Martyns Law 2026 – What UK Event Organisers Must Know

If you organise events in the UK — concerts, festivals, corporate conferences, sporting fixtures, community fairs — there is a new law coming that will directly affect how you plan and run them.

It is called Martyn’s Law, formally the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025, and enforcement is expected to begin in spring 2027. That leaves roughly one full event season to get ready.

This is not a distant policy conversation. The Home Office published its statutory guidance on 15 April 2026, and the Security Industry Authority (SIA) has been confirmed as the regulator. The SIA’s own enforcement guidance is due in autumn 2026.

Here is what you need to know, in plain English, without the legal jargon.

Martyn’s Law requires public venues and event organisers to prepare for terrorist threats and take steps to protect people on site. It places a legal duty on anyone responsible for a qualifying premises or event to have documented counter-terrorism procedures in place.

The law is named after Martyn Hett, one of 22 people killed in the Manchester Arena bombing in May 2017. His mother, Figen Murray OBE, campaigned for years to ensure that venues and events would never again be left without basic protective measures.

The key principle is proportionality. A community hall hosting 250 people will not face the same requirements as a 10,000-capacity festival. But both need to show they have thought about the risk and prepared for it.

Around 155,000 standard-tier and 25,000 enhanced-tier premises are expected to fall within scope across the UK.

This is where most organisers get confused, because the Act treats premises and events differently. Getting this right is the foundation for everything else.

If you operate a venue (qualifying premises)

The test is whether it is reasonable to expect 200 or more people to be present at the same time, including staff, and the premises is used for an activity listed in the Act.

• Standard tier: 200 to 799 people. Most mid-sized venues sit here — community halls, bars, hotels, mid-capacity venues, schools and colleges.
• Enhanced tier: 800 or more people. Larger venues, arenas, stadiums, major exhibition spaces.

One nuance worth knowing: if a venue that would normally sit below a threshold hosts events that push it over from time to time, even occasionally, it can be drawn into scope under the relevant tier.

Education settings are an exception. Where they meet the 200 threshold they remain in the standard tier regardless of capacity, so schools do not get pulled into enhanced tier duties.

If you organise an event (qualifying event)

A standalone event is treated differently, and there is no standard tier for events. A qualifying event is always enhanced tier, and it must meet all of these conditions:

• 800 or more people reasonably expected present at the same time
• It is accessible to the public
• There are measures to control access, such as ticket checks or taking payment
• It is not taking place at premises already in the enhanced tier
• The location is not otherwise excluded from the Act

So a 400-person corporate function held as a standalone event is not a qualifying event. But if you hold it in a venue that is itself standard tier, the venue’s obligations still shape how your event runs — and your contract will usually pass those requirements down to you.

The practical takeaway: check both tests. Ask what your headcount at peak is, and ask what the venue’s own status is.

Standard tier duties (200 to 799 premises)

Compliance means putting four public protection procedures in place. These are designed to be achievable without specialist consultants.

You need a procedure for evacuation, getting people out of the premises. A procedure for invacuation, bringing people in and away from the threat. A procedure for lockdown, securing the site. And a procedure for communication during an incident.

You must also notify the SIA that you are responsible for qualifying premises.

That is the core of it. No written risk assessment is legally required at standard tier. No named compliance officer. No physical security measures like barriers or searches. The emphasis is on awareness, planning, and being able to act.

Enhanced tier duties (800+ premises and all qualifying events)

On top of the four procedures, enhanced tier duty holders must also:

• Produce a written terrorism risk assessment
• Appoint a named senior individual responsible for compliance
• Prepare a compliance document and provide it to the SIA on request, along with risk assessments and training records
• Consider physical protective measures: access control, search arrangements, hostile vehicle mitigation, monitoring of the premises and the immediate vicinity, and protection of sensitive information about the site

This is where professional event security planning stops being optional. If you are running a festival, stadium fixture or major public event, you need a security partner who understands both the operational requirements and the documentation the SIA will expect.

3 April 2025 — Royal Assent. Martyn’s Law is now on the statute book, but duties are not yet enforceable.

10 April 2026 — Section 27 commenced, giving the Home Office power to issue statutory guidance.

15 April 2026 — Home Office publishes final statutory guidance. SIA launches public consultation on its regulatory approach (closed 12 June 2026).

Spring 2027 (expected) — Enforcement begins. Legal duties become enforceable. The SIA’s regulatory function goes live.

The 2026 season is effectively the dry run. Organisers who start preparing now will be ahead of the curve. Those who wait until enforcement begins will be scrambling — and potentially facing penalties.

The 2026 season is effectively the dry run. The SIA is recruiting for the role and is expected to begin with an advisory posture before moving to active compliance. Organisers who prepare now will be ahead. Those who wait will be scrambling.

What happens if you do not comply?

The penalties are set out in the Act.

For standard tier premises, breaches carry a maximum penalty of £10,000. For enhanced tier premises and qualifying events, the maximum is £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000 for continued non-compliance.

The SIA also has powers to issue compliance notices and restriction notices.

For most event organisers, the reputational risk matters as much as the financial one. Being seen to have ignored a legal duty to protect your attendees is not something any event brand can carry.

A note on who holds the duty

The legal duty sits with the person or organisation in control of the premises or event, not with your security contractor. Responsibility follows control, not ownership.

But in practice you cannot evidence compliance without your security provider’s records. The briefing sign-offs, SIA licence verification, stewarding headcounts at each entrance, patrol logs and incident reports all feed into your compliance file. Your provider’s paperwork becomes your paperwork. If they cannot produce it as a matter of routine, that is a gap you want to find now.

How K4 Security can help you prepare

K4 Security has delivered event security services across the UK for over 10 years. We hold an SIA Approved Contractor Scheme score of 92, placing us in the top 5% of UK security providers, and we are already supporting event organisers with Martyn’s Law readiness.

• Counter-terrorism risk assessments. Our consultancy team produces written assessments covering threat identification, vulnerability analysis and protective measures tailored to your venue and event type. See our event consultancy service and event risk assessment.
• Public protection procedures. We help you develop and document evacuation, invacuation, lockdown and communication procedures aligned with the Home Office statutory guidance.
• Access control and search operations. Our SIA-licensed event security officers deliver bag searches, ticket verification and perimeter control.
• Hostile vehicle mitigation planning. We advise on barrier placement and vehicle access design as part of your risk assessment.
• Crowd management under threat conditions. Our crowd management teams are trained for evacuation, invacuation and crowd movement during security incidents.
• CCTV and monitoring. We deploy rapid CCTV control rooms for real-time monitoring of the site and immediate vicinity.
• Documentation for the SIA. All our event security planning produces documentation designed to demonstrate compliance to the regulator.

Work out which test applies. Are you a premises, an event, or both? Count your peak headcount including staff. If you are a venue at 200+, you are in scope. If you are a standalone event at 800+ with controlled entry, you are enhanced tier.

Read the statutory guidance. The Home Office published it on 15 April 2026. It is the definitive document on what the law expects, and the government has been clear that you do not need to buy consultancy to comply at standard tier.

Review your existing security plan. If you already work with a professional provider, much of what Martyn’s Law requires may already be happening. The gap is usually documentation, not practice.

Talk to your security provider. Ask specifically about Martyn’s Law readiness and whether they can supply compliance evidence as standard. If they cannot answer, find one who can.

Start documenting now. Even informal procedures need writing down. The SIA will want evidence, not intentions.

Watch for the SIA’s final guidance in autumn 2026. That document will set out exactly how the regulator intends to enforce.