Martyn’s Law for Event Organisers: A Complete Guide

By UK Event Managers · Event Safety & Compliance · 8 min read

In May 2017, 22 people were killed and hundreds injured in the Manchester Arena bombing. Among those who lost their lives was Martyn Hett, a 29-year-old whose mother, Figen Murray, subsequently campaigned tirelessly for better protective security at public venues. That campaign resulted in the Terrorism (Protection of Premises) Act 2025 — commonly known as Martyn’s Law — which received Royal Assent in April 2025.

For event organisers across England, Wales, Scotland, and Northern Ireland, this new legislation creates real legal obligations. Whether you run a community festival, a corporate awards dinner, a music concert, or a charity gala, you need to understand what Martyn’s Law requires, when it applies to your events, and how to become compliant before the implementation deadline.

This guide covers everything event organisers need to know: the two tiers of compliance, what each tier requires, how to implement the necessary measures, common pitfalls to avoid, and where to get professional support.

What Is Martyn’s Law?

Martyn’s Law is the colloquial name for the Terrorism (Protection of Premises) Act 2025, a piece of UK legislation that places statutory duties on venues and events to have proportionate protective security and preparedness measures in place.

The legislation was introduced because there was no consistent legal requirement for venues to plan for terrorist incidents. Some organisations had robust counter-terrorism plans; others had virtually nothing. Martyn’s Law changes that by creating a baseline of security planning that all qualifying venues and events must meet.

Crucially, the law applies not just to permanent venues but also to temporary events — outdoor festivals, markets, sporting competitions, community events, and any other gathering that meets the capacity thresholds. If you organise events that routinely or occasionally attract 100 or more people, this law almost certainly applies to you.

Implementation is expected in 2027, giving event organisers time to prepare — but that window should be used productively, not ignored.

Who Does Martyn’s Law Apply To?

The Act covers “qualifying premises” and “qualifying events.” A qualifying event is any event held at a location (indoors or outdoors) where the number of people reasonably expected to be present at any one time is 100 or more. This includes:

• Outdoor music festivals and concerts
• Corporate conferences and award ceremonies
• Sporting events and competitions
• Community fairs, markets, and galas
• Charity fundraising events
• Trade shows and exhibitions
• Religious gatherings and ceremonies
• Educational events such as graduation ceremonies

The law applies to the responsible person for the event — typically the event organiser, the venue operator, or whoever holds the relevant licence or permission to run the event. If you contract with a venue, you should clarify with them which party holds the legal duty; in many temporary event contexts, that responsibility falls squarely on the organiser.

Events or premises with a maximum capacity below 100 people fall outside the scope of the legislation, though good security practice is always advisable regardless of size.

The Two Tiers of Compliance

Martyn’s Law creates two tiers of obligation based on the maximum number of people reasonably expected to be present at any one time.

Standard Tier (100–799 people)

Events and venues in the Standard Tier must implement straightforward, procedural measures focused on staff training and basic emergency preparedness. The requirements include:

• Staff training: All staff and volunteers who work at the event must receive counter-terrorism awareness training. This includes understanding the “Run, Hide, Tell” guidance, recognising suspicious behaviour, and knowing how to raise the alarm.
• Emergency procedures: A written plan must exist covering how staff will respond to a terrorist incident — evacuation routes, lockdown procedures, communication with emergency services, and how to protect attendees.
• Document and maintain: The plan must be documented, kept up to date, and made available to staff. There is no requirement for a professional risk assessment at this tier, but you must be able to demonstrate you have considered the risks.

Standard Tier compliance is deliberately designed to be achievable for small and medium-sized event organisers without significant cost. The National Counter Terrorism Security Office (NCTSO) provides free training resources, including the ProtectUK platform, which hosts e-learning modules suitable for event staff.

Enhanced Tier (800+ people)

Events and venues in the Enhanced Tier face a higher bar. These are larger gatherings where the potential impact of a terrorist attack is greater, and the law reflects that with more substantive requirements:

• Professional security risk assessment: A formal Counter Terrorism Security Advisor (CTSA)-level assessment of the venue and event, identifying specific threats and vulnerabilities.
• CCTV: Adequate CCTV coverage of public-facing areas, entrances, exits, and critical infrastructure points.
• Access control: Documented procedures for controlling who enters the event, including bag searches, ticketing verification, and management of accreditation for staff, contractors, and media. Note that staff carrying out physical searches or access control must hold a valid SIA Door Supervisor licence.
• Hostile vehicle mitigation (HVM): Where the layout permits it, measures to prevent or slow a vehicle-borne attack on pedestrian areas — this might mean barriers, bollards, or strategic placement of infrastructure.
• Communications plan: A tested communications plan covering internal staff coordination and liaison with police and emergency services during an incident.
• Regular review: The security plan must be reviewed periodically and after any significant incident or change in the threat landscape.

How to Implement Martyn’s Law Compliance Step by Step

Step 1: Establish Your Tier

Before anything else, work out whether your events fall into the Standard or Enhanced Tier. Use your realistic maximum attendance figure — not your licensed capacity, but the number you would genuinely expect at a sold-out or well-attended event. If you regularly run events that could tip over 800, you should plan for Enhanced Tier from the outset.

Step 2: Appoint a Responsible Person

Designate a named individual within your organisation who will own compliance. This person will be responsible for maintaining documentation, ensuring staff are trained, and liaising with authorities. For small organisations, this may be the event director themselves; larger operators may create a dedicated security or compliance coordinator role.

Step 3: Complete a Security Risk Assessment

For Standard Tier events, this can be a structured internal review. Walk the site, consider the likely threats (crowding, suspicious packages, vehicle access), and document what you found and what you have done about it. For Enhanced Tier events, engage a qualified Counter Terrorism Security Advisor. NCTSO can help you find qualified advisors through their national network.

Step 4: Write Your Emergency Response Plan

This is the core document that Martyn’s Law requires you to have. It should cover at minimum: the evacuation plan (with maps), lockdown procedures, how to communicate with staff during an incident, who calls 999 and what information to give, how to assist people with accessibility needs, and post-incident welfare procedures. This plan sits alongside — and is complementary to — your broader outdoor festival safety planning if your events are held outdoors.

Step 5: Train Your Staff

Use the free ProtectUK e-learning modules or commission face-to-face training. Keep records of who has been trained, when, and what was covered. Staff working a single-day event should receive a briefing at minimum; core team members should complete full counter-terrorism awareness training.

Step 6: Implement Physical Measures (Enhanced Tier)

If you are in the Enhanced Tier, work through your security advisor’s recommendations. Prioritise the highest-risk vulnerabilities first. Access control, CCTV, and bag-search procedures are typically the first areas to address at public-facing events.

Step 7: Test and Review

A plan that sits in a drawer is not a plan — it is a document. Run tabletop exercises with your team. Walk through the evacuation procedure. Test your radios and communication chains. Review the plan after every event and update it when anything changes: the venue, the expected attendance, the threat level, or your staffing arrangements.

Common Mistakes Event Organisers Make

• Assuming the venue handles it: Many organisers assume that because they are using a licensed venue, compliance is the venue’s problem. In practice, where events are run by external organisers, the duty may sit with the organiser. Get this clarified in writing in your venue hire agreement.
• Training only senior staff: Martyn’s Law requires that staff at the event are trained, not just management. That includes part-time stewards, casual bar staff, and volunteers.
• Generic plans: A downloaded template that has not been adapted to your specific venue and event type will not satisfy the legislation. Plans must be specific to the actual site layout, staffing, and likely attendance profile.
• Ignoring accessibility: Emergency plans must account for attendees with mobility impairments, sensory impairments, or other access needs. Failure to include these groups is both a legal risk and a moral failing.
• Leaving it until 2026: The implementation window is 2027, but if you are running events now, building your compliance framework early saves last-minute panic — and demonstrates good faith if anything goes wrong before the formal deadline.

Frequently Asked Questions

When does Martyn’s Law come into force?

The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025. The government has indicated a transition period before full enforcement begins, with implementation expected around 2027. However, event organisers are strongly encouraged to begin compliance work now rather than waiting until the deadline. Building the necessary plans, training, and procedures takes time, and demonstrating proactive compliance is also good practice from a reputational and insurance standpoint.

Does Martyn’s Law apply to outdoor events?

Yes. The Act explicitly covers both permanent indoor venues and temporary or outdoor events. If your outdoor festival, market, sporting event, or community gathering has a maximum expected attendance of 100 or more, it qualifies. The fact that the event is temporary or takes place on open land does not exempt it.

What happens if we do not comply with Martyn’s Law?

The Act includes civil sanctions for non-compliance. A dedicated regulator will be established to oversee compliance, and organisations that fail to meet their obligations can face financial penalties. The scale of the penalty is likely to be proportionate to the size and nature of the organisation. Beyond financial penalties, non-compliance creates significant reputational and legal risks in the event of an incident.

How much does Martyn’s Law compliance cost?

For Standard Tier events, the primary costs are staff time (to write the plan and deliver training) and any external training resources. The ProtectUK platform offers free e-learning. For Enhanced Tier events, professional security consultancy for a CTSA-level assessment typically costs between £1,500 and £5,000+ depending on the complexity and duration of the event. Physical security measures (CCTV, barriers, access control systems) are additional. The government has committed to publishing guidance to help smaller organisations manage compliance costs proportionately.

Is Martyn’s Law the same as a risk assessment for Health and Safety?

No. Your existing Health and Safety risk assessment addresses workplace and public safety risks such as slips, trips, electrical hazards, and crowd management. Martyn’s Law requires a separate, specific counter-terrorism security assessment. However, the two processes are complementary — a good overall event safety management system will incorporate both, and the documentation can be held together in your event safety file. If you work with professional event managers, they can help ensure both sets of obligations are covered.

Do I need a separate plan for every event I run?

Not necessarily. If you run a recurring event at the same venue with a broadly similar format and attendance profile, you can maintain a single plan that is reviewed and updated before each edition. However, if the venue, the format, or the expected attendance changes significantly, you should review and adapt the plan accordingly. A festival at a new site, for example, would require a fresh site-specific assessment. Contact our team for advice on how to structure your compliance documentation efficiently across multiple events.