condition of cover. This is a market trend that will accelerate as the deadline approaches.

---

The Hospitality-Specific Risk

Pubs, restaurants, and hotels are explicitly referenced in the SIA's draft guidance as typical Standard tier premises. The reason is straightforward: they are open to the public, often crowded, and have staff who interact with members of the public throughout the day.

The Manchester Arena attack targeted a public entertainment venue. The 2017 London Bridge attack targeted restaurants and bars in Borough Market. The terrorism risk to hospitality venues is not abstract — it is the precise risk that Martyn's Law was designed to address.

The practical reality for most hospitality operators is that the terrorism preparedness procedure will be relatively short — a page or two covering:

• Who is the responsible person
• What the evacuation procedure is in an emergency
• What staff should do if they see something suspicious
• How to communicate with emergency services
• Where the assembly point is

You almost certainly have some version of this in your fire safety plan already. Martyn's Law asks you to extend it specifically to terrorism scenarios. That is genuinely not a large lift — but it has to be done correctly and documented.

---

What You Should Do Now (April 2026)

Step 1: Establish whether you are in scope. Calculate the maximum number of people who can be present on your premises at any time — staff and customers combined. If that number reaches 200, you are in scope.

Step 2: Identify your responsible person. Under Standard tier, you need a named individual responsible for the terrorism preparedness procedure. This can be the owner, manager, or a senior member of staff. Make that decision now so they are available for training when SIA-approved pathways are published.

Step 3: Begin drafting your procedure. Even before final SIA guidance is published, you can draft a first version. Review your fire evacuation procedure and extend it to cover a terrorist incident scenario. The SIA's consultation documents give a clear indication of what will be required.

Step 4: Plan your staff training schedule. With typical hospitality turnover, training all customer-facing staff will take time. Start thinking about how you will deliver it — whether through in-person sessions, online training, or induction integration.

Step 5: Monitor SIA guidance. The SIA will publish approved training providers, template procedures, and definitive guidance before the compliance deadline. Subscribing to regulatory monitoring (such as ComplianceAlert) ensures you receive SIA updates the day they are published, without having to check manually.

---

The Competitive Advantage of Early Compliance

There is a reputational and commercial dimension to Martyn's Law that most operators have not yet considered.

Customers are increasingly choosing venues based on safety credentials. The post-pandemic shift toward transparency means that a pub displaying its Martyn's Law compliance — trained staff, published procedure — may be preferred over one that has not. Large corporate event bookings, in particular, are increasingly asking venues about safety and security protocols as part of procurement decisions.

Being Martyn's Law compliant from 2027 will become table stakes. Being Martyn's Law compliant from 2026 — ahead of the deadline — is a genuine differentiator.

---

Frequently Asked Questions

Does Martyn's Law apply to my beer garden? The capacity calculation includes all areas of your premises — indoor and outdoor — where the public can gather at the same time. A beer garden or outdoor terrace that is open to the public counts toward your total capacity.

What if I have multiple venues? Each venue is assessed individually. If you operate a chain of pubs, each location is separately in scope if it meets the capacity threshold.

Is there a fine for non-compliance? Yes. The SIA has powers to issue monetary penalties under the Act. The specific fine levels will be set in secondary legislation, but the enforcement framework mirrors other SIA licensing regimes.

Do I need to register with anyone now? Not yet. The SIA is expected to open a premises registration system as part of the implementation process. ComplianceAlert will alert subscribers when registration opens.

My pub has a capacity of 150. Am I in scope? Not for Standard tier. The threshold is 200 people. However, if you ever hold events that bring your total over 200 — including staff — you may be in scope for those events.

---

Summary: What ComplianceAlert Monitors for You

ComplianceAlert tracks SIA guidance updates, Martyn's Law secondary legislation, and implementation timeline announcements — so you receive a plain-English alert the moment anything relevant is published, rather than discovering a compliance deadline has moved when it is too late.

The 24-month implementation window is sufficient to prepare. It is not sufficient to ignore.

---

Start your free 7-day trial — no credit card required: compliancealert.co.uk/hospitality

Not sure if your business is compliant? Take our free 3-minute Compliance Score quiz — instant results, no sign-up required: compliancealert.co.uk/compliance-score

---