Updated October 2026. This article reflects the Section 27 statutory guidance (15 April 2026, corrected August 2026), the Home Office notification guidance of 14 July 2026, the SIA's regulator guidance of 17 July 2026, and the Principal Use of Premises Regulations 2026, in force since 15 October 2026, which matter for mixed-use HQ buildings. Commencement is expected in spring 2027, with the exact date still to be confirmed by the SIA. The four formal categories of enhanced-tier public protection measures are particularly relevant for HQ campuses.
This article is part of our comprehensive guide to Martyn's Law. For an overview of the legislation, who it applies to, tier requirements, implementation timelines, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Martyn's Law applies to a broad range of premises, including office buildings, business campuses and co-working spaces. Corporate landlords and tenants must understand how the Terrorism (Protection of Premises) Act 2025 affects them and what steps to take to comply ahead of the Spring 2027 commencement window.
How the tiered system applies to offices
Martyn's Law introduces a tiered approach based on the number of people reasonably expected to be present at the same time:
Standard tier (200 to 799 individuals): Most office buildings and corporate campuses will fall under this category. Responsible persons must implement appropriate public-protection procedures, including notifying staff, locking down or evacuating the premises, and communicating during an incident. There is no expectation of installing expensive physical measures for standard-tier premises (gtlaw.com). Standard tier non-compliance carries financial penalties of up to £10,000.
Enhanced tier (800+ individuals): Huge headquarters or multi-tower campuses may fall into this category. In addition to standard measures, enhanced-tier premises must produce a narrative-style compliance document for the regulator (gtlaw.com) covering the four formal categories of public protection measures introduced by the April 2026 statutory guidance: monitoring (e.g. CCTV, observation arrangements), movement (control of access, queuing, vehicle management), physical safety and security (barriers, glazing, layout) and security of information. Where the responsible person is an organisation, a senior individual must be designated, and that individual is personally exposed to criminal liability of up to two years' imprisonment for breaches involving consent, connivance or neglect. Enhanced tier financial penalties run up to £18m or 5% of worldwide revenue (whichever is higher), with daily penalties for continuing breaches and the possibility of a restriction notice preventing the premises from operating.
For a detailed comparison of standard and enhanced tier requirements, see our guide: Standard vs. Enhanced Tier: What's the Difference?.
Who is responsible?
The Act defines the responsible person as the individual or entity that has control of the premises (homeofficemedia.blog.gov.uk). In multi-tenant buildings, both the property owner and the tenants may be accountable for their areas. Businesses occupying a floor or suite within a larger building should work closely with the landlord or building management to ensure compliance across the entire site.
Coordination duty for shared spaces. The April 2026 statutory guidance is explicit on multi-responsible-person scenarios: shared lobbies, lifts, atria, loading bays, public realm and forecourts. Each responsible person retains their own duty, and there is an explicit coordination duty between them. Corporate occupiers of multi-tenant buildings should expect their landlord to take the lead on building-wide procedures and should be ready to integrate these into their own plans rather than running parallel arrangements.
Principal use for mixed-use buildings (regulations in force 15 October 2026). Where a single premises has more than one Schedule 1 use, for example an office tower with a ground-floor retail arcade, a public auditorium or a conference centre, the Terrorism (Protection of Premises) (Principal Use of Premises) Regulations 2026 decide which use is the principal one and therefore who the responsible person is. The test looks at how the building was designed or adapted, its physical features, how it continues to be used and how the local authority classifies it, and falls back to the share of floor space and time each use takes up. Home Office guidance was published on 10 September 2026 (gov.uk). Corporate estates with mixed-use buildings should settle the principal use now so that the right party notifies the SIA.
Notification deadlines. Under the Home Office notification guidance of 14 July 2026, the responsible person for premises in scope at commencement must notify the SIA within three months of the commencement date, through the SIA's online portal on GOV.UK, at no fee. New responsible persons have 28 days. Both tiers must notify; enhanced tier premises must also name their designated senior individual.
For more information on identifying responsible persons, see our guide: Who Does Martyn's Law Apply To?.
Key steps for corporate premises
1. Conduct risk assessments
Identify potential vulnerabilities in your office layout, such as reception areas, access points, parking garages, atriums and communal facilities. Assess the likelihood and impact of various attack scenarios and prioritise controls. Larger campuses should coordinate assessments across multiple buildings.
2. Develop emergency procedures
Even standard-tier offices must have clear procedures for evacuation, invacuation and lockdown, along with communication plans. Document these procedures and make sure they are easily accessible to staff. For enhanced-tier premises, keep records of these procedures for sharing with the regulator (gtlaw.com).
3. Train and empower employees
Provide regular security awareness training covering how to recognise suspicious behaviour, how to initiate a lockdown and where to assemble during an evacuation. Training should include contractors, security guards, cleaners, and anyone else who is regularly on site. Use refresher sessions to keep procedures top-of-mind.
4. Coordinate with landlords and neighbouring tenants
Multi-tenant offices present special challenges. Landlords should coordinate building-wide drills, share emergency plans and ensure that all tenants understand their responsibilities. Tenants should integrate building-level procedures into their own plans and communicate with neighbours regarding shared spaces such as lobbies, cafeterias, and parking areas.
5. Leverage AV technology for communication
Digital signage and PA systems: Install displays and speakers in lobbies, lift banks and open areas to broadcast emergency instructions. These systems should be integrated with the building's fire alarm and access control systems so messages can be triggered automatically.
Desktop alerts and mobile notifications: For distributed or hybrid workforces, use desktop pop-ups and SMS alerts to reach employees who are not in communal spaces. Ensure contact details are up to date.
Access control and occupancy analytics: Integrated access systems help track who is on site and can lock doors or restrict movement during an incident. Occupancy sensors can provide data to inform evacuation strategies.
For more information on how AV technology can support Martyn's Law compliance, see our complete guide to Martyn's Law.
6. Engage with local authorities
Corporate security managers should liaise with local police and counter-terrorism advisors to validate their risk assessments and emergency plans. Large sites may also arrange joint exercises with emergency services.
7. Prepare for the implementation timeline
Martyn's Law received Royal Assent on 3 April 2025, the Section 27 statutory guidance was published on 15 April 2026, and the SIA's guidance of 17 July 2026 says commencement is expected in spring 2027 with the exact date to be confirmed (gov.uk). Once the Act commences, premises have three months to notify the SIA. Use the remaining window to audit your sites, create plans and train staff. With statutory guidance now live, "watch and wait" is no longer the right posture: Government, the regulator and industry bodies all expect responsible persons to be visibly progressing through 2026.
For a detailed implementation timeline and compliance checklist, see our guide: Martyn's Law Implementation Timeline & Compliance Checklist.
Final thoughts
For most corporate premises, Martyn's Law will not require drastic infrastructure changes but will demand planning, documentation and training. By understanding which tier applies, identifying the responsible persons, coordinating with landlords and tenants, and leveraging integrated AV and communication systems, businesses can meet the Law's requirements and enhance the safety of their employees and visitors.
For more comprehensive information about Martyn's Law, including who it applies to, tier requirements, special considerations for education settings, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Strive AV's Martyn's Law Compliance service can help evaluate your existing AV infrastructure, design integrated communication systems, and develop emergency-alert strategies tailored to your workspace. Reach out to discuss how we can support your Martyn's Law compliance efforts.
Frequently Asked Questions
Q.Does Martyn's Law apply to private corporate offices?
Private offices that are not open to the public are generally outside the scope of Martyn's Law. However, the moment an office hosts a public event, opens reception areas to walk-in visitors, or operates publicly accessible spaces such as ground-floor lobbies, those areas may fall in scope if 200 or more people may be present at the same time.
Q.How does Martyn's Law affect co-working spaces?
Co-working spaces are publicly accessible premises and may fall under Martyn's Law if expected occupancy exceeds 200 people. The operator of the space is typically the responsible person, though individual tenants who host public events may share specific duties. Standard-tier procedures around evacuation, invacuation and staff awareness training apply.
Q.Who is the responsible person in a multi-tenant office building?
In multi-tenant buildings, the responsible person is whoever has control of the premises for its principal use, usually the building landlord or facilities manager. Where the building has more than one Schedule 1 use, the Principal Use of Premises Regulations 2026 (in force 15 October 2026) set out how to identify the principal use. Individual tenants are responsible for their own occupied spaces. Coordination between landlords and tenants is essential to ensure aligned emergency procedures and consistent staff training.
Q.Do internal corporate events count toward Martyn's Law thresholds?
Internal events that are not open to the public generally do not bring an office into scope. Martyn's Law specifically applies to publicly accessible premises and events. However, if an internal event has external attendees who can walk in without invitation, such as a public conference or product launch, capacity must be assessed against the 200-person threshold.
Q.What practical AV measures support Martyn's Law compliance in offices?
Useful technology includes integrated digital signage that can display emergency instructions, voice evacuation PA systems with all-zone announcement capability, occupancy analytics to monitor real-time density, visitor management for access control, and a centralised control platform that lets security teams override displays and broadcast simultaneous audio-visual alerts during an incident.
