Since the start of 2020, MI5 and the police have disrupted 19 late-stage attack plots and intervened in many hundreds of developing threats. That threat picture is the backdrop for the Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, the first legislation in UK history to establish a baseline legal standard for counter-terrorism preparedness at public venues. It received Royal Assent on April 3, 2025.
For venues that fall in scope, emergency response planning – specifically evacuation, invacuation, and lockdown – is where the legislation has the most practical, day-to-day impact.
A risk assessment is a document. A training session is a calendar event. The ability to move hundreds or thousands of people safely through a complex building during a crisis is an operational capability that depends on planning, infrastructure, and technology working together. This is where most venues have the biggest opportunity to improve.
Tiers, status and the regulator
Before getting into response planning, it's important to be precise about what's required, of whom, and by when. This is an area where a lot of secondary commentary blurs the details.
The Act establishes two tiers, based on the number of people reasonably expected to be present at the same time:
Standard tier
Premises expecting 200–799 individuals. Requirements are centred on straightforward, low-cost procedures; primarily having a plan for evacuation, invacuation, lockdown, and communication, and making sure staff know it.
Enhanced tier
Premises or qualifying events expecting 800 or more individuals. In addition to the standard tier procedures, enhanced tier venues must also take steps, so far as reasonably practicable, to reduce their vulnerability to an attack and the harm it could cause, and must appoint a designated senior individual responsible for compliance.
The regulator
The regulator is the Security Industry Authority (SIA), a body of the Home Office. The SIA provides guidance and support, and has enforcement powers for non-compliance, including compliance notices, monetary penalties, and restriction notices for enhanced tier premises.
Current status of Martyn's Law (Summer 2026)
The Act is not yet in force. The government's stated implementation period is at least 24 months from Royal Assent, intended to give venues time to prepare before the requirements become enforceable.
The Home Office published statutory guidance in April 2026 to help responsible persons understand what will be expected of them, but as that guidance itself notes, the requirements are not yet enforceable, and a further update is still to come on the exact commencement date.
In short: there's no legal obligation to comply yet, but the clock on preparation is already running, and venues that wait for enforcement to start planning will be behind.
For a full overview of the legislation's structure and tier definitions, see our complete guide to Martyn's Law. Read the guide →
The four public protection procedures
Government guidance for organisations in scope is explicit that public protection procedures need to cover four areas:
- Evacuation
- Invacuation
- Lockdown
- Communication
Each demands a different approach to crowd movement, and conflating them is one of the more common planning mistakes.
Evacuation
Evacuation moves people out of the venue. It's the response most people are familiar with – things like fire alarms, exit signs, and assembly points. Under Martyn's Law, evacuation planning has to go further than standard fire safety basics:
- Multiple route options. If the primary exit is compromised (i.e., blocked by the threat itself, or by crowd congestion) alternative routes need to be mapped and communicated in advance.
- Zone-based evacuation. In large venues, evacuating the entire building simultaneously can create dangerous crowd density at exits. Phased, zone-based evacuation is often safer and faster.
- Accessibility. Evacuation plans must account for visitors using wheelchairs, with mobility limitations, or with sensory impairments. Accessible routes, refuge areas, and communication methods aren't optional extras.
Congestion at exits isn't a theoretical risk. A statistical analysis of 46 historic stadium stampedes found that egress congestion, poor communication, and restricted exit widths were the primary causal factors.
Separately, crowd simulation research on a fully occupied stadium found it took roughly 20 minutes to evacuate the entire population. That's the kind of timeline a venue's evacuation plan needs to be built and tested against, not assumed away.
Invacuation
Invacuation is the process of moving people deeper into the venue, away from an external threat. It’s less intuitive and less commonly practised than evacuation. It applies when:
- There's a threat outside the venue (a vehicle attack near an entrance, an active threat in a car park)
- Moving people away from the perimeter is safer than sending them outside
- The venue interior provides structural protection
Invacuation requires identified interior safe zones with structural integrity, routes from public areas to those zones, communication systems that can reach people throughout the venue, and clear signage for people who may be disoriented.
Lockdown
Lockdown secures the venue perimeter to prevent a threat from entering. It typically combines physical security (locking doors) with communication (directing people to shelter in place).
It's arguably the most complex of the three responses, because it requires rapid identification and securing of all access points, clear communication to visitors who may not understand what's happening, and transition planning (the ability to shift from lockdown to evacuation if the situation changes).
Communication
Communication is the fourth procedure, and it's the one that makes the other three work. Recent research proves this is a perceived issue in retail venues:
Evacuation, invacuation, and lockdown all depend on people knowing which one is happening, right now, in their part of the building. That means:
- Reaching every zone. A message broadcast at the main entrance doesn't help someone three floors up in a food court. Communication systems need to cover the whole venue, not just the areas nearest a control room.
- Clarity under pressure. Instructions need to be unambiguous — which response is required, and where to go — since people under stress default to the clearest available guidance, not the most detailed.
- Multiple channels. Visitors and staff don't all receive information the same way. Audio announcements, digital signage, mobile alerts, and staff-led guidance each reach people the others miss, including visitors with sensory impairments.
- Two-way flow. Venues also need a way for staff on the ground to report what they're seeing back to whoever is coordinating the response, not just receive instructions.
Static plans tend to treat communication as an afterthought to evacuation. Under Martyn's Law, it's a standalone requirement in its own right.
5 reasons static evacuation plans fall short
Most venues currently rely on static evacuation maps: printed floor plans mounted near exits showing "you are here" with arrows to the nearest door. These serve a basic purpose, but they have real limitations in the context of what Martyn's Law asks venues to be ready for:
- They can't adapt to real-time conditions. If an exit is blocked, the printed map still points people there.
- They rarely support invacuation. Most static plans only show evacuation routes; interior safe zones and routes to them are seldom mapped at all.
- They're difficult to keep current. Venue layouts change constantly. Printed maps are often months or years out of date by the time they matter.
- They don't communicate actively. A map on a wall is passive. During a crisis, people need active guidance and directions pushed to them, not information they have to go looking for.
- They don't account for accessibility by default. A printed map can't show a wheelchair-accessible route versus a stairway-only route based on who's actually looking at it.
Building a Martyn's Law-ready emergency response plan
A practical starting point for venues thinking through what "reasonably practicable" preparedness looks like:
1. Map the venue accurately.
Start with an up-to-date floor plan that includes every door, stairwell, elevator, corridor, and open space, including service areas and back-of-house routes, which are often critical evacuation paths that get overlooked.
2. Identify zones.
Divide the venue into manageable zones for phased evacuation. Each zone should have at least two independent exit routes.
3. Map routes for all scenarios.
For each zone, define evacuation routes (out), invacuation routes (in, to safe zones), and lockdown positions.
4. Test for bottlenecks.
Use pedestrian flow analysis to identify where congestion is likely to occur, and widen routes, add alternatives, or adjust phasing accordingly.
5. Plan for accessibility.
Map step-free routes, identify refuge points, and make sure communication systems include visual and auditory channels.
6. Train and drill.
Run exercises for all scenarios regularly. Use the debrief to show teams where the plan worked and where it broke down.
Frequently asked questions
What is the difference between evacuation and invacuation?
Evacuation moves people out of the building to external assembly points. Invacuation moves people deeper into the building to interior safe zones. Which one is correct depends on where the threat is: inside the venue (evacuate) or outside it (invacuate).
Is Martyn's Law in force yet?
Not yet. The Act received Royal Assent on April 3, 2025, with a stated implementation period of at least 24 months. Statutory guidance was published in April 2026 to help venues prepare, but the substantive requirements are not yet enforceable. Venues in scope should use this period to plan, not wait for enforcement to begin.
What's the difference between the standard and enhanced tier?
Standard tier applies to premises expecting 200–799 people at a time, and focuses on having workable procedures in place. Enhanced tier applies to premises or qualifying events expecting 800 or more, and adds a duty to reduce vulnerability to an attack, so far as reasonably practicable, along with appointing a designated senior individual.
Who regulates Martyn's Law?
The Security Industry Authority (SIA), an arm's-length body of the Home Office, is the designated regulator. It will provide guidance and support to venues, and has enforcement powers for non-compliance once the Act is in force.
Do evacuation plans need to cover accessibility?
Yes. The Equality Act requires emergency plans to account for disabled visitors, and Martyn's Law reinforces this by expecting plans that are practicable for everyone, including those with mobility, sensory, or cognitive needs.
Can one system support evacuation, invacuation, lockdown, and communication planning?
In principle, yes. A single digital mapping platform can hold the underlying map data needed to plan and visualise all three scenarios, with different routing logic applied depending on which situation is unfolding.
How Mappedin can help
Mappedin works with security and operations teams at venues around the world, from stadiums and airports to hospitals and retail destinations, to turn static floor plans into living, responsive maps.
A few principles guide how that work applies to emergency preparedness under frameworks like Martyn's Law:
- Accuracy, since a plan is only as good as the map it's built on
- Accessibility, so that routing accounts for every visitor, not just the average one
- Adaptability, so that the guidance a venue gives people can change as fast as the situation does.
If you're mapping out what compliance looks like for your venue, we'd welcome the conversation.
Thinking through what Martyn's Law preparedness looks like for your venue? Get in touch. We're happy to talk through where digital mapping fits into your planning.
Share
