Martyn's Law: When Governance Has to Travel

By Danni Grant · 16 October 2026

In my last blog on governance, I promised I'd come back to what happens when governance has to stretch further. So here it is.

Over recent weeks, a lot of my time has been spent with organisations that don't have one premises. They have hundreds. National retail estates, hospitality groups, and businesses whose UK operations are one part of something much bigger, with decisions made in other divisions and, sometimes, other countries.

At that scale, the loop I described in that blog gets much longer. Getting an issue from the shop floor to someone who can decide, and getting the decision back again, can involve several layers of management, more than one legal entity and a head office in another time zone. And every extra step is another place where it can break.

What policing taught me about templates

In policing, the response to a marauding terrorist attack has a name. Operation Plato. For anyone who has worked in counter terrorism policing, it's a very familiar word.

Plato is the national identifier for the multi-agency response to that kind of attack. When one is suspected, Plato can be declared, usually from the police control room, and the declaration sets a predetermined response in motion. Every force has a Plato plan, built to a nationally agreed model. In practice, much of it sits ready in the control room as a set of prompts, waiting to be selected and applied the moment it's needed. Once declared, the response is co-ordinated with fire and ambulance colleagues under the Joint Emergency Services Interoperability Principles, and CONTEST, the UK's counter-terrorism strategy, commits to these skills being regularly tested, exercised and improved.

That's the whole point of a national template. Whoever is on duty, wherever they are, starts from the same place. Consistency is designed in, and it's tested routinely by police and emergency service partners together.

Even so, it can fail.

Public inquiries have examined Plato responses closely. They've found declarations that didn't reach all the partners who needed to know, too much resting on one person, and more than one version of a plan in use.

None of that was about the absence of a plan. There was a nationally defined process, trained and exercised. What failed were the things around it: whether information reached everyone who needed it, whether too much rested on one person, and whether everyone was working from the same version.

For me, those are governance questions. And they're exactly the questions a large business faces.

A national retailer or hospitality group should be aiming for something that works a lot like Plato: a common set of procedures, applied consistently across hundreds of sites, usable by whoever happens to be on shift. It's the right ambition. But a template only delivers consistency if the right version is in use everywhere, if the decision to act reaches everyone who needs to know, and if no single person is left holding more than they can manage.

The good news is that large businesses have done something like this before. The guidance notes that the responsible person may already have been identified for other regimes, such as health and safety or fire safety (paragraph 6.2). Most national organisations already manage those across hundreds of sites, with central standards, local delivery and reporting in between. Martyn's Law doesn't need to start from nothing. It can build on what already works.

One estate, three answers

Plato itself holds a balance: one national model, but a plan in every force. Martyn's Law asks large businesses for something similar. The Act applies premises by premises, and for many national businesses, the estate won't sit neatly in one tier.

A single organisation could have premises that fall outside the Act altogether, premises in the Standard Tier and premises in the Enhanced Tier, all within the same organisation. Premises are qualifying premises where it's reasonable to expect 200 or more people to be present at the same time, from time to time, and they move into the Enhanced Tier at 800 or more (section 2; paragraph 4.2). Staff count towards those figures (paragraph 4.31).

What's required differs significantly between them. Standard Tier premises need appropriate public protection procedures (section 5). Enhanced Tier premises need those procedures plus public protection measures, a compliance document provided to the SIA and, where the responsible person is an organisation, a designated senior individual (sections 6, 7 and 10). Premises outside the scope of the Act have no requirements under it, although the guidance points anyone who wants to go further towards good practice at ProtectUK and NPSA (paragraph 7.3).

That's why scoping has to come first. Until you know, premises by premises, which sites are in scope and in which tier, you can't know what the estate as a whole needs to deliver. And as I've written before, the label on a building doesn't always match what happens inside it.

The guidance recognises that one responsible person may cover several premises, giving the example of a company operating a chain of restaurants or shops, and asks it to consider how the requirements can be met at each individual premises, avoiding a one-size-fits-all approach (paragraph 6.6). This is the central tension for any business operating at scale. You want consistency: a common standard, shared training, one way of recording decisions. But a flagship store in a city centre, a unit on a retail park and a concession inside someone else's building are very different places.

This is also where strategic governance matters most. Somebody has to outline and agree the approach for the whole estate. Will out-of-scope sites follow the same procedures anyway, for consistency? Will larger Standard Tier sites take on some of the additional considerations on procedures written for the Enhanced Tier, as the guidance suggests may be appropriate (paragraph 7.31)? And how will the organisation explain to its own people why one store has different arrangements from the one down the road?

There's no single right answer to those questions, but they need to be decided deliberately, at the right level, and written down. The output will differ from site to site. The thinking behind it should be consistent, and clear to anyone who picks it up later.

Speaking the organisation's language

The thing that's had me scratching my head most recently, in the best possible way, is the rollout.

Getting the approach right for one premises is hard enough. Doing it consistently across a whole organisation, at hundreds of sites, takes real thought.

What I've found helps most is using the organisation's own language. Every large business already has its own way of talking about safety, operations and incidents: its own terms, documents and rhythm of briefing and reporting. If Martyn's Law arrives with a whole new vocabulary, it can feel like something bolted on from outside.

For one national retailer I'm working with, that's exactly what we've been doing. In practice, it means fitting public protection procedures into the way their teams already plan, brief and record, and using the names they already give to roles, routines and documents. People are far more likely to use something that feels like theirs.

It helps governance too. When Martyn's Law speaks the same language as the rest of the business, it can travel along the routes that already exist, rather than needing new ones of its own.

Which part of the business is the responsible person?

In a big group, this isn't always as obvious as it sounds.

The responsible person is whoever has control of the premises for their Schedule 1 use. The guidance explains that control will ordinarily mean physical possession, with the right and ability to make decisions about the premises' management and use. It doesn't require ownership, and could be held by a leaseholder or licence holder (paragraph 6.3).

The guidance's examples are worth reading closely. A company leasing a building as a shop is the responsible person, not the building's owner. On a retail park, each retailer is responsible for its own unit. But where a brewery owns a pub, leases it to a tenant and holds the licence for the premises, the brewery is the responsible person (paragraph 6.3).

For a business with several legal entities, brands and operating models, it's worth confirming early which entity has control of each premises. It may not be the name over the door, and it may not be the parent company.

When decisions are made somewhere else

Martyn's Law applies to premises in England, Wales, Scotland and Northern Ireland (paragraph 1.3). Organisations of that size rarely stop at the border.

One organisation I'm working with has its UK operations sitting within a wider European structure. Standards are set centrally. Budgets sit within divisions organised around how the business trades rather than country by country. That's entirely normal for an organisation of its size. But it means a decision about a UK premises may need sign-off from someone who has never had a reason to read the Act.

The legal position doesn't move. The responsible person can delegate tasks but not its legal responsibility (paragraph 6.1), and it remains liable even when it brings in outside support (paragraph 6.7). So the questions I'd ask are practical ones. Who explains the Act to the people who hold the budget? When a store identifies something that needs a decision, how does it reach them, and how quickly? And how is that decision recorded as one the responsible person made, for that premises?

For Enhanced Tier premises, the guidance offers a helpful picture of how this can work. Its example is a cinema chain whose senior individual is a board member at head office with little knowledge of the individual sites. They delegate day-to-day aspects of compliance to someone at each site, while keeping overall responsibility for the chain's compliance (paragraph 6.9). The senior individual must be someone with responsibility for managing the affairs of the responsible person, not a lower-level employee (paragraph 6.10).

There's no requirement to designate a senior individual for Standard Tier premises. But for a business with many Standard Tier sites, I think that model of central accountability with local delivery is still worth thinking about.

You don't operate alone

Large estates are full of neighbours: stores in shopping centres, units in stations, concessions inside other retailers' buildings.

Where qualifying premises form part of other qualifying premises, the responsible persons must co-ordinate with each other, so far as is reasonably practicable (section 8; paragraph 6.16). The guidance's example is a department store inside a shopping centre, both in the Enhanced Tier, co-ordinating to deconflict their evacuation plans and complement each other's lockdown and communication plans (paragraphs 6.16 to 6.18).

There's a co-operation duty too. Where the responsible person for Enhanced Tier premises needs permission or support from someone else with control of the premises, such as a building owner who has leased them out, that person must co-operate, so far as is reasonably practicable (section 8; paragraph 6.21). For Standard Tier premises, there's no equivalent duty, so those relationships will rest on lease terms and good working arrangements.

For a business with hundreds of sites, that can mean hundreds of separate relationships with centre managers, landlords and neighbouring operators. Somebody needs to own them. And whatever is agreed locally needs to find its way back into the organisation's own picture of each premises.

Estates don't stand still

Estates of this size change constantly. Stores open and close. Units are refitted, extended or repurposed. Seasonal peaks change how many people are expected on site, and planned peaks such as seasonal sales count when working out scope and tier (paragraphs 4.31 and 4.34).

The Act requires the responsible person to notify the SIA when it becomes responsible for qualifying premises and when it ceases to be (section 9; paragraph 7.64). It must also notify the SIA if information it has provided ceases to be accurate while it's still responsible (section 9(4)). The timescales and specific information required will be set out in regulations (paragraph 7.64).

The guidance also says procedures should be kept under review, taking account of changes to the premises and their operation (paragraph 7.29). For Enhanced Tier premises, measures must be kept under review, and the guidance suggests considering whether they need to be reassessed following material changes to the premises (section 6; paragraph 8.26).

With one or two sites, someone will usually notice when things change. With hundreds, you can't rely on that. Changes to the estate need to prompt a question: is this premises still in scope, is it still in the same tier, and are its procedures still right?

What I'd look for

In a multi-site business, I'd start by looking for a single picture of the estate. Every premises, whether it's in scope, which tier it sits in and why, and which entity is the responsible person. Without that, it's very hard to see where you stand.

Then I'd want to see a common approach that's genuinely applied locally, with room for each site to reflect what makes it different. Clear routes from each site to the people who can decide, and back again, including where those people sit outside the UK. One current version of each premises' procedures, so nobody is working from an old copy. Someone who owns the relationships with landlords, centre managers and neighbours. And something that brings a premises back for review when the estate changes. I'd also look hard for single points of failure. Whether it's one manager holding everything together at a site, or one lead at head office carrying the whole estate, too much resting on one person is a risk. Plato showed how quickly that can become the weak point.

In my last governance blog, I wrote about the value of a document that sets out an organisation's approach to Martyn's Law and the reasons behind it. At this scale, I think it matters even more. It's what keeps hundreds of local decisions pointing in the same direction, long after the people who made the first ones have moved on.

A question for large estates

I'll finish with a question for anyone responsible for Martyn's Law across a large estate.

If a manager at one of your sites spotted something today that needed a decision, do you know who would make it, where they sit, and how long it would take for the answer to get back to that site?

If you can answer that for one premises, the real test is whether you can answer it for all of them.

Events bring their own version of this challenge, with organisers, venues, contractors and volunteers all answering to different people. I'll come back to those another time.

Download this article (PDF, 216KB)