The Terrorism (Protection of Premises) Act 2025, in our own words

What is in force, and what is not

Part 3 of the Act (regulations, extent, commencement, short title) came into force at Royal Assent on 3 April 2025 (s.37(1)). Two commencement orders have been made so far: section 27, the Secretary of State's duty to publish guidance, came into force on 10 April 2026 (SI 2026/320), and the Security Industry Authority's power to prepare guidance and give advice under section 12(2) and (3) came into force on 15 June 2026 (SI 2026/622). The rest of Parts 1 and 2 is in force only for the purpose of making regulations and otherwise awaits a day appointed by the Secretary of State (s.37(2)). The Home Office statutory guidance under section 27 was published on 15 April 2026. The Act's duties on venues are not yet in force. The Security Industry Authority (SIA) expects them to come into force in spring 2027. No date has been set.

Section 2: which premises qualify, and which tier

Premises qualify if they are a building (or part of one, or a group of them) used wholly or mainly for one of the purposes in Schedule 1, if it is reasonable to expect that from time to time 200 or more people may be present at the same time in connection with that use, and if Schedule 2 does not exclude them (s.2(2)). Qualifying premises are enhanced duty premises where 800 or more may be present at the same time; everything else is standard duty premises (s.2(3)). Schedule 1 can override the thresholds for particular kinds of premises (s.2(4)).

The Act's words, s.2(2)(c): "it is reasonable to expect that from time to time 200 or more individuals may be present on the premises at the same time in connection with one or more uses specified in Schedule 1".

Cited in: the venue guide, the tier checker.

Section 3: qualifying events

An event is a qualifying event if it is held on premises that are not enhanced duty premises, the public will have access to attend it, it is reasonable to expect 800 or more people present at the same time at some point during it, entry is controlled by payment, ticket, pass or membership, and Part 2 of Schedule 2 does not exclude it (s.3(1)). Where entry is controlled for only part of the premises, each such part is treated as a separate event (s.3(2)).

Cited in: the tier checker.

Section 4: who is responsible

The person responsible for qualifying premises is whoever has control of them in connection with their Schedule 1 use; for an event, whoever will have control of the premises for the event (s.4(1)). Where premises have more than one Schedule 1 use, the principal use counts (s.4(2)). Where more than one person is responsible, the duties fall on each of them and they may comply jointly (s.4(4)).

Section 5: the four public protection procedures

Everyone responsible for qualifying premises or a qualifying event must, so far as is reasonably practicable, have appropriate public protection procedures in place (s.5(1)), with the objective of reducing the risk of physical harm if an act of terrorism were to occur on, at or near the premises or event (s.5(2)). Section 5(3) defines them as procedures to be followed by people working at the premises if an attack is suspected:

"(a) for evacuating individuals from the premises or event; (b) for moving individuals to a place on the premises or at the event where there is less risk of physical harm being caused to them; (c) for preventing individuals entering or leaving the premises or event; (d) for providing information to individuals on the premises or at the event."

The Act requires procedures, not equipment. The statutory guidance calls the four evacuation, invacuation, lockdown and communication, and says in terms that there is no statutory requirement to purchase equipment (para 7.25). Whether the information in (d) can reach everyone is the part that depends on the building and its systems.

Cited in: the venue guide, Does Martyn's Law require a PA system?, Can a fire alarm make lockdown announcements?, Warning back-of-house staff, the communication assessment.

Section 6: public protection measures, enhanced tier

Enhanced duty premises and qualifying events must also have appropriate public protection measures in place, so far as is reasonably practicable, and must assess and keep them under review. The measures cover monitoring of the premises and their immediate vicinity, the movement of people into, out of and within them, their physical safety and security, and the security of information about them.

Cited in: the venue guide.

Section 7: documenting compliance, enhanced tier

Enhanced duty premises and qualifying events must keep an up-to-date document setting out the procedures and measures in place and how each is expected to reduce the risk of harm, and give a copy to the Security Industry Authority, including after any revision. The standard tier has no documentation duty under the Act; the guidance calls documentation good practice for even the simplest procedures (para 7.8), and says standard tier premises should still prepare a document, because without one it may be difficult to demonstrate compliance (para 7.32).

Cited in: the venue guide, Does Martyn's Law require a PA system?.

Section 8: co-ordinating and co-operating

Where more than one person is responsible for the same premises or event, or where qualifying premises sit inside other qualifying premises (a shop in a shopping centre, a bar in a stadium), those responsible must co-ordinate with each other so far as reasonably practicable (s.8(1) to (4)). Anyone else with control of enhanced duty premises or the premises for a qualifying event must co-operate with the responsible person (s.8(5) and (6)).

Section 9: notifying the Security Industry Authority

Anyone who becomes, or stops being, responsible for qualifying premises or a qualifying event must notify the Security Industry Authority by a time that regulations will set (s.9(1), (2) and (5)), and must update the notification if the information in it stops being accurate (s.9(4)). Regulations can specify what the notification contains and how it is made (s.9(6)). This applies at both tiers. The SIA is building a notification portal on GOV.UK.

Cited in: the venue guide, the tier checker.

Section 10: a designated senior individual

Where the person responsible for enhanced duty premises or a qualifying event is an organisation rather than an individual, it must designate someone concerned in its management or control as responsible for making sure it complies with Part 1.

Cited in: the venue guide.

Section 12: the Security Industry Authority

The Security Industry Authority carries out the functions relating to the requirements in sections 5 to 10 (s.12(1)), including preparing guidance about how it will exercise those functions and giving advice (s.12(2)), with that guidance approved by the Secretary of State and kept under review (s.12(3)). Apart from s.12(2)(c), these subsections came into force on 15 June 2026 (SI 2026/622). With section 27 (in force since 10 April 2026), they are the only parts of Part 1 in force beyond regulation-making powers. The SIA consulted on its draft section 12 guidance between 15 April and 12 June 2026 and has said it will publish the final version and a consultation report in autumn 2026. The SIA has said it cannot endorse or recommend companies or services for compliance.

Cited in: the venue guide (the regulator), the communication assessment (who determines compliance).

Section 27: the statutory guidance

The Secretary of State must publish guidance about the requirements of Part 1, keep it under review and lay it before Parliament (s.27(1) to (4)). Section 27(5) is the subsection worth knowing: in any proceedings alleging a contravention, "proof that the person acted in accordance with applicable guidance under this section may be relied on as tending to establish that there was no such contravention". Following the Home Office guidance is therefore evidence in a venue's favour, which is why our pages cite it by paragraph.

Cited in: every Martyn's Law page that quotes the statutory guidance.

Section 37: commencement

Part 3 came into force on the day the Act was passed (s.37(1)). Parts 1 and 2 came into force on that day only for the purpose of making regulations and otherwise come into force on a day the Secretary of State appoints by regulations, which may appoint different days for different purposes (s.37(2) and (3)).

Schedules 1 and 2

Schedule 1 lists the uses that make premises qualifying premises, under these headings: shops, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, health care, bus and railway stations, aerodromes, childcare, primary and secondary education, further education, higher education, and public authorities. Places of worship, childcare, and primary, secondary and further education are always standard duty premises, however many people attend (paras 9, 13, 14 and 15; statutory guidance, paras 4.36 to 4.38); higher education premises are treated like any other and can be enhanced tier (para 4.39). Schedule 2 lists excluded premises and events, including certain premises in Parliament, the devolved legislatures and some used by the emergency services, and Part 2 of it lists excluded events. Both schedules are long and specific; check the premises type against them on legislation.gov.uk rather than against this summary.

Where this leads

What the Act asks of your venue, with the tiers, the four procedures and the sound-system question in one place: the venue guide. For the system that will carry the communication procedure on the day, and how it is maintained to its own standard: voice alarm maintenance.