Martyn's Law: Making Underspend Count

By Danni Grant · 30 October 2026

Around this time every year, the same conversation starts in finance meetings up and down the country. The mid-year figures come in, the forecasts get revised, and somewhere there's a line marked underspend. Then comes the question. What can we do with it before the year closes?

For anyone in scope of Martyn's Law, it's a question worth taking a bit more time over this year.

When guidance meets the budget cycle

The Home Office published the statutory guidance on 15 April 2026. It came out ahead of commencement, as promised, to give organisations time to prepare (paragraph 2.10).

For a lot of organisations, though, it landed just as a new financial year was starting and budgets had already been signed off. Six months on, I'm talking to responsible persons who know what's coming and have had nothing allocated to start the work.

That's nobody's fault. Legislative timetables and budget cycles rarely line up. But it does mean the underspend found this autumn may be the only flexible money some organisations have before the Act comes into force, which the Home Office currently expects to be spring 2027.

Standard tier still means real work

It's easy to assume standard tier premises can wait. The duties are lighter, and most of the public attention has been on the enhanced tier.

But the standard tier still carries legal duties. Premises must be notified to the SIA (paragraph 7.64). The responsible person must have evacuation, invacuation, lockdown and communication procedures in place, so far as is reasonably practicable. And the staff who'll carry those procedures out must be made aware of them and of their own role (paragraph 7.51).

For most organisations, standard tier sites make up the bulk of the estate. A small gap at one site might not look like much. Repeat it across dozens of sites and it's a very different picture.

So how do the people running those sites learn what the duties actually involve? Free e-learning such as ACT is there for general awareness of the terrorist threat (paragraph 7.60). CTPSaP is a five-day qualification. It's valuable, particularly for enhanced tier organisations, but it's a lot to ask of a store manager or a facilities lead at a standard tier site. There's a gap between the two, and closing it is one of the more practical things underspend can do this year.

When the estate isn't simple

Multi-site businesses have a particular challenge. One estate can include enhanced tier sites, standard tier sites and premises that are out of scope altogether, sometimes in the same town.

The responsible person can change from site to site. A flagship store, a unit in a shopping centre and a shared office building may each come with different arrangements with landlords and neighbours. Add seasonal events and temporary venues and it gets more complicated again.

What worries me here is inconsistency. One region gets on with it while another waits to be told, and nobody at the centre can say with confidence where the organisation stands. What helps is a group-wide picture with clear local ownership, with standards set centrally and applied by people who actually know each building. Building that picture is a good use of underspend, because it shows you where next year's money needs to go.

What you can do now

When money has to be spent before the year end, the temptation is to move fast and buy whatever can be bought quickly. I'd apply a different test. Will this still be worth having whatever the regulator's final approach looks like?

Some of what follows costs little more than time. Other things, like scoping a large estate, training the people who'll lead procedures, running a facilitated exercise or getting an independent review of draft plans, are where underspend really makes a difference.

Name a lead. Someone needs to own this before commencement. A named lead with a small working group drawn from across the business gives the work a home, and a voice at senior level.

Map your premises and events. List every site with realistic capacity figures, and every event you run. Premises where 200 to 799 people, including staff, can reasonably be expected to be present at the same time, from time to time, are standard tier. Expect 800 or more and it's enhanced. There are exceptions. Places of worship, childcare settings and primary, secondary and further education premises stay standard tier whatever their size, while higher education premises can fall in the enhanced tier (paragraphs 4.36 to 4.39). Qualifying events of 800 or more always carry the enhanced duties. Where each site sits shapes everything that follows, including your next budget request.

Confirm the responsible person. Who actually holds the duty for each premises or event? In multi-site organisations, shared buildings and partnership events, it's often less obvious than people think. Chapter 6 of the guidance sets out how to work it through.

Start with what you've got. Most premises already have fire evacuation plans, and many have incident response and business continuity plans too. Build on them. Just be clear which procedures are for fire and which are for an attack, because evacuating from an attack may need to work quite differently (paragraph 7.34).

Talk to your neighbours. Where responsibility is shared, or premises sit within other qualifying premises, responsible persons must co-ordinate, so far as is reasonably practicable (paragraph 7.63). The guidance also suggests thinking about what nearby premises have in place (paragraph 7.27). Have those conversations with landlords, tenants and partners now.

Train your people. ACT Awareness e-Learning is free, and Supplementary Document C points to other resources (paragraph 7.62). That's a good base. The people who'll lead or start a procedure may need more, and the guidance is clear it should be tailored to the premises and the procedures in place (paragraph 7.56).

Test it. I spent a lot of my policing career looking at where organisations struggled during and after attacks. The same lesson came up again and again. A plan that's never been tested tends to fail just when you need it. A tabletop exercise doesn't cost much, and it'll tell you more than any document review. The guidance asks responsible persons to think about how procedures will be tested and practised (paragraph 7.28).

Write your decisions down. What you decided, why, and what you based it on. There's no legal requirement to document standard tier procedures, but the guidance says you should, and without it compliance will be hard to show (paragraph 7.32). It's also exactly what a budget holder will want to see.

What to avoid

I'd be wary of two things.

The first is anything sold as a guarantee of Martyn's Law compliance before the Act has even commenced. There's no legal requirement to comply until it comes into force (paragraph 2.10). Using third-party products or services isn't mandatory either, and the responsible person stays liable whoever they bring in (paragraph 6.7). That applies to everyone working in this space, us included.

The second is big capital spend on physical measures before anyone's worked out whether they're needed. There's no statutory requirement to alter premises or buy equipment (paragraph 7.25). Proportionality runs right through the guidance, and a rushed purchase made to clear a budget line can be hard to justify later.

How GCG can help now

At GCG we start from the Act and the statutory guidance, keep things proportionate and try hard not to over-engineer. Everything we offer can be sized to the budget you've got and started before the year closes.

Most of our work at the moment is estate scoping, particularly across large and complex estates. We go building by building to establish what's in scope, which tier applies and who the responsible person is. We also help with governance, setting out who owns what and how decisions get made and recorded across divisions, regions and partners, and we review business continuity and major incident policies through a Martyn's Law lens. Then there's the practical support: scoping and planning templates, project plans through to spring 2027, quality assurance on plans teams have written themselves, and keeping track of government updates so our clients don't have to.

CT STEP, our digital platform, takes teams through four stages: Understand, Evaluate, Plan and Activate. It keeps preparation structured and consistent across sites, and records it as you go.

We've also just developed a one-day classroom course for responsible persons, certified by The CPD Certification Service. It's aimed at the person who holds the duty, particularly in the standard tier. It covers what the Act requires, how to think like a responsible person and what public protection procedures look like in practice, so they can shape the site-specific instruction their own staff need. It sits alongside ACT and CTPSaP rather than replacing either. It carries no government endorsement, and paying for external training isn't mandatory (paragraph 7.55). It's there for those who want structured support. For large workforces, we also offer a short terrorism security awareness e-learning package.

The team behind all of this has decades of experience in UK counter terrorism policing, including learning from past attacks and running national exercises. If you've found underspend this autumn and want to talk through how to use it, we'd be glad to help. A short conversation is often enough to work out where to start.

Thinking ahead to next year

If commencement arrives in spring 2027, as the Home Office currently expects, it'll fall early in the 2027/28 financial year for a lot of organisations. That's the budget most will really need, and the bids for it are being put together now.

Underspend used well this year also builds your evidence. If you can show you know your sites, who's responsible for them and where the gaps are, you're in a far stronger position for next year than someone turning up with a blank page.

This is where a well-scoped proposal helps. A good one separates what you can do now, within this year's underspend, from what you want in place by commencement, which belongs in next year's budget. Finance colleagues get a costed, phased plan to work with, and this autumn's spend becomes the first stage of something bigger.

So my question for this autumn's finance meetings is a slightly different one. What can we do now that will help us ask for the right budget next time?

Martyn's Law is about making sure the lessons of past attacks are acted on before the next one. A modest sum spent well this autumn could be a real first step.

Download this article (PDF, 68KB)