Martyn's Law for facilities managers and managing agents

The short answer

Under the Terrorism (Protection of Premises) Act 2025, every qualifying premises has a responsible person: whoever has control of the premises in connection with their listed use. The Home Office statutory guidance says control ordinarily means physical possession of the premises with the right and ability to make decisions about their management and use, particularly who may or may not remain on site. That is normally the operator running the shop, venue or hotel, not the company maintaining the building or collecting the service charge.

So a facilities management provider delivering hard or soft services, or a managing agent acting for a landlord, is usually not the responsible person. The guidance is clear that the responsible person cannot delegate their legal responsibility to a contracted service provider, but may delegate tasks. FM teams will often carry out a lot of the practical work. The legal duty stays with the client.

There are two important qualifications. First, if a managing agent or operator actually controls the premises for their listed use, for example by running a shopping centre's common areas, entrances and exits, it may be the responsible person. Second, anyone who has control to some extent of enhanced tier premises but is not the responsible person has a duty to co-operate under section 8 of the Act. The duties are expected to come into force in spring 2027.

Where FM providers and managing agents fit

The Act does not mention facilities management or managing agents by name. The position depends on control, which depends on the facts and the contracts. The table below shows typical positions, as a starting point only.

The statutory guidance gives a useful example. A retail park is owned by a pension fund and let through a property management company. Each retailer controls its own unit for its listed use, so each retailer is the responsible person for its unit, not the owner or the property manager. Our guide to who is the responsible person covers the test in full.

Shared buildings and the duty to co-ordinate

Shared buildings are where FM teams and managing agents matter most. Section 8 of the Act requires responsible persons to co-ordinate with each other, so far as reasonably practicable, where more than one person is responsible for the same premises and where one set of qualifying premises forms part of another. This applies at both the standard and enhanced tiers. The guidance says co-ordination is about removing barriers to delivering procedures, and avoiding new dangers such as funnelling large numbers of people into the same space.

The duty to co-ordinate sits with the responsible persons, but someone has to make it work. In a shopping centre, office building with a public-facing ground floor, or mixed-use scheme, that is often the managing agent or FM team. Practical support includes:

• Keeping an up-to-date list of occupiers, which units are likely to be in scope, and duty manager contacts.
• Running a tenants' or occupiers' group with protective security as a standing agenda item. The guidance gives this as an example of good co-ordination.
• Setting up a real-time channel between duty managers, such as a radio channel or messaging group.
• Checking shared corridors, service yards and stair cores have the capacity for several occupiers to evacuate at once.
• Agreeing who secures shared doors, shutters and entrances in a lockdown, and how out-of-hours staff are contacted.

Separately, section 8(5) and (6) require anyone with control to some extent of enhanced tier premises, who is not the responsible person, to co-operate with the responsible person. The guidance names a building owner who has leased premises to an operator as an example. Its own example is a freeholder asked to consent to concrete planters for an enhanced tier gallery, who must co-operate with and consider the request. A managing agent that controls access, shared parts or building systems should expect similar requests. Our guide to multi-tenant and shared buildings goes deeper.

What to put in place with clients

Start each client conversation with a short, structured review. This helps clients meet their duties and makes clear where your role begins and ends.

1. Confirm whether each building or unit is likely to be in scope and at which tier. The free tier checker gives a quick first view.
2. Confirm who the responsible person is for each qualifying premises and record it.
3. Map which parts of the building the client controls, which the landlord or agent controls, and which belong to other occupiers.
4. Agree which tasks you will deliver, such as maintaining locks and alert systems, briefing your own staff, or supporting drills.
5. Agree whether you are authorised to submit SIA notifications for the client. The notification guidance allows an employee, agent or consultant to submit, but responsibility stays with the responsible person, and it recommends a written record of who is authorised.
6. Agree how you will tell the client about changes that may affect their notification or procedures, such as layout changes or new occupiers. Changes to notified information must be reported to the SIA within 28 days.
7. Set a review date, ideally alongside the fire risk assessment review.

Remember that there is no requirement to carry out physical works at the standard tier. Standard tier duties are to notify the SIA and have public protection procedures in place so far as reasonably practicable. Do not present capital works as a legal requirement for a standard tier client.

Contracts and responsibilities

Most existing FM and managing agent contracts were written before the Act. Review them before the duties commence. Useful points to cover:

• A clear statement that the client remains the responsible person, and that the provider delivers specified tasks only.
• The tasks in scope, for example maintenance of doors, locks, shutters, public address and alarm systems, and timescales for repairing faults that affect lockdown or evacuation.
• Staff briefing: your staff on site must be made aware of the client's procedures and their role in them.
• Information security: the guidance lists policies that ensure suppliers, contractors and sub-contractors protect security-sensitive information as a public protection measure. Agree how floor plans and procedures are stored and shared.
• Notification support: whether you will prepare or submit notifications, and how the client authorises this.
• Change reporting: a duty to tell the client promptly about changes that may affect capacity, layout or co-ordination.
• Co-operation: for enhanced tier premises, how requests for consent or support from the responsible person will be handled.

Avoid contract wording that suggests legal responsibility has passed to you. It cannot, and it can mislead the client. The guidance says the responsible person should be satisfied that any support from providers, contractors or consultants is suitable, properly resourced and effectively delivered. Clear scope, reporting and records help your client show exactly that.

Security contractors

Many FM providers supply or manage security officers. The Act does not replace existing law. The statutory guidance reminds responsible persons to check whether licences are required for staff under other legislation, including SIA licences under the Private Security Industry Act 2001.

A licence is not the same as knowing the site. The guidance says staff with prior security training, such as training for an SIA licence, are still likely to need site-specific training or instruction on the procedures in place. Security officers are often the people who spot a threat, start a lockdown or guide people out, so include them in briefings and drills. Remember that contracted staff count towards the premises' capacity figure as staff.

At enhanced tier premises, security staff may deliver public protection measures such as patrols and searches of people or bags. The responsible person for those premises must document its measures in a compliance document provided to the SIA, and the guidance treats a record of staff training as a necessary part of it. Expect clients to ask for training and briefing records for your officers. See enhanced tier duties for more.

How FM teams can add value

FM teams already hold much of the information a responsible person needs. The guidance asks responsible persons to consider the layout of the premises and existing equipment that may be used in procedures, such as areas that can be easily secured, doors, locks and public address systems. FM teams know these better than anyone.

• Provide a building information pack: exits, lockable doors, shutters, PA and alarm coverage, CCTV, and which doors are on shared routes.
• Test the equipment that procedures depend on, and flag faults that would stop a lockdown or evacuation working.
• Combine Martyn's Law walk-throughs with existing fire drills where it makes sense, while keeping the procedures distinct. Our guide to Martyn's Law vs fire risk assessment explains the differences.
• Keep tidy records of drills, briefings and equipment tests that clients can use as evidence.
• Brief your own cleaning, engineering and front-of-house teams so they know what to do and who to follow.
• Run or support the occupiers' group in shared buildings.

If your firm wants to offer Martyn's Law support to clients, our partner programme is designed for FM and managing agent firms that want consistent, site-specific documents for client buildings without becoming security consultants.

Common mistakes and next steps

• Accepting, or implying, legal responsibility that belongs to the client.
• Assuming the landlord or managing agent is responsible because they own or manage the building.
• Leaving co-ordination between occupiers to chance in a shared building.
• Letting security officers rely on their licence training without any site-specific briefing.
• Sharing floor plans and procedures more widely than needed.
• Missing changes, such as a new occupier or layout, that the client must notify to the SIA within 28 days.

A good first step is a simple register of client buildings, likely tier, responsible person and who controls shared parts. Then review contracts and agree roles with each client before the duties commence. Clients who run standard tier venues can find tailored procedures and records in our packs, and our sample documents show what they look like.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025: Statutory guidance, corrected version (Home Office)
• Terrorism (Protection of Premises) Act 2025, section 8 (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025: notification requirement (Home Office)
• Terrorism (Protection of Premises) Act 2025, contents (legislation.gov.uk)