Preparing for Martyn’s Law: What Businesses Must do to Ensure Public Safety

September 2025, Ben Harris, Partner

Published on: IOSH Magazine

Read the Article

The new Martyn’s Law requires UK venues to adopt proportionate security measures – from staff training and evacuation planning to access controls and surveillance. Former Special Forces and Royal Marine Commando Ben Harris warns that compliance is only the starting point; true protection comes from embedding a culture of preparedness through leadership, drills, and layered security. Going beyond the legal minimum is key to safeguarding staff, visitors, and public trust.

With the imminent enactment of Martyn’s Law (the Terrorism [Protection of Premises] Act 2025), which received Royal Assent earlier this year, UK businesses, particularly those operating public venues, are facing a pivotal moment in elevating their approach to security and preparedness. 

The legislation, named in memory of Martyn Hett, who tragically lost his life in the 2017 Manchester Arena bombing, aims to ensure that venues are equipped to prevent, prepare for, and respond to terrorist threats. For businesses, this is more than a legal obligation; it is a responsibility to safeguard staff, visitors, and the wider public.

Martyn’s Law is likely to impact a wide range of venues, including large-scale concert arenas, theatres, sporting stadiums, shopping centres, hospitality venues, museums, galleries, cinemas, and even smaller public spaces such as community centres or local pubs with live events. While the law introduces clear requirements, its ultimate goal is to encourage a culture of vigilance and preparedness that extends across the public and private sectors.

Understanding the requirements of Martyn’s Law

Martyn’s Law introduces a tiered approach to compliance based on venue size, capacity, and risk profile. Smaller venues, such as boutique cinemas or community theatres, will need to implement straightforward measures: staff training, clear evacuation procedures, and basic incident response planning. For these venues, the focus is on awareness and preparedness, ensuring that employees know how to act in a crisis.

The legislation establishes two tiers of assessment – standard and enhanced – depending on venue size and capacity. These assessments determine the scale of protective measures required.

Martyn’s Law represents a significant evolution in public safety obligations. From community halls to major international airports, a proactive, structured approach to security and incident response is essential

Larger venues, such as stadiums, concert arenas, and major shopping centres, will be required to carry out more detailed risk assessments and implement comprehensive protective measures. These may include controlled access points, hostile vehicle mitigation, enhanced surveillance, and coordination with local emergency services. The key principle is proportionality: security measures should be tailored to the size, layout, and operational complexity of the venue without creating an environment that feels unwelcoming or oppressive for visitors.

It is also worth noting that the Security Industry Authority (SIA) will have an important role in the regulation and enforcement of Martyn’s Law. However, the SIA has yet to issue formal guidance, and businesses should keep abreast of future updates from the Home Office.

Compliance is the baseline, not the endpoint

It is important to recognise that meeting the legal minimum is only the starting point. Martyn’s Law sets the floor for safety, not the ceiling. Organisations that adopt a proactive approach to integrating security into the core of their operations will be better placed to protect people and maintain public confidence.

For example, a medium-sized theatre may comply by training staff on evacuation procedures, but a proactive approach might involve conducting regular scenario-based drills, engaging with local police on emergency planning, and implementing visitor communication strategies during incidents. Similarly, a shopping centre could go beyond compliance by reviewing parking layouts to minimise vehicle-based threats or by providing staff with situational awareness and de-escalation training.

The distinction is simple: compliance protects legally; preparedness saves lives and preserves reputation. 

Embedding a culture of preparedness

A culture of preparedness begins with people. Frontline staff are often the first line of defence, and their actions during a critical incident can make the difference between life and death. Employees need training in recognising suspicious activity, understanding evacuation routes, and reacting calmly and decisively under pressure.

Leadership commitment is equally critical. Managers and directors must prioritise security as an operational value, ensuring that staff feel supported and confident in their roles. This commitment extends to the continuous review of procedures, investment in training, and fostering open communication channels so that concerns can be raised and addressed promptly.

Regular drills and exercises are essential. These simulations allow teams to test their responses, identify gaps in planning, and improve coordination. Drills should cover multiple scenarios, from active threats inside a venue to emergencies involving vehicles or bomb threats. Importantly, exercises must be realistic but safe, striking a balance between stress-testing staff and avoiding unnecessary alarm.

Proportionate, practical security measures

MI5, The Security Service, identifies current UK threat levels as significant. And while there is a 24-month implementation period extending to April 2027, an attack could occur at any time. Terrorism will not wait for organisations or venues to be fully prepared. This reality underscores the urgency of moving beyond compliance timelines and embedding resilience measures as quickly as possible.

Protective measures under Martyn’s Law should be layered and tailored to the unique risks of each venue. Measures may include:

• controlled access points: ticketed entry, ID verification, and bag checks to manage who enters the venue;

• surveillance and monitoring: CCTV systems that cover entrances, exits, and key public areas, supported by trained operators;

• hostile vehicle mitigation: barriers, bollards, or landscaping to prevent unauthorised vehicle access at large-scale events;

• emergency communication systems: clear signage, PA systems, and digital notifications to inform visitors in real-time; and

• staff positioning and patrolling: visible security presence to deter potential attackers and reassure the public.

  
  

The goal is to implement reasonable measures that protect visitors and staff without compromising the experience. For example, in a museum or gallery, unobtrusive security and careful staff placement can maintain an open and welcoming environment while mitigating risks. In contrast, a football stadium may require visible barriers, bag searches, and crowd management strategies to ensure safety without hindering entry or enjoyment of the event.

Lessons from operational expertise

Drawing on experience in high-risk environments, organisations learn that preparedness is not just about equipment or procedures, it’s about adaptability. Threats are unpredictable, and response plans must be flexible. 

Scenario planning is invaluable: identifying potential threats and considering how each might unfold helps teams prepare practical responses. Equally, post-incident recovery planning ensures that venues can resume operations quickly and safely, minimising disruption to both staff and visitors.

Avella Security emphasises the importance of integrating these principles across all types of venues. While each space differs, ranging from community theatres to international airports, the underlying approach to threat assessment, staff training, and operational readiness is consistent.

Practical examples across venues

Concert arenas require robust crowd control, clear evacuation procedures, hostile vehicle mitigation, and coordination with law enforcement.

Stadiums and sporting venues need risk assessments for crowd density, emergency medical services, and access control for players and staff.

Shopping centres and retail parks should consider vehicle access points, CCTV coverage, and staff training for incident reporting.

Museums, galleries, and cultural venues benefit from discreet protective measures that safeguard visitors while maintaining accessibility and openness.

Community centres and smaller venues should focus on training, awareness, and simple, clear emergency procedures suitable for their scale.

Each example demonstrates how proportional security can be adapted to the type, size, and function of a venue. The principles remain the same: assess risk, train staff, implement practical measures, and embed preparedness into organisational culture.

Key takeaways for businesses

1. Identify your tier: understand how Martyn’s Law applies to your venue based on size, capacity, and risk.

2. Go beyond compliance: use the legislation as an opportunity to embed a culture of preparedness rather than just ticking a legal box.

3. Invest in staff training: employees are critical to both prevention and response; provide scenario-based drills and awareness programs.

4. Adopt proportionate security measures: tailor protective strategies to the unique risks of each venue.

5. Test and refine plans: regular drills and risk assessments ensure preparedness evolves with changing threats.

6. Plan for post-incident recovery: effective recovery strategies minimise disruption and help maintain public trust.

   
   

Martyn’s Law represents a significant evolution in public safety obligations. From community halls to major international airports, a proactive, structured approach to security and incident response is essential.

The organisations that prioritise preparedness, not just compliance, will be the ones that safeguard their people, maintain operational continuity, and set the standard for public safety in the UK.

Read Ben's previous article on safety at Notting Hill Carnival here.