Updated October 2026. This article reflects the Section 27 statutory guidance (15 April 2026, corrected August 2026), the Home Office notification guidance of 14 July 2026, the SIA's regulator guidance of 17 July 2026 (which confirms that qualifying events of 800 or more carry enhanced-tier requirements), the coordination duty for shared spaces (especially relevant to shopping centres and food courts) and the Principal Use of Premises Regulations 2026, in force since 15 October 2026, which decide the responsible person for mixed-use estates. Commencement is expected in spring 2027, with the exact date still to be confirmed.
This article is part of our comprehensive guide to Martyn's Law. For an overview of the legislation, who it applies to, tier requirements, implementation timelines, and how AV technology can support compliance, see our complete guide to Martyn's Law.
The retail and hospitality industries, from high-street shops and shopping centres to pubs, restaurants and hotels, are at the heart of community life. Under the Terrorism (Protection of Premises) Act 2025 (Martyn's Law), these venues must assess their exposure to terrorism risks and implement proportionate measures to protect guests and staff ahead of the Spring 2027 commencement window.
Which venues are in scope?
Martyn's Law applies to premises that are wholly or mainly used for specified purposes (gtlaw.com). In the retail and hospitality sector, this includes:
Shops and retail outlets: from independent boutiques to department stores and shopping centres (gtlaw.com).
Bars, pubs and restaurants (gtlaw.com).
Hotels and other accommodation: including those with conference or event space (gtlaw.com).
Visitor attractions and event venues that host public events or private functions (gtlaw.com).
Premises expecting 200 to 799 people fall into the standard tier, while those expecting 800 or more are enhanced-tier premises. Ticketed events run by retail and hospitality operators (a food festival, a Christmas market with entry checks, a hotel's public concert) are qualifying events only at 800 or more expected attendees, and qualifying events carry the same requirements as enhanced tier premises (gov.uk, SIA guidance, 17 July 2026).
Mixed-use estates: who is the responsible person? A shopping centre with a cinema, a hotel with a conference centre or a department store with a restaurant floor has more than one Schedule 1 use. The Terrorism (Protection of Premises) (Principal Use of Premises) Regulations 2026 came into force on 15 October 2026 and set out how to identify the principal use, and therefore the responsible person, from how the building was designed or adapted, its physical features, continued use and local authority classification. Home Office guidance was published on 10 September 2026 (gov.uk).
For a detailed breakdown of who falls under Martyn's Law scope, see our guide: Who Does Martyn's Law Apply To?.
Responsibilities of venue operators
1. Identify the responsible person
The person or organisation with control of the premises (such as the venue operator, franchisee, or landlord) is responsible for complying with Martyn's Law (homeofficemedia.blog.gov.uk). In shopping centres or food courts, both individual tenants and centre management may have duties, so collaboration is crucial (gtlaw.com). The April 2026 statutory guidance is explicit about shared spaces and multi-responsible-person scenarios, there is now an explicit coordination duty between the parties involved, and this is likely to be a focus of early SIA enforcement attention. Where the responsible person is an organisation operating an enhanced-tier site, a senior individual must be designated and is personally exposed to criminal liability for breaches involving consent, connivance or neglect.
2. Carry out risk assessments
Hospitality venues often have multiple entry points, back-of-house areas and high staff turnover. Conduct detailed risk assessments for each site, covering:
Public areas: such as dining rooms, lobbies, bar areas, retail floors and car parks.
Back-of-house operations: including kitchens, stock rooms and loading bays.
Peak periods: when footfall spikes during holidays, sales or special events.
Assess the likelihood and impact of different threats and identify sensible mitigation measures (e.g., monitoring entry points, controlling deliveries, securing stock areas).
3. Develop proportionate emergency procedures
Standard-tier venues must establish public-protection procedures that staff can follow in the event of a terrorist attack. These should include:
Evacuation and invacuation plans: routes to get customers and staff out of danger or into secure areas.
Lockdown protocols: how to secure doors and communicate with guests during a threat.
Communication strategies: methods to alert all patrons quickly (e.g., PA announcements, digital signage, mobile alerts).
For enhanced-tier venues, procedures must be set out in a compliance document for the regulator. The April 2026 statutory guidance is explicit that this document is a narrative, not a checklist, it must explain what is in place, why each measure is expected to reduce harm, and where the chosen approach differs from what would normally be expected, why (gtlaw.com). Enhanced-tier hospitality and retail venues should also address the four formal categories of public protection measures: monitoring (CCTV, security observation), movement (queuing, access control, vehicle management), physical safety and security (barriers, glazing, layout) and security of information.
For a detailed comparison of standard and enhanced tier requirements, see our guide: Standard vs. Enhanced Tier: What's the Difference?.
4. Train and brief staff
Retail and hospitality businesses often have part-time or seasonal workers. Provide regular training on recognising suspicious behaviour, initiating emergency procedures and reassuring customers. Ensure new hires receive induction training and that managers understand their roles in an incident.
5. Use technology to enhance safety
Digital signage and PA systems: Use screens and speakers to broadcast clear instructions during an emergency. Wayfinding screens can direct customers to exits or safe zones.
Access control and visitor management: For hotels and large venues, integrate door locks, guest-room systems and visitor management to restrict access to secure areas.
Surveillance and analytics: CCTV and occupancy sensors help monitor crowd density and identify unusual patterns. Integrating these with alerting systems enables faster response.
Mobile and desktop alerts: Use apps or SMS notifications to reach staff working in back-of-house areas or away from the main trading floor.
For more information on how AV technology can support Martyn's Law compliance, see our complete guide to Martyn's Law.
6. Coordinate with landlords and neighbouring businesses
In shopping centres and mixed-use developments, procedures must align across multiple tenants. Landlords should provide overarching emergency plans and share guidelines with each retailer or restaurant. Tenants should integrate these plans into their own procedures and participate in joint drills.
7. Liaise with authorities and industry bodies
Work with local police, Business Improvement Districts (BIDs) and industry associations to stay informed. Regularly review updates from ProtectUK and the Home Office. Engage in regional counter-terrorism briefings and make sure staff know how to report suspicious activity.
8. Plan for the implementation period
Martyn's Law received Royal Assent on 3 April 2025, the statutory guidance was published on 15 April 2026, and the SIA's guidance of 17 July 2026 says commencement is expected in spring 2027 with the exact date to be confirmed (gov.uk). Retail and hospitality groups should use the months to spring 2027 to audit venues, develop procedures and invest in training and technology, and should plan for the notification regime published on 14 July 2026: premises notify the SIA within three months of commencement, new responsible persons within 28 days, and qualifying events within 14 days of first publicity, all through the SIA's online portal at no fee. The SIA's final Section 12 enforcement guidance, due in autumn 2026, will show how inspections and penalties work in practice; trade bodies and large operators should review it as soon as it is published.
For a detailed implementation timeline and compliance checklist, see our guide: Martyn's Law Implementation Timeline & Compliance Checklist.
Summary
Retailers, restaurateurs and hoteliers have a duty to provide safe, welcoming environments. Martyn's Law doesn't require heavy-handed security measures for every shop or café; instead, it calls for planning, training and communication. By conducting risk assessments, creating proportionate emergency procedures, training staff, and leveraging technologies such as digital signage and visitor management systems, venues can meet the Law's requirements and protect customers and employees.
For more comprehensive information about Martyn's Law, including who it applies to, tier requirements, special considerations for education settings, and how AV technology can support compliance, see our complete guide to Martyn's Law.
Strive AV's Martyn's Law Compliance service works with retailers, hospitality groups and leisure providers to design integrated AV systems that support safety and compliance, from public-address announcements and digital signage to occupancy analytics and control platforms. Contact us to discuss how we can help your venues prepare for Martyn's Law.
Frequently Asked Questions
Q.Do small shops and cafés need to comply with Martyn's Law?
Premises with capacity under 200 people are exempt from the mandatory Martyn's Law requirements. Independent boutiques, small cafés and restaurants that never expect 200 or more patrons at one time fall outside scope. However, larger high-street stores, restaurants and chains that routinely exceed the threshold must comply with at least standard-tier duties.
Q.How does Martyn's Law apply to shopping centres?
Shopping centres typically fall under enhanced-tier duties because peak footfall regularly exceeds 800 people. Both the centre management (controlling shared areas) and individual tenants (controlling their own units) have responsibilities. The April 2026 statutory guidance introduces an explicit coordination duty for shared spaces, entrances, malls, food courts, car parks and the surrounding public realm, and is likely to be a focus of early SIA enforcement. Centre managers should provide overarching emergency plans, tenants should integrate them into their own procedures, and the two should be capable of being demonstrated as a coherent whole rather than as parallel arrangements.
Q.What are hotels' responsibilities under Martyn's Law?
Hotels and accommodation venues, particularly those with conference or event space, must conduct risk assessments, develop evacuation and lockdown plans, train staff in emergency response and use technology such as PA systems, digital signage and visitor management to communicate quickly with guests. Larger hotels expecting 800+ guests on-site fall under enhanced-tier duties.
Q.Are pop-up retail and hospitality events covered by Martyn's Law?
Only at the event threshold. Temporary events such as ticketed food festivals, Christmas markets with entry checks and similar activations are qualifying events if they are open to the public, have entry checks and 800 or more people (including staff) are reasonably expected at the same time; they then carry enhanced-tier requirements and must be notified to the SIA within 14 days of first being publicised. An event expecting fewer than 800, or one with no entry checks, is not a qualifying event, although a pop-up trading inside premises that are themselves in scope is covered by that premises' own duty. The event organiser is typically the responsible person and must conduct a proportionate risk assessment, brief staff on emergency procedures and plan communications appropriate to the venue.
Q.How can high-turnover hospitality teams meet training requirements?
Build emergency awareness into staff induction, provide concise written procedures at every site, use digital signage during off-peak hours to reinforce key messages, and run periodic drills involving full-time and part-time staff together. Refresher training when public threat levels change helps maintain readiness despite seasonal turnover.
