For insurers and brokers

You sent them the guidance. Who actually acted on it?

Most brokers with hospitality or leisure on the book have already emailed clients about Martyn's Law. Almost none of them can tell you what happened next, and from spring 2027 that gap stops being an administrative detail.

Why this is landing on brokers

Terrorism risk at publicly accessible premises used to be an insurance question, answered with a policy wording. The Terrorism (Protection of Premises) Act 2025 turns it into a governance question, answered with evidence, and the trade press has spent 2026 pointing out that broker advice on it now sits inside the liability frame rather than beside it.

That leaves a broker in an awkward position. Say nothing and you look absent on a risk your client has just been made legally responsible for. Say something specific and you have given advice you may be held to. Sending the ProtectUK link is the safe middle, and everybody has already done it.

How it works

The commercial shape is deliberately dull, because dull is what survives a compliance review.

• You licence it for a defined slice of the book. A segment you choose, priced on the number of policyholder premises covered, paid annually by you.
• Policyholders are invited in and pay nothing. They see it as something their broker arranged, not as a product they have been sold. That is the whole reason take-up is any good.
• They keep their own records. Procedures, ACT Awareness completions, drill and review logs, and an export they can hand to an inspector.
• You see the aggregate. How much of the funded book has procedures in place, how far training has got, and where nothing has moved since sign-up.

What you can actually see

The portfolio view is deliberately narrow. It answers the questions an underwriter or an account executive would ask at renewal, and nothing beyond them.

You can see	You cannot see
Share of funded premises with documented procedures	The content of any policyholder's procedures
Training completion rates across the book	Named individual staff records
When each site last logged a drill or review	Any assessment of whether what they did was adequate
Which sign-ups have never been opened	Anything at all from premises you do not fund

Policyholders are told at sign-up exactly what the funder can see. Nothing is shared quietly, because a broker who is found to have been passing client data around has a much larger problem than Martyn's Law.

What it does not do

Worth stating plainly, because the wrong claim here would create the exposure it is supposed to remove.

• It does not make any policyholder compliant, and no supplier can. The responsible person under the Act is still your client.
• It is not endorsed by the Home Office or the SIA. No such endorsement exists for any product.
• It does not assess premises, rate risk or feed an underwriting decision on its own.
• It issues no certificate, because Martyn's Law has no certificate to issue.

What it costs

Insurer and broker licences are priced by arrangement, on the number of policyholder premises covered rather than on the size of the book. A pilot across a few hundred premises is a different conversation from a scheme covering several thousand, and both are worth having.

For context, the operator pricing on the main page runs from £2,400 a year for a small group to £18,000 for a large operator. Funded book pricing sits below the equivalent per-premises rate, because you are removing the sales cost of reaching those premises one at a time.

Questions brokers ask

Does this make us look like we are advising on their security?

No, and the wording matters. You are funding a record keeping tool, in the same way many brokers already fund risk management portals, health and safety templates or driver training. Musterlog holds what your client did. It never tells them whether it was enough.

What if a funded policyholder is prosecuted anyway?

Then the record exists, which is better for everyone than the alternative. Musterlog does not claim to prevent enforcement action. It means your client can show what was in place and when, rather than reconstructing it after the fact.

Can we white label it?

Co-branding on the policyholder-facing side is straightforward and expected. Full white labelling is not, because a policyholder should be able to see who holds their data and on what terms.

Our clients are mostly single-site. Is this still worth it?

For the policyholder individually, sometimes not, and we would say so. The free ProtectUK templates are genuinely good. The value to you is the aggregate: one funded scheme gives you a preparedness picture across hundreds of premises that would otherwise take a survey to assemble.

Who holds the data?

Musterlog Ltd, as processor for the policyholder. The policyholder is the controller of their own records. The funder receives aggregate figures only, on terms the policyholder sees before they start. Musterlog Ltd is in formation and its Information Commissioner's Office registration will be in place before any policyholder data is held.