Martyn's Law for businesses in Northern Ireland

Business · October 2026 · Aegis advisory team

Martyn's Law applies to many businesses that welcome the public, from shops and gyms to cinemas, halls and visitor attractions. The first job is to work out whether you are in scope and, if so, which tier.

What is Martyn's Law?

Martyn's Law is the Terrorism (Protection of Premises) Act 2025. It became law in April 2025, applies across the whole of the UK, including Northern Ireland, and is expected to be enforced from spring 2027. The Security Industry Authority (SIA) is the regulator.

Is my business in scope?

Three questions decide it:

1. Is the premises used for a purpose listed in the Act? The list includes shops, food and drink, entertainment and leisure, sports grounds, halls, visitor attractions, hotels, health care, transport hubs and more.
2. Do members of the public have access? A private office used only by staff is generally not in scope.
3. Are 200 or more people reasonably expected to be present at the same time? Count staff as well as customers, and think about your busiest periods.

Who is the responsible person?

The responsible person is whoever has control of the premises. For most businesses that is the company itself, not an individual employee. The responsible person must notify the SIA when the notification process opens.

If your unit is inside a larger premises, such as a shopping centre, retail park or mixed-use building, you will need to coordinate with the operator of the wider site so that procedures work together.

Standard tier duties

Have the following in place, so far as is reasonably practicable, and make sure staff know them:

• Evacuation: getting people out safely.
• Invacuation: bringing people inside to a safer place.
• Lockdown: securing the premises to keep a threat out.
• Communication: raising the alarm and telling people what to do.

There is no requirement for standard tier premises to buy physical security equipment.

Enhanced tier duties

Larger venues must also put in place measures that reduce vulnerability to an attack, so far as reasonably practicable. These cover four areas: monitoring the premises and its surroundings, controlling the movement of people, physical safety, and the security of sensitive information. You must document your assessment and plan, and an organisation must designate a senior individual who is accountable for compliance.

Penalties

• Standard tier: fines of up to £10,000, plus daily penalties for continued non-compliance.
• Enhanced tier: fines of up to £18 million or 5% of worldwide revenue, plus daily penalties.

Some serious failures, such as obstructing the regulator, are criminal offences.

Why it matters to the board

Martyn's Law is not only a security issue. It is a decision-making and accountability issue. Leaders will need to show that they understood the duty, considered the risks to their premises and made proportionate, recorded decisions. That record is what stands up if the SIA, an insurer or a court asks questions after an incident.

First steps

1. List every site you operate and assess realistic peak numbers at each.
2. Decide which sites are out of scope, standard tier or enhanced tier, and record why.
3. Confirm the responsible person and, for enhanced sites, the designated senior individual.
4. Draft procedures for each in-scope site and brief staff.
5. Agree how compliance will be reviewed and reported to the board.

This article is general information, not legal advice. It reflects the Terrorism (Protection of Premises) Act 2025 and the Home Office statutory guidance published in April 2026. Check the current guidance, or speak to us, before relying on it for your own premises. Last updated October 2026.