Commercially Connected Shorts - 22 April 2026

This week we look at:

• Are you within scope of Martyn’s Law – The Terrorism Protection of Premises Act 2025?
• Cyber: Is your organisation sufficiently cyber secure?
• Trade: Commission updates rules on technology transfer agreements
• Tech: EU Digital Fitness Check – implications for multinational businesses

Are you within scope of Martyn’s Law – The Terrorism Protection of Premises Act 2025?

On 15 April 2026, the Home Office published statutory guidance on the legal duties under section 27 of the Terrorism (Protection of Premises) Act 2025 (Martyn’s Law).  The Act applies UK-wide and is designed to improve preparedness and protective security at certain publicly accessible premises and events.  Importantly, the regime operates on the assumption that an attack could occur anywhere - it is not based on assessing likelihood at a particular venue.

The guidance includes information on the legal requirements under the Act and steps that must be taken to meet these ahead of the Act’s substantive requirements being commenced (likely Spring 2027).

Premises are in scope if they:

• include a building accessible to the public (including part or a group of buildings)
• are wholly or mainly used for a Schedule 1 use (for example shops, hospitality, leisure, venues, transport hubs, healthcare, education, public authorities)
• can reasonably expect 200+ individuals (including staff) at the same time from time to time
• are not excluded under Schedule 2 (premises used by either House of Parliament, and parks, gardens, or sports grounds that meet Schedule 2 conditions)

There is a tiered regime for qualifying premises: “standard tier” applies where 200 to 799 individuals can reasonably be expected at the same time from time to time, and “enhanced tier” applies where the figure is 800 or more.  Special rules mean that places of worship and childcare, primary, secondary and further education remain in the standard tier even if the 800+ threshold is reached. 

“Qualifying events” - generally those with 800 or more people at some point, public access, and entry checks such as tickets or membership - can bring locations into scope even where they would not be qualifying premises.  This includes “other land” without buildings.  However, events at already enhanced tier premises are not treated as qualifying events. 

The “responsible person” is defined by the Act and is generally the party who controls the premises: for qualifying premises, this is whoever controls the premises for the principal Schedule 1 use; for qualifying events, this is whoever controls the premises for the purposes of the event. 

All in-scope premises and qualifying events must have appropriate public protection procedures (so far as reasonably practicable): evacuation, invacuation (bringing people inside to a place of safety), lockdown and communication, taking account of the premises or event and its immediate vicinity. Enhanced tier premises and qualifying events have additional duties: appropriate public protection measures (monitoring, movement, physical safety and security, and security of information), keeping measures under review, designating a senior individual (where the responsible person is an organisation), and producing and submitting a compliance document to the regulator, keeping it updated (including within 30 days of revisions). 

The Security Industry Authority (SIA) is the regulator with inspection and information-gathering powers.  It has a graduated enforcement toolkit including compliance notices, restriction notices, penalty notices, and - in serious cases - prosecution. Maximum civil penalties are up to £10,000 for most standard tier contraventions.  For enhanced tier premises and qualifying events, penalties can reach up to £18 million or 5% of qualifying worldwide revenue (whichever is higher), plus potential daily penalties. With these responsibilities, the SIA has launched a consultation on its role as regulator with a view to publishing further guidance on its functions.

The guidance emphasises that organisations do not need to buy third-party products or services to comply, and that the Act does not override other legal regimes (for example fire safety, health and safety, licensing and Equality Act duties) which must still be complied with.  It also contains useful examples to help organisations assess their scope. 

The new Martyn’s Law framework will impose baseline counter-terrorism preparedness duties on many public-facing businesses and event organisers across the UK, with significantly tougher requirements (and potential penalties) for larger venues and qualifying events. Businesses should use the statutory guidance now to confirm whether any sites or events fall within scope, identify the “responsible person”, and document proportionate procedures for evacuation, invacuation, lockdown and communication, aligned with existing safety and licensing processes. Larger venues and organisers that may be “enhanced tier” should also start planning the required protective measures, governance (including a designated senior individual) and the compliance documentation that will need to be maintained and submitted to the SIA once the regime is commenced. 

Is your organisation sufficiently cyber secure?

On 15 April 2026, the Department for Science, Innovation and Technology published an open letter to businesses regarding AI cyber threats.  In it the government signals a clear escalation in cyber risk as AI tools make sophisticated attacks cheaper, faster and more accessible to criminals. The letter highlights:

• AI is materially changing the cyber threat landscape. Frontier AI models can now identify vulnerabilities and generate exploit code at speed and scale, lowering the skill barrier for cyber-attacks and accelerating risk for all businesses
• Capabilities are progressing faster than expected. Testing suggests frontier AI cyber capabilities are doubling roughly every four months, increasing the likelihood and sophistication of attacks in the near term
• Businesses of all sizes are targets. AI enabled attackers will focus on organisations with weaker defences, not just government or critical infrastructure
• Basic cyber hygiene remains the first line of defence. Measures such as board level oversight, Cyber Essentials certification, strong password policies, patching and backups remain highly effective against the majority of attacks, including AI enabled ones
• Government support and guidance are available. Businesses are encouraged to follow National Cyber Security Centre guidance, sign up to its free Early Warning Service and use the Cyber Governance Code of Practice and Cyber Action Toolkit as appropriate

The Cyber Security and Resilience Bill will strengthen protection for critical services, and the forthcoming National Cyber Action Plan will look at national security.  In the meantime, organisations should respond now by treating cyber security as core governance rather than an IT issue. Recommendations include:

• brief the board
• review incident response and insurance arrangements
• achieve Cyber Essentials certification (and flow requirements through supply chains)
• align internal practices with National Cyber Security Centre guidance 

Early action will materially reduce risk and disruption as AI enabled cyber threats continue to accelerate.

Commission updates rules on technology transfer agreements

On 16 April 2026, the European Commission adopted the revised Technology Transfer Block Exemption Regulation (TTBER) and updated Guidelines on the application of Article 101 TFEU to technology transfer agreements, following its 2025 review and consultation process.

Technology transfer agreements allow a company to license its technology rights—like patents or copyrights—to another firm for production purposes. The TTBER provides exemptions for technology transfer agreements from EU anti-competitive rules if specific conditions are met. The Guidelines offer businesses advice on interpreting the TTBER and assessing agreements not covered by the exemption.

The revised TTBER introduces targeted clarifications to definitions and to the ‘hardcore restrictions’ (i.e., the most serious competition law infringements that prevent exemption), and extends the grace period for exceeding market share thresholds from one to three years during the life of an agreement. The Guidelines have been expanded to include additional guidance on technology pools, licensing negotiation groups, and the licensing of certain types of data.  The new TTBER and Guidelines were published in the Official Journal on 21 April and enter into force on 1 May 2026 and businesses should now check if their technology licensing agreements comply with these revised EU competition laws.

EU Digital Fitness Check consultation – implications for multinational businesses

The European Commission is assessing how EU digital rules work in practice and where they overlap across data protection, cybersecurity and AI.  As part of its Digital Fitness Check consultation, we submitted a response setting out the main friction points for multinational businesses.

In our latest insight, we highlight key concerns which include inconsistent national interpretation of NIS2, cross-border incident reporting conflicts, and duplicated obligations across overlapping regimes. 

The direction of travel is not deregulation, but clearer and more workable implementation.  For businesses, this is an opportunity to identify duplication, stress-test reporting pathways and clarify internal ownership ahead of any follow-on simplification measures.

In particular, businesses should consider the following actions:

• Map overlap across different regimes: identify where the same systems, datasets, products or processes fall within more than one EU regime
• Test cross-border interaction: examine how obligations interact across Member States, especially where national implementation diverges
• Check scope and reporting triggers: assess whether differences in national rules affect scope, notification thresholds or supervisory touchpoints
• Review incident response processes: test whether overlapping regimes impose different timelines, thresholds or disclosure requirements
• Clarify internal ownership: check whether data, cybersecurity and AI responsibilities are split across teams dealing with the same activity

The objective is not to redesign compliance frameworks but to identify existing duplication, uncertainty or operational tension.

For more on the key practical challenges and regulatory direction see: EU Digital Fitness Check consultation – implications for multinational businesses

With thanks to Maarten Stassen, Nils Müller, Olaf van Haperen, Robbert Santifort, Caroline Lyannaz and Joanna Kulewska.