Martyn’s Law and Emergency Communication
The Terrorism (Protection of Premises) Act 2025 places a preparedness duty on qualifying premises, and it is expected to come into force in spring 2027. Communication is one of the four procedures it asks for. It is also the only part of the duty a telecoms supplier can help with, and most of this page is about telling the two apart.
Request a quoteWho it applies to, and what it actually asks for
Last updated
Martyn’s Law is the Terrorism (Protection of Premises) Act 2025, named after Martyn Hett, who was killed in the Manchester Arena attack. It received Royal Assent on 3 April 2025, the Home Office published its statutory guidance on 15 April 2026, and the Act is expected to come into force in spring 2027 — the commencement date has not been fixed. The Security Industry Authority is the regulator, and it enforces through compliance notices, restriction notices and monetary penalties rather than going straight to prosecution. Nothing is enforceable yet. Anyone telling you that you are already in breach is selling something.
It applies to qualifying premises: a building, or a building and its grounds, wholly or mainly used for one of the activities listed in the Act. Retail, food and drink, entertainment and leisure, sports grounds, hotels and other visitor accommodation, visitor attractions, libraries and museums, halls and community centres, places of worship, health care, education and childcare, and public authority premises are all on that list. Some things that look like they belong on it are excluded outright — public transport among them — because they already sit under their own security regimes. Scope then turns on how many people may reasonably be expected to be present at the same time. From 200 up to 799 puts you in the standard tier. 800 or more puts you in the enhanced tier. Below 200 the Act does not apply at all.
Two things about that number catch people out. It counts everybody present at once — staff, volunteers and contractors as well as customers, not tickets sold — and it is your busiest realistic day rather than an ordinary one, so premises that are quiet for fifty weeks of the year can still be in scope because of the other two. Some categories stay in the standard tier however large they get: places of worship, childcare, and primary, secondary and further education. Higher education is not in that carve-out. Separately, an event the public can attend where 800 or more people are expected at the same time at some point, held somewhere with a check on entry, is a qualifying event in its own right and carries the enhanced requirements.
The duty itself is shorter than most summaries of it. You notify the SIA who the responsible person is. You then put in place, so far as is reasonably practicable, appropriate public protection procedures: evacuation, invacuation — moving people somewhere safer inside rather than out — lockdown, and communication. Enhanced tier premises and qualifying events do all of that and then more: public protection measures covering monitoring, the movement of people, physical security and information security; a designated senior individual where the responsible person is an organisation rather than a person; and a document setting out the procedures and the measures, which goes to the regulator. The Act places no documentation requirement on the standard tier at all.
That last point is the one that decides whether any of this is a purchase, so it is worth stating plainly. Standard tier is a planning and training exercise, not a procurement exercise. What the Home Office expects there has consistently been described as simple and low cost, achievable without buying equipment or bringing in external trainers, and the official guidance goes as far as saying premises do not need to spend money on consultants to comply. A pub with a capacity of 250 does not need a mass notification system, and we would not sell it one on the grounds that the law requires it, because the law does not. What the law asks at that size is that somebody has worked out how a warning reaches everyone in the building, and that the staff on shift know what to do when it arrives.
Equipment earns its place where the building defeats a shout: several buildings, bedrooms and function rooms, a kitchen with extraction running, a plant room, a car park, grounds people are spread across. It earns its place again where the right response is not the same everywhere, because holding one wing still while clearing another needs a message that can be aimed. Beyond that we are a telecoms and IT supplier, and we cover the communication procedure rather than the rest of the duty. We do not carry out your terrorism risk assessment, write your procedures, supply door supervision or install physical security measures, and we cannot certify anything — there is no such thing as a Martyn’s Law compliant phone system, and the duty stays with the responsible person whatever is installed. Where a security consultant is already engaged, we would rather build to their design than reopen it.
What we cover on the communication side
Alerting in a single action
A dedicated emergency button that starts a procedure in one press. Nobody should be looking up a number or recalling a code while it is happening.
Announcement across the whole site
Paging and voice reaching wherever people are. Wired where the containment is already in, wireless where buildings are temporary, IP over your own network where announcements need aiming.
Zoned, not just everywhere
A message to one wing, one building, or the whole site at once. Clearing one area while holding another still is the reason zoning is worth paying for.
Alerting inside the phone system
Alarm and alert functions are part of the Evonex platform rather than a separate product, so the system staff use every day is the one that runs an incident.
Coverage where people actually are
Car parks, grounds, bedrooms, function rooms, back of house. A warning that reaches the reception desk and nowhere else is not a communication procedure.
Survey first, specification second
We look at the site and your existing emergency plans before anything is specified, then agree tones and wording, train staff and hand over formally. A system that does not serve a procedure people already know is decoration.
Martyn’s Law and Emergency Communication — Common Questions
Does Martyn’s Law apply to us?
If your premises are wholly or mainly used for one of the activities named in the Act — retail, food and drink, entertainment and leisure, sport, hotels, visitor attractions, halls, health care, education and childcare, places of worship and others — and 200 or more people may reasonably be expected to be present at the same time, then yes. Count staff, volunteers and contractors as well as customers, and count your busiest realistic day rather than an average one. Below 200 you are out of scope entirely.
Are we already late?
No. The Act received Royal Assent on 3 April 2025 and is expected to come into force in spring 2027, and the commencement date has not been fixed, so there is nothing to be in breach of yet. What is worth doing now is establishing which tier you fall into, because that decides whether this is a short conversation about procedures or a documented submission to the regulator. Anyone telling you that you are currently non-compliant is selling something.
What does the communication procedure actually require?
Getting information and instructions to the people on your premises when something happens: alerting them to the danger and telling them what to do. The Act does not name a technology. For a small single-room venue a trained member of staff and a raised voice can satisfy it. For a hotel, a campus or a site with grounds it will not, because there is no way to reach everyone at once. The test is whether a warning genuinely gets to everybody, not what produced it.
Do we have to buy a mass notification system?
Not because of the law. Standard tier duties are described as simple and low cost, achievable without buying equipment, there is no requirement to document them, and the official guidance goes as far as saying you do not need to spend money on consultants either. Where a system earns its money is where a shout will not carry — multiple buildings, bedrooms, grounds, plant rooms, a car park. We would rather look at your site and tell you it is not needed than sell you the largest option.
Is there such a thing as a Martyn’s Law compliant phone system?
No, and we would not describe anything we sell that way. The duty belongs to the responsible person for the premises, and it covers notification, procedures, training and — at enhanced tier — measures and a document sent to the regulator. Equipment can only ever support one of the four procedures. Any supplier claiming their product makes you compliant is telling you something the legislation does not support.
We are a school. Which tier are we in?
Standard, and that stays true however large you get. Childcare, primary, secondary and further education premises, along with places of worship, remain in the standard tier even where 800 or more people may be present. Higher education is not in that carve-out, so a university is treated on capacity like anything else. Being held at standard tier does not remove the duty, but it means the expectation is procedures and training rather than the documented measures and regulator submission required at enhanced tier.
We hold a one-off event in our grounds. Does that change anything?
It can. An event the public can attend where 800 or more people are expected to be present at the same time at some point, held somewhere with a check on entry — a ticket, a payment, a pass, a membership — is a qualifying event and carries the enhanced tier requirements, even if the premises themselves are standard tier or out of scope for the rest of the year. Private functions such as weddings and corporate hire are not public access and do not qualify on their own.
What happens to alerting if the internet connection goes down?
It depends what the alerting runs on, and it is worth deciding deliberately rather than discovering it on the day. Anything hosted, the phone platform included, fails with the circuit it runs over. A mobile 4G or 5G backup gives a second route; an on-site paging system driven from a local amplifier carries on without the internet, at which point mains power and battery backup become the question instead. For some sites, accepting the risk is a defensible answer. The wrong outcome is not knowing which of those you have.
Can you write our procedures or carry out the risk assessment?
No. We are a telecoms and IT supplier and we cover the communication side only — alerting, site-wide voice, coverage and testing. Your terrorism risk assessment, your procedures, staff training on how to respond and any physical security measures sit with you or with a security consultant. Where one is already engaged we would rather build to their design than start a second, competing conversation about it.
What is worth doing before it commences?
Work out your capacity honestly and write down which tier that puts you in, because everything else follows from it. Then walk the site at its busiest and ask where a warning would not be heard — the kitchen, the plant room, the car park, the far end of the grounds. If the answer is nowhere, you have a procedure and a training job rather than a purchase. If there are gaps, you now know what they are before anyone quotes you for filling them.
More Support Services
Where we cover martyn’s law and emergency communication
We deliver this across the UK. These 8 are where a director is actually based — each page names who you would be dealing with, and what the local economy is made of.
Working out what your premises needs?
If the building defeats a shout, tell us how it is laid out and we will say what would actually reach people in it — and where you do not need to buy anything.