There's a piece of legislation that most event organisers we speak to haven't heard of yet. But even if you haven't come across it, it might still apply to you.
It's called Martyn's Law, after Martyn Hett, one of 22 people killed in the Manchester Arena attack in 2017. Formally it's the Terrorism (Protection of Premises) Act 2025. It requires public venues and events to have procedures in place that could reduce harm if an attack occurred.
The threshold is just 200 people on site, including staff. That means it reaches schools, theatres, village halls, farm parks, churches and sports clubs: places that have never had to think about counter-terrorism legislation. A lot of the organisations we work with will be in scope, and most of them don't know it yet.
The Act is expected to come into force from spring 2027. The statutory guidance was published in April 2026, so you can now read exactly what's expected. There's time to prepare, but not time to ignore it.
This isn't legal advice. If you need guidance specific to your venue, the statutory guidance on GOV.UK is the place to start, and the Security Industry Authority (SIA) will be able to help once the Act comes into force. But here's a plain-language look at what the Act involves and what you can do now.
What is Martyn's Law and why does it exist?
The Manchester Arena inquiry found that security procedures at the arena existed on paper but hadn't been tested. Staff hadn't been trained on what to do, communication broke down under pressure, and emergency exits were unclear.
The key finding? People responsible for security on the night didn't think an attack was a realistic possibility. Most plans were theoretical rather than practical.
The inquiry made over 150 recommendations. One of them was that venues should be legally required to plan for these situations. Not just large arenas, but any public space where significant numbers of people gather. That recommendation became Martyn's Law.
The law isn't intended to turn every village hall into a fortress. It's about making sure that if you run a public venue, you've thought through the basics: how you would get people out safely, how you would communicate during an emergency, and whether your team has actually talked through the plan rather than just having one filed away somewhere.
When does Martyn's Law apply?
The Act applies in two situations:
Premises that include at least one building, are publicly accessible, and regularly have 200 or more people on site at the same time (including staff and volunteers). This covers venues like village halls, theatres, schools, sports clubs, farm parks, churches, and heritage sites.
Events of 800 or more people where there's entry control in place, such as ticket checks or wristbands. This can include outdoor events.
Within those two categories, there are two tiers. The standard tier (200 to 799 people) has straightforward, low-cost requirements. The enhanced tier (800+) asks for more, including risk assessments and a written security plan.
If you're well under 200, the Act doesn't apply to you, though the principles behind it are still good practice. If you're not sure whether you hit the threshold, read on.
Does Martyn's Law apply to your venue?
The key question is whether you regularly have 200 or more people on site at once. That 200 includes staff, volunteers and contractors.
The wording in the Act is "at least occasionally." So your busiest days count even if your average is well below 200. A village hall that squeezes 250 in for the Christmas fair is potentially in scope, even though most events only draw 80.
Think about a school with 200+ pupils and staff. A 300-seat theatre. A farm park open daily. A heritage railway running Santa specials. A church that fills at Christmas and Easter. All potentially in scope.
If you're not sure whether you hit 200, your ticketing data is a good place to start. The statutory guidance says historic attendance is a valid way to assess your numbers, so the reports in your booking platform can do a lot of the work for you.
One specific consideration: primary, secondary and further education settings always stay in the standard tier regardless of size.
Does Martyn's Law apply to one-off events?
Events have a higher bar. A one-off event only qualifies if 800+ people are expected and there's entry control in place, such as ticket checks, wristbands or screening.
A fireworks display for 600 without formal entry control wouldn't qualify. A county show for 2,000 with ticketed entry almost certainly would.
Worth remembering: even if your individual events don't hit 800, your premises might still be in scope if 200+ people are routinely on site.
What does the standard tier require?
Two things, both designed to be low-cost.
Register with the regulator
The SIA will act as the regulator for Martyn's Law. When the Act comes into force, you'll need to notify them that your premises are in scope. The process will be set out closer to the time.
Have public protection procedures in place
This is the main one. You'll need procedures covering four areas.
Evacuation means getting people out safely. Most venues already have a fire plan, which is a good starting point. But when did your team last practise it? The Arena inquiry found plans that existed in a folder but had never been walked through.
Invacuation means moving people to a safe place inside the building when going outside would be more dangerous. For a theatre, that might mean keeping the audience in the auditorium and securing the foyer. For a farm park, it means knowing your nearest solid building. For a village hall, it could be as simple as knowing which room has a door that locks from inside.
Lockdown means securing the building to slow down access. Which doors lock from the inside? Can the main entrance be secured quickly? Most people haven't thought about this until they're asked.
Communication covers alerting everyone on site and contacting emergency services. How would you tell 300 people what's happening? If your venue doesn't have a PA system, who tells whom, and in what order?
There's no requirement at standard tier for physical security measures. No bag searches, no CCTV, no barriers. The focus is on having a plan and making sure your team understands it. The guidance uses the phrase "reasonably practicable" throughout, which basically means proportionate to your venue. What's reasonable for a 300-seat theatre is different from what's reasonable for a village hall that hosts a quiz night.
If you're thinking about broader event safety planning (risk assessments, insurance, crowd management), our event protection guide covers the full picture.
What about the enhanced tier?
For the enhanced tier (800+), the requirements go further. You'll need risk assessments, physical measures where appropriate, a written security plan for the SIA, and a named person in your organisation who's responsible for making sure it all happens.
Who is the responsible person under Martyn's Law?
Whoever has control of the premises. For a permanent venue, that's the operator. For an event in a hired space, it's whoever takes control of the site for the event. If a school hires out its hall to an external group, it depends on who's running things on the day.
Venues and hirers need to be clear with each other. If you're hiring a space, ask what procedures are in place. If you're a venue, make sure your hirers know what's expected. It's worth writing it into your hire agreements so everyone's on the same page.
Does Martyn's Law apply to free events?
Yes. The Act is based on venue capacity, not whether you charge for entry. A free open day with 250 people on site is just as in scope as a sold-out ticketed show.
If you run free events and assume this doesn't apply because nobody's buying a ticket, it does. But if you already take free registrations through a booking platform, you'll have the attendance data you need to check whether you're hitting the 200 mark.
What does Martyn's Law mean for ticketed events?
If you're already running ticketed events, you've got a head start on quite a bit of this.
Your booking data tells you whether you regularly hit 200. That's the starting point for everything. Contact details collected at booking give you a way to reach visitors at short notice, whether for a routine cancellation or something more serious. And if you scan tickets at the gate, you've got a live picture of how many people are currently on site.
None of this is compliance on its own. But the Act asks venues to think about numbers, data and communication, and if you're already ticketing, a good chunk of that groundwork is done.
How to get started
None of this needs to be complicated, and you don't need to have everything figured out before the Act comes into force.
One thing worth saying upfront: the Government has been clear that you shouldn't need to hire consultants or buy specialist products to comply. If someone's trying to sell you a Martyn's Law compliance package, that's not what the Government intended. The standard tier requirements are designed to be manageable on your own.
Start by checking your numbers. Look at your busiest days from the past year. Do you regularly hit 200 including staff? Your booking reports and attendance records will tell you pretty quickly.
Then read the statutory guidance. It's on GOV.UK and it's genuinely readable, not the usual wall of legal text. ProtectUK has supporting materials too, including a free ACT Awareness e-learning course if you want to go further.
After that, have a conversation with your team. It doesn't need to be formal. Ten minutes asking "what would we actually do?" goes a long way. Who calls 999? Who manages the entrance? Where do people go if they can't leave the building? The Arena inquiry showed that plans on paper aren't enough. The people on the ground need to have thought it through.
It's also worth checking whether your trade body or sector association is producing specific guidance. Many already are, and their advice will be tailored to the kind of venue you actually run.
And talk to your insurer. Some are already asking about Martyn's Law preparedness, so it's better to raise it yourself than be caught off guard.
Is Martyn's Law manageable for smaller venues?
Honestly, most of what the standard tier asks for is common sense that good event organisers are already halfway to. You know your venue. You know how many people come through the door. You probably already have a fire plan. The gap between where you are now and where the Act needs you to be is likely smaller than it sounds.
Spring 2027 will come around quickly, but there's plenty of time to get ready if you start now. The organisers who'll find this easiest are the ones who had the conversation early, even if it was just ten minutes with their team asking "what would we do?"
If you want to see how your booking data can help you figure out your numbers, create a free account on TryBooking or get in touch and we'll walk you through it.