Martyn’s law – new regulations obliging venues to introduce anti terrorism measures

I had the privilege of meeting Figen Murray last year and hearing directly from her about her unwavering courage and determination following the heartbreaking loss of her son, Martyn Hett, in the Manchester Arena attack in 2017. Figen has channelled her immense grief into a powerful and impactful campaign for change. Her steadfast commitment to public safety has been pivotal in the creation of Martyn’s law, which aims to enhance security measures at public venues and events across the UK. Through her advocacy, Figen has displayed extraordinary bravery and resilience, transforming a deeply personal tragedy into a mission that will protect countless lives in the future. Her story is a testament to the strength of the human spirit and the impact one individual can have on society.

The Terrorism (Protection of Premises) Bill, known as Martyn’s Law, is aimed at enhancing the UK’s preparedness for, and protection from, terrorist attacks. The legislation will require certain premises (including pubs, bars, clubs, restaurants, hotels, leisure spaces, shops and arenas) to take steps to prevent potential terrorism. The legislation is expected to receive Royal Assent this year and to come into force in 2026. The Government has issued a number of factsheets Terrorism (Protection of Premises) Bill 2024: factsheets - GOV.UK (www.gov.uk)

The Government has also committed to issuing guidance to assist those responsible for compliance before the legislation comes into force. We will provide updates when the guidance is published.

How will Martyn’s Law apply to the hospitality sector?

Premises will fall within the scope of the legislation if they are:

1. Premises as defined by the Bill; and
2. Wholly or mainly used for a qualifying activity (which are defined in Schedule 1 of the Bill); and
3. Meet the thresholds for individuals present at a premises.

Venues that are within the scope of the legislation will be required to provide better protection and training against potential terrorism threats across the United Kingdom.

Which premises are in scope?

Premises can consist of a building such as a pub, hotel or nightclub. The definition also covers buildings with land used for the qualifying activity of the building e.g. a pub beer garden or a hotel with grounds used for dining and events.

Is the premises mainly used for a qualifying purpose?

To be in the scope of the legislation, a premises must be used wholly or mainly for one or more of the uses set out in Schedule 1 of the Bill; including food and drink (principally consumed on the premises); nightclubs, hotels, entertainment activities, sports and leisure. More details will be contained in future guidance.

Does the premises meet the threshold for individuals present at the premises?

If it is reasonable to expect that, from time to time, there will be more than 200 people present at the premises at the same time, then the premises will fall within the scope of the legislation. Obligations depend on whether the business is a Standard or Enhanced Tier business. The legislation sets out ways of calculating a reasonable expectation of individuals present using methods such as safe occupancy for fire regulations, historic attendance data, fixed seating, licence or other restrictions.

See the factsheet here for more information on calculations:
Terrorism (Protection of Premises) Bill: Reasonable expectation of numbers of individuals present (formerly known as capacity calculations) - GOV.UK (www.gov.uk)

Who is responsible for complying with the requirements of the Bill?

The responsible person is the person who has control of the premises in connection with their qualifying use/s (e.g. the use of a building as a sports ground or a hotel). This will usually be the premises operator, e.g. if a person leases a building for retail use as a shop and is in control of the building for that use, they will be the responsible person.

If more than one person (including more than one company or organisation) is responsible for a qualifying premises or an event, they must, so far as is reasonably practicable, co-ordinate with each other in complying with the Bill’s requirements. If qualifying premises form part of other qualifying premises, they must, so far as is reasonably practicable, co-ordinate in complying with the Bill’s requirements.

Standard Tier

All premises with a capacity of 200 – 799 people will fall within the standard tier. This is likely to include many pubs, bars, hotels and some restaurants.

The Responsible Person must notify the SIA when they start and cease the role.
The responsible person must notify the Security Industry Authority (SIA) (the Regulator) when they start and cease the role.

The Responsible Person must notify the SIA when they start and cease the role.
Under the standard tier, the responsible person must implement reasonably practicable public protection procedures aimed at reducing the risk of physical harm to individuals if an act of terrorism were to occur at the premises or in the immediate vicinity.

The responsible person must first consider the different types of terrorist attack that might take place at their location and how procedures could help reduce harm in the event of such an attack.
Further guidance will be published to assist the responsible person.

The 4 types of procedures that must be put in place are:

• Evacuation - the process of getting people safely out of the premises or event
• Invacuation - the process of bringing people safely into, or to safe parts within, the premises or event
• Lockdown - the process of securing the premises or event to ensure that the entry of any attacker is restricted or prevented e.g. locking doors, closing shutters or using barriers
• Communication - the process of alerting people on the premises or event to move them away from any danger

The requirements of the legislation will be subject to the concept of “reasonably practicable”. You will be able to take into account the nature of your premises, available resources, etc. when fulfilling your obligations.

The Bill does not require physical alteration to the premises or purchase of equipment at standard duty premises, and staff will need to be trained to put the procedures into place.

Enhanced Tier

All premises and public events with a maximum capacity of 800 or more will fall within the enhanced tier. This is likely to include larger venues, including clubs and arenas. Those responsible for larger premises and events in the enhanced tier are required to do more in recognition of the potentially higher impact of a successful attack. All enhanced tier premises and events must comply with all requirements under the standard tier and must also put in place measures such as hiring security staff and installing CCTV.

If you only have control of part of a building i.e. a bar or restaurant in a bigger building complex, the person/business in control of your outlet will have a duty to cooperate with the operator of the building to fulfil their duties.

Temporary Events

If you are planning a temporary event with over 800 people, you must ensure the event compiles with Martyn’s Law. You will need to comply with the Enhanced Tier requirements even if your usual capacity is less than 799.

Enforcement and Sanctions

A new Regulator will be established through a new function of the SIA. The Regulator’s core activity will be to guide and advise businesses on complying with their obligations. The SIA will publish guidance to assist businesses and is likely to cover risk assessment and training. The Regulator will also have powers to inspect and enforce all requirements under both tiers.

Initially, a contravention or restriction notice will be issued for non-compliance. If the breach is not remedied, a fixed penalty fine (max £10,000) will be issued.

For the enhanced tier only, the Regulator can issue a maximum fixed penalty of the higher £18m or 5% of worldwide revenue. Criminal sanctions will also be available.

In the most serious cases, the premises may be shut down.

Costs of complying

The costs of complying with the new obligations should not be a huge burden for the sector. The main cost will be setting up the correct procedures and providing staff with the appropriate training. You are likely to have extensive health and safety policies in place already, meaning the new requirements will be an extension to these. For larger venues such as arenas, it is likely anti-terrorism policies are already in place, so these will need reviewing and aligning with the new requirements.

What should you be doing to get ready for the new regulations?