Martyn’s Law: Statutory guidance update

One of the most significant developments in the guidance is the introduction of the ’Must‘, ’Should‘, and ’Could‘ framework. This distinction separates legal obligations from strongly recommended good practice and optional illustrative measures. Importantly, the guidance confirms that there is no mandated list of security controls. Instead, organisations are expected to demonstrate that decisions have been made thoughtfully, proportionately, and with reference to their specific risk profile.

All requirements remain subject to the principle of reasonably practicable, requiring organisations to balance risk, cost, and operational feasibility. As a result, compliance is less about adopting specific technologies or physical measures, and more about the quality of judgement applied. Organisations should expect scrutiny not only of what measures were implemented, but also of why others were not.

A practical starting point will be to use the Statutory Guidance’s structure to identify ’Must‘ requirements first, before assessing how ’Should‘ statements supplement the minimum compliance baseline.

The guidance provides greater clarity on what constitutes a qualifying premises. To fall within scope, a premises must be publicly accessible with controlled entry, used for a qualifying purpose, and reasonably expected to host 200 or more people. The emphasis has moved away from static, building‑based categorisation towards how space is used in practice.

Attendance thresholds are to be assessed using structured, evidence‑based methodologies drawing on normal operating conditions, historic footfall, and typical activity levels. This marks a shift away from conservative worst‑case assumptions and places greater emphasis on proportionate forecasting. Office and professional environments are generally excluded unless public access is integral to operations, while temporary or partial use – such as events – can bring premises into scope.

In complex estates, the guidance recognises that responsibility may be layered or shared, reflecting the realities of multi‑use environments.

For qualifying events, the guidance reaffirms the threshold of 800 or more attendees reasonably expected at one time, alongside the requirement for controlled access arrangements such as ticketing or invitations. Clearer methodologies are provided for estimating attendance using ticket sales, capacity, and historic trends.

The guidance also confirms that large gatherings without access control may fall outside scope, even where attendance is high. Primary responsibility typically sits with the event organiser rather than the venue owner, although responsibilities may be shared where infrastructure or services are jointly managed. This distinction provides important clarity for organisations that regularly plan, host, or support public facing events.

The statutory guidance makes clear that compliance with Martyn’s Law is not intended to follow a fixed checklist or prescribed set of security controls. Organisations are expected to apply informed judgement, based on a clear understanding of their risk environment and how an attack might realistically occur. Measures should be proportionate, effective, and appropriate to the nature of the premises or event.

Organisations will not be judged on the adoption of technologies or physical security measures. There is no expectation that organisations can prevent attacks outright; rather, the focus is on proportionate risk mitigation and preparedness. Regulatory scrutiny will focus instead on the quality of decision‑making, including whether risks have been appropriately assessed and whether measures — or decisions not to implement certain measures — can be reasonably justified.

While the guidance avoids prescriptive requirements, it places strong emphasis on evidencing judgement. Organisations are expected to document their rationale clearly, explaining why specific measures were selected or rejected and demonstrating how decisions align with assessed risk. Compliance will therefore be context‑driven and judgement‑based rather than binary.

In practice, compliance is likely to be assessed through audit and review processes led by the SIA, with emphasis on governance, documentation, and continuous improvement. Organisations should expect to demonstrate regular review of risks and procedures, ongoing adaptation to changes in threat or usage, and evidence that lessons are identified and acted upon.

The SIA’s own supervisory guidance is currently published for consultation and is not yet widely available. It is expected that finalised guidance will close some remaining gaps around regulatory interpretation and enforcement expectations as the regime matures.

For enhanced tier premises and qualifying events, expectations increase around structured planning, assessment, and oversight. Organisations are expected to demonstrate an understanding of potential attack types, crowd behaviour, ingress and egress patterns, and peak usage periods.

While the guidance avoids prescriptive templates, it raises expectations around documented assessments, defensible decision‑making, and the ability to articulate why measures are appropriate. For events, this includes coordination with venues, authorities, and emergency services, and scaling measures in line with duration and risk.

Critically, the Home Office frames enhanced compliance as a leadership and governance issue, requiring senior ownership, oversight and accountability – not solely operational delivery by security teams.