Martyn’s Law and the Duty to Protect: Rethinking Risk in Commercial Real Estate

Following the Manchester Arena attack in 2017, the UK has experienced 15 domestic terror attacks with authorities disrupting a further 43 late-stage plots, highlighting the ongoing risk to the public when people leave their homes. In response, the Manchester Arena Inquiry and London Bridge Inquest called for stronger public protection measures, and these have come in the form of the Terrorism (Protection of Premises) Act (the “Act”).

The Act – known colloquially as Martyn’s Law (after Martyn Hett who was tragically killed in the Manchester attack) – introduces much needed legal duties to strengthen protective security and emergency preparedness across the UK. For the first time, those responsible for certain premises and events must assess the risk of a terrorist attack and plan appropriate responses in the event of an occurrence. Those responsible for these “Qualifying Premises” will be required to take measures to reduce their vulnerability and increase public safety.

The current UK terror threat level is set at “substantial” by MI5, suggesting an attack in the UK is likely. The threat is described as “enduring and evolving,” with attacks becoming less predictable and harder to detect. Because potential targets vary widely, a wide variety of premises must take action to reduce the impact of such an event. Government engagement with businesses has shown that, without legal requirements incentivising responsible actors, counter-terrorism measures will fall behind mandatory obligations like fire preventive measures. With research showing that individuals are more likely to respond effectively to a terrorist incident if they have advance planned, the government has decided there is sufficient duty of care owed to the public and has mandated action from those responsible for Qualifying Properties, taking a balanced approach to implementing these new obligations.

What does this mean for commercial property owners?

The Act received Royal Assent on April 3, 2025, though will not be “in force” until the end of a 2-year implementation period, allowing Responsible Persons (defined below) of Qualifying Premises sufficient time to comply with the requirements.

A designated “Responsible Person” must be identified – this will be the individual with control of the Qualifying Premises. This is generally the owner of the property or the occupational leaseholder. The Responsible Person is then regulated by the Security Industry Authority (“SIA”). Not identifying the Responsible Person does not disclaim them from responsibility under the Act, non-compliance is a criminal offence, with increasing penalties depending on the “tier” of the Qualifying Premises.

What is a Qualifying Premises?

Under the Act “Qualifying Premises” are those with the following characteristics:

• premises which consist of a building or a building and other land. This includes part of a building or a group of buildings;
• premises must be wholly or mainly used for one or more of the uses specified in Schedule 1 of the Act;
• premises where it is reasonable to expect that from time to time, 200 or more individuals (including staff) may be present at the same time in connection with one or more uses specified in Schedule 1; and
• Though they will not include premises that are excluded under Schedule 2 of the Act.

Schedule 1 includes a wide range of venues, but particularly relevant premises are:

• Pubs, bars, and restaurants;
• Hotels;
• Shops, retail centres, and supermarkets (and can include individual stores which are part of a larger shopping centre); and
• Entertainment venues (like theatres, stadiums and cinemas).

A Tiered System

The Act introduces a tiered system based on the reasonable expectation of capacity. “Standard Tier” Qualifying Premises have a threshold of 200 to 799 people. This requires a basic terrorism risk assessment and the implementation of an emergency action plan. The “Enhanced Tier” applies to Qualifying Premises of 800 or more people. The Responsible People for these Qualifying Premises will be required to implement more extensive anti-terrorism measures, including appointing a Designated Senior Individual (DSI), developing security plans, and implementing physical and procedural counter-terrorism measures.

Responsible Persons should act now to assess whether they control Qualifying Premises, determine the applicable Tier, and identify the proportionate security measures required.

It is also advisable to consider any additional insurance coverage that may be of relevance and to start engaging with asset managers and facilities management contractors to plan and implement strategies to ensure compliance.  While insuring against non-compliance is not possible, some specialist terrorism insurance and public liability policies may be of relevance.

Penalties and Offences

Where Qualifying Premises are not in compliance when the Act is deemed in force by future regulations, Responsible Persons will be risking daily fines and fixed penalties of up to £10,000, whereas Responsible Persons for Enhanced Tier Qualifying Premises are risking fines of up to £18 million or 5% of global turnover – whichever is greater.

The consequences are severe.  The Act additionally introduces compliance notices and restriction notices as pre-cursers to punishment. Compliance notices are issued by the SIA as the regulator, and require action by Responsible Persons to meet their duties under the Act. Restriction notices can limit or even prohibit the operation of Qualifying Premises until all identified issues have been satisfied. Failure to comply with these notices constitutes a criminal offence.

If you would like to learn more about your obligations under the Act we encourage you to reach out to a member of our Commercial Property team who are well equipped to advise you on the new obligations.