Martyn's Law and Digital Signage Readiness

Start with the law's operating objective, not a screen specification

The Act received Royal Assent on April 3, 2025. It creates a tiered regime for qualifying premises and events. Premises are likely to enter scope where they meet the statutory use and building tests, are not excluded and can reasonably expect at least 200 people, including staff, to be present at the same time from time to time. The SIA describes 200 to 799 people as the standard tier and 800 or more as the enhanced tier. Qualifying events generally use the 800 threshold and have additional entry-check conditions. Special rules and exclusions mean a headcount alone is never a complete scope test.

Both tiers must consider appropriate public protection procedures, so far as reasonably practicable, for evacuation, invacuation, lockdown and communication. Enhanced-tier premises and qualifying events also consider public protection measures concerning monitoring, movement, physical safety and security, and security of information. Enhanced-duty documentation and senior accountability are more extensive. The responsible person retains responsibility; a signage supplier cannot assume it on the venue's behalf.

The Home Office guidance explains that there is no statutory requirement under the public protection procedure duty to make a physical alteration or purchase specific equipment. That is the decisive point for a signage project. The legal question is not whether a venue owns a particular display platform. It is whether its procedures are appropriate to its circumstances and reasonably practicable, and whether people can be given timely, understandable instructions when an incident occurs.

Define where digital signage helps - and where it does not

Statutory guidance says communication can take many forms, including verbal instructions, signage, posters, briefings and audio broadcasts. Digital displays therefore sit within a channel mix rather than above it. They can be useful in concourses, receptions, retail floors, food courts and circulation areas where people already look for information. A centrally controlled network can replace scheduled commercial content with an approved message across selected zones and languages. It can also give a control room a consistent visual instruction while staff deliver verbal guidance.

Screens also have material limitations. People may face away from them, have limited sight, not understand the displayed language or be in toilets, stairwells, back-of-house areas or outdoor queues. Smoke, crowd movement, power loss, damaged networks or an incident close to a display can make a normal route or instruction unsafe. Silent visual content may not attract attention. An animated alert may also be inaccessible or misinterpreted under pressure.

Build the channel assessment by zone. Record the audience, likely occupancy, viewing direction, normal dwell time, available sound, accessibility needs, connectivity and alternative channel for every relevant area. A map showing "screens installed" is not enough. The useful question is whether the complete channel set can reach people where they may actually be, and whether staff know what to do when one channel is unavailable.

Translate procedures into controlled message architecture

Emergency messages should be outputs of an agreed procedure, not copy invented at the control desk. Start with the decisions that an authorised incident lead may make: evacuate a particular zone, invacuate people away from an external danger, initiate a partial or full lockdown, hold people for further information, or end an alert. For each state, define the intended audience, approved wording, permitted zones, language variants, duration, visual hierarchy and companion audio or staff instruction.

The Home Office stresses that information should be simple, clear and specific to the action required. That favours short verbs, unambiguous destinations and one instruction per state. Avoid a generic "emergency" slide that leaves people to infer the action. Equally, avoid publishing sensitive operational detail such as security positions or internal response logic. Content governance must reconcile clarity for the public with security of information.

Treat evacuation, invacuation and lockdown as different states. The same display cannot safely tell one audience to leave while the adjacent zone should remain inside. Site zoning should correspond to the operational plan, not just the marketing playlist structure. Test whether a control operator can select the correct scope under pressure and whether the system makes the active state unmistakable.

• Use pre-approved master messages with controlled local fields.
• Keep translations under the same review and version process.
• Separate public instructions from staff-only operational content.
• Define a clear all-clear or transition message and who may issue it.
• Prevent an alert template being reused for routine marketing.
• Record the owner, approval date, review date and superseded version.

Engineer the alert path for resilience and safe failure

A normal content workflow may tolerate a delayed publish or an offline player. An emergency override cannot inherit those assumptions without examination. Document the complete path from an authorised decision to the pixels on each endpoint: identity, authentication, control interface, cloud or on-premise service, network, player, display input and power. Identify which components are shared with other systems and which single failure could block or misroute an instruction.

Decide what "offline" means. A player may keep showing cached commercial content when it loses the network, which is useful in normal operation but dangerous if teams assume it received an override. Monitoring should distinguish an endpoint that is online, an endpoint that acknowledged the alert and a display that is actually presenting the intended input. Where positive confirmation is not technically available, the procedure needs an explicit human check or alternative channel.

An override should have priority over playlists, local scheduling and promotional takeovers. Define how it starts, expires and is cancelled; an indefinite stale warning can create a second risk. Consider local activation if the central service is unreachable, but protect that capability from accidental or malicious use. Avoid relying on consumer casting, shared passwords or an undocumented technician account for a critical workflow.

Accessibility and human factors belong in the system design. Use high contrast, stable layouts, large text, plain language and redundant cues that do not depend on colour alone. Where appropriate, pair visual instructions with audio and trained staff. Verify sight lines at realistic crowd density and lighting, not only on a design preview at a desk.

Put authority, auditability and information security around the channel

Name the business owner of the communication procedure, the system owner, the people authorised to activate an override and the people permitted to edit approved templates. Those are different roles. Apply least privilege, strong authentication and named accounts. Review access after role changes and remove it promptly when someone leaves. A regional marketing publisher should not automatically receive emergency-control privileges.

Audit records should show who changed a template, who approved it, who initiated an alert, which message and zones were selected, when endpoints acknowledged it, and when the state ended. Protect those records from routine editing and align retention with the venue's security, legal and incident-review policies. Logs are evidence for learning; they are not a substitute for testing or staff competence.

The Act's enhanced-tier security-of-information considerations also matter to content teams. Do not expose floor plans, camera positions, access controls or response details through preview links, public asset libraries, screenshots or supplier support tickets. Classify alert templates and technical documentation, restrict exports and define how suppliers may access the environment. Include emergency publishing and notification obligations in contracts and offboarding.

Test the procedure, not merely the publish button

A successful CMS demonstration proves that one operator can publish one slide in favourable conditions. A readiness exercise should test the decision and communication chain. Use safe, clearly labelled exercise content and coordinate with venue leadership so nobody mistakes a test for a real incident. Include representatives from security, operations, facilities, IT, accessibility, communications and relevant suppliers.

Run scenarios at different occupancy levels and times. Measure how long it takes to authorise and present the message; which endpoints receive it; whether zones are correct; whether local schedules and inputs are overridden; how people understand the instruction; and how the team identifies and covers failed endpoints. Test a lost network, unavailable controller, power interruption, absent authorised user and message correction. Exercise the transition to an all-clear as carefully as the initial alert.

Record observations, owners and target dates. Retest after material changes to the site, screen estate, network, CMS, access model, procedure or message library. The statutory guidance encourages procedures to be reviewed and tested in context. A practical evidence pack can include the channel map, approved message register, role matrix, access review, endpoint inventory, test plan, results, exceptions and remediation log.

1. Confirm scope with the current statutory guidance and accountable team.
2. Map people, zones, procedures and every available communication channel.
3. Approve message states and translations before configuring technology.
4. Document activation, acknowledgement, expiry and fallback behaviour.
5. Review privileged access, supplier access and security-sensitive material.
6. Exercise realistic failures, capture evidence and close corrective actions.

Official sources and review points

Regulatory guidance will continue to develop before commencement. Check these primary sources when making decisions and record the version relied upon in your readiness documentation.

• Home Office: Terrorism (Protection of Premises) Act 2025 statutory guidance - updated August 7, 2026.
• Security Industry Authority: understanding Martyn's Law and the SIA's role - includes the expected spring 2027 commencement.
• Terrorism (Protection of Premises) Act 2025 - enacted legislation.
• Home Office Martyn's Law collection - statutory guidance, factsheets and updates.
• ProtectUK - official protective-security learning and operational resources.