Martyn’s Law

Martyn’s Law: what it means for your premises and your cover

Martyn’s Law — the Terrorism (Protection of Premises) Act 2025 — places a legal duty on venues and events to be ready for a terrorist attack. It reaches far wider than arenas and stadiums: hotels, sports grounds, wedding and function venues, visitor attractions, village halls and places of worship can all be in scope. This guide explains who it covers, what each tier must do, the penalties for getting it wrong, and the one thing it does not do — make you insured.

Part of: Commercial insurance at Apex

What Martyn’s Law is, and when it starts

Martyn’s Law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. Its formal name is the Terrorism (Protection of Premises) Act 2025, and it creates a duty to prepare. The person responsible for a venue does not have to predict an attack or judge how likely one is at their site; they must have worked out in advance what staff would do if an act of terrorism happened at or near the premises, and made those plans workable.

The Act received Royal Assent on 3 April 2025, and the Government committed to an implementation period of at least 24 months, so it is expected to come into force in spring 2027, with the exact date confirmed nearer the time. Statutory guidance has already been published, so duty holders have a settled picture of what compliance looks like well before the duties bite. Everything the Act requires is qualified by what is reasonably practicable — proportionate to the premises, taking account of cost, time and how difficult a step would be.

Which premises are in scope, and the two tiers

Martyn’s Law applies to premises that are a building (or a building with land), used wholly or mainly for one of 17 purposes listed in the Act, where it is reasonable to expect 200 or more people present at the same time from time to time, and which are not otherwise excluded. Those 17 categories are far wider than the arenas the public debate focuses on. They include shops, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels and places of worship, health care, bus and railway stations, aerodromes, childcare, schools, further and higher education, and public authorities. A mid-sized restaurant, a village hall, a wedding venue or a garden centre can all qualify.

Which tier you fall into depends on how many people may be present at once.

One important carve-out: places of worship remain in the standard tier even where 800 or more people may be present, in recognition of their open-access nature. Premises already covered by other security legislation, open-air recreation sites with no access control, and Parliament and the devolved legislatures are excluded altogether.

What standard-tier premises must do

The standard tier is the one most hotels, function rooms, clubs and mid-sized venues will fall into. It is a procedural tier, built around planning and staff awareness rather than equipment spend. The responsible person must notify the SIA and have in place — so far as is reasonably practicable — appropriate public protection procedures of four kinds:

• Evacuation — getting people out of the premises safely.
• Invacuation — bringing or keeping people safe inside, away from a threat outside.
• Lockdown — securing the site to stop a threat getting in.
• Communication — getting the right information to staff and the public quickly.

What the standard tier does not require is just as worth knowing. The statutory guidance confirms there is no obligation to carry out a formal risk assessment or to install physical security measures. For most venues, compliance is about having thought it through and trained the team — not about spending on hardware.

What enhanced-tier premises and events must do

The enhanced tier applies to the largest venues, where 800 or more people may be present, and to qualifying events where 800 or more may reasonably be expected at once. These duty holders do everything the standard tier requires and then add public protection measures aimed at reducing the vulnerability of the premises or event to an attack. The guidance groups them under four headings:

• Monitoring — how the site and its surroundings are watched.
• Movement — how people enter, leave and move around the site.
• Physical safety and security — the physical measures that protect people.
• Information security — protecting information that could help an attacker.

Enhanced-tier duty holders must also document their procedures and measures, set out in an assessment how these reduce the premises’ vulnerability, and submit that assessment to the SIA. This is where Martyn’s Law moves from planning to evidenced, written provision.

Enforcement and penalties

The regulator is the Security Industry Authority (SIA), which will work through desk-based assessments and on-site inspections on a risk-based approach informed by intelligence. Where it finds a failure, it can issue compliance notices, restriction notices and penalty notices.

The financial penalties are set in the Act, and are significant at the top end:

• Standard tier: a maximum penalty of £10,000.
• Enhanced tier and qualifying events: the greater of £18 million or 5% of the responsible person’s qualifying worldwide revenue for their most recent complete accounting period.

These are ceilings rather than automatic fines, and the SIA has signalled a proportionate, advice-led approach in the early period. But the scale of the enhanced-tier figure is a clear statement of how seriously the duty is meant to be taken — and a reason to get the groundwork right before commencement.

Where insurance fits — and where it does not

Martyn’s Law does not require you to buy insurance, and no policy makes a venue compliant. The duties are operational: you meet them by planning, training and — at the enhanced tier — documented measures. Insurance sits alongside that work, not in place of it, and anything sold to you as “Martyn’s Law insurance” is misdescribed. With that said, preparing for the duty is a natural moment to check that your cover actually responds to the event it concerns:

• Liability. If someone is injured at your premises and alleges your arrangements fell short, that is a liability claim — and public liability insurance is the cover built to respond. Your documented Martyn’s Law procedures are useful evidence in defending one.
• The fines themselves are different. Regulatory penalties are generally not insurable — a liability policy is not intended to pay a fine, and insurers usually exclude them. What cover can sometimes help with is the legal cost of responding to a regulatory investigation, subject to the policy wording.
• Business interruption. If an incident, at your site or nearby, stops you trading, lost income falls to business interruption insurance, and damage to the building to commercial property insurance.
• Terrorism cover is usually separate. This is the one that catches venues out: standard property and business interruption policies commonly exclude terrorism, with cover provided by a separate extension, often through the government-backed Pool Re scheme. Many venues discover the gap only when they start asking. See terrorism insurance.

The uncomfortable truth is that the incident Martyn’s Law prepares you for is often the one your property policy excludes — and you find out which only when you look. Preparing for spring 2027 is the sensible moment to read the duties and your cover together.

Related

• Boutique hotel insurance (South West)
• Wedding & function venue insurance (South West)
• Sports club and ground insurance
• Terrorism insurance explained
• Care home insurance (South West)
• Commercial insurance at Apex

Why use a specialist broker, and why Apex

A non-standard or high-value commercial risk is advice-led. A specialist broker searches the market rather than one insurer’s panel, presents the risk properly — which matters under the Insurance Act 2015 duty of fair presentation — and gets the details that decide a claim right. Buying a packaged policy direct can be fine for a simple, standard risk; for the risks on this page it rarely is.

Apex Insurance Brokers is an independent commercial insurance broker established in 2009 and based in Bristol, owned entirely by its directors and directly authorised by the FCA since 2016. We are not tied to any single insurer or scheme, we do not run our own policy or underwriting, and we have no placement quotas. We have access to over 30 markets, including Lloyd’s syndicates via wholesale, which is what lets us place a non-standard, high-value or hard-to-place risk that a packaged insurer might decline. We usually return three or four competing quotes set out so you can compare them like for like, every client has a named broker from first quote to renewal, and every claim gets director-level attention rather than a call-centre queue.

• Owned by its directors, not for sale. No consolidator, no private-equity owner, no external shareholders. Read the Apex Independence Charter.
• Independent, not tied. No single-insurer scheme, no in-house policy, no placement quotas — the recommendation is the one that fits, not the one we are paid to push.
• Over 30 markets, including Lloyd’s via wholesale. So a non-standard, high-value or hard-to-place risk that one underwriter dislikes can still be placed properly with another.
• Usually three or four competing quotes, laid out side by side — sums insured, cover basis, excesses, exclusions and premium — with a plain-language note on the trade-offs.
• A named broker all year. The person who places the cover is the person who picks up the phone at renewal, on a mid-term change, or when a claim lands.
• Director-level attention on claims. A serious loss is handled by someone senior who stays involved, not a call-centre queue.
• Directly authorised by the FCA since 2016, not an appointed representative trading under someone else’s permissions.

What happens when you get in touch

• A named broker reads it, not a call centre — the same person from first quote to renewal.
• We search the market for you — over 30 insurers including Lloyd’s via wholesale — and set the quotes out to compare like for like.
• If your current cover is already right, we tell you in writing, free and without obligation — the stay-put letter.
• No obligation and no pressure. You get a clear recommendation and decide in your own time.

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.