Compliance July 2026

Martyn's Law Explained: What Town and Parish Councils Really Need to Know

The new law sent ripples through village halls and local events, and some volunteers cancelled things out of fear. Here's what's actually required, who's exempt, and how to respond proportionately without spending a penny you don't need to.

Alex Jay
Alex Jay
Managing Director, Little Green Button

First, a quick hello. I'm Alex Jay, and I run Little Green Button, a digital safety company based up in Norwich. I've spent the last seven years thinking about how to keep people safe at work without wrapping them in cotton wool, so when Martyn's Law started dominating the headlines, I found myself in a lot of worried conversations with people who run local halls, parks, and events. I'll be honest with you: I think a law that gets everyone talking about safety is no bad thing. It's a bit of carrot and stick, and this is the gentle nudge most of us need. But the nerves it has created are real, so let me try to settle a few of them.

When Martyn's Law was announced, ripples went through everywhere: schools, churches, village halls, parks, and local councils. On a personal level, events I'd been looking forward to, like a local steam rally, were suddenly in doubt. People saw the law, saw that the guidance wasn't fully clarified yet, and some simply thought, "You know what, we're volunteers, we'll just cancel it." Fireworks displays, remembrance services, Christmas lights switch-ons. There's a bit of nuance around the rules, and that nuance was making people scared. Clerks and councillors already have enough on their plate.

So I want to do the opposite of scaremonger. I want to signpost you to some genuinely good guidance, walk through a few real examples, explain why this law came about, and show how it's actually a force for good. I'm not a counter-terrorism expert, and I'm not expecting you to become one either. For a lot of you, the risk is very, very low, and the honest headline is this: Martyn's Law is all about a proportionate response.

By the end of this, I'm hoping you'll have clarity on the scope of what the law entails, and confidence that, for most councils, there shouldn't be huge overheads, no costly tools to buy, and no consultants to hire. There might be a little extra paperwork. But I want to justify why even that is a good thing.

What Martyn's Law Actually Is

The official title is the Terrorism (Protection of Premises) Act 2025. It sounds heavy, and a lot of you are thinking, "How on earth does that relate to a parish or town council?" In essence, it received Royal Assent in April 2025, creating a legal framework that makes certain publicly accessible premises and events responsible for keeping people safe, and for being prepared if the worst were to happen: knowing how to communicate effectively and having thought about sensible precautions ahead of time.

The law is named after Martyn Hett, one of the 22 people tragically murdered in the Manchester Arena bombing in 2017. His mother, Figen Murray, has campaigned tirelessly ever since. (I was fortunate enough to hear her speak at the Martyn's Law Conference recently, where she gave a lot of the context behind it.) The thinking is grounded in real evidence: a handful of small, low-cost measures (having plans and policies in place, thinking ahead) can make a genuine difference to response times in an emergency. It isn't about scaring people. It's about being prepared.

The Timeline: Nothing Is Being Enforced Yet

This is the most reassuring part. Royal Assent happened in 2025, but the Home Office has set a two-year implementation period. When the law was first announced, everyone thought the scope was enormous. A school is publicly accessible, a church is, a village hall is, a park is… and suddenly a thousand questions opened up.

Since then, the Home Office and the Security Industry Authority (SIA) have been steadily publishing guidance to get people ready. Right now, no duties are being enforced. The SIA is due to launch a new online notification portal in spring 2027, and that's when things start to be enforced. Dates may shift slightly, but the key point stands: you have a good amount of time. By educating yourself now, you're doing exactly the right thing: there's a real window to clarify things and ask questions before anything becomes mandatory.

A council clerk reviewing a premises checklist to decide whether an event is in scope for Martyn's Law

Don't Panic, and Don't Rule Yourself Out

The two biggest mistakes are opposite errors: assuming everything you run is in scope and rushing to spend money, or hearing "we're probably exempt" and binning events off without checking. The truth for most councils sits calmly in the middle. Go and look.

The Tiers: Where Do You Fall?

I won't make you read Section 27 or all 400-odd pages of guidance. But you'll see some common terms, so it's worth getting familiar with them. The Act sorts premises into bands based on how many people are expected at the same time, on a regular basis.

Exempt: under 200 people

If your premises doesn't expect 200 people, you're exempt from the specific duties. That doesn't mean you stop thinking about health and safety (you still have other obligations), but the Martyn's Law duties don't bite here.

Standard tier: 200 to 800 people

Once you regularly expect 200 or more people (including staff) at the same time, you're in the standard tier. Think of a Christmas party that books out the same hall every year and draws 250 people. The obligations here are light: chiefly having thought about, and documented, some straightforward public protection procedures.

Enhanced tier: 800 people or more

The enhanced tier applies to premises with a capacity of 800+ that regularly fills to that level. The two tests are: does it have the capacity, and is it actually fulfilling it on a regular basis? Obligations here are meaningfully heavier.

Qualifying events: 800+ with access control

Separately, a qualifying event is a public event where 800 or more people are expected, with entry conditions and access control (tickets, gates, a fenced enclosure). A fenced, ticketed fair can be a qualifying event in its own right even if the park it sits on is otherwise excluded.

Your obligations differ significantly across non-exempt, standard, and enhanced. For qualifying and enhanced-tier situations, the actual security procedures are defined by the Security Industry Authority, so I'd defer to them on the detail there.

The New Vocabulary

A few terms are worth knowing. There are responsible persons: whoever has control of the premises or event, which isn't necessarily the owner (it might be a charitable trust or a hirer). And there are public protection procedures, which in plain terms mean:

Evacuation, invacuation, lockdown, and communication

  • Evacuation: the one we all know. Fire alarm goes off, get everyone out safely to the muster point. Most hiring agreements already cover exits, extinguishers, and who calls the emergency services.
  • Invacuation: if something dangerous is happening outside, it may be safer for people to come inside and stay put. That means having a defined "everyone come in" procedure, perhaps locking certain doors.
  • Lockdown: familiar from schools. If there's an intruder or a threat nearby, everyone stays in place and secure until further updates. (We recently had a local lockdown alert go out to schools over someone walking around with what turned out to be an air rifle.)
  • Communication: especially at larger events. If someone has a heart attack at a fireworks display, how do you communicate with volunteers and attendees? Who liaises with emergency services? Think wider than terrorism: most of this covers medical emergencies and everyday incidents too.

Proportionality runs through the whole Act. Not all of us run massive events. They simply want to see that we've thought about these things in advance, appropriate to our actual circumstances.

A community fireworks display and Christmas lights switch-on, the kind of local event affected by Martyn's Law

Most Community Events Are Fine to Go Ahead

Open, unticketed events on public land (fireworks displays, remembrance services, Christmas lights switch-ons) are often exempt. The measures that do apply are usually light: think ahead, keep it proportionate, and write down your reasoning.

Does It Apply to You? Some Familiar Scenarios

The guidance turns on one core question: Is it reasonable to expect 200 or more people, including staff, to be present at the same time, from time to time? Here's how that plays out for the kinds of places councils actually run.

Village hall with regular 200+ peaks

The hall body usually holds the premises duty. If a recurring booking (say, that annual event that draws ~250 in a 300-capacity hall) regularly clears 200, you're in the standard tier. You'll want to look at your hiring agreements and update a couple of procedures, nothing overboard.

A private wedding or party in that hall

The hall itself may be standard tier, but the wedding inside it is not a qualifying event: it's not ticketed to the public and it's not 800+. In your hiring agreement you'd simply highlight what the hirer needs to be aware of.

An open park event

Not automatically in scope. Open recreation land is excluded as premises. An unticketed picnic with no gate control and no restricted area is likely exempt. But if it becomes a fenced, ticketed event with access control and 800+ attending, you're into qualifying-event territory, and the obligations get heavier.

Christmas lights switch-on / fireworks / remembrance service

It depends on the layout. Open to the public, on public space, with no access control? You could well be exempt. Crucially, though, record your reasoning. A single minuted line ("we reviewed our premises; these are in scope, these are out, here's why") costs nothing and covers you if you're ever challenged.

The Common Mistakes to Avoid

I've already seen people trip over the same few things:

Watch out for these

  • Panic buying. People spending budget on tech or consultants to make an event go ahead. Understand the scope first; much of this is proportionate and in-house.
  • Assuming everything is in scope. A lot of public land and community events simply don't qualify. Double-check before you worry.
  • Ruling yourself out too quickly. Equally, don't hear "probably exempt" and bin an event off. Go and check the maximum capacity and how regularly recurring events actually fill it.
  • Contracting away accountability. Some duties can be delegated, but don't assume that handing a park over to an organiser makes it entirely their problem. Be explicit in agreements about who holds control.
  • Over-claiming compliance. You'll see "buy our product and you'll be Martyn's Law compliant," or "one £5k visit and you're sorted." No product and no single visit makes you compliant. Raise an eyebrow at anyone who says otherwise.

What To Actually Do

I'm not trying to give you homework. But here's a short, practical to-do list you can work through with the tools you already have:

Your practical checklist

  • Check the legislation and sign up for updates: join the SIA mailing list and use the Protect UK flow charts ("I have a building… if yes / if no") to quickly test whether a premises or event is in scope.
  • List your premises and regular events: document them, even the ones you believe are out of scope, and minute that you've considered them.
  • Estimate realistic peak numbers: for each recurring event, what does it actually draw, and how often?
  • Identify who has control: are you unlocking doors, providing keys, staffing the site? Or is it your land with someone else responsible?
  • Review your hiring agreements and event forms: extend the familiar fire/evacuation briefing to cover invacuation, lockdown, and communication where relevant, and make responsibility explicit.
  • Keep procedures simple: no one reads a 50-page pack. One-pagers with clear steps for volunteers are exactly right.
  • Record your decisions and review annually. Showing you've thought about it is the single best thing you can do.

Where Technology Fits (and Where It Doesn't)

There are genuinely useful tools: walkie-talkies, alerting systems, and software that helps you communicate quickly and get help to the right people in an emergency, plus a record of your decision-making. Deciding who needs to be alerted, and what they should do, matters more than the kit itself; you don't want to panic every volunteer.

But I'll be transparent: I'm the Managing Director of Little Green Button, which works in exactly this space. Nothing in this guidance depends on what we do. Your plan should stand up on its own: even without any technology, you need to have thought about how you'll help people in these scenarios. And to say it once more: no product makes you compliant. Anyone telling you otherwise is selling, not helping.

Keep it practical and record your reasoning. We've got loads of time to get ready, there's loads of good guidance out there, and it's all about a proportionate response, not scaring people. Give it a bit of thought ahead of time and you'll be absolutely fine.

If I can leave you with one more thought, it's the same advice I'd give my 18-year-old self: don't sweat the small stuff. Get the things that matter in place, write down your thinking, and don't lose sleep over the rest. A couple of small steps now, taken early, make a genuinely big difference later. In my line of work we'd call that marginal gains, and it applies here as much as anywhere.

Where To Get Trustworthy Guidance

Stick to the official sources and you won't go far wrong. A quick tip if you're using AI to help you think through your own event: ask it to cite its sources, and insist on the Home Office or SIA, not "Barry's blog."

Watch the Full Session

This article is drawn from Alex's Pod-on-the-Parish webinar. For the worked examples in full, the audience Q&A, and the specific bits of guidance to look up, watch the on-demand recording.

About Alex Jay

Alex is the managing director of Little Green Button, a Norwich-based digital safety and panic-alarm company whose software helps frontline teams call for help when they need it, from NHS receptions to university campuses. He came to safety the long way round, via international studies, market research, and data science, which is why he can rarely resist a statistic or a "marginal gains" analogy. Outside work he's a self-confessed data nerd, currently earning his motorbike licence for a bucket-list road trip with his dad.

A Note from John Fagan, Founder of Civic.ly

Alex's message is one we hear a lot: the answer to new obligations usually isn't more software; it's a clear record that you've thought things through. That's exactly the discipline Civic.ly is built to support for your buildings, playgrounds, and public spaces.

With Civic.ly, councils can:

  • Keep a single register of every premises and community asset, with capacity and usage notes in one place
  • Build simple checklists and procedures your team and volunteers can actually follow
  • Record decisions and reviews, with a clear audit trail if you're ever challenged
  • Schedule an annual review so nothing quietly falls out of date
  • Provide evidence of the steps you've taken, strengthening your position without over-engineering it
Book a Demo

Frequently Asked Questions

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent in April 2025. It requires certain publicly accessible premises and events to take proportionate steps to keep people safe and be prepared to respond if the worst happens. It is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena bombing.

Sometimes, but many council premises and events are out of scope. It depends on how many people are realistically expected at the same time, on a regular basis, and whether there is access control. Premises below 200 capacity are exempt, and open, unticketed events on public land are often excluded. The key action is to check each premises and recurring event, then record your reasoning.

The Act received Royal Assent in 2025, but there is a two-year implementation period before duties are enforced. The Security Industry Authority is expected to launch its notification portal in spring 2027, which is when enforcement begins. Dates may shift slightly, so nothing is being enforced yet; you have time to prepare.

The standard tier covers premises that regularly expect 200 to 800 people at the same time, and requires you to have thought about and documented simple public protection procedures. The enhanced tier applies to premises with a capacity of 800 or more that regularly fills to that level, and carries meaningfully heavier obligations set by the Security Industry Authority.

For most councils, no. The Home Office and Security Industry Authority are clear that standard-tier duties can be handled in-house with resources you already have: no products to buy, no consultants required. No product makes you "Martyn's Law compliant," so be wary of anyone selling that claim. Larger, enhanced-tier events will involve some genuine cost and planning.

Evacuation is getting everyone out safely to a muster point, the response we all know from fire drills. Invacuation is the opposite: if something dangerous is happening outside, it may be safer for people to come inside and stay put, which means having a defined procedure and perhaps locking certain doors. Martyn's Law also introduces lockdown and communication procedures alongside these.

Ready to get your assets under control?

See how Civic.ly helps councils manage everything from playgrounds to public toilets — in one place.

Book a Demo See Features