White paper from Assurity Consulting

Following a period of consultation and amendments the Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, received Royal Assent on Thursday 3rd April 2025. The aim of the legislation is to improve protective security and organisational preparedness across the UK, following the Manchester Arena Attack.

So, what does this mean for your business?

1. The background to Martyn’s Law

At 22:30 on 22nd May 2017, in a foyer filling with people following an Ariana Grande concert at the Manchester Arena, Salman Abedi detonated a bomb killing 22 children, teenagers, parents and others, injuring another 1,017. One of those who died was 29-year-old Martyn Hett, after who the law is named and who’s mother Figen Murray led the campaign for the new law.

Since them Counter Terrorism Policing (CTP) report that they “and the UK Intelligence Services have stopped seven late-stage terror attacks since the start of the Covid-19 pandemic”.

“That takes the total number of foiled terrorism plots since March 2017 to 32 – with 18 related to Islamist extremism, 12 to Extreme Right Wing Terrorism (XRWT) and two to Left, Anarchist or Single Issue Terrorism (LASIT)”.

The Act therefore finally delivers on successive governments commitment to strengthen the security of public events and venues. GOV.UK explaining that the law will see “the public are better protected from terrorism by requiring those responsible for certain public premises and events to take reasonably practicable steps to be prepared and ready to keep people safe in the event of an attack. Certain larger premises will be required to consider and, where appropriate, take steps to reduce their vulnerability to acts of terrorism.”

2. What does Martyn’s Law cover?

The Act sets out a tiered approach to make sure that the controls required are in keeping with the level of risk posed. Subject to conditions, qualifying premises will be where 200 or more individuals (including staff) must, from time to time, be reasonably expected to be present at the same time in connection with one or more uses specified in the Act.

Dependant on numbers likely to be present at the premises or event, a two-tiered approach Standard and Enhanced.

Standard duty premises (Standard tier) – Premises whereby it is reasonable to expect that at least 200 individuals may be present at least occasionally but not more than 799. If 800 or more individuals may be expected, the premises will be enhanced duty.

Responsible person – For qualifying premises, the responsible person is the person who has control of the premises in connection with the use e.g. the use of a venue as a sports ground. For multi-use premises this is the person who is responsible for the premises principal use.

Requirements for standard duty premises:

-Notify the Security Industry Authority (SIA) of their premises; and

-Have in place, so far as reasonably practicable, appropriate public protection procedures.

These public protection procedures are those which should be followed by people working at the premises if an act of terrorism were to occur at the premises, or in the immediate vicinity. These are meant to be simple, low-cost activities with costs relating primarily to time spent. There is no requirement to put in place physical measures.

Enhanced duty premises (Enhanced tier) – An event where it is reasonable to expect that there will be at least 800 individuals present at some point during it.

Responsible person – For qualifying events, the responsible person is the person who has control of the premises at which the event will be held for the purposes of the event. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park for the purposes of that concert, the company putting on the event will be the responsible person. However, if a stately home puts on a concert in its grounds and maintains control of the site for the purposes of that concert, the stately home will be the responsible person.

Requirements for enhanced duty premises:

• As per standard duty

• Have in place, so far as reasonably practicable, appropriate public protection measures that could be expected to reduce both (i) the vulnerability of the premises or event to an act of terrorism, and (ii) the risk of physical harm being caused to individuals if an attack was to occur there or nearby. For example, bag checks, scanners, CCTV or physical security presence.

• Document the public protection procedures and measures in place and provide this document to the SIA.

• Where the responsible person is not an individual, they must designate a senior individual with responsibility for making sure that the responsible person complies with these requirements.

3. What premises and events qualify/fall in scope for Martyn’s Law?

For qualifying premises, those in scope for standard tier will be:

• There is at least one building (or the premises are in a building);

• The premises are wholly or primarily used for one or more of those specified in Schedule 1 of the Act (see below);

• It is reasonable to expect that at least 200 individuals may be present “at least occasionally”; and

• The premises are not excluded under Schedule 2 of the Act

Where 800 or more people would be expected at the premises, these will become enhanced duty premises.

For qualifying events the criteria that apply to those falling into scope for enhanced tier are:

• They take place at a building, other land or a building and other land, including parts or groups of buildings;

• Members of the public will have access for the purpose of the event;

• It is reasonable to expect that, at some point, 800 or more individuals present for the event;
• Measures will be in place, for the purpose of attending the event, to secure or check that members of the public who wish to access it:

-Have paid to do so;

-Have tickets or passes allowing access; or

-Are members or guests of a club, association or similar body; and the event is not excluded as mentioned above in relation to premises.

Schedule 1 of the Act “Specified uses of Premises” includes:

• Shops etc. – where the sale, display or service is principally to visiting members of the public

• Food and drink – where the food or drink is principally for consumption on the premises by visiting members of the public;

• Entertainment or leisure activities – where the activity is principally for the benefit of visiting members of the public;

• Sports grounds (UK definitions apply);

• Use as a library, museum or gallery where admittance is principally to visiting members of the public;

• Halls etc. used as venue for hire for events or activities/an exhibition hall, or a conference centre;

• Visitor attractions – where used of cultural, historic, touristic or educational value;

• Hotels – incl. hostels and holiday parks;

• Places of worship;

• Healthcare – inc. hospitals;

• Bus and railway stations;

• Aerodromes (exc. military);

• Childcare (UK definitions apply);

• Primary and secondary education;

• Further education;

• Higher education;

• Public authorities – use (other than use mentioned elsewhere in the Schedule) for the provision by a public authority of facilities or services to visiting members of the public; and

• References to visiting members of the public – the schedule states: In determining for the purposes of this Schedule whether premises are used by visiting members of the public, it is irrelevant that access to the premises may be limited (at all times or particular times) to members of the public who:

a. Have paid to access the premises;

b. Have tickets or passes allowing access; or

c. Are members or guests of a club, association or similar body

Schedule 2 of the Act “Excluded premises and events” includes:

1. Legislatures and devolved administrations – purposes of either House of Parliament;
2. Devolved parliaments in Wales, Scotland and Northern Ireland;
3. Parks, gardens, etc. where members of the public have not paid to do so, don’t have tickets or passes allowing access, are not members or guests of a club, association or similar body;
4. Transport security (various exceptions apply);
5. Events to be held on certain excluded premises; and
6. Events at certain places of worship, schools, etc.

4. Martyn’s Law other considerations

Regulator and enforcement – The Security Industry Authority (SIA) will be the regulator and responsible for providing guidance and making sure compliance is up held with the new legislation. Sections 12 to 26 of the Act covers enforcement, fines and offences, with penalties for non-compliance as big as £18 million or 5% of qualifying worldwide revenue.

Commencement – It has been proposed that the requirements will not be enforceable for 24 months, providing time for the responsible persons of qualifying premises and events will have time to appropriately plan and implement as relevant the requirements, as well as the SIA to set up their new internal functions and provide further guidance

Public protection procedures – Measures to be followed by individuals working on the premises or at the event if there is reason to suspect that an act of terrorism is occurring, or is about to occur, on the premises, at the event or in the immediate vicinity of the premises or event include:

a. For evacuating individuals from the premises or event;

b. For moving individuals to a place on the premises or at the event where there is less risk of physical harm being caused to them;

c. For preventing individuals entering or leaving the premises or event; and

d. For providing information to individuals on the premises or at the event.

For enhanced duty premises and qualifying events, they also relate to:

a. The monitoring of the premises or event and the immediate vicinity of the premises or event;

b. The movement of individuals into, out of and within the premises or event;

c. The physical safety and security of the premises or the premises at which the event is to be held; and

d. The security of information in relation to the premises or event.

White paper from Assurity Consulting

1. The importance of senior management engagement

Health and safety senior management engagement refers to the active and visible participation of your top-level executives in the development, implementation, and continuous improvement of your health and safety performance. They set the tone, directly influencing the behaviours and attitudes of employees to health and safety and so are critical to your organisations prevailing culture.

Senior management engagement provides strategic leadership in aligning your health and safety objectives with the wider business goals. It communicates a clear message to employees, contractors, and other stakeholders that safety is a core value rather than just a regulatory obligation. Having said that, regulatory compliance/risk management has been (and still is for many) the primary driver for health and safety in organisations.

Financial risk, particularly with the introduction of revised sentencing guidelines for health and safety and food safety in 2016: and the significant increase in penalties for both organisations and individuals where prosecutions occur (currently about 3 a week on average according to HSE figures) – which may surprise some and certainly does for more than a few directors!

Moral risk management, back to culture and trust, has been a developing driver, hand in hand with EDI, staff attraction/retention, pay and conditions and the greater expectation employees have for their working life. But being a caring employer and having ‘a good place to work’ is always a benefit.

Of all these though, reputational risk management is the aspect that is having most traction. With more information about organisations being expected by consumers, customers, investors and employees, the importance of non-financial risk management (particularly health and safety) cannot be discounted. Are you adding any content/information to your health and safety initiatives? How could you engage with your senior management to deliver better/more/verifiable health and safety content?

Leadership commitment is a key component in safety management systems, i.e. ISO 45001 and publications such as “Leading health and safety at work” (HSE). If your organisation is looking to secure or maintain such systems, what is in place to actively demonstrate this commitment?

All these points offer opportunities to not only promote the positive benefits of successful health and safety management but also remind senior managers of the responsibilities and accountability they have as duty holders.

2. Factors to consider/sell when engaging senior management

Good health and safety is good for business. The positive impacts you and your senior management should be considering and promoting are:

• Keeping employees and others safe in work – effective health and safety management reduces accidents, illnesses, and serious injuries at work (less lost time).

• Complying with legislation – and promoting the positives not just minimising the risk in legal and/or civil action and reputational damage.

• Improving productivity/efficiency – minimising disruptions caused by accidents and incidents, therefore delivering more consistent operations and higher employee productivity.

• More effective cost management – such as compensation claims, medical expenses, legal fees, and insurance premiums.

• Employee morale and retention – a strong health, safety and wellbeing culture improves morale and reduces turnover.

• Positive reputation – being able to demonstrate a positive and proactive safety culture shows professionalism and responsibility, that can help attract better talent, partners, and customers.

• Better risk management – good health and safety management helps identify and control risks before they cause harm, protecting your people, places and processes.

• Better business continuity – serious accidents/safety failures can have a major impact on business; good safety management is key to long-term operational stability.

• Better ethical management – well-managed health and safety reflects ethical leadership and corporate responsibility.

3. What should good senior management be doing?

Senior management can demonstrate genuine and active engagement in health and safety through a variety of practical and visible actions. These include:

Setting the right example

What senior management see as important, so do the rest of the organisation. Adopting or ignoring the health, safety and wellbeing procedures you have in place either helps promote or undermines what you have in place.

Establishing clear policies and objectives

Senior leaders should make sure that robust health and safety policies are in place, clearly articulated, and aligned with the organisation’s goals. Your policies should be more than formal documents – they should reflect the way you want to do business.

Providing resources and support

Effective engagement means not only promoting safety but allocating adequate resources in terms of time, money and people to implement safety initiatives. A mentality of investing– rather than spending – in appropriate risk assessments, training, equipment, and health surveillance is fundamental to good health and safety.

Getting involved

Visibility reinforces the importance of safety and encourages employee involvement. Does your senior management actively participate in health and safety audits, inspections, toolbox talks, or safety meetings, they all demonstrate commitment.

Integrating safety into business process

Put health and safety considerations into your strategic planning, procurement, project management, and operational procedures embeds it into your business operations. Safety becomes ‘business as usual’.

Monitoring performance and learn from incidents

Review your health and safety performance (through e.g. KPIs, accident, incident and near-miss reports) helps make informed decisions. When incidents occur, senior management should lead or be actively involved in investigations and learn from any lessons.

Create the right culture

An engaged senior management team creates a strong health and safety culture. Culture, in this context, is about the shared beliefs, practices, and attitudes toward health and safety across the organisation. A culture shaped by engaged leaders is one where safety is considered everyone’s responsibility.

We’ve seen many examples where senior management getting involved has had a real impact on standards and performance.

4. What barriers to good health and safety management do we see and how can they be avoided?

While few, if any, senior managers have said health and safety is not a priority, there can be several potentially conflicting interests or barriers that can cause challenges in what and how is implemented. These can include:

Competing priorities: business pressures, such as meeting financial targets or deadlines, can sometimes overshadow safety considerations. This can be avoided by using data (i.e. accident investigation information) and your business intelligence to demonstrate the financial and reputational benefits of proactive safety leadership. Underlying causes is key here.

Lack of understanding/training: some senior managers may lack the technical knowledge or understanding of their role in promoting and influencing safety culture. Many directors and senior managers are sadly unaware of their specific responsibilities particularly with health and safety and the law.

This can be avoided by incorporate health and safety leadership training into executive development programs or providing specific training/briefings on health and safety. Current topics, such as Martyn’s law and updated guidance, are always good conversation starters.

Delegation of responsibility: leaders erroneously believing that safety is the responsibility of others – health and safety officers, line managers and even contractors. Yes, everyone has a responsibility for health and safety, but the primary duty is with those who create the risk in being responsible for managing it (to paraphrase the HSE).

This can be avoided by making safety performance visible throughout the organisation, part of senior managers’ appraisals and incentive structures and with good policies, procedures and training in place.

5. In summary

In summary, fundamentally effective senior management engagement is about creating and maintain the culture of the organisation. Promoting and delivering good health and safety benefits everybody, and while some may seem a little more intangible, those benefits can include:

• Reduced incidents, injuries and lost time: a culture led by engaged leaders results in fewer workplace accidents.

• More effective cost management: preventing incidents means less downtime, fewer compensation claims, and lower insurance premiums. As the saying goes if you think safety is expensive, see what having an accident costs!

• Improved compliance and risk management: better systems and clear expectations drives better performance, especially when driven from the top.

• Better employee relations: workers feel more valued and respected, leading to improved morale and lower turnover.

• Enhanced reputation: organisations with a strong safety culture and leadership will attract better talent, customers and potentially investors.

Senior management engagement in health and safety is not optional – it is a fundamental part of business management and those that do it well will benefit from the investment.

By leading from the front and committing to allocate resources, setting the right example and embedding safety within the core of business operations, your senior management have a significant role to play in your health and safety culture.

When your senior management show that health and safety matters to them, it starts to matter to everyone else in the organisation too.