Martyn’s Law does not make training a legal requirement for either tier. The Home Office’s statutory guidance does say that staff with a role in your public protection procedures must be made aware of those procedures and their role, and that without training it is likely to be difficult to show your procedures are appropriate. The duties are expected to start in spring 2027, although no date has been set in law yet.
This guide explains what the Terrorism (Protection of Premises) Act 2025 requires, what the official guidance says about training, who should be trained, and the free resources you should use first.
Martyn’s Law in brief
The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. The Security Industry Authority (SIA) is the regulator.
- Standard tier: premises where it is reasonable to expect 200 to 799 people to be present at the same time from time to time. Staff count towards the total.
- Enhanced tier: premises where 800 or more people may be present.
- Qualifying public events: events with 800 or more people, public access and entry checks such as tickets or paid entry.
- Always standard tier: places of worship, childcare premises, schools and further education settings stay in the standard tier whatever their capacity.
Not sure which tier applies to your venue? Use our free Martyn’s Law tier checker.
The government committed to an implementation period of at least 24 months. The SIA says it expects the Act to come into force in spring 2027 and will confirm the exact date in advance. Premises already in scope will have three months from that date to notify the SIA.
Is Martyn’s Law training a legal requirement?
No. The Home Office’s statutory guidance is direct about it:
“There is no statutory requirement in the Act for the responsible person, or for staff working at qualifying premises and qualifying events, to carry out specific training, learning or instruction related to counter-terrorism or the Act’s requirements.”
The same paragraph says staff with roles in the procedures “must be made aware of the procedures and their specific role”. The guidance goes on to say that if staff are not informed or trained, “it is likely to be difficult for the responsible person to demonstrate that appropriate and reasonably practicable procedures are in place.”
An earlier draft of the Bill did include a training requirement for all premises in scope. The government removed it in 2024, and the Act as passed has no training duty for either tier.
The guidance is also clear that paying for training is optional: “It is not mandatory to pay for third-party training or learning to comply with the Act’s requirements.” It warns against courses that cost thousands of pounds and claim to make attendees compliant. Only the SIA decides whether a premises complies, so be wary of anyone who says a course will do that for you.
What standard tier premises must do
Standard tier premises have two duties:
- Notify the SIA that the premises is in scope.
- Have public protection procedures, so far as is reasonably practicable, to be followed by the people working there in the event of an attack. They cover four areas:
- evacuation
- invacuation (moving people to a safer place inside)
- lockdown (preventing entry or exit)
- communication (giving information to people on site)
The Act does not require a written document for the standard tier, but the guidance says one should be prepared. Writing procedures down is also the easiest way to train people on them consistently.
What enhanced tier premises and events must do
Enhanced tier premises and qualifying events must do everything above, plus:
- put in place public protection measures covering monitoring, the movement of people, physical security and information security
- send a document of compliance to the SIA and keep it up to date
- appoint a designated senior individual where the responsible person is an organisation
For the enhanced tier the guidance says training needs and evidence of training “should be documented”, and it treats training records as a necessary element of the document of compliance.
Who should be trained, and on what
The guidance says training should suit each person’s role, and that good practice is for all staff to be “trained to be alert to suspicious items and behaviours, know how to report concerns”. In practice that means:
| Who | What they need |
|---|---|
| All staff, including casual, agency and volunteer staff | Spotting and reporting suspicious items and behaviour, and what to do when the procedures are triggered |
| Staff with a role in the procedures | Their specific role in evacuation, invacuation, lockdown and communication at your premises |
| Duty managers and supervisors | Making decisions under pressure, starting the procedures, directing staff and the public |
| The responsible person and senior individual | The duties under the Act, keeping procedures current, records and working with the SIA |
Casual and agency staff are easy to miss. Large venues may have hundreds of people on site who were not there last month, so plan how they will be trained before their first shift.
Training on its own is not enough. Practise the procedures with drills and walk-throughs, so people know the routes, the signals and who makes the call.
Free training you should use first
Before paying for anything, use the free official resources. ProtectUK offers free e-learning (registration needed), including:
- ACT Awareness: about 45 minutes, for all staff
- ACT for Education: about 60 minutes, for staff in education settings
- ACT Security: about 90 minutes, for frontline security staff
- Faith Security Training: about 60 minutes, for places of worship
Counter Terrorism Security Advisers also run ACT sessions, subject to availability. The Home Office has published guidance and supplementary documents, and the SIA is publishing its own guidance, templates and a scope checking tool.
Where site-specific training helps
The free courses build general awareness. They do not cover your building, your procedures or who does what at your venue, and they do not keep a record of who is ready across several sites. That is the gap most organisations need to fill.
Capytech’s Martyn’s Law Academy trains every member of staff on your own procedures, from foundation awareness through to the people who lead and are accountable for them. The Martyn’s Law Register keeps track of who is trained at each premises and the drills you have run, so the evidence is in one place when the SIA asks. Neither makes you compliant on its own. They make it much easier to show that your procedures are known, practised and working.
Penalties
The SIA can issue compliance notices, and for the enhanced tier and events, restriction notices. Maximum penalties under the Act are:
- Standard tier: up to £10,000, plus up to £500 a day for continuing failures
- Enhanced tier and events: up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, plus up to £50,000 a day
The SIA has said it will not charge for notifications or inspections.
A practical timeline
- Now: work out whether your premises are in scope, counting staff, and which tier applies.
- Next: write or review your procedures for evacuation, invacuation, lockdown and communication.
- Then: train everyone, using the free ProtectUK courses for awareness and site-specific training for your procedures and roles.
- Before go-live: run drills, fix what they reveal and keep records.
- When the Act commences: notify the SIA within three months if your premises are already in scope.
Frequently asked questions
No. The Act does not require specific training for either tier. However, staff with roles in your public protection procedures must be made aware of the procedures and their role, and the statutory guidance says it will be difficult to show your procedures are appropriate if staff are not informed or trained.
No. The statutory guidance says it is not mandatory to pay for third-party training to comply. Free ProtectUK courses cover general awareness. Paid training is worth it only where it covers your own procedures and roles, or saves you time managing training and records.
Everyone working at the premises should be able to spot and report suspicious items and behaviour, and know what to do when procedures are triggered. Staff with specific roles in the procedures need training on those roles, and managers need to know how and when to start them.
For enhanced tier premises and events, the guidance treats training records as a necessary part of the document of compliance. For the standard tier no record is legally required, but keeping one is the simplest way to show your procedures are known.
No date has been set in law yet. The SIA expects the Act to come into force in spring 2027 and has said it will confirm the exact date in advance.
No. Schools, further education settings, childcare premises and places of worship stay in the standard tier whatever their capacity.
Get your people Martyn’s Law ready
The Martyn’s Law Academy trains every member of staff on your procedures, and the Martyn’s Law Register keeps the evidence in one place.