Martyn’s Law: What Building Managers Need to Know About Emergency Preparedness and INVAC Planning

Guidance for Building Managers and Facilities Teams

Updated March 2026 • Enforcement expected April 2027

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. For anyone responsible for a publicly accessible building, it introduces a clear legal framework around emergency preparedness for terrorist incidents. Enforcement is expected from April 2027, giving organisations a defined window to understand their obligations and put plans in place.

This article explains what the law requires at each tier, covers the three core emergency procedures it references, and sets out why many organisations, particularly those in the enhanced tier, will benefit from reviewing their physical systems as part of their compliance planning.

What is Martyn’s Law?

The Act is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack on 22 May 2017. It follows years of campaigning by his mother, Figen Murray OBE, who argued that clearer statutory duties on emergency preparedness could help protect the public in the event of a terrorist attack.

The legislation requires those responsible for qualifying premises to implement proportionate security measures and have documented procedures in place. The Security Industry Authority (SIA) has been appointed as the regulator and will oversee compliance, provide guidance during the implementation period, and take enforcement action where necessary.

Martyn’s Law is not about creating a culture of fear. It is about ensuring that organisations have thought carefully about what they would do in an emergency, and that their people know how to respond.

Who Does the Law Apply To?

The Act applies to premises where it is reasonable to expect 200 or more individuals to be present at the same time in connection with a qualifying use. Schedule 1 of the Act lists the categories of premises in scope, which include educational establishments, with some special considerations for schools, retail spaces, healthcare settings, places of worship, restaurants, entertainment venues, and sports grounds. Notably, offices are not included.

Qualifying premises are divided into two tiers based on expected capacity.

Who Does the Law Apply To?

The Act applies to premises where it is reasonable to expect 200 or more individuals to be present at the same time in connection with a qualifying use. Schedule 1 of the Act lists the categories of premises in scope, which include educational establishments (with some special considerations for schools), retail spaces, healthcare settings, places of worship, restaurants, entertainment venues, and sports grounds. Notably, offices are not included.

Qualifying premises are divided into two tiers based on expected capacity:

Important: The Government’s position is clear that standard tier compliance does not require organisations to purchase third-party products or specialist services. The focus at standard tier is procedural having plans, training staff, and being ready to act. This article reflects that position accurately.

The Three Core Procedures

Both tiers require organisations to have procedures in place covering three scenarios. Understanding the difference between them is essential to effective planning.

Evacuation

Evacuation involves moving people safely out of a building and away from a threat. Most organisations will have fire evacuation procedures that provide a starting point, but emergency evacuation in a terrorism context has additional considerations, particularly around where people are directed once outside, and how staff account for them.

Lockdown

Lockdown involves restricting movement within a building to protect occupants from an external threat. It may be appropriate where an incident is occurring nearby and moving people outside would increase their risk. A lockdown procedure requires rapid communication, the ability to secure access points quickly, and clear direction for staff and visitors on what to do and where to go.

Invacuation

Invacuation, sometimes called ‘shelter in place’, involves moving people inside a building and into a designated safe area rather than evacuating them. It is appropriate when the threat is external and the safest course of action is to bring people in from exposed areas and hold them in a controlled location.

Of the three procedures, invacuation is the one most organisations are least prepared for. Unlike fire evacuation, it is rarely practised, and the plans that do exist are often vague about where people should go, who directs them, and how the all-clear is communicated.

What the Law Actually Requires and What Best Practice Looks Like

It is important to be clear about the distinction between legal minimum requirements and what genuinely effective emergency preparedness looks like in practice.

Standard Tier: Procedures, Not Physical Measures

For standard tier premises (200–799 people), the law requires organisations to have public protection procedures in place covering evacuation, invacuation, lockdown, and communication. It does not require physical security infrastructure, and compliance does not depend on purchasing specialist systems or services. The focus is on having clear, documented, and practised procedures, and on ensuring staff know what to do.

For many standard tier organisations, a significant amount of groundwork will already exist through fire safety and health and safety frameworks. The task is to review those frameworks, identify gaps in relation to terrorism-specific scenarios, and ensure the three procedures are clearly defined and understood by the people who need to carry them out.

Enhanced Tier: Going Further

For enhanced tier premises (800+ people), the requirements go considerably further. In addition to public protection procedures, duty holders must also take reasonably practicable steps to reduce the vulnerability of the premises to a terrorist attack. This includes documenting procedures and measures and submitting that documentation to the SIA. A designated senior individual must be appointed with responsibility for security compliance.

At enhanced tier, physical systems such as alerting, communication, and access control become genuinely relevant to compliance, not just best practice. The vulnerability reduction obligation is difficult to satisfy on procedures alone when the building itself presents risks that infrastructure could address.

Beyond the Minimum: Why Systems Matter for Well-Run Organisations

Even for standard tier premises, there is a practical argument for reviewing physical systems as part of emergency planning. This is not because the law demands it, but because a procedure is only as effective as the infrastructure that supports it.

If staff cannot communicate an invacuation instruction rapidly across a large building, or if the alert signal is ambiguous, the procedure will not work under pressure. Organisations that genuinely want their plans to function, rather than simply to exist on paper, often find that targeted investment in communication and alerting makes the difference between a plan that works and one that does not.

A written procedure is a necessary starting point. But a procedure that cannot be reliably communicated to everyone in a building, under pressure, in real time, is not a plan that will protect people.

Physical Systems That Support Effective INVAC Planning

The following applies primarily to enhanced tier premises, where vulnerability reduction measures are a legal requirement, and to any organisation that wants to ensure its procedures are operationally effective rather than compliant on paper only.

Audible and Visual Alerting

A distinct alert signal for invacuation is important. Standard fire alarm tones prompt people to leave the building, which is exactly the wrong response during an invacuation. Enhanced tier venues in particular should consider how they communicate a shelter-in-place instruction differently from a fire evacuation signal, using audible and visual systems that are clearly distinguishable.

Public Address and Voice Alarm Systems

A voice message over a public address system is significantly more effective than an alarm tone in a terrorism-related scenario. It removes ambiguity, provides clear instruction, and can be updated in real time as an incident develops. For larger venues, a voice alarm system capable of delivering distinct invacuation messaging is a sensible baseline.

Access Control

During an invacuation or lockdown, the ability to secure entry points quickly is critical. Access control systems that can be managed centrally, locking perimeter doors while keeping internal routes clear, give security and facilities teams a significant operational advantage over manual processes. For enhanced tier premises with multiple access points, this is one of the more impactful system investments available.

Staff Communication

Those directing an invacuation need a reliable means of communicating with each other and with a central point of control. This might involve radio systems, paging, or integration with existing security monitoring infrastructure. The mechanism matters less than its reliability under pressure.

Designated Safe Areas

Invacuation requires somewhere for people to go. Safe areas should be identified in advance, assessed for capacity, and understood by all staff. For enhanced tier premises, these should offer meaningful protection from external threat, with consideration given to entry point security and, for prolonged scenarios, basic provisions.

What Building Managers Should Do Now

Enforcement is expected from April 2027. That gives organisations a defined window, but it is not a reason to delay. Early assessment is almost always more cost-effective than responding under time pressure.

Recommended steps:

• Confirm whether your premises fall within the standard or enhanced tier

• Review your existing emergency procedures, do they cover invacuation and lockdown, or only fire evacuation?

• Identify gaps in staff knowledge and plan a training programme

• Schedule drills that include invacuation scenarios, not just fire evacuation

• For enhanced tier premises, commission a site assessment to identify vulnerability reduction measures and ensure documentation is in order for SIA submission

• For any tier, review whether your current alerting and communication systems can reliably support the procedures you have in place

Note: The Government’s statutory guidance for Martyn’s Law will be published during the 24-month implementation period. Building managers should monitor GOV.UK and ProtectUK for updates, as this guidance will clarify compliance expectations in more detail.

How Advance Fire & Security Can Help

Advance Fire & Security works with building managers, facilities teams, and security leads across a range of sectors. We provide practical, systems-led support for organisations preparing for Martyn’s Law, with a clear understanding of what the law requires at each tier and what genuinely effective emergency preparedness looks like in practice.

We can help with:

• Site assessment and gap analysis against Martyn’s Law requirements

• Specification and installation of audible and visual alerting systems (enhanced tier and above)

• Public address and voice alarm system design and installation

• Access control system review, upgrade, and installation

• Integration of new systems with existing security infrastructure

• Staff training support and procedure documentation

• Ongoing maintenance and monitoring

We work with both standard and enhanced tier premises and can advise on phased approaches where capital expenditure needs to be managed over time. For standard tier clients, our starting point is always a straightforward assessment of your current procedures, with no obligation to purchase any system or service.

Arrange a free, no-obligation compliance review.

Visit: advance-security.co.uk • Or call us to speak with a member of our team.

Advance Fire & Security • Part of the New Path Group

Further reading: Martyn’s Law factsheets are available at GOV.UK. ProtectUK (protectuk.police.uk) provides free guidance and resources for premises and event organisers.

This article is intended as general guidance only and does not constitute legal advice. Building managers should refer to official GOV.UK and SIA guidance for their specific obligations under the Terrorism (Protection of Premises) Act 2025.