Martyn's Law Explained: What UK Hospitality Venues Need to Do in 2026
Last updated: April 2026
Martyn's Law isn't live yet. But pretending it is would be the smart move.
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The law is not yet in force - the government set a minimum 24-month implementation period, so enforcement is expected around April 2027 (Home Office factsheet).
That makes 2026 the preparation year. Twelve months to work out what your venue needs to do, train your teams, and build the systems before the clock starts.
Here's what hospitality operators need to know.
What is Martyn's Law?
The Act is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena bombing. His mother, Figen Murray, led the six-year campaign that got the law through Parliament.
The aim is simple: make sure venues and events in scope have basic, proportionate plans for what to do if the worst happens.
The Home Office and the Security Industry Authority (SIA) - the designated regulator - are publishing statutory guidance during the implementation period. That guidance will define the fine detail of what "reasonably practicable" means for different venue types (ProtectUK guidance hub).
Who does it apply to?
The Act sets up a two-tier system based on how many people your venue can reasonably be expected to host at any one time:
Standard tier: 200-799 capacity
Cafes, restaurants, pubs, mid-size hotels, small event spaces, retail premises. Expected to have basic public protection procedures.
Enhanced tier: 800+ capacity
Stadiums, arenas, large event venues, big hotels, major visitor attractions. Expected to have fuller security plans, risk assessments and documented procedures.
Out of scope: venues with a capacity under 200, and premises not used for one of the qualifying activities (which do include retail and hospitality).
Reality check on capacity: the number is the reasonable expected attendance at any one time, not your maximum licence. A 150-cover restaurant that never has more than 120 in at once is out of scope. A 250-seat event space with a 400-person standing capacity could land in either depending on typical use.
What do hospitality operators need to do?
Exact requirements will be set by SIA guidance during the implementation period. Based on the Act as passed, here's the shape of it:
Standard tier venues (200-799):
- Notify the SIA that the premises are in scope
- Have simple, appropriate public protection procedures covering: evacuation, invacuation (locking down inside), lockdown, and communication
- Make sure staff know the procedures
Enhanced tier venues (800+):
- Everything above, plus:
- A documented public protection plan with a risk assessment
- Measures covering monitoring, physical security, and incident response
- Appoint a responsible person
- Keep records the SIA can inspect
The emphasis throughout is "reasonably practicable" - the government has been explicit this isn't meant to be cost-prohibitive for small operators.
A realistic 2026 prep plan
You've got roughly 12 months. Here's a sensible path:
Q2 2026 - Scope it.
Work out which tier you're in, site by site. Note any edge cases (venues hosting occasional events that push capacity, for example).
Q3 2026 - Draft procedures.
Write the four core procedures: evacuation, invacuation, lockdown, communication. Keep them short and site-specific. A one-pager per venue beats a 40-page binder nobody reads.
Q4 2026 - Train.
Roll out the procedures to every team, every site. Don't treat it as a one-time module - embed into onboarding for new starters. The free ACT Awareness e-learning from ProtectUK is a sensible baseline for hospitality teams.
Q1 2027 - Audit and log.
Run a dry-run drill at each site. Log who was trained, when, and on what. Fix anything the drill exposed.
From April 2027 - Maintain.
Ongoing training, logs, and updates when sites change. This isn't a project. It's a new baseline.
The three mistakes operators are about to make
1. Waiting until 2027.
The prep period exists for a reason. Venues that leave it until enforcement starts will hit it cold, with no system, no training log, and no procedure documents. Audit risk and insurance risk both go up.
2. Over-engineering it.
Standard tier venues don't need a counter-terrorism consultant on retainer. The law is explicitly proportionate. A two-page site procedure and a trained team meets the bar.
3. Treating it as separate from existing compliance.
Martyn's Law lives alongside fire, food safety, allergens, EHO, licensing and health and safety. Operators running each of these on paper or in WhatsApp are going to drown. The venues winning at compliance run one system across all of it.
How Aquaint handles Martyn's Law prep
Aquaint is built for hospitality compliance as daily operations - not a once-a-year audit scramble. For Martyn's Law prep specifically:
- Recurring site risk reviews - schedule an annual Martyn's Law check per site with the right prompts built in
- Document library - upload your evacuation, invacuation and lockdown procedures per site, visible to every team member on shift
- Training records - log who's been trained on what, with expiry dates and automatic reminders
- Announcements - push procedure updates to every site, instantly
- Audit trail - every check, every training log, every document access, timestamped and exportable
- Multi-site oversight - see at a glance which sites are compliant and which have gaps
The whole point: when the SIA audits in 2027, you pull one report. Not a filing cabinet.
FAQs
When does Martyn's Law come into force?
Expected around April 2027, following a 24-month implementation period from Royal Assent on 3 April 2025.
Who regulates Martyn's Law?
The Security Industry Authority (SIA).
Does Martyn's Law apply to pubs?
If the pub's expected capacity is 200 or more at any one time, yes - as a standard tier venue at minimum.
Does Martyn's Law apply to cafes and small restaurants?
Only if expected capacity is 200 or more. Smaller venues are out of scope.
What happens if I don't comply?
Once in force, the SIA will have enforcement powers including compliance notices, restriction notices, and monetary penalties. The full penalty regime will be detailed in SIA guidance.
Do I need to do anything in 2026?
You don't legally have to - yet. But this is the designated prep period. Operators who use it will be ready. Operators who don't will be scrambling in spring 2027.
Related reading
Let's get aquainted - sign up to our newsletter
Join our newsletter to stay up to date on features and releases.