Martyn's Law for Schools and Universities: 18 Actions

The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent on 3 April 2025. Its core duties are expected to come into force in spring 2027, after an implementation period of at least two years. For most education settings, that leaves two terms to get ready.

Martyn's Law is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack in 2017. It requires those responsible for certain premises and events to be prepared to protect people if a terrorist attack happens. The Security Industry Authority (SIA) will regulate it.

Education is treated differently from other sectors, and not all education is treated the same way. Schools, early years settings and further education colleges sit in the standard tier whatever their size. Universities and independent training providers do not get that protection, and large campuses can fall into the enhanced tier. That single difference changes how much work a higher education provider has to do.

This guide sets out 18 actions in three phases, from now to commencement, for schools, multi-academy trusts, colleges and universities. For the general picture, see our earlier article, Martyn's Law explained.

---

Which Tier Are You In?

The Act applies to premises where 200 or more people may reasonably be expected to be present at the same time, provided the premises are of an eligible type, which includes education.

Setting	Tier
Early years, primary and secondary schools, academies	Standard tier, regardless of capacity
Further education and sixth form colleges	Standard tier, regardless of capacity
Events held at these settings, such as concerts or sports days	Standard tier, regardless of attendance
Universities and other higher education providers	Standard tier at 200 to 799; enhanced tier at 800 or more
Independent training providers	Standard or enhanced tier, based on capacity
Premises below 200	Outside the Act

The Department for Education's guidance, Martyn's Law for education settings, explains how this works in practice.

---

What the Standard Tier Requires

Under section 5 of the Act, the person responsible must, so far as reasonably practicable, have appropriate public protection procedures in place covering four areas:

Evacuation: getting people out of the premises.
Invacuation: moving people into or within the premises to a safer place.
Lockdown: preventing people from entering.
Communication: giving information to people on the premises.

Premises must also be notified to the SIA. The standard tier does not require physical security measures such as barriers or CCTV. The government has been clear that it is about procedures and training.

Enhanced tier premises must also put in place appropriate public protection measures, maintain documentation, and designate a senior individual. That is where higher education providers with large campuses need to look closely.

---

Phase 1: Now to the End of 2026 (Understand and Plan)

Action 1: Confirm Who Is Responsible

The duty sits with the person who controls the premises. In a maintained school that may be the local authority or governing body; in an academy, the trust; in a university, the institution. Shared sites, leased buildings and lettings complicate this. Write it down.

Action 2: Work Out Your Tier for Every Site

Schools and colleges can do this quickly. Universities need to assess each building or premises, because capacity is assessed by premises, and a lecture theatre complex, sports centre or students' union may qualify differently from a library or office block.

Action 3: Read the Official Guidance

The Home Office's statutory guidance under section 27 was published in April 2026. Read it alongside the DfE education guidance and the government's Act collection page, including the factsheets and notification requirement.

Action 4: Map What You Already Have

Most education settings already have fire evacuation plans, safeguarding procedures and, often, lockdown arrangements. Map them against the four procedures. You are likely to find you have most of the pieces, but not joined up or tested. See our fire evacuation strategy guide.

Action 5: Name an Owner and a Timeline

Give one senior person responsibility for readiness, with a simple plan to spring 2027. In a trust, decide what is done centrally and what each school does.

Action 6: Check Your Fire Risk Assessment Is Current

Evacuation for a terrorist incident is different from evacuation for a fire, but the routes, assembly points and roles overlap. Start from a current school fire risk assessment.

---

Phase 2: January to Commencement (Build and Train)

Action 7: Write or Update Your Evacuation Procedure

Cover how people will be told to leave, which routes to use depending on where the threat is, and where to go. A terrorist incident may make your usual fire assembly point unsafe.

Action 8: Write an Invacuation Procedure

Invacuation means moving people to a safer place inside the building. Identify suitable rooms or areas, how people will be directed there, and how to account for them. This is the procedure most schools and universities do not yet have in writing.

Action 9: Write or Update Your Lockdown Procedure

Cover how external doors and gates are secured, how classrooms and other rooms are made safer, and how the lockdown is ended. Many schools have lockdown plans for other threats; check they work for this one.

Action 10: Set Up Communication

Decide how you will alert people across the site: a distinct alarm tone, messaging apps, radios or public address. Make sure it reaches people in every building, outdoor spaces and anyone working alone.

Action 11: Include Everyone

Procedures must work for pupils and students of all ages, staff, visitors, contractors and people with disabilities. Check how personal evacuation arrangements work in a lockdown or invacuation. See personal emergency evacuation plans: 7 questions offices get wrong.

Action 12: Train Staff

Staff need to know what to do and when. Use free resources from ProtectUK, the counter terrorism policing platform, including awareness training and the Run, Hide, Tell principles, and add site-specific briefings. See our health and safety training.

Action 13: Plan for Events and Lettings

School events stay in the standard tier, but they still need procedures. Universities hosting open days, graduations, conferences and concerts may have qualifying events in their own right. Lettings to outside groups need clear arrangements for who is responsible.

Action 14: Notify the SIA

Qualifying premises will need to notify the SIA. Check the notification requirement guidance and be ready when the process opens.

---

Phase 3: From Commencement (Test and Maintain)

Action 15: Test the Procedures

Run tabletop exercises and, where appropriate, practical drills. Treat lockdown and invacuation drills as carefully as fire drills, and in schools think about how to do this without frightening younger children. See fire drills: 7 things yours is probably not testing.

Action 16: Keep Records

Record your procedures, training, tests and lessons learned. For enhanced tier premises, documentation is a specific requirement. For everyone, it is what you will show the SIA if asked.

Action 17: Review After Change

Building works, new buildings, changes in capacity, new events and staff changes all affect procedures. Build a review into your annual health and safety calendar.

Action 18: Integrate It Into Your Wider Safety System

Martyn's Law procedures should sit alongside fire safety, safeguarding, visitor management and critical incident planning, not in a separate binder. See health and safety in schools: 12 duties education settings miss and visitors and reception: 7 duties.

---

Universities: Why the Enhanced Tier Matters

For higher education, the enhanced tier brings additional duties for premises or events with 800 or more people, including appropriate public protection measures, documentation and a designated senior individual. Large lecture theatres, sports venues, students' unions and graduation ceremonies may all qualify.

Universities should map every qualifying premises and event, decide which tier each falls into, and plan accordingly. Those with campuses outside the UK should note that Martyn's Law applies across the UK only, and overseas campuses face very different, often guidance-based, regimes. See our university health and safety rankings and education page.

---

The 18 Actions at a Glance

Phase	Actions
Now to end of 2026	1. Confirm responsibility. 2. Work out your tier. 3. Read the guidance. 4. Map existing plans. 5. Name an owner. 6. Check your fire risk assessment.
January to commencement	7. Evacuation. 8. Invacuation. 9. Lockdown. 10. Communication. 11. Include everyone. 12. Train staff. 13. Events and lettings. 14. Notify the SIA.
From commencement	15. Test. 16. Keep records. 17. Review after change. 18. Integrate.

---

How Arinite Helps

Arinite has supported 1,500+ businesses across 50+ countries for 15+ years, protecting 100,000+ employees, with 95%+ client retention. Our qualified consultants help schools, trusts, colleges and universities build Martyn's Law procedures into their existing health and safety arrangements, rather than as a separate project.

Done For You: our health and safety consultants map your sites and tiers, write your four procedures, and test readiness through independent health and safety audits.
Done With You: we run workshops with your leadership team, help you adapt existing fire and lockdown plans, and support staff training.
DIY: you hold procedures, training records, drills and reviews for every site on our health and safety consultants and software platform, with reminders built in.

For education groups and institutions with campuses in several countries, our international health and safety consultants handle local requirements abroad, and our global health and safety consultants keep every campus to one standard.

---

Frequently Asked Questions

When does Martyn's Law come into force?

The Act received Royal Assent on 3 April 2025. Its main duties are expected to come into force in spring 2027, after an implementation period of at least 24 months. Settings should use the time until then to prepare.

Are all schools in the standard tier?

Yes. Early years settings, schools and further education providers stay in the standard tier regardless of capacity, and events held at them are treated the same way.

Are universities in the standard or enhanced tier?

It depends on capacity. Higher education providers are tiered like other premises: 200 to 799 people is standard tier, and 800 or more is enhanced tier.

Do schools need to install physical security measures?

The standard tier focuses on procedures and training, not physical infrastructure such as barriers or CCTV.

What is invacuation?

Invacuation means moving people into or within a building to a safer place, rather than evacuating them outside. It is one of the four procedures the standard tier requires.

---

Use the Next Two Terms Well

Most education settings already have much of what Martyn's Law requires. The work is joining it up, filling gaps like invacuation, and testing it. Book a free gap analysis with Arinite and we will review your sites against the Act and show you what to do first.

Request your free gap analysis