View our separate guidance for FE colleges in Wales.

If you’re a headteacher, chief executive or chair of trustees, this is a practical guide to what Martyn's Law — the Terrorism (Protection of Premises) Act 2025 — means for your school, who is legally responsible, what you actually need to do, and what you can safely ignore.

Key points at a glance:

• Most secondary schools, academies and sixth form colleges are in scope. 
• Education settings remain in the standard tier regardless of capacity - enhanced duties do not apply. 
• Standard-tier requirements focus on documented procedures and staff training, not physical security infrastructure. 
• The responsible person is the governing body (maintained schools) or the trust board (academies). 
• The compliance deadline is expected to be spring 2027, but the requirements are clear now. 
• Official guidance and free resources are available - there is no need to buy third-party compliance products before reading them.

When does Martyn's Law take effect?

Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, came into force on 3 April 2025. The UK Government has committed to an implementation period of at least 24 months before duties become legally enforceable, meaning the compliance deadline is spring 2027. 

The Home Office published its final statutory guidance in April 2026 and the requirements for standard-tier settings are now clearly set out. The implementation period gives you time to plan and prepare properly.

What is Martyn's Law and why does it exist?

The Act takes its name from Martyn Hett, one of the 22 people killed in the Manchester Arena bombing in 2017. It exists because of years of relentless campaigning by his mother, Figen Murray OBE to ensure venues implement counterterrorism and security preparedness and have actionable plans in the event of incidents.

That context is worth keeping in mind when the governance and compliance checklist starts to feel abstract.

Which schools are in scope?

The Act uses a tiered system based on the number of people reasonably expected to be present at a premises at the same time. 

Most secondary schools, academies and sixth form colleges will comfortably meet the 200-person threshold on any ordinary day once pupils, staff and visitors are counted together. For a typical secondary school of 1,200 pupils and 80 staff, the question more or less answers itself.

Here is the part that should give you some relief. Early years, primary, secondary and further education settings benefit from a specific consideration in the Act. They remain in the standard tier regardless of their capacity, meaning enhanced duty requirements do not apply.

Sixth form colleges fall within the further education category and share that protection. If that has been a source of anxiety in your setting, you can set it aside.

Settings where fewer than 200 people are reasonably expected to be present at the same time fall outside scope entirely, though the government encourages all settings to have preparedness plans in place regardless. 

Small primary schools may well find themselves below the threshold. For a village school with 90 pupils, a handful of staff and an occasional parent volunteer, that is a sensible outcome, but you should still review your preparedness.

What do schools actually need to do to comply?

All settings within scope must, so far as is reasonably practicable, have public protection procedures in place. These are procedures to enable staff to act quickly to reduce harm in the event of a terrorist incident at or near the premises, covering:

• Evacuation.
• Invacuation.
• Lockdown.
• Communication.

The obligations for standard-tier settings are not designed to be onerous. The UK Government has been explicit: standard-tier requirements are centred on simple, low-cost activities. There’s no requirement to install new physical security infrastructure such as CCTV, biometrics, additional gates or barriers.

What you will not need to do

What is required is documented procedures and trained staff. Duty holders can plan against these requirements with confidence. They are clear, proportionate and achievable well within the implementation period.

Building on what you already have

For most schools, the encouraging news is that much of the groundwork already exists in some form. If you've been following Keeping Children Safe in Education, your local authority's emergency planning guidance or your trust's own framework, you almost certainly have evacuation plans, lockdown protocols and communication procedures already in place. 

The task now isn't to start from scratch. It's to formalise what you have, document it clearly and test it against the specific framework the legislation imposes. That is a meaningfully different and considerably more manageable exercise than the one some settings fear they are facing.

The gaps, when you find them, are likely to be smaller than you expect. The question to ask of each procedure is not just whether it exists, but whether it is current, whether it reflects the Act's specific requirements and whether your staff actually know what to do. 

Notifying the SIA

Responsible persons at all qualifying premises must also notify the Security Industry Authority (SIA) as regulator. A ‘responsible person’ is the individual or organisation that has overall control of qualifying premises or events. 

The online portal for doing so is not yet live. When it does open, notification should be approved and submitted as an act of the responsible person. For trusts, that means board approval - not a task that should be delegated to the business manager.

Who is legally responsible? Governance under Martyn's Law

For maintained schools, the responsible person is the governing body. For academy trusts, it is the trust itself as the legal entity.

What this means for multi-academy trusts

That last point matters enormously for multi-academy trusts. Where a trust operates schools across multiple sites, it's the trust board that is the responsible person across every one of those sites. A trust-wide approach to procedures, training, documentation and audit isn't a choice. It's the only workable model. 

Local governing bodies can support implementation, but they can't carry the legal responsibility. That sits with the trust board. The principal or chief executive should implement the board’s approval. Briefing the board after the event isn't the same as the board discharging its legal duty, and the two should not be confused.

How does Martyn's Law affect school lettings?

Many schools regularly let their premises to community groups, sports clubs, faith organisations and external event organisers. As a general rule, where your premises are hired for an event, responsibility as the qualifying premises operator remains with you unless responsibility has been clearly allocated elsewhere in writing. 

In practice, that means your existing lettings agreements need to be reviewed - and probably soon, before a large event takes place.

The question is most likely to arise where sports halls or large spaces are let to external organisers attracting significant numbers of the public. A Saturday football tournament for local clubs, a community concert, a large public examination centre - each of those arrangements deserves a look. 

Practical steps for lettings

We'd recommend that any school operating lettings at scale takes the following steps before the end of this academic year:

• Review your template lettings agreement against the Act's requirements.
• Identify any events that might attract 200 or more attendees and could be a qualifying event in its own right, bringing the hirer its own obligations.
• Take advice on how responsibility under the Act is properly allocated between you and the hirer.

Do you need to buy Martyn's Law compliance products?

The market for compliance products has grown rapidly since royal assent, and not all of it is selling something the Act actually requires. The SIA, the Home Office and ProtectUK have all confirmed they don't endorse any third-party products or providers claiming to ensure compliance with Martyn's Law. 

The DfE has similarly confirmed it doesn't endorse paid services offering to enhance security measures and preparedness for education settings.

Before commissioning third-party services, start with the official guidance. The best free resources are:

• ProtectUK (protectuk.police.uk): Practical guidance and free e-learning on protective security.
• National Protective Security Authority (npsa.gov.uk): Threat assessments and security advice.
• DfE free webinars for education settings: Being delivered during the implementation period.

Attend the free sessions and read the official material first. If you still feel you need external support afterwards, at least you will know what you are buying.

What will an SIA inspection look like?

The Home Office published its final section 27 statutory guidance on 15 April 2026, setting out what those responsible for qualifying premises must do to comply with the Act. That guidance is on gov.uk and it's the authoritative statement of what is required. There is no longer any reason to be uncertain about the substance of the obligations.

The SIA has signalled a proportionate, advisory-first approach. Think of it as a professional conversation about whether your documented procedures are in place, understood by your staff and capable of being acted on quickly. That said, proportionality has its limits. The Act gives the SIA powers to issue civil notices and financial penalties, and in the most serious cases to refer matters for prosecution. 

A setting with no documented procedures, no evidence of staff training and no record of engagement with the guidance isn't going to find that conversation particularly comfortable.

Upcoming regulatory guidance

The SIA's draft section 12 guidance on how it will exercise its regulatory functions is currently being finalised following public consultation. Once published, it will give the clearest picture yet of what an inspection will look like in practice. Watch for it and sign up for SIA email updates if you haven't already.

Where should you start? A practical checklist

The most useful first steps are:

• Have a governance conversation: Make sure your board or governing body understands that it is the responsible person as a matter of law and is prepared to accept that responsibility at a whole-organisation level. 
• Audit what you have: Work through your existing procedures and compare them against the Home Office statutory guidance.
• Identify real gaps: The question to ask of each procedure is not just whether it exists, but whether it is current, whether it reflects the Act's specific requirements and whether your staff actually know what to do.
• Don't wait: The requirements are clear, the obligations are manageable and the implementation period exists to give you time to prepare properly, not to defer the work.

For most schools, the honest assessment is that this is achievable now, with the staff, documentation and procedures you largely already have.

If you haven't already spoken to legal advisers about Martyn's Law, now is a reasonable time to do so. Not because the Act is impenetrable, but because it doesn't sit in isolation. 

It interacts with your governance arrangements, your KCSIE obligations, your Prevent duty, your employment policies and your lettings agreements, and the way those things fit together is worth working through with someone who knows the sector.

Why this matters

Martyn's Law doesn't ask schools to do anything that is alien to good educational leadership. 

Looking after the people in your care, planning carefully for difficult situations, making sure your staff know what to do - those things are already at the heart of what you do every day. What the Act does is give those responsibilities a formal legal framework and place accountability clearly where it belongs.

At Browne Jacobson, we work with schools and academy trusts across England on governance, safeguarding, employment, health and safety and commercial law. Martyn's Law cuts across all of these, and it is an area our education and regulatory teams know well.

If you would like to talk through what it means for your school or trust, please get in touch.