The Home Office published fresh Martyn's Law guidance on 5 August 2026, and for the first time it sets out the notification timeframes that duty-holders can actually plan against. The headline for anyone running a venue or an event is no longer whether the regime is coming, it is the date the paperwork is due.
On the guidance as published, qualifying premises will have a three-month window from the commencement of the relevant section of the Act to submit a notification to the Security Industry Authority, and any changes after that are to be reported within 28 days. Qualifying events are on a tighter clock: in most cases the responsible person will need to notify the SIA within 14 days of the event date being made publicly available. The SIA is the regulator for the regime.
The important caveat is timing. The duties will not come into effect until next year, so none of these windows is running yet. What has changed is that the windows are now defined, which turns Martyn's Law from a principle into a scheduling problem duty-holders can prepare for now rather than scramble on later. The UK national threat level sits at SEVERE, which is the backdrop the whole regime is built against.
Operator implication: for clients who hold or run qualifying sites and events, the work that pays off before commencement is mapping. Which premises and which events fall in scope, who the named responsible person is for each, and how a 14-day event-notification and a 28-day change-report get built into the way the client already books and runs things. The Ops Con's role here is advisory and operational rather than regulatory, so the honest framing for a client is that we help them be ready to register and to run compliant protective measures, while the notification itself is theirs to file with the SIA when the clock starts.
