Martyn’s Law and venue insurance: duties, tiers and cover
What the Act requires: a verified summary
The Act applies to premises where 200 or more individuals — including staff — may reasonably be expected to be present at the same time. From 200 to 799, premises fall in the standard tier: the responsible person must notify the regulator (the Security Industry Authority) and put in place appropriate, reasonably practicable public protection procedures — broadly, plans for evacuating people, moving them to safety within the building, locking down and communicating during an attack. The standard tier does not mandate physical alterations or equipment.
Where 800 or more individuals may reasonably be expected, premises fall in the enhanced tier: on top of procedures, the responsible person must take appropriate measures to reduce both the premises’ vulnerability to attack and the risk of physical harm, and must document those procedures and measures for the regulator. Certain large events are brought into scope on the same 800-person footing. The SIA will investigate and enforce non-compliance.
When it bites
At the time of writing the duties are not yet in force. Royal assent was April 2025 and government has signalled at least twenty-four months of lead time, which is why venues are being encouraged to use 2026 to prepare rather than wait. Commencement dates and final guidance can move — before treating any date as fixed, check the current commencement position. Nothing in this page is legal advice on compliance; our territory is what the new regime means for cover.
What preparation looks like, broadly
For most standard-tier venues the work is organisational: establish honestly how many people can be present at once (the figure includes staff, and it is about reasonable expectation, not licensed capacity alone), designate who the responsible person is, write the procedures, train the people who would carry them out, and record all of it. Enhanced-tier premises add security measures and formal documentation. Much of this resembles what fire safety planning already looks like — which is also a fair preview of how insurers will come to view it.
The insurance angle: three covers, three different jobs
Terrorism cover
Standard commercial property and business interruption policies exclude terrorism. Cover is bought back either through the long-standing government-backstopped reinsurance scheme — Pool Re — via participating insurers, or in the standalone terrorism market, which can offer more flexibility on what is covered, including non-damage denial of access in some forms. The new duties do not require any venue to buy terrorism insurance. But a venue that has just formally assessed itself as a place where hundreds gather — and therefore a conceivable target — has, in the same breath, described its own uninsured exposure if terrorism cover has been declined as an economy. Our page on terrorism insurance covers the buying routes in detail.
Public liability
Injury claims by visitors following an attack would look to the venue’s public liability cover, and such claims typically turn on whether the venue took reasonable care. Once the Act is in force, the procedures it requires are likely to become the practical yardstick: a venue that can show compliance has strong evidence of reasonable care, while one that ignored a statutory duty hands a claimant’s lawyer their opening argument. Expect liability insurers, over time, to ask about protect-duty compliance the way they already ask about fire risk assessments — and answer accurately, because those answers form part of the presentation of the risk.
Event cancellation
Cancellation and abandonment cover for events held at a venue standardly responds to perils like weather or venue damage — and standardly excludes terrorism unless the extension is bought. An attack, a credible threat, or a police cordon nearby can all stop an event with no damage to the venue itself. Whether that loss is insured depends entirely on whether the terrorism and threat extensions were purchased. The new regime does not change the wordings; it changes how foreseeable the gap looks.
Compliance is not insurance — and insurance is not compliance
The two systems answer different questions. Complying with the Act reduces the risk of harm and of enforcement; it does not pay for a cancelled event, a damaged building or a liability claim. Insurance pays money when defined events happen; it does not discharge a single statutory duty, and no policy makes a venue “Martyn’s Law compliant”. A venue in scope needs both conversations — one with whoever leads its security planning, one with its broker — and the second is materially easier once the first has happened, because the same capacity figures, procedures and documentation are exactly what a well-presented insurance submission is built from.
Frequently asked questions
Is Martyn's Law in force now?
Not yet, at the time of writing. The Act received royal assent in April 2025 and government has indicated an implementation period of at least twenty-four months, with the SIA being established as regulator in the meantime. Venues are being encouraged to prepare now — but check the current commencement position for dates.
Does my venue need terrorism insurance to comply with Martyn's Law?
No — the Act requires procedures and, for larger premises, protective measures. It does not require any insurance purchase. The honest framing is different: the assessment the Act forces you to make is also an assessment of what an uninsured terrorism loss would do to the business, which is why the two conversations belong together.
How is the 200-person threshold counted?
It is based on the number of individuals, including staff, who may reasonably be expected to be present at the same time — a practical expectation test rather than simply the licensed capacity. Establishing that figure honestly is the first compliance step, and it is the same figure your insurance programme should be built around.
Would public liability insurance respond to injuries in a terrorist attack?
Visitor injury claims against a venue would normally engage public liability cover, and typically turn on whether the venue took reasonable care. Policies and their terrorism-related terms differ, so this is a wording question to resolve with your broker in advance rather than assume — and once the Act is in force, documented compliance will be central evidence of reasonable care.
Will complying with Martyn's Law reduce our premiums?
No promises — pricing depends on the whole risk and the market. What is reasonable to say is that insurers reward well-evidenced risk management, and the capacity assessments, procedures and documentation the Act requires are precisely the material that makes a venue submission credible. Some insurers may in time ask about compliance directly.
Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This page is general information, not advice on a specific policy.