On 22 May 2026, the Security Industry Authority published a remembrance message marking nine years since the Manchester Arena attack of 22 May 2017. Chair Mike Cunningham and chief executive Michelle Russell said the organisation’s thoughts were with the people of Manchester, remembering the 22 people who were killed, the hundreds who were injured and the families whose lives were permanently altered by the attack. (gov.uk) The statement was brief, but it carried more than a commemorative purpose. Its wording placed remembrance alongside the SIA’s public protection role, indicating that the events of 2017 continue to shape how the regulator frames its mission and responsibilities. (gov.uk)
The policy significance sits in the SIA’s reference to Martyn’s Law. In the same message, the regulator said it remained committed to strengthening public safety and was ‘humbled and honoured’ to have been appointed regulator for the new regime. That role is not provisional: government material confirms that the Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025 and named the SIA as regulator. (gov.uk) That matters because the SIA is not a new body created for this task. According to its GOV.UK profile, it is the statutory regulator of the UK’s private security industry, established under the Private Security Industry Act 2001. The Home Office announcement of Mike Cunningham’s appointment as chair, effective from 1 March 2026, also made clear that the organisation would take on the Martyn’s Law function as implementation progressed. (gov.uk)
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. Home Office and SIA material describes it as a framework to improve preparedness at publicly accessible premises and events, with legal duties calibrated to the number of people reasonably expected to be present. (gov.uk) The legislation is named in memory of Martyn Hett, one of the 22 people killed in the Manchester Arena attack, following sustained campaigning by his mother, Figen Murray OBE. In that context, the SIA’s anniversary statement sits within a wider government effort to connect remembrance of the attack to a specific programme of regulatory change. (gov.uk)
Implementation, however, is still under way. The SIA said in March 2026 that Martyn’s Law had not yet come into force, that there would be a minimum two-year implementation period from Royal Assent in April 2025, and that premises and events were not yet legally required to comply. The same update said the SIA did not yet have its new powers under the Act. (gov.uk) Subsequent SIA material published in April 2026 said the new law was expected to come into force in spring 2027. For operators, the present phase is therefore a preparation period rather than an enforcement phase, even though the regulatory model is now being set out in much greater detail. (gov.uk)
That detail began to emerge on 15 April 2026. On that date, the Home Office published section 27 statutory guidance explaining how the Act is intended to work in practice, and the SIA launched a public consultation on its draft section 12 guidance covering how it intends to exercise its regulatory functions. The SIA later confirmed that consultation would remain open until 12 June 2026. (gov.uk) The Home Office guidance sets out the broad shape of compliance. It says smaller premises such as shops and restaurants with 200 to 799 people expected to be present will need clear public protection procedures, while larger premises and events with 800 or more people will be required to take additional steps to reduce vulnerability to attack. The explanatory notes to the Act add that enhanced duty premises and qualifying events must document their procedures and measures and provide that information to the SIA. (gov.uk)
Read against that timetable, the 22 May remembrance message functions as both tribute and policy signal. It re-states that the SIA sees Martyn’s Law as part of its public protection remit and that it intends to deliver the regime in co-ordination with government and the wider security community across the UK. (gov.uk) For venue operators, local authorities and security professionals, the practical meaning is straightforward. The legal duties are not yet live, but the Home Office guidance has been published, the SIA’s draft regulatory approach is out for consultation, and organisations can already review whether they are likely to be in scope and what procedures or governance changes may be needed before commencement. That final point is an inference from the published implementation timetable and guidance programme, rather than a new legal requirement in force today. (gov.uk)