There's a piece of legislation that every hotel operator in the UK should have on their radar. Most don't. And the compliance deadline is closer than it feels.
The Terrorism (Protection of Premises) Act 2025 - widely known as Martyn's Law, after Martyn Hett, who was killed in the Manchester Arena attack in 2017 - received Royal Assent on 3 April 2025. It comes into force in spring 2027. The Security Industry Authority has been designated as the regulator.
This isn't advisory. It's statutory. And the penalties are significant.
What it requires
Martyn's Law operates on a tiered system based on the number of people reasonably expected to be present at a premises or event.
Standard tier (200-799 people). You must notify the SIA, and implement reasonably practicable public protection procedures covering evacuation, invacuation, lockdown and communication. Non-compliance carries fines of up to £10,000.
Enhanced tier (800+ people). Everything in the standard tier, plus: formal risk assessments, documented physical security measures, and a designated senior individual responsible for compliance. The documentation must be submitted to the SIA. Fines for non-compliance reach up to £18 million or 5% of worldwide revenue - whichever is greater.
If your hotel hosts conferences, weddings, large events, or has public areas that could reasonably hold 200 or more people at once, you are almost certainly in scope.
Why this matters for hotels specifically
Hotels are unusual premises. They're not a stadium with one event and one capacity figure. A hotel might be standard tier for its restaurant and bar, but enhanced tier for its conference and banqueting facilities - or for a large wedding. The capacity assessment isn't static. It shifts with the event.
That complexity is precisely why preparation needs to start now, not in January 2027 when the deadline is weeks away.
The SIA has indicated that its approach will involve desk-based assessments and on-site inspections, typically with at least 72 hours' notice. But warrants for unannounced entry can be sought in specific circumstances. The regulator's toolkit includes compliance notices, monetary penalties and restriction notices for serious or persistent non-compliance.
The government has explicitly stated that premises do not need to hire third-party consultants to comply. Neither the Home Office nor the SIA endorses any private sector products or services for this purpose. That's worth remembering if someone tries to sell you a Martyn's Law compliance package.
What you should be doing now
The Act doesn't require compliance until spring 2027. But the gap between "not legally required yet" and "operationally ready" is significant. Here's what I'd recommend.
Classify your capacity tiers. Walk every event space, restaurant, bar, lobby and public area. Determine the maximum reasonable capacity for each, and for the premises as a whole. Be honest about the numbers - underestimating capacity to avoid the enhanced tier isn't a strategy, it's a liability.
Assign accountability. For enhanced-tier premises, you need a designated senior individual. This person needs to understand the requirements, have the authority to implement changes, and be named in your SIA notification. Don't leave this to the last minute.
Audit your existing procedures. Most hotels already have evacuation procedures. Fewer have invacuation plans - the procedure for bringing people inside and securing a building when the threat is external. Lockdown procedures are rarer still. Map what you have, identify the gaps, and document everything.
Train your teams. The legislation requires staff training on these procedures. This isn't a one-off fire drill. It's ongoing, documented training that the SIA can inspect. Build it into your operational calendar now.
Don't conflate this with fire safety. Fire evacuation and terrorism response share some mechanics but differ fundamentally. A fire evacuation moves everyone out. An invacuation moves everyone in. A lockdown secures and conceals. Your team needs to understand which response applies to which scenario.
The context
Martyn's Law exists because of a real and terrible event. The Manchester Arena attack killed 22 people and injured over a thousand. Martyn Hett was one of them. His mother, Figen Murray, campaigned for years to bring this legislation into being.
That context matters. This isn't bureaucratic box-ticking. It's a statutory framework designed to protect the public in places where people gather. Hotels are among the most prominent of those places.
The implementation period exists precisely so that operators have time to prepare properly. Use it. The spring 2027 deadline will arrive faster than anyone expects, and the SIA will be looking for evidence that preparation was genuine, not rushed.
If you haven't started, start now.
---
Sources: Terrorism (Protection of Premises) Act 2025 (Royal Assent 3 April 2025); Home Office Martyn's Law Factsheet (April 2025); GOV.UK Statutory Guidance under Section 27 (updated 7 August 2026); SIA Regulatory Guidance under Section 12; ProtectUK Martyn's Law Overview.
Elliott Wakefield is a commercial consultant specialising in independent boutique hotels.
Get in touch to discuss your commercial strategy →