Martyn’s Law: what the Terrorism (Protection of Premises) Act 2025 asks of you

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025 and is expected to come into force in spring 2027. It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017, and it exists because of a campaign led by his mother, Figen Murray. The Government published statutory guidance on 15 April 2026, and the Security Industry Authority is standing up a new regulatory function to enforce it.

If you run a venue, a shopping centre, a hospital, a school, a place of worship, a stadium or an office building open to the public, this is the first time UK law will require you to have thought about what your people do in the first ninety seconds of an attack. Here is what it actually asks for.

Two tiers, set by how many people can be there

The Act sorts qualifying premises by the number of individuals who may reasonably be expected to be present at the same time. The standard tier covers 200 to 799. The enhanced tier covers 800 or more. The threshold is about capacity, not attendance on an average Tuesday, and it is the figure most premises get wrong on first reading.

What the standard tier has to do

Two things. Notify the SIA that the premises exist, and put in place appropriate public protection procedures: what your people do to reduce the risk of physical harm if an attack happens at or near the premises. The guidance frames those procedures around four actions. Evacuation, getting people out. Invacuation, bringing people into a safer place inside. Lockdown, securing the premises against entry. And communication, getting the instruction to everyone who needs it.

Note what is not there. The standard tier does not require you to buy equipment, and it does not require you to make the building harder to attack. It requires a plan, and people who know it.

What the enhanced tier has to do

Everything above, plus two more. Appropriate measures, meaning steps that actually reduce the vulnerability of the premises to an attack rather than only mitigating one in progress. And documentation: enhanced duty premises must record their procedures and measures and provide that document to the SIA.

That last obligation is quietly the significant one. It turns security from something you believe you have into something you have written down and handed to a regulator.

Who carries the duty

The responsible person is whoever has control of the premises. In practice that is the operator rather than the landlord, and it is a named accountable role rather than a department. The SIA has said it will support and guide, and that it will act on serious or persistent non-compliance through compliance notices, monetary penalties and restriction notices, with criminal offences available in the most serious cases.

The part nobody is ready for

Write the procedures and you have a document. The hard question is the one the regulator will eventually ask, and the one that actually matters at 8pm on a Friday: when it happens, does the instruction reach everybody, does anyone know it reached them, and is there any record afterwards of who was told and when.

Most premises today answer that with a radio net, a fire panel and a WhatsApp group. Radios reach the staff carrying one. The fire alarm is the wrong instruction for an attack, because it evacuates people into the open. And a messaging group is not a record: nobody can tell you afterwards who read it, who moved, or how long any of it took.

Martyn’s Law does not mandate any particular technology, and anybody selling compliance in a box should be treated with suspicion. But it does create a standard that a plan on a shelf cannot meet.

Where Vatar fits

We should be straight about what we do and do not do here. Vatar is not a compliance product and cannot discharge your duty. The duty is yours. What we can do is the operational half that a written procedure assumes and most premises cannot evidence.

Detection on the cameras you already own. A Warden runs on a device on site and watches every feed at once, which is the gap between an incident starting and someone noticing it. It keeps working when the internet does not, because an attack is exactly when infrastructure fails.

A way to raise the alarm without a radio. The SOS button is carried, not mounted. A member of staff on a shop floor or a door can raise a verified alert with one press, without unlocking a phone or reaching a panel, and without announcing that they are doing it.

Invacuation and lockdown as an instruction rather than a hope. Because the alert lands in one system, it can drive the connected speakers, the doors and the staff notification together, which is the difference between four written procedures and four things that actually happen at once.

And a record. Every alert in Ogbon is a job with an owner and a clock on it: who was told, who acknowledged, who moved, how long it took. That is the artefact an enhanced duty premises has to produce and the one a plan on a shelf cannot.

One thing we will not claim: Vatar has no responders in the United Kingdom, and this is not a private response service here. Under Martyn’s Law the responders are your own staff and the emergency services. Our part is making sure both are informed in the first seconds rather than the first minutes, and that afterwards you can prove it.

What to do now, not in 2027

Work out your capacity figure and therefore your tier. Name the responsible person. Write the four procedures and rehearse them, because an unrehearsed procedure is a document rather than a plan. If you are enhanced tier, start the documentation now, since it is the part that takes longest and the part the regulator will read. Then ask the honest question about how an instruction actually reaches every person in your building on the worst night of the year, and whether you could show anyone afterwards that it did.

The commencement date is not the deadline. The rehearsal is.