Martyn's Law: what venues must do, and where texts fit

Martyn's Law is the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and will require whoever controls premises where 200 or more people may be present at once, and events for 800 or more, to have plans for keeping people safe if an attack happens. It isn't in force yet. The Security Industry Authority (SIA), which will regulate it, said in July 2026 that it expects the Act to come into force in spring 2027, and that it will confirm the exact date ahead of time. The Home Office published the statutory guidance on 15 April 2026, so the detail of what's expected is already public.

The Act is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017, and his mother, Figen Murray, led the campaign for it. For a venue, pub, hotel or shop that fills up on a Saturday, it adds a short list of duties. One of them is communication, meaning how information reaches people on the premises, and that's the duty a staff text sits closest to.

Is Martyn's Law in force yet?

No, apart from the parts that let the government and the regulator prepare. Section 37 says the main provisions come into force on days the Secretary of State appoints by regulations, and so far there have been two sets. The first brought section 27, the duty to publish guidance, into force on 10 April 2026. The second, made on 10 June 2026, brought in the SIA's duty to prepare its own guidance and give advice, plus a duty to produce a statement on what it counts as worldwide revenue for penalties, from 15 June 2026. The duties on premises themselves (sections 5 to 10) are still waiting.

The statutory guidance puts the timing like this: "The implementation period is at least 24 months from Royal Assent to allow those in scope of the Act to prepare for the requirements of the Act coming into force". It adds that there's no legal requirement to comply until then, but "those in scope of the Act will wish to begin considering the requirements". Twenty-four months from 3 April 2025 is April 2027, which sits with the SIA's spring 2027.

The SIA consulted on its own guidance (how it will inspect and enforce) between 15 April and 12 June 2026, and says it will publish the final version and a consultation report in autumn 2026. It's building an online portal for notifications, and from early 2027 it'll invite volunteers to test it.

Which premises and events does it cover?

Section 2 sets four tests for premises. They have to be a building, or a building with land; be wholly or mainly used for one of the uses in Schedule 1; be somewhere "it is reasonable to expect that from time to time 200 or more individuals may be present on the premises at the same time"; and not be excluded by Schedule 2. The SIA's page adds a detail worth knowing: the 200 "includes members of staff".

Schedule 1 is broad. It covers shops and services for visiting members of the public, food and drink for consumption on the premises, entertainment and leisure, sports grounds, libraries, museums and galleries, venues for hire, exhibition halls and conference centres, visitor attractions, hotels, hostels and holiday parks, places of worship, health care, railway, bus and tram stations, airports and other aerodromes, childcare, schools, further and higher education, and public authority premises that serve visiting members of the public.

Then the tiers. Premises where 800 or more people may be present at once are "enhanced duty premises"; everything else that qualifies is standard. Places of worship, childcare, schools and further education stay in the standard tier however big they are. Events are covered separately by section 3: an event qualifies if 800 or more people may be present at once, the public can attend, there are checks on entry (payment, tickets or passes, or membership of a club), and it isn't held at premises that are already enhanced tier.

How many places is that? The Home Office's impact assessment for the Bill, dated 16 July 2024, modelled the capacity of UK premises and came up with a central estimate of 154,623 in the standard tier and 24,268 in the enhanced tier, out of 928,554 sites it looked at. Retail and hospitality dominates both.

Those are modelled numbers, built from floor areas and fire safety crowd densities where real capacities weren't known, and the assessment's own sensitivity range runs from 123,900 to 177,000 for the standard tier. The guidance comes with a separate document on assessing how many people can reasonably be expected, because the number you can reasonably expect at the busiest times is what decides the tier.

What each tier has to do

Section 5 is the duty every qualifying premises shares. The person responsible must, "so far as is reasonably practicable", have public protection procedures in place to reduce the risk of physical harm if an attack happens on the premises or nearby. The Act lists four kinds, to be followed by people working there:

• evacuating people from the premises
• moving people to a safer place on the premises (the guidance calls this invacuation)
• preventing people entering or leaving (lockdown)
• providing information to people on the premises (communication)

The SIA explains "reasonably practicable" as weighing what can be done against "the cost, time and difficulty of implementation", taking account of the nature of the premises and the resources you have. For a 250-capacity pub, that means a notification and procedures, and nothing more.

The enhanced tier adds more. Section 6 requires public protection measures (monitoring, controlling how people move in and out, physical security, and the security of information about the premises), and section 7 requires a written document setting out the procedures and measures and how they reduce risk, with a copy sent to the SIA. Where the responsible person isn't an individual (a company, say), section 10 requires a named senior individual.

What the guidance says about communication

Paragraphs 7.46 to 7.49 of the statutory guidance deal with the communication procedure. Its purpose is "to ensure information is provided to people at the premises or event, alerting them to danger as quickly as possible if an attack is taking place". The guidance lists the forms it can take as "verbal communication, signage, posters, briefings and audio broadcasts", with messages such as moving inside away from windows, going to a safer space or exit, or "simply to get down, stay quiet and stay hidden".

It then asks the responsible person to think about four things. What information should go to the public and what to staff, since "this information might differ", and it should be "simple and clear". Who shares it, including "how staff will communicate with each other and how information will flow between staff and decision-makers". How to share it quickly: "public address systems, loud hailers/megaphones, closed radio systems and alarms could be used at larger premises or events, and more basic forms of alert such as giving loud, clear verbal commands could be used at smaller premises". And how to set the channels up before they're needed, by "documenting procedures, briefing staff and testing the communication procedure".

The worked example is a standard tier hotel: a guest reports an unattended bag in the lobby, the duty manager uses the PA system to start an evacuation through the back doors, and the receptionist calls the police. Another example has a shop owner who locks the door, moves people to a back room, calls the police "and also posts a message on an incident reporting chat group for local businesses"; a café up the road sees it and brings its customers inside.

Where a text fits, and where it doesn't

Notice what's on the guidance's list for the moment of an attack: voices, PA systems, radios, alarms. A text isn't there, and with good reason. A business text is fast most of the time, but it's queued, routed and delivered by networks, and our post on why a text can arrive late explains the ways that can go wrong. Staff on a busy floor aren't looking at their phones either. For "get down and stay hidden", a shout beats a message.

Texts are useful around the edges of the procedure:

• staff who aren't on shift, who need to know not to come in, or where to go instead
• managers, key holders and the senior individual, if they're off site when something starts
• the slower follow-up once the immediate response is done: reopening times, where to collect belongings, who to call
• the preparation the guidance asks for, such as briefing reminders and the date of the next test

A staff text in that role should be short, say who it's from, and give one instruction:

"Crown Rooms: the venue is closed today on police advice. Do not come in for your shift. Your manager will call you by 2pm. Reply OK when you've read this."

That's 154 characters, so one SMS part. The reply line does a job a broadcast can't: from a two-way number the OKs come back to one inbox, and whoever's coordinating can see who hasn't answered. Our post on shift alerts by text covers the everyday version, and the staff alerts page has the set-up.

Two cautions from the guidance apply to texts too. Keep what goes to the public separate from what goes to staff, because the instructions differ. And watch what you put in writing. For enhanced tier premises, the guidance on security of information warns that "providing excessive details could create vulnerabilities" and singles out material drawn up for internal use, such as plans showing CCTV. A staff text that lists where the safe rooms are, sent to everyone who has ever worked a shift, is that kind of material. Keep the text to the instruction and leave the detail in the written procedure.

Event marketing texts and the notification clock

Texts also meet Martyn's Law in event marketing. Section 9 will require the person responsible for a qualifying event to notify the SIA, and the Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026, made on 9 July 2026, set the deadline. For an event first publicised after the duty starts, notification is due "before the end of the period of 14 days beginning with the day on which it is so publicised". An event counts as first publicised when its date is made available to the public to advertise it, "through any medium".

The Home Office's notification guidance spells out what counts: websites, social media, posters, and "communications sent to the public or customer mailing lists". A promotional text announcing the date of an 800-person ticketed night to your customer list is that kind of communication. If it's the first time the date goes out, it starts the 14-day clock, once the duty is in force. The regulations come into force on the same day as section 9(1), and premises get three months from that day to notify. The text itself still needs the usual marketing basis, consent or the soft opt-in, which our SMS marketing rules guide covers.

CaptiFi Connect can hold a separate staff list, send to it from the dashboard or through the API, and bring the replies back to one shared inbox that your managers can see under their own team logins; the venues page shows the set-up. The SIA will start testing its notification portal with volunteers from early 2027, and the guidance says templates for writing the procedures down will follow.