Prepare to make your premises safer from terror attacks

Last month, the Terrorism (Protection of Premises) Act 2025 (also known as Martyn’s Law) received royal assent, starting the clock on the two-year implementation period before the main provisions come into force.

The legislation was prompted by the 2017 Manchester Arena attack and is named after Martyn Hett, one of the victims, following a campaign by his mother, Figen Murray.

For the first time, it requires those responsible for certain premises and events at which large gatherings occur – such as sports and entertainment venues, hotels, student accommodation, and shopping centres – to consider terrorist threats and take forward proportionate mitigations.

Get ready for Martyn's Law, advises Lynne Gray

The UK’s National Risk Register highlights terrorist attacks as one of the top risks facing the country. However, despite several inquiries and inquests reflecting the risk in findings, there was found to be a lack of consistent security outcomes across UK public locations. The legislation aims to address this, requiring those responsible for qualifying premises and events to take appropriate action (so far as reasonably practicable) to reduce the risk of harm to staff and the public, or risk enforcement which includes criminal offences for serious non-compliance.

The regulations take a tiered approach around different uses of premises and the number of individuals reasonably expected to be present. Organisations need to understand if their premises or event qualifies and then consider which tier they fall within to inform duties and any required response.

The legislation details publicly accessible premises within its scope, including sports grounds, entertainment venues, shopping centres and healthcare facilities. Where the public has access to premises or part of the premises, with an expected capacity of 200-799 persons, this falls within the standard tier.

An expected capacity of 800 or more takes the premises into the enhanced tier, with different duties applying.

The standard duty requires appropriate public protection measures, so far as reasonably practicable. That means procedures which should be followed by people working at the premises if an act of terrorism were to occur there or nearby and which may reduce the risk of physical harm to individuals. That could be locking down premises, evacuating or moving people to safe places. Many organisations in the standard tier will already have policies and mitigations in place under other regulatory requirements, such as health and safety and fire safety. These are meant to be low-cost mitigations and there is no requirement to have physical measures in place, in contrast to enhanced duty premises.

The enhanced duty requires a more proactive approach, considering counter-terrorism measures to reduce, so far as reasonably practicable, both the vulnerability of premises or an event to an act of terrorism occurring, as well as the risk of physical harm to individuals if an attack was to occur there or nearby. That could include CCTV monitoring or installing barriers, safety glass, and bag or vehicle checks. Any procedures must be documented and submitted to the regulator, the Security Industry Authority (SIA).

The SIA needs new regulatory capability to enforce the legislation, which is expected to take 24 months to establish, hence the lead-in time before the new provisions kick in.

For many businesses operating qualifying premises and events across Scotland, this may be the first time they have been required to address the risk from terrorism and represents significant additional responsibilities that need to be considered as part of their activities. They should be using the next two years to understand and prepare for the legislation coming into force fully.

Lynne Gray is a Partner, Burness Paull LLP​