Martyn’s Law: what every FM needs to do before 2027

The Terrorism (Protection of Premises) Act 2025 has passed into law. Detailed guidance arrives in summer 2026, enforcement in 2027. That gap is shorter than it sounds.

For years, facilities managers quietly lobbied for clearer legal footing on terrorism preparedness. The answer, when it finally came, landed with more weight than many expected. The Terrorism (Protection of Premises) Act 2025 — universally known as Martyn’s Law, after Martyn Hett who died in the 2017 Manchester Arena bombing — received Royal Assent in April 2025. It is the most significant change to public venue security legislation in a generation.

The act does not ask FM teams to become counter-terrorism experts. What it does require is that they build, document, and maintain a framework of preparedness that is proportionate to the size and nature of their premises. For most facilities managers in commercial property, the standard tier will apply. For those managing large venues, arenas, or major public spaces, the enhanced tier demands considerably more.
Who is in scope

The legislation divides premises into two tiers based on capacity. The standard tier applies to any premises that can accommodate between 200 and 799 people in a publicly accessible area. The enhanced tier covers venues with a capacity of 800 or more. For FM teams managing mixed-use commercial buildings with event spaces, the calculation of capacity — and therefore which tier applies — may not be straightforward.

There is a practical point here that many FM teams are missing. Capacity in the context of Martyn’s Law is not the fire evacuation capacity of the building as a whole. It refers to the capacity of any publicly accessible area within the premises. A corporate headquarters with a ground floor auditorium that seats 250 people would fall into standard tier even if the overall building holds far more.

Standard tier obligations (200–799 capacity): Terrorism risk assessment, documented emergency procedures, basic staff awareness training, and a named responsible person for security compliance.
What the standard tier actually requires

The Home Office is developing detailed statutory guidance, expected in summer 2026. What is already clear from the legislation itself is that standard tier premises must carry out a terrorism risk assessment, document their emergency procedures, ensure staff who work in publicly accessible areas have basic terrorism awareness training, and designate a responsible person accountable for compliance.

None of these requirements should be entirely alien to FM teams that already operate mature health and safety frameworks. The challenge is not understanding what is required — it is building an audit trail that demonstrates it. The Security Industry Authority (SIA) will act as the new regulator, and it will expect evidence.
The enhanced tier is a different beast

Enhanced tier venues — those holding 800 or more — face a significantly more detailed set of obligations. These are expected to include formal security planning documents, regular staff training programmes with scenario-based exercises, incident response drills, and ongoing engagement with local counter-terrorism policing. For FM teams managing venues of this scale, the groundwork should already be underway. Waiting for final statutory guidance before beginning is a risk not worth taking.
The practical FM checklist

Before statutory guidance lands, here is what FM teams should be doing now. First, establish your capacity across all publicly accessible areas and determine which tier applies. Second, review and update your existing emergency evacuation and lockdown procedures to ensure they address terrorism scenarios specifically — not just fire and medical emergencies. Third, document that review. Fourth, identify who in the organisation is the designated responsible person. Fifth, begin staff awareness training — the Counter Terrorism Policing network offers free ACT (Action Counters Terrorism) awareness training that is widely used and well regarded. Sixth, review your physical security: access control, CCTV coverage, and the visibility of entrances and exits.

Treating Martyn’s Law as you would fire safety compliance — with regular, documented drills and reviews — is both the practical approach and the one most likely to satisfy a regulator.