Martyn’s Law Protection Plan Template A practical planning worksheet for public protection procedures and preparedness A Martyn’s Law protection plan should help the responsible person understand the premises, record appropriate public protection procedures and make sure the people expected to carry them out know what to do. This Camelott® worksheet is a planning aid based on current statutory guidance; it is not an official government or SIA compliance template. Current position — 23 September 2026: the Terrorism (Protection of Premises) Act 2025 is law, but its substantive duties are not yet in force. The SIA is preparing for commencement in spring 2027; the exact date has not yet been confirmed. The Home Office statutory guidance remains the starting point, with additional principal-use guidance published on 10 September 2026. Use the Planning Template Martyn’s Law Protection Plan: Six Planning Sections The statutory duties vary by tier. Use these sections to organise the information needed to understand your site and build procedures that can actually be implemented. 1 Confirm Scope and Responsibility Record the premises or event, its Schedule 1 use and, where relevant, its principal use, the number of people reasonably expected to be present, who is the responsible person and whether another responsible person needs to co-ordinate with you. Where premises have two or more Schedule 1 uses, use the Home Office principal-use guidance. 2 Map the Premises and Immediate Vicinity Note entrances, exits, internal zones, safer areas, public-facing spaces, external areas and the immediate vicinity where events outside your control could affect the procedures you need inside the premises. 3 Write the Four Public Protection Procedures Consider evacuation, invacuation, lockdown and communication. The procedures should be appropriate to the site and capable of being implemented rapidly and effectively if an attack is suspected or occurring. 4 Define Communication, Decisions and Roles Record how people will be warned, what instructions may be given, who can initiate procedures, who contacts the emergency services and how different procedures may need to work together as the situation changes. 5 Make Sure Staff Can Carry Out the Procedures Staff with responsibilities need to understand the procedures and their role. Decide what briefing, instruction, practice or training is appropriate and how procedures will be tested and reviewed. 6 Add Enhanced Tier Requirements Where Applicable Enhanced Tier premises and qualifying events have additional duties relating to public protection measures, documentation and review. Keep these separate from the requirements that apply to Standard Tier premises. The Four Public Protection Procedures These procedures are relevant to Standard Tier premises, Enhanced Tier premises and qualifying events once the duties commence. Public Protection: Evacuation Moving people away from danger by moving them out of all or part of the premises or event. Public Protection: Invacuation Moving people to a place within the premises or event where there is less risk of physical harm, including bringing people inside where it is safe to do so. Public Protection: Lockdown Securing all or part of the premises to control entry, exit or movement where that reduces the risk of people moving towards danger. Public Protection: Communication Providing information quickly so people know there is danger and receive appropriate instructions where it is safe to provide them. Standard Tier and Enhanced Tier: Keep the Duties Separate A useful plan separates duties that apply across the Act from the additional Enhanced Tier requirements. That avoids making smaller premises think they must produce documentation or measures that apply only to the Enhanced Tier. Standard Tier Appropriate public protection procedures must be in place, so far as is reasonably practicable. Staff who have a role in those procedures need enough awareness, understanding and instruction to carry them out effectively. Enhanced Tier In addition to public protection procedures, the responsible person must consider appropriate public protection measures, keep those measures under review and meet the Act’s additional documentation and governance requirements. Documentation The Home Office guidance says documenting even simple procedures is good practice. Enhanced Tier premises and qualifying events have specific statutory documentation requirements. Training The Act does not prescribe a specific paid training course. People responsible for implementing procedures or measures still need sufficient awareness, instruction, learning or training to perform their role effectively. Templates The SIA confirmed on 11 September 2026 that it is developing separate Standard Tier and Enhanced Tier templates. Use of those templates will not be mandatory. There is likewise no requirement to use this Camelott® worksheet or any commercial template. What Should You Record in the Plan? The detail should match the scale and complexity of the site. A useful working document is specific enough that staff can understand what happens in a real incident. Site Information Responsible person, premises use, expected numbers, building layout, access points, immediate vicinity, shared areas and any other responsible persons you need to co-ordinate with. Procedure Decisions What triggers evacuation, invacuation or lockdown; who can make that decision; how instructions are communicated; and how procedures change as more information becomes available. Communication Methods PA, radios, staff messaging, alarms, visual alerts or other suitable methods may support communication. Record who needs the information, how they will receive it and whether the method is likely to work in the circumstances. A particular alarm product is not itself a Martyn’s Law compliance requirement. Staff Readiness and Review Who needs instruction, what will be tested or practised, lessons identified after tests or incidents, and when the procedures will next be reviewed. Official Martyn’s Law Guidance Use current government guidance as the source of truth. Commercial templates should only help organise your work around those requirements. Home Office statutory guidance Current section 27 guidance on scope, duties, public protection procedures and Enhanced Tier measures. Read GOV.UK guidance ↗ SIA regulator guidance Current explanation of the SIA’s role, scope and preparations for commencement. Read SIA guidance ↗ Home Office principal-use guidance Guidance for premises used for two or more Schedule 1 uses when determining the principal use and responsible person. Read principal-use guidance ↗ SIA tools and templates update September

Section 6: Roles and responsibilities Record the legal responsibility separately from the people who will carry out day-to-day emergency actions. That distinction is particularly important for Enhanced Tier premises and qualifying events. 6.1 Legal responsibility Responsible Person The individual, organisation or company with control of the premises or event for the purpose that brings it within scope. Senior Individual — Enhanced Tier only Where the Responsible Person is an organisation, record the sufficiently senior individual designated to ensure the organisation complies with the Act. Do not confuse these legal roles with an Incident Lead. Operational tasks can be delegated, but the Responsible Person cannot pass its statutory responsibility to a contractor or junior member of staff. 6.2 Operational emergency roles Incident / Duty Lead Deputy / Backup Lead People authorised to initiate procedures 6.3 Role handover 6.4 Awareness / instruction status A specific paid training course is not mandatory under the Act. Record how the people with responsibilities will gain enough understanding and experience to carry out the procedures effectively. Legal and operational responsibilities are clearly distinguished. People with emergency roles know what they are expected to do. Deputies or alternative arrangements are identified where needed. Role information is reviewed when staffing, shifts or procedures change. Section 7: Contacting and supporting the emergency services Decide how 999 will be called, what essential information can be given quickly and how responders can reach the site without relying on one person or one route. 7.1 Primary 999 caller 7.2 Backup caller / alternative 7.3 Key information for the 999 call Call 999 as soon as it is safe to do so. Do not delay the call while trying to complete a form or gather information that is not immediately available. Optional M/ETHANE aide-memoire M — Major incident declared? (for responder use) E — Exact location T — Type of incident H — Hazards present or suspected A — Safe access routes N — Number / severity of casualties, if known E — Emergency services present / required M/ETHANE is a JESIP format used by emergency responders to share incident information. A premises may use the headings as a useful prompt, but staff do not need to complete a formal M/ETHANE message before calling 999. 7.4 Emergency-service access / rendezvous 7.5 CCTV, keys and access support Do not record passwords, alarm codes, access-control credentials or sensitive vulnerabilities in a publicly accessible version of this worksheet. At least one reliable method of contacting 999 is available. Staff know the exact site address and how to describe the incident location. Emergency-service access arrangements can adapt if the normal entrance is unsafe. Section 8: Changing, ending and recovering from lockdown A lockdown procedure may need to change as the incident develops. Record how an all-clear or transition to another procedure will be authorised and verified. 8.1 Authority to change or end the procedure 8.2 Verified all-clear / transition message 8.3 Recovery, welfare and evidence Do not assume an area is safe simply because the alarm has stopped. The procedure should explain how the all-clear is authenticated and how police or other emergency-service instructions will be followed where they are involved. Staff should not search or “sweep” potentially dangerous areas unless that forms part of an appropriate, trained and authorised response. Staff know how a genuine all-clear or change of procedure will be communicated. The plan allows procedures to change as the threat location and emergency-service advice change. Post-incident welfare, safeguarding, evidence preservation and debrief arrangements are identified. Lessons from drills or incidents feed back into the next review of the plan. Reference points: Home Office statutory guidance · JESIP M/ETHANE guidance · Camelott® Martyn’s Law Explained © 2026 Camelott® Digital Ltd · Planning worksheet · General guidance only

Martyn’s Law Responsibilities: From Legislation to Action A practical preparation roadmap for premises and events Martyn’s Law responsibilities start with understanding whether your premises or event is in scope, who the Responsible Person is and which duties apply. The next step is to put workable public protection procedures in place and, for the Enhanced Tier, consider the additional public protection measures and documentation required. Use the Protection Plan Current legal position: the Terrorism (Protection of Premises) Act 2025 is law, but its substantive duties are not yet in force. The SIA currently expects commencement in spring 2027, with the exact date still to be confirmed. Martyn’s Law action plan: six practical steps Scope, responsibility and tier come first. Technology should only be considered after the organisation understands the procedures it needs people to carry out. 1 Check whether the premises or event is in scope Do not use capacity alone. Check the principal use of the premises, whether it is publicly accessible, the number of people reasonably expected to be present at the same time and whether an exclusion or different threshold applies. For most qualifying premises, Standard Tier means 200–799 people and Enhanced Tier means 800 or more. Qualifying events are subject to the Enhanced Tier requirements. See the full scope guide. 2 Identify the Responsible Person Record who has control of the premises or event for the relevant use. If qualifying premises overlap or sit within one another, Responsible Persons may also need to co-ordinate with each other so far as is reasonably practicable. Enhanced Tier organisations also need to designate a sufficiently senior individual to ensure the organisation complies with the Act. 3 Put the four public protection procedures in place Consider evacuation, invacuation, lockdown and communication. The procedures should be appropriate for the site and capable of being put into action rapidly and effectively if an attack is suspected or taking place. Use the Camelott® planning worksheet. 4 Prepare the people who will carry out the procedures Staff with responsibilities need enough awareness, instruction, experience and appropriate tools to perform their role effectively. The Act does not prescribe a particular paid training course. Briefing, induction, practice, equipment instruction and proportionate exercises can all form part of readiness. 5 Add Enhanced Tier measures where they apply Enhanced Tier premises and qualifying events have additional duties to consider appropriate public protection measures that reduce vulnerability or the risk of physical harm, so far as is reasonably practicable. Enhanced Tier also brings additional documentation and governance requirements. 6 Test, maintain and review Check that procedures still work, staff understand their role and any equipment relied on remains operational. Keep proportionate records where they help demonstrate what was reviewed, tested, changed or learned. There is no blanket statutory rule that every drill must be logged purely to create an “inspector audit trail”; record-keeping should reflect the duties that actually apply. Standard Tier and Enhanced Tier The tiers are not simply two sizes of the same checklist. Enhanced Tier premises and qualifying events have additional legal requirements. Standard Tier For most qualifying premises, this applies where 200 to 799 people can reasonably be expected to be present at the same time, from time to time, for a qualifying use. Notify the SIA when the notification requirement is in force. Have appropriate public protection procedures in place. Make sure relevant people can carry out those procedures effectively. No general requirement to buy a particular alarm or security product. Enhanced Tier For most qualifying premises, this applies where 800 or more people can reasonably be expected to be present at the same time. Qualifying events are subject to the same enhanced requirements. Standard public protection procedures still apply. Additional public protection measures must be considered. Documentation and review requirements are more extensive. Organisations must designate a Senior Individual. Important: some premises are excluded or subject to different thresholds or treatment. Use the current Home Office guidance rather than deciding tier from maximum building capacity alone. Use this graphic as a quick overview only. Current statutory guidance takes precedence, particularly where exclusions or different thresholds apply. Where does technology fit? Technology can support a procedure, but it should not be the starting point for deciding what the organisation needs to do. Communication technology A dedicated lockdown alarm, PA system, radio network, staff messaging platform or other communication method may help warn people and give instructions. The right method depends on the premises, procedure and people who need to receive the information. Public protection measures Enhanced Tier premises and qualifying events may need to consider physical, procedural or technical measures to reduce vulnerability or harm. What is appropriate and reasonably practicable depends on the individual premises or event. A lockdown alarm is not “compliance technology”. It may support the lockdown and communication procedures where a dedicated warning method is appropriate, but the Act does not mandate a specific alarm product. Read The Role of Lockdown Alarms for the practical technology side. Martyn’s Law responsibilities — FAQs Is Martyn’s Law already in force? The Act has received Royal Assent, but its substantive duties are not yet in force. The SIA currently expects commencement in spring 2027 and says the exact date will be confirmed before go-live. Is Standard Tier based only on a 200-person capacity? No. The assessment is not simply the maximum number a building can hold. Scope depends on the qualifying use and the number of people reasonably expected to be present at the same time, together with any relevant exclusions or special treatment in the Act. Does Martyn’s Law require a lockdown alarm? No specific lockdown alarm product is mandated. An alarm may support public protection procedures where a dedicated warning method is appropriate for the premises. Do staff have to complete an approved Martyn’s Law training course? The Act does not prescribe a particular commercial training course. The people with responsibilities do need enough awareness, instruction, experience and appropriate tools to perform their role effectively. Do organisations need to record every

Martyn’s Law History: Why the Law Exists From the Manchester Arena attack to the Terrorism (Protection of Premises) Act 2025 Martyn’s Law history begins with the Manchester Arena terrorist attack on 22 May 2017, the campaign led by Figen Murray after the death of her son Martyn Hett, and the later recommendation that legislation should improve preparedness at publicly accessible premises and events. Martyn’s Law Explained Current position: the Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. Its substantive duties are not yet in force. The SIA currently expects commencement in spring 2027, with the exact date still to be confirmed. The Manchester Arena attack and the origins of Martyn’s Law On 22 May 2017, a terrorist detonated a bomb at Manchester Arena as people were leaving an Ariana Grande concert. Twenty-two people were killed, including Martyn Hett. Martyn’s mother, Figen Murray, went on to campaign for legislation that would place clearer preparedness duties on qualifying publicly accessible premises and events. The law that ultimately followed is commonly known as Martyn’s Law in tribute to her son. The legislation was also developed in the context of the Manchester Arena Inquiry. The Home Office has stated that the Protect Duty consultation and later draft legislation responded in part to the Inquiry’s recommendation for legislation to improve the safety and security of public venues. Martyn’s Law timeline The law developed over several years through campaigning, consultation, draft legislation, Parliamentary consideration, Royal Assent and implementation guidance. 22 May 2017 Manchester Arena terrorist attack Twenty-two people were killed in the attack, including Martyn Hett. Figen Murray subsequently campaigned for stronger preparedness requirements at public venues. 26 February 2021 Protect Duty consultation opens The Home Office opened a public consultation on proposals for a Protect Duty. The consultation ran until 2 July 2021. 2 May 2023 Draft Terrorism (Protection of Premises) Bill published The Government published draft legislation known as Martyn’s Law for pre-legislative scrutiny. 2024 Further consultation and revised legislation The Government consulted further on the proposed Standard Tier requirements and continued to revise the legislative approach before the Bill proceeded through Parliament. 3 April 2025 Royal Assent The Terrorism (Protection of Premises) Act 2025 received Royal Assent, placing Martyn’s Law on the statute book. 15 April 2026 Statutory guidance published The Home Office published statutory guidance under section 27 of the Act to help Responsible Persons determine scope and understand their duties. The guidance has since been updated, including in August 2026. 17 July 2026 SIA regulator guidance published The Security Industry Authority published guidance explaining its role as the regulator and how organisations can prepare during the implementation period. Spring 2027 — expected Substantive duties expected to commence The SIA currently expects commencement in spring 2027. The exact date has not yet been confirmed, so organisations should not describe the duties as already in force. What was the legislation designed to change? The central idea is preparedness: qualifying premises and events should have proportionate arrangements that can be put into action if a terrorist attack is suspected or taking place. Clear responsibility The Act identifies a Responsible Person for premises or events in scope, rather than leaving preparedness as an undefined shared responsibility. Practical procedures Public protection procedures cover evacuation, invacuation, lockdown and communication, so far as is reasonably practicable. Proportionate duties Standard Tier and Enhanced Tier have different requirements. Enhanced Tier premises and qualifying events have additional duties for public protection measures, documentation and governance. A regulator The Act establishes the Security Industry Authority as the regulator responsible for overseeing the Martyn’s Law regime once the relevant provisions commence. What Martyn’s Law does not mean Understanding the history also helps separate the purpose of the Act from claims that go beyond what the legislation actually requires. It does not require every public venue to buy a dedicated lockdown alarm. It does not prescribe one commercial training course for all organisations. It does not mean Standard Tier and Enhanced Tier have identical paperwork requirements. It does not require organisations to advertise detailed security arrangements to the public. The substantive duties are not yet in force as of September 2026. What should organisations do during the implementation period? The implementation period gives organisations time to understand whether they are in scope and prepare without pretending that the statutory duties have already commenced. Check whether the premises or event is within scope and which tier applies. Identify the Responsible Person and any co-ordination required with others. Review evacuation, invacuation, lockdown and communication procedures. For Enhanced Tier, consider the additional measures, documentation and governance requirements. Make sure people with responsibilities understand what they are expected to do. Review any equipment relied on to support the procedures. For a practical step-by-step version, see Martyn’s Law Responsibilities: From Legislation to Action . Official sources for the Martyn’s Law history For legal status and dates, use current government and regulator material rather than relying on older draft-Bill summaries. Protect Duty consultation Home Office · opened February 2021 Draft Terrorism (Protection of Premises) Bill Home Office · published May 2023 Terrorism (Protection of Premises) Act 2025 Home Office collection · Royal Assent April 2025 Statutory guidance Home Office · current 2026 guidance SIA regulator guidance Current implementation and regulator position From the history to practical preparation The history explains why the legislation was created; the next question is what it means for an individual premises or event. Camelott® has separate guidance covering scope, responsibilities, planning and the role of lockdown communication. Martyn’s Law Explained From Legislation to Action Preparedness & Public Trust General information only. Timeline and legal status checked against current Home Office and SIA material available in September 2026. This is not legal advice.