Martyn's Law in Schools and Universities: A Practical Starting Point

There are 24,499 schools in England educating more than 8.9 million pupils and most of them reach the same threshold at some point each term. At a parents' evening, a nativity play, sports day or an open evening, 200 or more people are on site at once. That number matters because it is the trigger for the Terrorism (Protection of Premises) Act 2025, now better known as Martyn's Law.

The Act has been law since receiving Royal Assent on 3 April 2025, and it is expected to come into force in Spring 2027. The Home Office published its statutory guidance in April 2026. Notification guidance followed in July 2026, and the regulator is now building the systems it will use to register and inspect premises. For school business managers, trust estates leads, college principals and university security teams, this academic year is the one in which preparation needs to happen.

If you want a general overview of the Act itself, our guide to the Protect Duty and Martyn's Law covers the background. This guide is for those in education to understand how to get a handle on Martyn’s Law early.

Where Martyn's Law stands in September 2026

Key dates so far

•        3 April 2025: The Act received Royal Assent.

•        September 2025: The Department for Education published guidance on how the law will affect schools, colleges and nurseries.

•        15 April 2026: The Home Office published its statutory guidance. That guidance is intended to let those in scope comply without needing to buy specialist or consultancy services.

•        15 April to 12 June 2026: The Security Industry Authority (SIA) consulted on how it will regulate. It plans to publish its final guidance and a consultation report in autumn 2026.

•        14 July 2026: The government issued guidance on the requirement to notify the SIA when someone becomes, or stops being, responsible for qualifying premises. The SIA summarised the notification timelines in August 2026.

What's still to come

The exact commencement date has not yet been confirmed. The Home Office will confirm it through Parliament. April 2027 is the earliest possible date, because the government promised at least 24 months from Royal Assent. The SIA's online notification portal is still being built, and volunteers will be invited to test it from early 2027. The practical upshot is that you can't notify yet, but you can do everything else.

Does Martyn's Law apply to your school, college or university?

The 200-person test

A setting is in scope if 200 or more people may reasonably be expected to be present at the same time. That headcount includes staff, contractors and any other workers on site, as well as visitors. In a school, that means pupils, teachers, support staff and parents all count. Assess capacity against your busiest realistic moment rather than an ordinary Tuesday. If your numbers reach the threshold at the busiest expected point, that figure decides your position.

Schools and colleges

This is the most important point for most readers. Early years, primary, secondary and further education settings have a special consideration under the Act, which places them in the standard tier even if they expect 800 or more people. A 1,800-pupil secondary academy therefore has the same core duties as a 250-pupil primary. It does not take on the heavier enhanced-tier obligations that apply to arenas and stadiums.

The statutory guidance defines further education broadly. It covers colleges, sixth-form colleges and independent training providers that are wholly or partly publicly funded.

Universities

Higher education does not get the same easement. Universities fall into either the standard or the enhanced tier depending on how many people may reasonably be expected in each set of premises at the same time. Many universities are likely to have at least some buildings or events in the enhanced tier, particularly larger venues and occasions such as graduations and conferences. The assessment is complicated by the mix of lecture theatres, libraries, students' union venues, sports centres and conference spaces on a typical campus. Estates and security teams should map buildings and uses individually rather than assume one answer for the whole campus.

Mixed-use sites

The statutory guidance includes a worked example of a secondary school with a gym, a theatre and a café. In that example, the school and gym are mainly used for education, but the café and theatre are open to the public throughout their opening hours, so they are treated as mainly used for food and drink and for entertainment respectively. If your school lets a sports hall, theatre or café to the community, check how each building is classified.

Below 200 people

Settings with fewer than 200 people are out of scope, but they are still encouraged to have preparedness plans. Many small primaries will fall into this group. It is still worth reading the steps below, because the same procedures are good safeguarding practice.

What the standard tier asks schools and colleges to do

Notify the SIA

Each setting needs a responsible person, typically the proprietor, trust board or governing body. Once the law commences, anyone responsible at the commencement date will have three months to notify, and changes must then be reported within 28 days. The responsible person can ask someone else to complete the notification on their behalf, but the responsibility stays with them. For a MAT, that is likely to mean the business or estates team completing notifications for each qualifying school.

Put four public protection procedures in place

Standard tier premises must have public protection procedures covering evacuation, invacuation, lockdown and communication. In a school context, these look something like this:

•        Evacuation: Getting pupils, staff and visitors off site safely by a route away from the threat. Your fire evacuation plan may not be suitable, because assembling everyone at one point could put them in danger.

•        Invacuation: Bringing people from playgrounds, fields and outbuildings into the safety of the building.

•        Lockdown: Securing doors and entrances quickly to delay or prevent an attacker getting in. That includes knowing who locks what, and how fast.

•        Communication: Alerting staff, pupils and visitors quickly with a signal everyone recognises, distinct from the fire alarm, and informing parents afterwards.

Train, brief and review

The duty is about people knowing what to do. The government's own example of a standard tier venue includes a short awareness briefing for new staff at induction and reviewing procedures annually or after significant change. For schools, that fits naturally alongside existing safeguarding and fire safety induction.

A note on suppliers, including us: the DfE and Home Office do not endorse any third-party products or providers. Standard tier compliance is designed to be low-cost, and much of it is about planning, practice and paperwork rather than new equipment.

What the enhanced tier adds for universities

Measures to reduce vulnerability

Enhanced tier premises need everything in the standard tier plus measures to reduce vulnerability to attack. These cover monitoring, movement of people, physical safety and information security, proportionate to the venue. The Home Office gives CCTV, bag search policies and vehicle checks as examples for larger premises. On a campus, that could include CCTV coverage, controlled access to buildings, and procedures for large events such as graduations and freshers' fairs.

A compliance document and a designated senior individual

Enhanced tier measures must be documented, provided to the SIA, and owned by a designated senior individual. For most universities, that will mean a named senior leader, typically at director or registrar level, holding accountability.

Penalties

The SIA will have enforcement powers across both tiers. Standard duty premises face a maximum penalty of £10,000 with daily penalties of up to £500. Enhanced duty premises face a maximum of £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000. The SIA says it will assess compliance through desk-based assessments and on-site inspections, using a risk-based approach.

A practical starting point: six steps to take this term

Step 1: Confirm who the responsible person is

Agree formally, and minute it at board or governor level, who holds responsibility for each site. For MATs, decide now whether notifications will be handled centrally by the trust or delegated to individual schools. If your trust is already standardising ID and site processes across its schools, this fits naturally into the same central workstream.

Step 2: Assess your peak capacity

For each site, identify the busiest realistic occasion, whether that's a performance, a parents' evening, an exam season or a community letting. Record the figure and how you reached it. For universities, repeat this building by building.

Step 3: Map existing plans against the four procedures

Most schools already have a fire evacuation plan, and many have a lockdown policy. Compare them against the four procedures and look for gaps. Common gaps include having no invacuation plan for the playground, no distinct lockdown signal, and no plan for how lockdown works when visitors are in the building.

Step 4: Check you know who is on site

Evacuation and lockdown both depend on accounting for everyone afterwards. If your visitor record is a paper book at reception, ask whether you could say within minutes who was in the building and where. A digital visitor management system that captures sign-in and sign-out in real time makes that roll call far more reliable. It also supports your existing KCSIE record-keeping.

Step 5: Make lockdown fast and strangers easy to spot

Consider how long it actually takes to secure every external door. Access control can lock doors centrally in seconds rather than relying on a member of staff walking the site. Clear, colour-coded ID cards for staff, visitors and contractors, worn on consistent lanyards, help staff notice quickly when someone on site isn't accounted for. That is the kind of vigilance that counter-terrorism awareness training asks for.

Step 6: Train, drill and record

Brief staff, practise lockdown and invacuation at least once a year in an age-appropriate way and keep a record of what you did and what you changed afterwards. When the SIA asks, evidence of practice will matter as much as the written plan.

Where ID and access control fit (and where they don't)

To be clear, Martyn's Law does not require schools to buy ID cards, access control or visitor management software. The standard tier is about procedures, and a school can meet it with good planning and practice alone.

What these tools can do is make the procedures work in practice. Visible ID helps staff spot unfamiliar faces. Real-time visitor records support accurate accounting after a lockdown. Access control makes securing a large site realistic in the time available. For universities in the enhanced tier, controlling the movement of people is an explicit category of measure, so access control and ID are more likely to form part of the documented approach.

Starting now means starting calmly

Martyn's Law is not designed to turn schools into fortresses. For most schools and colleges, it formalises what good settings already do: knowing how to get people out, how to bring them in, how to lock down, and how to tell everyone quickly. Starting this term gives you time to test plans, fix gaps and brief staff before the SIA's notification window opens, rather than rushing in spring 2027.

If you'd like to talk through how visitor management, ID or access control could support your procedures across one school, a whole trust or a university campus, get in touch. We'll give you honest advice on what will genuinely help.