Martyn's Law: What does the latest guidance on terrorism protection mean for UK sports organisations?

When the Terrorism (Protection of Premises) Act 2025 (better known as Martyn’s Law) received Royal Assent on 3 April 2025, the broad shape of the regime was already clear: certain premises and events would need to prepare for a terrorist attack, and larger venues and events would need to go further by considering and, where appropriate, reducing their vulnerability to one. What was less clear was how some of the Act’s key concepts would work in practice, particularly around scope, responsibility and what 'appropriate' and 'reasonably practicable' might mean on the ground.

Martyn's Law is not in force yet and will not be until spring 2027 at the earliest. But the Home Office’s statutory guidance, published on 15 April 2026 (and updated on 18 May 2026) is an important milestone to allow duty holders to prepare. 

Do you qualify? Standard and enhanced tiers, and qualifying events

The Act itself established the framework: qualifying premises are premises consisting of a building, or a building and other land, used mainly for one or more specified uses, where it is reasonable to expect that from time to time 200 or more individuals may be present in connection with that use. 

• Premises where it is reasonable to expect 200–799 individuals are in the standard tier.
• Those where 800 or more individuals may be present are in the enhanced tier.
• There is also a separate category of qualifying events for certain events at which it is reasonable to expect 800 or more people to be present at the same time, where access is controlled and the event is not already covered as enhanced-tier premises.

Most larger stadiums, enclosed pitches and purpose-built sports centres will fall within the enhanced tier, with smaller establishments subject to the standard tier duties. The authors suspect the separate category of qualifying events will be of less relevance to the sports sector, as most premises will be caught by the tier system, though mass participation events occurring in parks or fields could well fall under this category.

Calculating capacity – from time to time and at the same time

The statutory guidance (and related supplementary documents) clarifies that calculating which tier applies is not a pure capacity exercise. The question is not just how many people could theoretically be squeezed in, or the average number of people in a given space. The guidance is clear that a reasonable method should be used to calculate the greatest number of individuals expected to be at the premises at the same time (at any point in time).

Historic attendance data, safe occupancy figures and booking or ticketing information may all be relevant to determine this number. Staff, volunteers and contractors must also be counted, not just members of the public.

Calculating this figure will be particularly important for sports organisations on the margins of scope. A local club may usually operate below 200 people, but if it holds a handful of annual tournaments, open days or representative fixtures at which the reasonable expectation exceeds the threshold, it may still be brought within scope. Equally, a cycling event, regatta or triathlon may have only a brief period during which 800 or more participants, staff and spectators are all present at the same time, but that can still be enough for the event to qualify. The new guidance means sports organisations cannot use low day-to-day attendance rates to determine if their premises are in scope.

Conversely, if premises have an unexpected, one-off occurrence when the number of individuals present exceeds the standard tier threshold, the premises will remain out of scope of the Act. However if this occurrence happens again, or could then be reasonably expected to happen again, then the premises may fall within scope of the regime going forward. For those just outside of scope, it will be prudent to keep an eye on numbers to make sure that, if the position changes, you are ready to comply. Supplementary document B gives an example of a football stadium that usually expects 500 spectators per game during the season, except for one testimonial where attendance is expected to reach 1,000 spectators and staff. Because the testimonial is a one-off and is not expected to occur again, the stadium will remain in the standard tier.

How are mixed-use spaces treated

The premises has to be used wholly or mainly for one of the uses listed in Schedule 1 to the Act to be within scope. These uses specifically include leisure activities and premises designated as sports grounds. The fact that a space is used for another purpose, not listed at Schedule 1, even for significant parts of the year, may not be relevant if its main use is listed. 

A helpful example given in the guidance is where a sports stadium is used as a conference centre during downtime. As the conference usage is secondary, the stadium will continue to be caught by the Act.

What counts as a 'premises'?

The supplementary examples published alongside the guidance illustrate how the Home Office expects the rules to apply to complex premises and estates. It gives the example of a football stadium that consists primarily of land outdoors but also stands and some buildings. The whole premises will be in scope of the regime. It is clear that a 'premises' may be a group of buildings and land in close geographical proximity and under the same control and there can be premises within premises.

That has obvious implications for sports complexes. A stadium campus may include a main bowl, hospitality areas, retail outlets, food and drink concessions, club museums, conference facilities and independently operated gyms or studios. 

• In some cases, the site may be treated as one premises.
• In others, particular spaces may amount to separate premises in their own right if they are sufficiently distinct and under separate control.

The practical result is that venue owners cannot simply assume the legal position is straightforward, particularly where elements of the site are franchised, licensed out or outsourced. The guidance continues the Act’s emphasis on co-ordination and co-operation between parties with overlapping control.

This is one area where the sports sector may have more work to do than first expected. It is common for facilities management, catering, stewarding, event delivery or venue operations to be split between different entities. The guidance makes it clear that fragmented control is not a reason for inaction. If more than one person has some degree of control, those parties need to work together so that the relevant procedures and measures can be put in place and operate effectively.

Which venues are outside of scope

Parks, gardens, and recreation grounds are excluded from scope, unless there are controls in place limiting access. Most sports grounds that are open to the public are also excluded, unless they are 'designated sports grounds'. Designated sports grounds are those which, in the opinion of the Secretary of State for Culture, Media and Sport, have accommodation for more than 10,000 spectators, or 5,000 spectators in the case of Premiership or Football League grounds in England and Wales.

For example, a small-scale sports ground may charge users a fee to hire pitches, but those charges are not a condition to access the premises in general (other than the hired pitches), so the sports ground more generally is not in scope.

Who is responsible?

The 'responsible person' is responsible for ensuring a particular premises or event complies with the requirements of the Act. The terminology is somewhat confusing as this need not be a human person. Instead, it is the entity (be that an individual, organisation or company) with control of the qualifying premises or qualifying event. 

In the examples given alongside the guidance:

• The responsible person for a football stadium will be the football stadium operator;
• The operator of a golf club will be the responsible person. This is true even when the event that tips the golf club into the enhanced tier (in this example, an annual firework display) is hosted by a third party operator.

The duties and compliance required

The standard-tier duty remains relatively light-touch, but compliance is more than a paperwork exercise. The responsible person must ensure, so far as is reasonably practicable, that appropriate public protection procedures are considered and put in place, including for evacuation, invacuation (the moving of people away from danger within the premises), lockdown and the means to communicate and implement such measures when needed. The guidance explains that these procedures should be tailored to the premises, be realistically capable of being implemented by people working there and be communicated to those who need to know them. The Act does not require standard-tier premises to install expensive physical security features, and the Government has expressly stated^[6] that organisations do not need to hire consultants in order to comply. 

The Security Industry Authority (SIA) is responsible for fulfilling the regulatory functions set out in the Act, and will publish its own guidance on compliance with the Act in due course. The responsible person must notify the SIA when they become responsible for a premises and, equally important, when they cease to be responsible. This information will need to be provided in a timely manner (the exact timeframe will be prescribed in legislation and has not yet been confirmed).

The statutory guidance, read with the supplementary resources, strongly suggests that familiarity, rehearsal and role clarity will matter just as much as formal written procedures.

For enhanced-tier premises and qualifying events, the position is more onerous. In addition to the standard-tier style procedures, there must be appropriate public protection measures to reduce vulnerability to an attack and the risk of physical harm if one occurs. The Act identifies four broad categories:

• monitoring the premises or event and its immediate vicinity;
• controlling movement into, out of and within the premises;
• physical safety and security measures; and
• the security of information, such as plans and other sensitive information.

The guidance continues to stress proportionality, but it also makes clear that larger and better-resourced organisations will be expected to do more. Organisations or companies in this category must also designate a senior individual for compliance purposes and document compliance information for submission to the SIA.

For larger sports venues, most of this will not feel conceptually new. Bag checks, CCTV, searching policies, queue management and the secure handling of plans or control-room information are already familiar features of many major venues and events. The significance of the guidance is not that it introduces an alien concept, but that it clarifies these features must now be considered through the lens of a statutory regime, considering the different forms and types of possible attack, with documented reasoning and a clear link to the Act’s required outcomes.

What sports organisations should be doing now

The publication of the new guidance – and the fact that implementation could be less than a year away – makes this a sensible moment for sports organisations to move from 'monitoring developments' to structured preparation. 

Organisations should:

• identify which of their premises and events are likely to fall within scope, using a defensible method for assessing numbers and recording the basis of that assessment;
• map who actually has control over the relevant premises or event, including where operations are shared or outsourced, or the use of a premises is shared and has multiple uses; and
• consider the different forms and types of possible attack, review existing emergency plans, crowd management arrangements and security measures, and consider these against the Act’s concepts of public protection procedures (in the case of standard duty premises) and, where relevant for premises which fall under the enhanced duty, public protection measures.

Contracting and allocating compliance risk in venue-hire and outsourcing agreements

Contracting will also matter. Where venues are hired out, or where third parties deliver security, stewarding, catering or event management functions, contractual documents should clearly allocate roles, information-sharing, co-operation obligations, audit rights and responsibility for implementing venue procedures. The statutory guidance does not prescribe specific clauses, but its repeated focus on co-ordination and co-operation means that loose or informal arrangements are unlikely to be enough. 

Sports clubs, stadium operators and venue owners should review venue hire agreements, event management agreements, catering, security and facilities contracts to allocate responsibility for compliance activities, information-sharing, risk assessments, crowd management, evacuation, lockdown and communication procedures, and to require co‑operation where multiple parties exercise control.

But because statutory responsibility attaches to the 'responsible person', it cannot simply be contracted away, even where operational tasks are outsourced. As such, contractual allocation of operational responsibilities should be drafted on the basis that the responsible person may remain legally accountable under the Act regardless of the contractual position, and contracts considered as another risk-management tool rather than a complete transfer of liability.

In the context of a 'qualifying event' – if an event operator enters into a venue hire contract to hire a location for a qualifying event, the event operator will have control over the location for the duration of the event, and as such will be the responsible person for the qualifying event under the Act.

Please note this content was originally published in LawInSport, 17 July 2026, and can be seen here.

Further support and resources

The guidance points duty holders towards existing resources produced by the National Counter Terrorism Security Office (NaCTSO), the National Protective Security Authority (NPSA) and ProtectUK, and notes that training, learning or counter-terrorism awareness will often be needed to ensure staff can deliver procedures and measures effectively. For a sector that often relies on a mix of employees, agency staff, stewards, volunteers and event-day workers, that may prove to be one of the biggest practical challenges.