The plan, kept current
Named for a reason
On 22 May 2017, 22 people were killed in the attack at Manchester Arena. One of them was Martyn Hett. His mother, Figen Murray, spent the years that followed campaigning for a simple idea: that places where the public gather should have to think about what they would do if the worst happened. That campaign became the Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law. It received Royal Assent on 3 April 2025.
Where things stand
01 · 3 April 2025
Royal Assent. An implementation period of at least 24 months begins.
02 · April 2026
The Home Office publishes final statutory guidance.
03 · 2026
The Security Industry Authority (SIA) prepares to regulate, consulting on how it will inspect and enforce.
04 · Expected spring 2027
The duties come into force and the SIA begins regulating.
Dates after Royal Assent are based on current government and SIA announcements and may change.
Does it apply to you?
It depends on how many people may be on your premises at the same time, including staff. Pubs, bars, clubs, music venues, theatres, sports grounds, places of worship, shops, hotels, schools and many more are in scope if they reach the threshold.
Standard tier · 200 to 799 people
You need to tell the SIA you’re responsible for the premises and have proportionate public protection procedures in place. No physical changes to your building are required.
Enhanced tier · 800 or more people
Everything in Standard, plus public protection measures, documented compliance and, if you’re an organisation, a designated senior individual. Large qualifying events are covered too.
Capacity is the number of people who may reasonably be present at the same time, not floor area or an average night. Fire safety occupancy figures, ticket sales and historic attendance can all help you work it out.
The four procedures every in-scope venue needs
If something happened at or near your venue, would your staff know what to do in the first few minutes? The law asks you to plan for four things.
• Evacuation: getting people out safely when the threat is inside.
• Invacuation: bringing people inside and holding them safely when the threat is outside.
• Lockdown: stopping an attacker getting in, and protecting the people inside.
• Communication: alerting staff and the public quickly, and in a way they understand.
Procedures from templates.
Start from a ready-made template for each of the four, edit the steps for your building, and every change is saved as a new version.
Communication, prepared.
Pre-approved announcements for evacuate, invacuate, lockdown and more, in every language you need, each signed off by a fluent speaker.
Nobody left behind.
Personal evacuation plans for anyone who needs help getting out, recalculated when routes or hazards change.
For Enhanced tier venues
Larger venues and events also need public protection measures across four areas: monitoring, movement, physical safety and security of information. You also need to document your approach and, if you’re an organisation, name a designated senior individual.
Measures, mapped to the guidance.
Add measures by category, from CCTV coverage to bag checks to egress lanes, following ProtectUK’s framing.
The right people, named.
Record who owns your plan day to day and who is accountable at senior level, with a short wizard that explains each role.
Rehearse it on your building.
Model your site, see egress routes and choke points, and test layouts before the night.
The regulator and the penalties
The Security Industry Authority
The Security Industry Authority (SIA) will regulate Martyn’s Law. It can inspect premises, request information, issue compliance and restriction notices, and impose financial penalties.
Key facts
• Standard tier: penalties of up to £10,000.
• Enhanced tier: penalties of up to £18 million or 5% of worldwide revenue, whichever is greater.
• Daily penalties can apply if non-compliance continues after a notice.
• Inspections are typically arranged with notice, and you’ll need to show what you’ve put in place.
Show the work, every day, not just on inspection day
Your team knows the plan.
Every shift starts with a brief that includes the national threat level and the checks to run, and Vigil records who has read it.
A record that holds up.
Incidents, drills and decisions are logged at the time, signed and sealed, so your evidence is there when the SIA asks.
See your risk, plainly.
A clear picture of what’s driving your venue’s risk tonight, with every input shown. The system flags and your team decides.
Getting ready, in five steps
1. Work out your capacity and your tier.
2. Name the people responsible for your plan.
3. Write your four procedures and make sure your staff know them.
4. If you’re Enhanced tier, add your public protection measures and document them.
5. Keep it current: brief your team, run drills, and record what you do.
Vigil walks you through every step, and shows you what’s still missing.
Who it’s for
Pubs and bars
Most will be Standard tier. Vigil gets your procedures written and your team briefed.
Clubs and music venues
Busy nights, changing crowds. Keep your plan current and your evidence ready.
Large venues and events
Enhanced tier duties, measures and documentation, in one place.
The difference it makes
BEFORE
AFTER
A plan in a folder nobody opens
A live plan your team has read
Not sure which tier applies
Your tier confirmed from your capacity
No record of drills or training
Every drill and acknowledgement logged
Panic when the SIA calls
Evidence ready to show
Frequently asked questions
When does Martyn’s Law come into force?
The Act received Royal Assent in April 2025 with an implementation period of at least two years. The duties are currently expected to come into force in spring 2027.
Do I need to make changes to my building?
Not at Standard tier. Standard tier is about procedures, so your staff know what to do. Enhanced tier venues also need public protection measures, which can include physical measures where reasonably practicable.
Does capacity include staff?
Yes. It's the number of people who may reasonably be present at the same time, including staff and workers.
Does Vigil make my venue compliant?
Vigil gives you the procedures, records and evidence the law asks for, and shows you any gaps. Putting them into practice is down to your venue, and the SIA decides whether you meet the duty. No software is endorsed by the SIA.
Where can I read the official guidance?
The Home Office statutory guidance, the SIA's own guidance and ProtectUK are the best places to start. We link to them below.
Information, not legal advice
This page is a plain-English summary for information only. It is not legal advice. Always check the latest official guidance and take professional advice for your premises.
Start getting ready today.
Founding Venues get 50% off for their first year, and we’ll set you up personally.
Connect
All systems operational
Updates on new features and releases.
Vigil
© 2026 Vigil Labs Ltd. All rights reserved.