Martyn's Law Just Got Real for Universities and Hospitals

The Home Office published its statutory guidance in April 2026. Enforcement is expected by April 2027. Here's what changes for the people running universities and hospital estates, and where real-time indoor mapping actually fits into compliance.

The countdown most estates teams haven't started

Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, received Royal Assent in April 2025. For a year it sat in an unusually long grace period: law on the books, but nothing to actually do yet. That changed in April 2026, when the Home Office published the statutory guidance that turns the Act's broad principles into specific, checkable requirements.

With enforcement expected by April 2027, that leaves roughly nine months for the organisations affected to move from "aware of the legislation" to "able to demonstrate compliance." For a university with forty buildings or a hospital trust running three sites, nine months is not a long runway.

The number that decides everything: 200

Martyn's Law applies to any premises where at least 200 people could reasonably be expected on-site at the same time, provided it's used for one of the purposes listed in the Act's Schedule 1. That list is broad. It explicitly includes healthcare and education establishments, alongside retail, hospitality, entertainment and several others.

The Home Office's own impact assessment estimates that 178,900 sites across the UK fall into scope. Two tiers apply, based on expected occupancy:

Standard tier (200-799 people): lighter-touch, procedure-based obligations
Enhanced tier (800+ people): the same obligations, plus documented protection measures and a named senior individual accountable for them

Most university lecture theatres, libraries, student unions and larger teaching buildings will clear 800 without much difficulty. Schools get a specific carve-out that keeps them in the standard tier regardless of size, but the guidance for education settings is explicit that higher education institutions do not get the same exemption. They're assessed the same way as any other qualifying premises. Hospitals, being named directly under Schedule 1, are in scope wherever their public-facing areas meet the occupancy threshold.

Key statistics

178,900 - sites across the UK estimated to fall in scope of Martyn's Law (Home Office Impact Assessment)
800+ - occupancy that pushes a premises into the Enhanced Tier, with mandatory documented protection measures (ProtectUK)
Up to £18m or 5% of worldwide turnover - maximum penalty for serious enhanced-tier non-compliance (Poppleston Allen)
~9 months - roughly what's left before enforcement begins, expected April 2027 (Home Office)
24 months - the minimum implementation period the Government committed to from Royal Assent (Home Office Factsheet)

What you'll actually have to do

Strip away the legal language and Martyn's Law asks every in-scope premises to be ready on four fronts:

Evacuation - getting people out of the building, by a route that's actually clear and current, not the one printed on a fire plan from three renovations ago
Invacuation - moving people to a safe location within the building when going outside is more dangerous than staying in
Lockdown - securing the premises and stopping movement into affected areas
Communication - telling everyone on-site, in real time, what's happening and what to do

None of these are new concepts for universities or hospitals. What's new is the expectation that enhanced-tier premises document how they'd actually deliver them, and name someone accountable for it.

Where digital wayfinding actually fits

This is the part worth pausing on, because it's easy to read Martyn's Law as a physical security problem: CCTV, bag checks, security personnel. Some of that does apply to enhanced-tier premises. But evacuation, invacuation, lockdown and communication are fundamentally information problems before they're anything else. Staff and visitors can only follow a safe route, avoid a locked-down zone, or reach a safe point if they can see, in the moment, where that is.

That's the gap real-time indoor mapping is built to close. A digital map that can redirect routes around a closed zone, push live status to screens and mobile devices, and show staff exactly where everyone is meant to go, does the "communication" and "evacuation" legs of the requirement in a way a static PDF fire plan simply can't. For enhanced-tier premises that need to document their protection measures for the SIA, having a live, auditable system to point to is a considerably stronger answer than a laminated map behind reception.

Start the assessment now, not in early 2027

The Home Office and SIA have both been explicit that organisations don't need to buy consultancy services to comply, and that's true. But the assessment itself, working out whether your premises are standard or enhanced tier, who your responsible person is, and what your current evacuation and communication procedures actually look like in practice, takes real time to do properly across a multi-building estate.

The organisations that will be in the best position by April 2027 are the ones treating this as a 2026 project, not a 2027 deadline.

Frequently asked questions

Does Martyn's Law apply to university campuses?
Yes. Higher education institutions are assessed under the same tiering as other qualifying premises, unlike schools, which have a specific standard-tier carve-out regardless of size.

Are hospitals in scope of Martyn's Law?
Healthcare is one of the uses explicitly listed under Schedule 1 of the Act, so hospital premises with public-facing areas that meet the 200-person threshold fall in scope.

What's the difference between standard tier and enhanced tier?
Standard tier (200-799 expected people) requires basic public protection procedures - evacuation, invacuation, lockdown and communication plans. Enhanced tier (800+) requires the same, plus documented protection measures and a named senior individual accountable for compliance.

See what this means for your estate

If you're an estates or security lead trying to work out where your buildings sit and what your evacuation and communication plans currently look like in practice, that's exactly the conversation worth having early.

Book a demo