What Martyn’s Law is
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. It is known as Martyn’s Law after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. It requires those responsible for certain premises and events to be ready to keep people safe if a terrorist attack happens, and it makes the Security Industry Authority (SIA) the regulator.
Is it in force yet?
Not for schools. Section 37 says the duties in Part 1 start on a day set by regulations. As of 20 October 2026, only these provisions have been brought into force:
- section 27 (Home Office guidance), from 10 April 2026 (SI 2026/320)
- section 12(2) and (3) (SIA guidance) and section 18(5) to (7) (an SIA statement on revenue), from 15 June 2026 (SI 2026/622)
The duties on schools in sections 5 and 9 are not yet in force. The government committed to an implementation period of at least 24 months from Royal Assent (statutory guidance, paragraph 2.10), and the SIA says it expects the Act to come into force in spring 2027, with the exact date to be confirmed. Until then there is no legal duty to comply, but the Home Office published its statutory guidance in April 2026 so that organisations can prepare.
Which schools are in scope
Premises are in scope if they include a building, are wholly or mainly used for a use listed in Schedule 1, and it is reasonable to expect 200 or more people on site at the same time, from time to time (section 2). Schedule 1, paragraph 14 covers primary and secondary education, including maintained schools, academies and alternative provision academies, independent schools, non-maintained special schools and pupil referral units.
When counting:
- include staff. The Home Office guidance says the figure “must include staff working at the premises”, which means employees, contractors and volunteers (paragraph 4.23). DfE’s education page says the count is “staff and learners”.
- use your busiest regular times, not the average. If 200 or more are present “on occasion”, the test is likely to be met (paragraph 4.31).
- keep your evidence. Whatever method you use must be evidenced and must satisfy the SIA if asked (paragraph 4.25).
A school that can’t reasonably expect 200 people at once is out of scope, though DfE still encourages every setting to have preparedness plans.
Schools are always standard tier
The Act has two tiers: standard (200 to 799 people) and enhanced (800 or more). Schools are treated differently. Schedule 1, paragraph 14(3)(b) says school premises are standard duty premises “regardless of how they would otherwise be treated” (statutory guidance, paragraph 4.38). So a secondary school of 1,500 pupils is standard tier, as are early years and further education settings. Universities are not covered by this rule and can be enhanced tier.
Who is responsible
The Act names the responsible person for schools (Schedule 1, paragraph 14(3)(a)):
- for a pupil referral unit, the local authority that maintains it
- for any other school, the governing body or, where there is no governing body, the proprietor
That responsibility can’t be handed to a contractor, though tasks can be delegated (paragraph 6.1). Where one body is responsible for several sites, such as a trust, the Home Office guidance says it should think about each site separately rather than use one plan for all (paragraph 6.6).
What standard tier schools will have to do
1. Notify the SIA (section 9). The responsible person must tell the SIA when they become, or stop being, responsible for the premises. Under SI 2026/793, a site already in scope has three months from when section 9(1) comes into force to notify, through the SIA’s online portal. The notification includes the responsible person’s details, the address, the greatest number of people reasonably expected on site at once and how that was worked out. Changes must be notified within 28 days.
2. Have public protection procedures (section 5). So far as is reasonably practicable, there must be appropriate procedures for staff to follow if an attack is happening or about to happen on or near the site:
- evacuation: getting people out
- invacuation: moving people to a safer place inside
- lockdown: stopping people entering or leaving
- communication: giving information to people on site
Most schools already have lockdown and evacuation plans, and the Home Office guidance recognises this (paragraph 4.38). The work is checking that your plans cover a terrorist attack, including one nearby, and that staff know their part. DfE’s school and college security guidance, updated in July 2026, covers security policies, lockdown and visitors.
3. Make sure staff know the procedures. There is no required course, but staff who would carry out the procedures must know them and their role (paragraphs 7.51 to 7.53). The guidance says buying third-party training or products is not mandatory (paragraphs 6.7 and 7.55).
Standard tier schools do not have to put in public protection measures such as CCTV or bag searches, appoint a designated senior individual or send a compliance document to the SIA. Those duties apply only to the enhanced tier and to qualifying events (sections 6, 7 and 10).
Events and hiring out the site
An event at a school can’t be a qualifying event, however many tickets are sold (Schedule 2, paragraph 6). If a hirer uses your hall or field, the governing body or proprietor stays responsible. The Home Office guidance gives the example of a school playing field hired for a 950-person festival: the school stays standard tier and sets out the hirer’s duties in the hire agreement.
Enforcement
The SIA will assess compliance through desk-based checks and inspections, usually with at least 72 hours’ notice. For standard tier premises, the maximum penalty is £10,000 (section 18), plus up to £500 a day for not complying with a compliance or restriction notice (section 19).
Still to come
As of 20 October 2026:
- the commencement date for the duties hasn’t been set
- the SIA consulted on its own guidance from 15 April to 12 June 2026 and says the final version will follow in autumn 2026
- DfE said in 2025 that it would publish guidance for education settings during the implementation period; we found no separate DfE statutory guidance on Martyn’s Law yet
Martyn’s Law sits alongside other site and visitor changes in 2026, such as the removal of the supervision exemption for volunteers. See safeguarding changes in 2026 and the single central record.