What Martyn’s Law means for public-facing workplaces

With the forthcoming implementation of the Terrorism (Protection of Premises) Act 2025, better known as Martyn’s Law, UK organisations with public-facing premises are entering a new era of security responsibility. Named in memory of Martyn Hett, who tragically lost his life in the 2017 Manchester Arena bombing, the law aims to ensure that workplaces and venues are prepared to prevent, prepare for, and respond to acts of terrorism. 

This legislation marks a decisive shift in how employers must think about security, risk, and duty of care. While compliance will soon be a legal necessity, the broader imperative is to embed a culture of vigilance and resilience across every public-facing organisation – from corporate offices and healthcare facilities to retail spaces, educational institutions, and cultural venues.

Martyn’s Law introduces a tiered framework for compliance, based on a premises’ size, capacity, and risk profile. The Standard Tier applies to smaller sites (typically with a capacity of 100 or more). These workplaces must introduce basic security awareness training, clear evacuation and lockdown procedures, and incident response plans. 

For example, a public-facing council office, GP surgery, or university reception area may fall under this category. The Enhanced Tier applies to larger or higher-risk sites (with a capacity of 800 or more). These organisations will need to conduct detailed risk assessments, develop security management plans, and coordinate closely with local emergency services. 

Measures may include controlled access points, surveillance systems, or hostile vehicle mitigation in external areas. While the Home Office and Security Industry Authority (SIA) are expected to issue detailed guidance and enforcement frameworks, the underlying principle is proportionality: security measures must be appropriate to the venue’s size, layout, and operations – not excessive or intrusive.

Martyn’s Law sets a new minimum legal standard, but true resilience goes far beyond compliance. Checking a box on a training register will not, by itself, protect lives or reputations. For workplaces that welcome members of the public, the distinction is clear: compliance protects you legally; preparedness protects people. Consider an office building with frequent public visitors. Compliance might mean ensuring staff know evacuation routes and where the assembly points are. 

Preparedness means testing those routes under realistic conditions, ensuring security and reception teams can identify and report suspicious behaviour, and having communication protocols to guide staff and visitors during a live incident. Preparedness also means recognising that terrorist threats are not limited to bombs or vehicles. Lone-actor attacks, insider threats, or cyber-physical disruptions can all have devastating impacts. A well-prepared organisation builds layers of protection – physical, procedural, and cultural – that enable it to anticipate, deter, and respond effectively.

From my time in the military and later in private security, one lesson stands out: procedures don’t save lives – people do. A plan is only as effective as the people who understand and apply it under pressure. In the context of Martyn’s Law, this means training must be practical, scenario-based, and repeatable. Staff should be confident in recognising suspicious or unusual behaviour, responding calmly and decisively to alarms or instructions, moving visitors quickly and safely to secure areas or evacuation points, and communicating clearly with colleagues and first responders.