Martyn's Law: what every small UK venue needs to know before 2027The biggest change to venue law in a generation lands on the rooms least equipped to hear about it. Here's the plain-English version — the threshold, the tiers, the four procedures — and the free tool that drafts them for you.
TL;DR: 200 people is the threshold, procedures are the duty
Martyn's Law — formally the Terrorism (Protection of Premises) Act 2025 — received Royal Assent on 3 April 2025 and is expected in force around 2027. It reaches every UK premises where it’s reasonable to expect 200 or more people at once, including staff and performers: pub back rooms, 250-capacity clubs, community halls. Standard tier (200–799) asks for two things: notify the regulator (the SIA) and keep simple, written public protection procedures — evacuation, moving people to safety inside, lockdown, communication. No mandated equipment. Enhanced tier (800+) adds protective measures and a documented assessment. The venues this lands hardest on are the ones with no security consultant — which is exactly who this guide (and the free readiness check we built) is for.
New to venue compliance generally? The UK live music licensing guide covers the licensing side, and the free compliance checklist maps every duty your venue owes.
On 22 May 2017, a bomb was detonated in the foyer of Manchester Arena as an Ariana Grande concert ended. Twenty-two people were killed. One of them was Martyn Hett, a 29-year-old from Stockport. His mother, Figen Murray, spent the years that followed campaigning for one thing: a law requiring venues to at least think about what they would do if it happened to them. On 3 April 2025, that law — the Terrorism (Protection of Premises) Act 2025 — received Royal Assent. Everyone calls it Martyn's Law.
Here's the problem we keep seeing across the venues on GigXchange: the arenas and stadiums this law was written in the shadow of have security departments who have been preparing for years. The 250-capacity club, the pub back room, the community hall — the rooms that host most of the UK's grassroots live music — mostly haven't heard of it. And they're exactly who the standard tier is designed for.
Martyn's Law: the cite-ready facts
- The Terrorism (Protection of Premises) Act 2025 (c. 10) received Royal Assent on 3 April 2025, with an implementation period of at least 24 months — duties expected in force around 2027. Source: legislation.gov.uk.
- Standard tier: premises where 200–799 people (including staff) may reasonably be present at once must notify the Security Industry Authority and keep documented public protection procedures. Source: Home Office statutory guidance (April 2026).
- Enhanced tier: premises expecting 800+ people additionally need public protection measures, a documented vulnerability assessment, and a designated senior individual where an organisation is responsible. Source: statutory guidance.
- The four procedure areas the guidance names: evacuation, invacuation, lockdown, communication — required "so far as reasonably practicable" for the premises. Source: ProtectUK.
- Context: UK grassroots venues run on a 2.5% average profit margin, and most are operated by 1–2 people who also do the bookings and the bar — which is why a paperwork-first, no-mandated-kit standard tier matters. Source: Music Venue Trust Annual Report 2025.
Which tier is your venue in?
Everything turns on one number: how many people — including staff and performers — it is reasonable to expect on the premises at the same time. Not your ticket allocation; everyone through the door. Your fire-risk-assessment occupancy figure is the usual evidence.
| Capacity (incl. staff) | Tier | What you must do |
|---|---|---|
| Under 200 | Out of scope | No duties — though the standard-tier procedures are free good practice for any room with a crowd. |
| 200–799 | Standard | Notify the SIA when registration opens + keep documented public protection procedures (the four areas below). No mandated equipment. |
| 800+ | Enhanced | Everything above, plus public protection measures, a documented vulnerability assessment, and a designated senior individual. |
| One-off event, 800+ expected | Qualifying event | Large one-off events carry their own duties under the Act — whatever the venue's usual capacity. |
The "including staff" nuance catches people out in both directions: a 180-ticket room can be in scope on a packed night, and a hall that could hold 250 but never reasonably expects 200 may not be. The statutory guidance covers how to assess it; when in doubt, work the number out properly first.
What "procedures" actually means
The standard tier asks for a written plan covering four situations, held by whoever is responsible for the premises and known by the people working the room:
- Evacuation — getting people out through the nearest safe exit, which may not be the door they came in through, and away from the building (not necessarily your usual fire assembly point, if it's exposed).
- Invacuation — the one nobody's heard of: moving people to safety inside, away from windows and doors, when the danger is outside.
- Lockdown — securing entry points where it's safe to do so and keeping people in place until police direct otherwise.
- Communication — how staff alert each other fast and unambiguously, who calls 999, and how you tell a room full of people what to do in short, direct instructions.
That's it. Written down, reasonable for your size of premises, and trained — including the casual bar staff who work one Friday a month. The ProtectUK hub carries free police-backed training materials for exactly this.
The 5-step prepare-now plan
| Step | Do this | Time |
|---|---|---|
| 1 | Pin down your real maximum occupancy (fire-risk-assessment figure, including staff and performers) — this decides everything. | 10 min |
| 2 | Run a readiness check to get your tier and your exact duty list — our free Martyn's Law readiness check does this from six questions. | 5 min |
| 3 | Draft the four procedures. The readiness check generates a first draft from five answers (who leads, evacuation route, safe internal spot, staff alert method, responder info) — then adapt it to your building. | An afternoon |
| 4 | Walk every member of staff through it — including casuals — and fold it into onboarding. Repeat when people join. | 30 min per briefing |
| 5 | Watch for SIA registration opening and notify when it does. Review the procedures when your layout, capacity or event pattern changes. | Ongoing |
Steps 1–3 are one afternoon, once. That's the entire distance between "never heard of it" and "ready two years early" for a standard-tier venue.
What we built to help
We build free compliance tools for grassroots venues — the Licensing Checker and Compliance Checklist already cover music licensing and the wider legal stack. Martyn's Law is the newest member of that family:
- The Martyn's Law readiness check — six questions give your tier verdict and your duties as a tickable readiness list, every item linked to the statutory guidance or ProtectUK.
- A procedures-draft generator — five short answers become a written-procedures document covering the four required areas, with a sign-off line — exported as a PDF to review, adapt and train against.
- Saved to your venue — ticks and answers live on your venue record alongside your licensing check and compliance board, restored on any device.
It's guidance, not security advice — ProtectUK and the Home Office statutory guidance are the authorities, and every screen of the tool links them. But it turns "I should probably look into that" into a document in your hand this afternoon, free.
This post is general information, not legal or security advice. Confirm your venue's position against the statutory guidance, ProtectUK, and — once its regulator function opens — the SIA. We'll refresh this post as commencement dates and SIA registration details are announced.
Frequently Asked Questions
Annual refresh commitment
This guide was published on 5 July 2026 and is refreshed every July. We re-verify every reference, recommendation, and data point once a year. Next scheduled refresh: July 2027. If any claim is outdated before then, email support@gigxchange.app and we will update it within 24 hours.
