UK HE needs to be ready for upgraded terrorism preparedness rules

With the UK’s national threat level raised to severe in May, a terrorist attack is now considered highly likely.

That is already, no doubt, concentrating minds within universities, on whose agendas safety has always been high. But new legislation expected to come into force next spring will bring counter-terrorism preparedness into even sharper relief, alongside institutions’ wider responsibilities for public safety. And higher education needs to be ready.

Martyn’s Law – officially known as the Terrorism (Protection of Premises) Act 2025 – is designed to reduce the risk of harm at public premises and events in the event of a terrorist attack. Named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack, it aims to ensure premises and events have appropriate plans in place regarding how they would respond.

Terrorists have targeted a wide range of people and places in recent years, and it is not always possible to predict where in the UK an attack might happen, or the type of premises or events that could be impacted. But universities are clearly at potential risk. As places of learning, debate, research and community engagement, they often operate in open environments that welcome thousands of people every day.

Martyn’s Law does not seek to change that character, but it does require proportionate arrangements to be put in place to protect staff, students and visitors. This should be seen not as a burden but as an opportunity to create, enhance and embed a security culture, in which everyone in the organisation understands the critical role they play in security. The confidence that their universities are prepared for emergencies will contribute to students’ overall experience and support wider well-being objectives. While no one tends to notice if security goes well, the ramifications if it doesn’t are felt across society.

A good first step is to determine whether you’re in the scope of the act by using the flowcharts for premises and events. While there are special considerations in place for premises used for early years, primary, secondary or further education, these do not extend to higher education.

If it’s reasonably expected that at least 200 people, including staff and students, will be present at the busiest times, the premises are likely to be in the standard tier. This requires managers to have thought about things like lockdown and communication arrangements in the event of an attack. The emphasis is on preparedness rather than expensive physical security measures.

If at least 800 people will be present, the building is likely to be in the enhanced tier. This requires the implementation of active measures to reduce the risk of harm from an attack and reduce vulnerability to one, such as monitoring and movement control. Reading the Home Office’s guidance on this should be on the to-do lists of all senior university managers, as well as those of estate and security staff.

A typical university is likely to have numerous premises in scope – although, in some cases, a group of buildings may be treated as single premises. And certain external events will also be drawn into scope of the enhanced tier if 800 or more people are expected at the busiest times and if there are controls on entry – even if the premises themselves are not in scope as enhanced tier premises.

Premises and events will need to be compliant by the time the act comes into force, which makes the coming months crucial for preparation. One of the most important early steps will be to determine accountability. Universities should be clear about who holds responsibility for premises in scope and how those responsibilities connect to existing governance structures. Clear ownership will support effective decision-making, oversight and compliance.

For many institutions, compliance will not start from scratch, of course. Universities are already experienced in managing complex health and safety obligations, major events, emergency planning and business continuity arrangements. And where good protective security measures and preparedness procedures already exist, they will be solid foundations. 

Complying with the act should be less about creating entirely new processes and more about ensuring existing arrangements adequately address the threat from terrorism and are applied consistently across a diverse estate. Further useful materials can be found on the police’s Protect UK website.

As regulator, our primary aim is to support organisations to understand and meet their obligations. Alongside that support, we will monitor compliance and take a proportionate approach to addressing instances where requirements have not been met.

We’re currently inviting those who are in scope to help test and develop our systems and processes. We need hundreds of volunteers to help us test the online notification system we are currently developing, as well as draft regulatory guidance. It’s an opportunity to feed back prior to launch and to shape the way we regulate, as well as a practical opportunity to get to grips with what will be legally required. Anyone interested should sign up or find out more. 

Universities have always adapted to meet changing expectations around safety, well-being and risk. Martyn’s Law represents the next stage of that evolution. By taking steps now, institutions can strengthen preparedness, support their communities and contribute to a more resilient public environment.

We look forward to working with the higher education sector as it prepares for implementation.

Laura Gibb is executive director for Martyn’s Law at the Security Industry Authority.