Martyn's Law questions answered.

What is Martyn's Law?Link

Martyn's Law is the popular name for the Terrorism (Protection of Premises) Act 2025, a United Kingdom law requiring certain premises and events to be prepared for a terrorist attack.

It received Royal Assent on 3 April 2025 and introduces two tiers of duty based on how many people may reasonably be expected to be present at the same time.

Standard tier applies where 200 to 799 individuals may be present and focuses on having effective public protection procedures.

Enhanced tier applies where 800 or more individuals may be present and introduces additional public protection measures intended to reduce a premises' vulnerability.

The Security Industry Authority (SIA) will regulate the Act once it comes into force.

Why is it called Martyn's Law?Link

Martyn's Law is named after Martyn Hett, one of the twenty-two people killed in the Manchester Arena terrorist attack on 22 May 2017.

His mother, Figen Murray, spent years campaigning for a legal duty requiring publicly accessible premises to be better prepared for terrorist attacks. The Terrorism (Protection of Premises) Act 2025 is the result of that campaign.

Martyn's Law and the Terrorism (Protection of Premises) Act 2025 are the same legislation under two different names.

When does Martyn's Law come into force?Link

No commencement date has yet been announced.

The Government has stated there will be an implementation period of at least 24 months following Royal Assent on 3 April 2025. Commencement is therefore widely expected during Spring 2027.

The Home Office published statutory guidance in April 2026, allowing organisations to begin preparing now.

Until commencement, the Security Industry Authority has no inspection or enforcement powers under the Act.

What is the difference between the standard and enhanced tiers?Link

Standard tier focuses on what people do when an attack happens. Enhanced tier requires those same procedures together with additional public protection measures designed to reduce the vulnerability of the premises.

Standard tier applies where 200 to 799 individuals may reasonably be expected to be present at the same time.

Enhanced tier applies where 800 or more individuals may reasonably be expected to be present.

Who enforces Martyn's Law?Link

The Security Industry Authority will regulate Martyn's Law.

It will have powers to issue compliance notices, restriction notices and financial penalties where organisations fail to meet their duties once the Act is in force.

None of these enforcement powers are currently active because the legislation has not yet commenced.

Does Martyn's Law apply to my school?Link

Schools are treated as standard tier under Martyn's Law however large they are.

The Home Office statutory guidance is explicit: premises used for childcare or for primary, secondary or further education that can reasonably expect 200 or more individuals, including staff, to be present at the same time from time to time fall within the standard tier, even where that number is 800 or more. So a very large secondary school does not get pushed into the enhanced tier by its size, the way a similarly sized commercial venue would.

Below 200 expected individuals a school is not in scope, although the guidance encourages preparedness anyway. Whether your particular setting is in scope, and who holds the duty for it, is a question for your trust, your local authority or your own legal advisers, and Ag Lockdown offers no opinion on it.

Does Martyn's Law apply to colleges and universities?Link

Further education colleges are treated as standard tier regardless of size, in the same way as schools, but higher education is treated differently and universities can fall into the enhanced tier if they meet the criteria.

The Home Office statutory guidance places childcare and primary, secondary and further education premises in the standard tier even where 800 or more individuals may be present. It does not extend that treatment to higher education.

A university building expecting 800 or more individuals at the same time may therefore sit in the enhanced tier, with the additional duties that go with it. Large campuses often contain premises with very different uses and expected numbers, so the assessment is done premises by premises.

Take your own advice on where your buildings sit.

Does Martyn's Law apply to hospitals and healthcare premises?Link

Healthcare premises are among the uses named in the Act, and which tier applies depends on how many individuals may reasonably be expected to be present at the same time.

Unlike schools and further education, healthcare has no carve out keeping it in the standard tier regardless of size, so a healthcare premises expecting 800 or more individuals at the same time can fall into the enhanced tier. In practice a hospital site is not one premises but many different uses with very different footfall, so the assessment has to be done properly and locally rather than assumed.

Ag Lockdown offers no opinion on which tier any healthcare organisation falls into, and NHS trusts and private providers should take their own advice.

Does Martyn's Law apply to council buildings and local authorities?Link

Public authority buildings are among the uses named in the Act, so council offices, civic centres, libraries, leisure centres and community halls can be in scope where 200 or more individuals may reasonably be expected to be present at the same time.

Which tier applies depends on the expected numbers at each building, so a council estate will typically contain some premises in scope at the standard tier, some potentially at the enhanced tier, and some not in scope at all. Ownership and control matter too, because the duty falls on whoever has control of the premises for its relevant use, which is not always the council itself where a building is leased, run by a trust or operated by a third party.

Councils should take their own advice on their estate.

Does Martyn's Law apply to hotels, shopping centres and other venues?Link

Hotels and shopping centres are among the uses named in the Act and are in scope where 200 or more individuals may reasonably be expected to be present at the same time, with the enhanced tier applying at 800 or more.

A shopping centre raises a question hotels do not: the centre and the individual units may be under different control, and the duty falls on whoever has control of the premises for its relevant use, so a centre operator and its tenants need to be clear about who holds what. Some premises are excluded from the Act altogether, including parks and gardens with free and open access, Parliament and the devolved legislatures, and transport premises already covered by their own security legislation.

Take your own advice on whether and how the Act applies to your site.

How do I work out whether my premises is in scope?Link

The test is whether it is reasonable to expect that 200 or more individuals may be present on the premises at the same time, from time to time.

Individuals means everyone, so staff are counted as well as customers, pupils, patients, residents and visitors. From time to time matters: the question is not your average day, it is whether the number is reached at all on a recurring basis, so an open evening, a graduation, a busy clinic or a Saturday trading peak can be what brings a premises into scope.

The premises also has to be used for one of the purposes listed in the Act. The Home Office statutory guidance sets out the test and gives worked examples.

It is a judgment about your own building, and organisations should take their own advice rather than rely on a rule of thumb.

Who is the responsible person under Martyn's Law?Link

The responsible person is whoever has control of the premises for the purpose of its qualifying use, which is often an organisation rather than a named individual.

Where the responsible person is an organisation and the premises is in the enhanced tier, the Act requires a designated senior individual to be named from among those involved in its management or control. In education, legal commentators generally point to the local authority for maintained schools and to the academy trust for academies, but the answer turns on who actually controls the premises, and buildings that are leased, shared or hired out complicate it.

This is exactly the point where organisations should take their own legal advice, because getting it wrong means nobody has picked up the duty. Ag Lockdown gives no view on who the responsible person is for any organisation.

What are the four public protection procedures?Link

They are evacuation, invacuation, lockdown and communication, and every premises in scope, standard tier and enhanced tier alike, is expected to have appropriate procedures for all four.

The statutory guidance defines them as follows.

The first three all depend on the fourth working, because a procedure nobody can be told about is not a procedure. That is the one Ag Lockdown is built around.

What is invacuation, and how is it different from evacuation?Link

Invacuation means moving people away from danger to a safer place inside the building, rather than out of it.

Evacuation is the opposite: getting people out of the premises entirely. Under Martyn's Law both are among the four public protection procedures a premises in scope is expected to have, alongside lockdown and communication.

The reason the law names invacuation separately is that the fire alarm instinct, which is to send everyone outside, can be exactly the wrong response to a hostile attack, where outside may be where the danger is. Invacuation and lockdown are often confused: invacuation is about where people go, lockdown is about securing the premises so nobody enters or leaves.

A premises needs a way to tell people which one is happening, which is why communication sits alongside them.

Do we have to buy equipment or make changes to our building?Link

No. Standard tier duties are about procedures, not physical security, and the statutory guidance is clear that standard duty premises are not required to put in place physical measures or make alterations to the building.

The enhanced tier goes further and expects public protection measures as well as procedures, covering things such as monitoring, movement of people, physical safety and security, and security of information, and those may involve investment.

Everything is qualified by what is reasonably practicable, which the guidance describes as proportionate, weighing what can be done against the cost, time and difficulty of doing it. Nobody is required to spend their way to readiness, and no supplier can tell an organisation what its duty is.

What the law does not require, though, is not the same as what readiness takes. Procedures still have to work when nobody is looking anything up, and that is worth judging separately from what you are obliged to buy.

Take your own advice on what is reasonably practicable in your setting.

Does Martyn's Law require staff training?Link

The Act does not require a specific training course or qualification. What it requires is that appropriate public protection procedures are in place, and a procedure is only in place if the people who have to carry it out understand what to do.

That is why most guidance talks about making staff aware of procedures rather than completing a particular course, and why free counter-terrorism awareness material is available through ProtectUK.

Be cautious of anyone claiming a training course alone satisfies the law. The Act does not prescribe one.

Ag Lockdown takes a different approach. Rather than expecting people to remember complex systems under extreme pressure, staff simply need to know how to raise an alert and, if instructed, scan the QR code displayed in their room. The Emergency Response Centre then takes the incident on and guides the response in real time.

Using Ag Lockdown itself takes around two minutes to learn because, in a crisis, people should not be expected to remember complicated technology while they are living through the emergency.

Do we have to tell the regulator, and write our procedures down?Link

Premises in scope will have to notify the Security Industry Authority, and enhanced duty premises will additionally have to document their procedures and measures and provide that document to the regulator.

For standard duty premises the Act sets a notification duty rather than a duty to submit a plan. Writing procedures down is still sensible, because after any incident what an organisation had in place will be examined closely, and a procedure that exists only in somebody's head is hard to evidence.

Notification cannot happen until the relevant provisions commence and the regulator opens the process, so watch the regulator's own published guidance for how and when. Organisations should take their own advice on what they need to record.

Does Martyn's Law make governors or trustees personally liable?Link

Martyn's Law does not make governors and other responsible people more liable than they already were.

Penalties under the Act sit with the organisation. Personal exposure for governors, trustees and senior leaders sits separately, under the law on negligence that already existed before this Act.

What Martyn's Law adds is a clear published benchmark to work to, which cuts both ways: it makes it easier to show you were ready, and easier for someone afterwards to show you were not. That is the honest reason this lands on senior people even though the fines do not.

Anyone worried about their own position should take their own legal advice, and Ag Lockdown does not give a view on any individual's liability.

What should we do first to get ready?Link

Start by working out whether each of your premises is in scope and who holds the duty for it, because everything else follows from those two answers.

Then read the Home Office statutory guidance and look honestly at what you already have. Most organisations already have evacuation procedures and emergency plans. The gap is rarely the document itself. It is whether people can actually put it into practice when seconds matter.

A simple question usually exposes the answer. Imagine the first member of staff who sees a hostile threat at the far end of your site. How do they warn everybody else, all at once, without leaving the room?

For many organisations, the honest answer is still a chain of handovers through reception, individual phone calls or radios. Others rely on communication systems that still leave staff managing the incident themselves, or app-based solutions that depend on the right person having the right phone at exactly the right moment.

Ag Lockdown was built differently. It does not simply communicate an incident. It takes the crisis off site, so your people can concentrate on those in front of them while experienced Controllers run the response alongside your leadership and the emergency services.

Can a product make us Martyn's Law compliant?Link

No.

Compliance rests with the organisation responsible for the premises.

No supplier can certify compliance or guarantee that an organisation meets its legal duties.

Products and services should instead be judged by how effectively they help organisations deliver the procedures the legislation expects.

How much does it cost to prepare?Link

The Act sets no minimum spend and names no product, so nobody can tell you a figure you are legally required to pay. That makes this a harder question than it first looks.

Standard tier duties are about having procedures that work. The real cost is not in writing a procedure down, it is in being able to run it on the day, when the person who did the training is not the person who is there and nobody has time to look anything up. A procedure that exists only on paper costs very little and delivers very little.

So the useful question is not what compliance costs. It is what it takes for your people to act together and at once, on the worst day rather than the average one. That is the test worth applying to any approach, including ours.

What is Ag Lockdown?Link

Ag Lockdown is a fully managed lockdown and emergency response service for multi-room environments, including schools and colleges, council and civic buildings, hospitals and healthcare settings, hotels and halls of residence, and shopping centres.

It is not an app. It is not an alarm.

When an alert is raised, former military Controllers in Ag Lockdown's permanently staffed Emergency Response Centre take the crisis off site. From the first alert until the all clear, they take the incident on, managing it alongside your leadership and the emergency services.

They immediately open a secure command room, bringing together your leadership, the Controllers and the emergency services as the incident requires. On your authority they put the site into lockdown, coordinate the response, build and maintain a live room-by-room picture as the situation develops, and ensure verified information reaches the people who need it.

Your people are not left running a crisis they are caught up in. They look after those in front of them while Ag Lockdown manages the incident with them.

Authority always remains with your organisation. Every decision that is yours to make stays yours, and the emergency services lead once they are on scene. What Ag Lockdown takes on is the running of the incident itself, so those decisions are made with experienced Controllers beside you rather than alone and under pressure.

The same Emergency Response Centre also supports everyday operations, including first aider calls, lone worker protection, fire evacuation roll calls and site-wide messaging.

Can Ag Lockdown help us prepare for Martyn's Law?Link

Yes. Martyn's Law expects organisations to have effective procedures for evacuation, invacuation, lockdown and communication. The first three all depend on the fourth working.

But communication alone is not the same as managing an incident. Sending an alert tells people something is happening. It does not remove the burden of running the response.

Ag Lockdown takes the crisis off site, so your people are not left making high-consequence decisions while they are caught up in the emergency themselves. Experienced Controllers manage the incident alongside your leadership, maintaining the operational picture, coordinating information, supporting decision making and working with the emergency services until the incident is over.

Ag Lockdown is not a compliance certification and does not provide legal advice. It delivers the operational readiness the legislation expects while leaving authority exactly where it belongs, with your organisation.

Is Ag Lockdown an app?Link

No. Ag Lockdown is deliberately not an app.

An app depends on the right person having the right phone, unlocked, in their hand, with signal, at one of the most stressful moments of their working life. Most staff will not install a work app on their personal phone in the first place, leaving a split estate where the message reaches some people but not others.

Ag Lockdown takes a different approach. Alerts are delivered through the screens and devices your organisation already owns, including PCs, laptops, Macs, Android screens and Chromebooks.

Where staff use their own phones, they simply scan the QR code displayed in the room. Nothing needs to be downloaded or installed.

The Emergency Response Centre manages the incident. Your technology simply becomes the means through which that response reaches your people.

What happens when someone raises an alert?Link

Any member of staff can raise an alert using a dedicated number that connects directly to Ag Lockdown's Emergency Response Centre. Former military Controllers answer within seconds and immediately take the incident on.

A secure command room is established, bringing together your authorised leaders and, as the incident develops, the emergency services and other responders.

On your authority, lockdown messages are broadcast across the screens and devices already on site.

Where available, your existing CCTV is used to identify threats, track movement and relay verified intelligence to your leadership and the emergency services. It is never routine surveillance. It is used only to support the live management of an incident.

Staff scan the QR code displayed in each room to report how many people are present, whether anyone is injured and whether anyone cannot move. Room by room, the Emergency Response Centre builds and maintains a live operational picture so help reaches the right place first.

Throughout the incident, Controllers remain in constant contact with your leadership, providing verified information, coordinating communications, updating those sheltering in rooms and managing the response through to the all clear.

Afterwards, recordings, messages and voice logs are available as a one-click download, with a full timestamped incident report available on request.