From Piper Alpha to Martyn’s Law: Why We Never Learn in Time
What a decade‑long wait for Martyn’s Law reveals about our politics, our priorities and our duty of care.
In May 2017, 22 people were murdered at Manchester Arena. Nearly a decade on, the law that bears one victim’s name “Martyn’s Law”, has only just made it onto the statute book, and it will be the end of this decade before most venues truly feel it in their day‑to‑day operations.
For those of us who work in risk, security and resilience, that timeline doesn’t come as a surprise. It’s disturbingly familiar. We saw the same long arc after Piper Alpha in 1988, after Hillsborough in 1989, and after Grenfell in 2017.
By the time the inquiries finish, the Bills are drafted, and the Acts are commenced, the world that produced the original disaster has already moved on. The regulations that eventually land are often hardening yesterday’s risk more than tomorrow’s.
This essay is my attempt to unpack why that keeps happening – and what it tells us about how we really treat safety.
Four disasters, four slow journeys to reform
Piper Alpha – a new regime, years late
On 6 July 1988, the Piper Alpha platform exploded in the North Sea, killing 167 workers. It remains the UK’s worst offshore disaster.
The public inquiry that followed exposed systemic failures in permit‑to‑work, maintenance, communication, and emergency response. It recommended a fundamental shift to a goal‑setting safety case regime overseen by the Health and Safety Executive, replacing detailed prescriptive rules with a requirement on duty holders to demonstrate that they had reduced risks “so far as is reasonably practicable”.
That shift was profound. Over time, it reshaped offshore safety and influenced how we regulate other high‑hazard sectors. In many ways it was a step change in how we think about risk.
But it did not happen quickly. The core legislation arrived several years after the explosion. The new regulations took time to draft and consult on. Then came the slow, painstaking process of assessing every installation, agreeing safety cases, and enforcing them in practice.
From the night of the disaster to a fully embedded new regime, you are looking at close to a decade.
Hillsborough – safety lessons fast, truth and candour painfully slow
On 15 April 1989, 97 people died as a result of the crush at Hillsborough. The interim Taylor Report, published the same year, drove rapid physical reforms in English football: all‑seater stadia in the top divisions, changes to perimeter fencing, and stronger oversight of capacity and crowd management.
In that sense, the “engineering” lessons were implemented relatively quickly.
But the deeper issues around truth, accountability and institutional candour have taken decades to confront. Families spent years fighting official narratives that blamed fans rather than systemic failures. They campaigned for a statutory “Hillsborough Law” to create a legal duty of candour on public authorities and to ensure bereaved families have access to the same quality of legal representation as the state.
More than thirty years on, those reforms are still being argued over and only partially delivered. The legal and cultural shifts have lagged so far behind the physical changes that, for many families, justice has always felt out of reach.
Hillsborough is a split‑screen story: the concrete, engineering‑centred fixes came relatively fast; the transparency and power‑balance issues have moved at a glacial pace.
Grenfell – building safety by the decade
Grenfell Tower burned in June 2017. Seventy‑two people died. The images are now part of our collective memory: fire racing up a facade, people signalling for help at windows, a community watching their neighbours die in real time.
The public inquiry has unfolded in phases over years, exposing a web of failure, in regulation, in building control, in product testing, in landlord oversight. An independent review of building regulations and fire safety concluded that the system for high‑rise residential buildings was simply “not fit for purpose”.
We have seen major legislative responses: new fire safety law clarifying responsibilities, and a Building Safety Act that creates a dedicated regulator and a new regime for higher‑risk buildings. On paper, this is a fundamental reset of how we manage building safety.
But again, look at the timeline. The fire was 2017. The core legislation arrived in 2021 and 2022. Much of the detailed secondary legislation, guidance, and regulator capacity is still being built out. Government’s own implementation plans push key milestones into the late 2020s.
In the meantime, thousands of people continue to live in buildings with cladding and compartmentation issues everyone now understands all too well. The arc from catastrophe to fully functioning new system is once again close to a decade.
Manchester Arena and Martyn’s Law – hardening yesterday’s targets
The Manchester Arena bombing took place on 22 May 2017.
In the years that followed, Martyn Hett’s mother, Figen Murray, became the driving force behind what began as the “Protect Duty” and is now widely known as Martyn’s Law. Her argument was straightforward, if you are responsible for publicly accessible venues where people gather, you should have a clear legal duty to consider terrorism risk and take proportionate steps to protect the public.
The path from that clear idea to actual law has been anything but straightforward.
We had consultation on a Protect Duty. Then a long period of apparent stasis. Then a draft Terrorism (Protection of Premises) Bill. Then yet another consultation on how to handle smaller venues. Political bandwidth was eaten up by Brexit, by a pandemic, by leadership changes.
The Act finally made it onto the statute book in 2025. But buried in the fine print is another long lead‑in: time to build a regulator, publish detailed guidance, and give venues a chance to prepare.
Most serious commentary converges on the same conclusion, for the average venue, Martyn’s Law becomes a real operational duty closer to the ten‑year anniversary of Manchester Arena than to the attack itself.
And that’s before you look at how the law was watered down along the way: higher thresholds, lighter “standard tier” duties, and a design that leans heavily on existing regimes and voluntary guidance rather than driving a truly new mindset.
By the time the law arrives, the threat has moved
From a risk perspective, long lags are a problem because hazards and threats are not static. They adapt to our defences, to technology, to politics, to culture.
Nowhere is this more obvious than in the terrorism space.
The threat picture that drove early thinking on Martyn’s Law was dominated by large‑crowd, high‑impact attacks against obvious targets: arenas, stadiums, big transport hubs. That danger hasn’t gone away, but we have seen a sustained shift towards fast, low‑tech, low‑signature attacks by lone actors or small cells. The targets are often softer and smaller: faith settings, schools, community spaces, open‑air gatherings and markets.
Martyn’s Law, as finally framed, is built around:
Fixed premises that can host 200 or more people at the same time.
Formal events where 800 or more people are expected at once, in a clearly bounded space with controlled entry.
A “standard” tier that is deliberately described as low‑ or no‑cost, focused on procedures, and explicitly not about forcing new physical measures onto smaller venues.
That will certainly improve preparedness in part of the estate: big retail, arenas, major visitor attractions, the larger end of hospitality, and formal events with tickets and fences.
But the threat has already bled into spaces that sit below or outside those definitions. A small mosque or synagogue with a regular congregation well under 200. A youth club, a small independent school, a community hall. A town‑centre Christmas market spread across public streets with no ticketing or perimeter. A vigil or protest where hundreds gather at short notice.
From the attacker’s point of view, the attraction of those targets is obvious. From the law’s point of view, they are often grey areas or beyond scope.
That mis‑match – between where the law bites and where the risk is evolving – is the heart of my discomfort with how long we take to move from “we know what went wrong” to “we’ve made sure it’s harder to happen again”.
Why do we keep learning so slowly?
Looking across Piper Alpha, Hillsborough, Grenfell and Martyn’s Law, four themes stand out.
1. Political bandwidth and competing crises
Reform has to fight for oxygen.
Piper Alpha’s legacy was shaped against the backdrop of wider debates about deregulation and the future of the North Sea. Grenfell has had to compete for attention with housing policy, austerity, and the politics of who pays for remediation. Martyn’s Law’s journey has been overshadowed by Brexit, Covid and rapid changes of political leadership.
It’s not that ministers and officials don’t care. It’s that slow‑burn, systemic risks keep getting pushed off the top of the pile by the crisis of the day. From the outside, what looks like careful prioritisation often feels like strategic amnesia.
2. Fear of “burden on business”
In every one of these domains, there has been a constant drumbeat of concern about cost and “red tape”.
In Martyn’s Law, you can trace the fingerprints of that concern in the way the standard tier was softened, no mandated terrorism‑training product, no compulsory standard form, explicit assurances that no one would be forced into expensive physical upgrades.
Post‑Grenfell, similar arguments appear around who pays for remedial works and how far new duties should bite into existing stock versus new builds.
There is a legitimate debate to be had about proportionality. Nobody wants poorly designed regulation that crushes small organisations or stifles community spaces. But when “burden on business” becomes the primary lens, rather than one factor among many, the gravitational pull is always towards the minimum viable change that can be pushed through.
3. Inquiry culture vs adaptive risk
The UK instinctively responds to catastrophe with a public inquiry. That instinct has its virtues: thoroughness, a public record, some measure of catharsis.
But inquiries are inherently backward‑looking. They examine a particular chain of events in a particular context. Their recommendations are framed around what was known, technically feasible and politically thinkable at the time.
By the time those recommendations are translated into detailed policy, drafted as legislation, fought over in Parliament, and then turned into regulations and guidance, the world has moved. Technology has changed. Markets have evolved. Adversaries have read the same reports.
So we build very precise systems designed to prevent a recurrence of that disaster under those conditions, and then we try to stretch those systems to cover a risk landscape that has already shifted.
4. Fragmented responsibility and diffused accountability
In all these cases, responsibility is spread across many hands.
Offshore oil and gas involved operators, contractors, regulators and government departments. Football crowd safety sat across clubs, police, local authorities and governing bodies. Building safety spans landlords, freeholders, managing agents, architects, contractors, building control, fire services and central government. Public‑venue terrorism risk is shared between venue operators, local authorities, private security, police and multiple central bodies.
Where responsibility is fragmented, reform is harder and slower. It is too easy for each party to argue that someone else should move first, pay more, or accept more liability. Negotiating those boundaries takes time. In the meantime, the people exposed to the risk – platform workers, football fans, residents, concert‑goers, are stuck in the middle.
What this tells us – and what we can do about it
It would be easy to throw up our hands and say: “That’s just how it is. The system is slow. Politics is messy. We will always regulate the last disaster.”
I don’t think that’s good enough. And I don’t think it’s the only way forward.
1. Treat law as a floor, not a ceiling
Piper Alpha showed that goal‑setting regimes can work when there is a shared bias towards safety. The safety case approach constantly forces the question: “What would a reasonably practicable safe system look like here?” – not “what is the bare minimum the rules say I must do?”.
Martyn’s Law can be read in the same way. For venues in scope, it should be the floor, not the ceiling. For venues that fall just below a threshold or sit in a grey area, it should act as a benchmark for what “good” looks like, even if the letter of the law doesn’t yet compel them.
2. Change the default question
Organisations still default to: “What does the law require me to do?” The more useful question is: “Given our risks, our people and our context, what is reasonably practicable, and how will we justify our choices when they are scrutinised later?”
The 200‑ and 800‑person thresholds in Martyn’s Law are legal constructs. They are not magical safety numbers. The threat doesn’t materialise at 201 and disappear at 199.
If you run a 150‑person youth venue, a small faith setting, a local fair, a school or college, you may not be squarely in scope of Martyn’s Law. But you are certainly in scope of a deeper duty of care. The absence of a statutory obligation does not equate to the absence of risk.
3. Practitioners have to move faster than Parliament
The law will almost always arrive late. That doesn’t mean it’s useless, but it does mean we cannot afford to wait for it before we act.
Most of the important safety decisions are made in design reviews, procurement choices, staffing models, training budgets, local partnership meetings and yes, sometimes in quick WhatsApp exchanges on a busy day. Those are the moments where we can choose to integrate lessons across domains – to apply Grenfell thinking to smaller residential blocks, to apply Martyn’s Law thinking to sub‑threshold venues, to apply offshore “safety case” thinking to new types of infrastructure.
Those of us in risk, safety and resilience have to be the people who shorten the lag: who notice emerging tactics, who join dots across sectors, who argue for doing the obvious, proportionate things now rather than after the next inquiry.
Closing thought
When I look across Piper Alpha, Hillsborough, Grenfell and Martyn’s Law, what depresses me is not that we fail to learn. We do learn, eventually. The safety case regime transformed offshore operations. Football grounds are safer than they were in 1989. Building safety is being fundamentally re‑set. Martyn’s Law will almost certainly save lives in some future incident.
What troubles me is the time it takes us to admit what we already know, to agree on a baseline of “good enough”, and to hard‑wire that into how we build, operate and govern, while hazards and threats keep moving.
We can’t fix the whole system alone. But in our own spheres of influence, we can refuse to treat the law as the final word. We can choose to act as if the next inquiry is already being written, and ask ourselves now:
When they look back at this moment, will they say we did what was reasonably practicable – or that we waited to be told?