Martyn's Law Training Requirements: Employer Readiness Checklist

Last updated: 15 July 2026

The Legal Position as at 15 July 2026

The Terrorism (Protection of Premises) Act 2025, commonly called Martyn's Law, received Royal Assent on 3 April 2025. It applies across England, Wales, Scotland and Northern Ireland and creates duties for certain publicly accessible premises and events.

The Home Office published statutory guidance in April 2026. Crucially, paragraph 1.1 says that section 27 was commenced so the guidance could be published, but that further details would be provided on when the Act's substantive requirements would commence. Employers should therefore prepare, but should not claim that a particular certificate makes them legally compliant today.

This distinction matters when buying training. A provider can help an organisation prepare its people, procedures and records. It cannot sell a generic course that automatically makes a venue compliant, because compliance depends on the responsible person's assessment of that particular premises or event and what is appropriate and reasonably practicable there.

Who May Be in Scope?

Scope is not decided by headcount alone. The premises must satisfy all of the statutory criteria, including being used for a qualifying purpose and being accessible to visiting members of the public. Use the Home Office decision process rather than assuming that every workplace above a threshold is covered.

There are special rules. For example, qualifying premises used primarily for childcare, primary, secondary or further education, and places of worship, remain in the standard tier even where 800 or more people may be expected. Higher education is treated differently and can fall within the enhanced tier. Attendance calculations include staff, and the test is reasonable expectation at the same time rather than annual footfall or a building's theoretical maximum occupancy.

What Does the Guidance Say About Training?

Paragraph 7.51 of the statutory guidance is direct: there is no statutory requirement for the responsible person or staff to carry out a specific form of training, learning or instruction about counter-terrorism or the Act. That does not mean staff preparation is optional in practice.

Where people have responsibility for carrying out a procedure, the guidance says they must be made aware of it and their specific role, and be given the understanding, experience and tools needed to act effectively. If nobody knows how to carry out a procedure, it will be difficult to show that the procedure is genuinely in place.

The guidance recognises several valid learning methods: induction sessions, team or shift briefings, annual refreshers, shadowing, supervised practice, e-learning and structured courses. It also says paid third-party training is not mandatory. Select the method based on the complexity of the role and the procedure, not on the marketing label attached to a course.

The four procedures staff may need to understand

• Evacuation: moving people away from the premises or event where that reduces harm.
• Invacuation: moving people to a safer place within the premises.
• Lockdown: restricting access, exit or movement to help protect people.
• Communication: alerting staff and people present, contacting emergency services and sharing clear instructions.

These are not four scripts to copy into every workplace. The responsible person must determine what is appropriate and reasonably practicable for the actual layout, people, operations and surrounding area, and ensure procedures do not conflict with fire safety, health and safety or accessibility arrangements.

Build a Role-Based Learning Plan

Start with responsibilities, not job titles. The same employee may have different responsibilities during normal trading, a large event or a low-staffed shift. Contractors and volunteers also count as staff for the purposes described in the guidance, so include anyone whose actions are part of the plan.

Free ACT Awareness e-learning and action cards are available through ProtectUK and can help build general awareness. Use them as an input, then add the organisation's own reporting route, site plan, decision authority and accessibility arrangements.

Martyn's Law Employer Readiness Checklist

Use this as a working checklist for the implementation period. A checked box should point to evidence or an owner, not merely record that the topic was discussed.

1. Confirm scope and responsibility

• Record why each premises or event is in scope, out of scope, standard tier or enhanced tier.
• Use evidence of the number reasonably expected at the same time, including staff and predictable peaks.
• Identify the responsible person based on control of the premises for its qualifying use or control of the event.
• For enhanced-tier premises or qualifying events operated by an organisation, identify the appropriate senior individual.
• Map landlords, tenants, hirers, contractors and neighbouring responsible persons who must coordinate or cooperate.

2. Design workable procedures

• Assess evacuation, invacuation, lockdown and communication against credible scenarios and the specific site.
• Check that terrorism procedures align with fire, health and safety, safeguarding and accessibility plans.
• Define decision authority, deputies and cover for nights, weekends, leave and high-turnover shifts.
• Give staff a short, accessible quick-reference version without exposing sensitive security information unnecessarily.
• For enhanced-tier premises and qualifying events, connect each role to the relevant monitoring, movement, physical security or information-security measure.

3. Prepare people by role

• Add local awareness and reporting routes to induction for employees, contractors and volunteers.
• Give procedure owners scenario-based instruction and practice rather than awareness content alone.
• Provide supervisors and public-facing staff with the additional depth their decisions require.
• Make reasonable adjustments so staff can access and apply the learning.
• Schedule refreshers and trigger additional briefing after material changes to the site, staffing or procedures.

4. Test, learn and improve

• Run a tabletop exercise before attempting a live exercise.
• Test communication routes, decision handoffs and cover arrangements, not just recall of terminology.
• Record gaps, owner, due date and closure evidence in an improvement log.
• Review procedures after exercises, relevant incidents, layout changes and significant changes in expected attendance.
• Keep detailed protective-security information secure and available only to people who need it.

What Evidence Should Employers Keep?

The standard tier does not create a named training-record template. Enhanced-tier premises and qualifying events must document compliance more broadly, and the statutory guidance says training needs and evidence of delivery should be documented for the operation of public protection measures.

A proportionate evidence set can include:

• a role-to-procedure matrix showing who needs which instruction;
• version-controlled briefings and quick-reference cards for each site;
• attendance or assignment records covering employees, contractors and volunteers;
• scenario questions, observed practice or supervisor sign-off for operational roles;
• exercise schedules, debriefs, improvement actions and evidence of closure;
• records of refresher triggers and material changes;
• governance review and approval by the responsible person or designated senior individual.

A spreadsheet of course completions without a clear link to roles and site procedures is weak evidence. Conversely, a short internal briefing followed by demonstrated understanding may be entirely proportionate for a simple role. The guidance focuses on whether procedures can be implemented effectively.

A simple test for every role

Ask four questions:

1. Notice: What might this person observe or be told?
2. Decide: What decision can they make, and what must they escalate?
3. Act: What exact action should they take at this site?
4. Communicate: Who needs to know, through which channel, and what is the fallback?

If a staff member can answer a generic quiz but cannot answer those four questions for their workplace, the learning design is incomplete.

What Employers Should Do Next

Do not wait for commencement to identify responsibilities and obvious gaps, but avoid buying a large generic course library before the premises procedures are defined. The most useful order is:

1. confirm scope and the responsible person;
2. design or review the site-specific procedures;
3. map responsibilities to employees, contractors and volunteers;
4. select proportionate learning methods for each role;
5. practise, capture gaps and improve;
6. monitor the Home Office and SIA for commencement and regulatory updates.

That sequence produces a readiness programme people can use. It also prevents the common failure mode of treating a generic awareness certificate as proof that a procedure exists and can be carried out.