When Martyn’s Law received Royal Assent in April 2025, much of the operational detail remained unclear. A year on, the picture has sharpened. The Home Office published 129 pages of statutory guidance on 15 April 2026, with a further update on 13 May 2026, and the implementation clock is now firmly ticking towards spring 2027.

The Terrorism (Protection of Premises) Act 2025 — Martyn’s Law — established a two-tier framework: standard tier at 200–799 persons; enhanced tier at 800 or more.

The new statutory guidance provides the operational detail that was missing. Key clarifications include how to assess expected occupancy, how “from time to time” should be interpreted (occasional peaks can bring premises into scope), and how premises-within-premises are treated (individual units in a shopping centre or entertainment complex are assessed separately from the larger site).

The Security Industry Authority (SIA) has also published guidance for public consultation, clarifying how it intends to discharge its regulatory functions — including inspections, compliance notices, restriction notices, and monetary penalties of up to £18 million or 5% of worldwide revenue for enhanced tier premises.

For venue and location owners, operators, and event organisers in the entertainment sector- particularly those involved with large capacity venues such film studios, music venues, sports grounds, and casinos –  the time for watching and waiting is over.

Most day-to-day filming activities fall outside the Act’s scope because there is no public access. Closed sets, studio shoots with controlled cast and crew, and location work on private land are typically excluded.

However, where studios combine production with public-facing activities – such as studio tours, premieres, fan events and promotional activations – those activities can bring the premises into scope. Studios welcoming thousands of visitors for tours will likely be enhanced duty premises, triggering the full suite of obligations: risk assessments, monitoring and surveillance, access control, documented compliance submitted to the SIA, and a designated senior individual.

A particularly important clarification concerns filming locations. The Act applies where a location is open to the public during filming or hosts public events, and 200 or more people may be present at the same time – meaning temporary structures or event spaces can trigger duties. Responsibility falls on whoever has control of the premises at the relevant time, which could be the location owner, the production company, or the event organiser. This makes contractual clarity essential.

Production companies should now be conducting terrorism vulnerability assessments for each location, developing evacuation and lockdown procedures, and ensuring compliance responsibilities are clearly documented in location agreements.

Given that Martyn’s Law was born from the Manchester Arena attack, music venues were always going to be a focal point. The statutory guidance now clarifies the breadth of capture: any music venue expecting 200 or more people at a time (including staff) falls within scope. That brings in a substantial number of mid-size venues, theatres, and live music pubs.

The guidance confirms that standard tier requirements are centred on procedural readiness – staff training, emergency response plans, and communication protocols – with no requirement for physical alterations or equipment purchases. This is a deliberate choice by the Government to keep the standard tier low-cost and accessible for smaller operators.

For larger venues and qualifying events with 800 or more people, the enhanced tier applies and the expectations are more far-reaching. The guidance specifies that measures relating to monitoring of the premises and their immediate vicinity are expressly required, alongside measures addressing movement, physical safety, and information security. A significant clarification for the festival sector is that outdoor events on open land qualify if they have controlled entry (such as ticketing) and expect 800 or more people at the same time- even where the site has no permanent building.

Music venue operators should now be mapping capacity, identifying the responsible person, and beginning to draft procedures.

Major stadiums – Wembley, the Etihad, Twickenham, etc. – are confirmed as enhanced tier premises requiring robust infrastructure and documented compliance.

Under enhanced duty, stadium operators must conduct event-specific risk assessments, implement monitoring and surveillance, manage movement and access, address physical security (which may include perimeter measures and screening), and collaborate with local authorities and emergency services.

A notable clarification concerns smaller grounds. Undesignated sports grounds (those not covered by the Safety of Sports Grounds Act 1975) that are freely accessible with no access controls are excluded under Schedule 2 of the Act. However, where a ground charges admission or imposes ticketing, it can fall within scope – potentially catching even non-league and community grounds that regularly host 200 or more people. For smaller clubs without dedicated security teams, meeting even standard tier obligations raises legitimate financial and resource concerns.

The fan experience implications are also worth noting. Enhanced tier grounds will likely see longer entry times, visible security presence, bag checks, and restricted access zones – potentially even at lower-league fixtures that cross the 800-person threshold. Balancing compliance with an enjoyable matchday atmosphere will be a significant operational challenge.

Casinos in major cities and resort destinations will in most cases fall within the enhanced duty category. Many already operate sophisticated security regimes, but existing measures must now be mapped against the Act’s specific requirements – monitoring, movement, physical safety, and information security – and documented in a compliance submission to the SIA.

Compliance measures are likely to include robust entry controls (ID checks, bag searches), comprehensive surveillance systems, enhanced physical security infrastructure, and staff training that extends beyond security personnel to hospitality workers who can recognise suspicious behaviour.

Where a casino forms part of a broader complex (a hotel, entertainment centre, or mixed-use development), the Act requires responsible persons to cooperate and coordinate with landlords and other tenants. The guidance notesthat persons with “some level of control” of enhanced tier premises who are not the responsible person must cooperate so far as is reasonably practicable. Casino operators within multi-tenanted premises should therefore be reviewing lease arrangements and management agreements to ensure that compliance responsibilities are clearly delineated.

Venue and location owners should now be using the methods set out in the statute and the guidance to assess occupancy and determine tier classification. It is important to identify who the responsible person is under the ‘control-based’ test (which mirrors the approach used in fire safety regulation), and for enhanced tier premises, appoint the designated senior individual. Incident response plans should be reviewed against the four categories of public protection procedure specified in the Act: evacuation, invacuation, lockdown, and communication. Staff require counter-terrorism awareness training -the Government’s free ACT Awareness training through ProtectUK is a recognised starting point. Importantly, the Government and the SIA have both explicitly warned against spending money on third-party consultants or products claiming to offer compliance solutions – no such products are endorsed.

April 2027 is approaching. The framework is in place, the regulator is preparing, and whether you run a film studio tour operation, a grassroots football club, a 300-capacity music venue, or a city-centre casino, the guidance is clear: it’s time to act.