Martyn’s Law is now on the statute book, and the clock is running. If your premises can hold 200 people or more, you have new legal duties to prepare for. This guide explains who is in scope, what the standard tier actually asks of you, and the specific points where visitor management supports your readiness. It is written for UK facilities, workplace and security leads.
Last reviewed July 2026 by the HybridHero team. HybridHero is a UK workplace management platform, ISO 27001 certified. This guide is general information, not legal advice.
What Martyn’s Law is
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack, and it was carried by a campaign led by his mother, Figen Murray.
The Act requires certain public premises and events to be prepared to keep people safe in the event of a terrorist attack. It received Royal Assent on 3 April 2025. The Home Office published its statutory guidance in April 2026, and the regulator is the Security Industry Authority (SIA).
Every qualifying premises must have a designated responsible person who is accountable for meeting the duties. The official hub for guidance is ProtectUK, run by counter terrorism policing.
Who is in scope: the two tiers
Scope is set by how many people can be at your premises or event at the same time. There are two tiers, and the duties differ sharply between them.
200 to 799
Standard tier
- Focus is on simple, low cost procedures
- No requirement to buy physical security equipment
- Evacuation, moving people to safety, lockdown and communication
- Staff should know what to do
800 and above
Enhanced tier
- Everything in the standard tier, documented
- Measures to reduce vulnerability, such as monitoring and physical security
- A security document, kept up to date
- Held to a higher standard by the SIA
Most offices, clinics, smaller venues and workplaces that welcome the public sit in the standard tier. The rest of this guide focuses there, because that is where the largest number of organisations, and the most confusion, sits.
What the standard tier requires
The most important thing to understand is what the standard tier does not ask for. It does not require you to buy equipment, install barriers, or spend on security hardware. The Home Office is explicit that standard tier duties are about having simple, well understood procedures in place.
Those procedures cover four things you would put into effect if an act of terrorism happened at or near your premises:
The four public protection proceduresEvacuation: getting people out safely. Moving people to safety: bringing people inside and away from danger when leaving is not safe. Lockdown: securing the premises to stop people entering. Communication: alerting and instructing people quickly and clearly.
To run any of those well, one thing has to be true first: you need to know who is in the building. That is the point where a visitor management system does real work, and it is covered next.
Where visitor management supports readiness
A visitor management system will not make you compliant on its own. What it does is give the responsible person accurate, real time answers to the questions an incident forces on you. Here is where HybridHero visitor management maps onto the standard tier procedures.
Know exactly who is on site, in real time
You cannot account for people you cannot see. Digital sign in for visitors, contractors and staff gives you a live, accurate count of who is in the building at any moment, replacing a paper book that is often out of date and left at an empty desk.
An instant evacuation and roll call list
When you evacuate or move people to safety, the responsible person needs a list of everyone on site, on a phone, at the assembly point. A visitor system produces that roll call instantly, so you can check people off and identify anyone unaccounted for.
Fast, accurate sign in and sign out
QR and pre registration sign in keeps the on site record accurate without a queue at reception, and sign out keeps it honest, so your roll call reflects who is actually still in the building.
Records and an audit trail
The responsible person has to be able to show that procedures exist and are followed. A digital audit trail of arrivals, departures and evacuation records gives you that evidence, held in one place.
What software does not do
Being straight about this matters, both for your planning and because overselling compliance is a risk in itself. No software makes an organisation Martyn’s Law compliant. The Act is about people, procedures and accountability.
What a visitor system supports
- Knowing who is on site in real time
- An instant roll call and evacuation list
- Accurate sign in and sign out
- Records and an audit trail
- Host and reception notifications
What only your organisation can do
- Appoint a responsible person
- Write and agree the procedures
- Train staff and run drills
- Decide evacuation and lockdown routes
- Assess your own premises against the guidance
Treat a visitor system as the tool that makes the people side faster and more reliable, not as the whole answer.
A standard-tier readiness checklist
A practical starting point for a premises in the 200 to 799 tier. Work through the statutory guidance for the detail that applies to you.
- Confirm your tier. Establish the maximum number of people who can be present at the same time, and check it against the 200 and 800 thresholds.
- Name a responsible person. Make one named person accountable for the duties at each premises.
- Write the four procedures. Set out how you would evacuate, move people to safety, lock down and communicate.
- Fix how you know who is on site. Move off the paper book to a real time record you can produce as a roll call in seconds.
- Train your staff. Make sure people know their part in each procedure, and keep it fresh.
- Keep records. Hold evidence that procedures exist and are followed, ready for the responsible person.
- Review it. Revisit the plan as your premises, headcount or layout change.
Key dates and what to do now
The Act received Royal Assent on 3 April 2025, with an implementation period expected to be at least 24 months. That points to enforcement from around 2027, and the statutory guidance is already published, so the preparation window is open now.
The organisations that will find this easiest are the ones that treat 2026 as preparation time rather than waiting for the deadline. Getting an accurate, real time picture of who is on your premises is a foundational step, and it is useful well beyond compliance, for reception, security and workplace planning alike.
Frequently asked questions
Does Martyn’s Law apply to offices?
It can. Scope is set by capacity, not by building type. If your premises can hold 200 or more people at the same time and the public have access, you are likely in scope. Check your maximum occupancy against the thresholds and read the statutory guidance.
Does the standard tier mean I have to buy security equipment?
No. The Home Office is clear that the standard tier is about simple, low cost procedures, not physical measures or equipment. You are putting plans and training in place, not building barriers.
Can software make us compliant?
No single product makes an organisation compliant. Compliance rests on a responsible person, agreed procedures and trained staff. A visitor management system supports readiness by giving you a real time record of who is on site and an instant roll call, but it is a tool within a wider plan.
When does Martyn’s Law come into force?
The Act received Royal Assent on 3 April 2025, with an implementation period expected to be at least 24 months, so enforcement is anticipated from around 2027. The Home Office published its statutory guidance in April 2026.
Who regulates it?
The Security Industry Authority (SIA). Official guidance is published on GOV.UK and through ProtectUK, run by counter terrorism policing.
Important. This guide is general information to help UK workplace and facilities teams get oriented. It is not legal advice, and it does not replace the official statutory guidance. Assess your own premises against the Home Office guidance on GOV.UK and ProtectUK, and take professional advice where you need it.