£18m or 5% of turnover: the Martyn's Law clock after Hyrox

More than 1,000 runners used shared equipment after an elite competitor was allowed to finish a race in Beijing, and the organiser has now refunded entry fees to everyone in the affected waves. If your shopping centre hosts events, that refund is the number that should worry you, because the rule that would have stopped it did not exist until after the race had finished.

Hyrox co-founder Moritz Fürste apologised to everyone affected "directly or indirectly" and accepted that he should have foreseen the incident. The rulebook now permits the withdrawal of a racer on medical grounds where blood, vomit, urine or contamination poses a welfare or contamination risk. That change arrived after the event, not before it. Your venue contracts are written the same way.

The organiser's own statement admits the protocol existed but nobody could apply it

Hyrox said the Beijing incident was an unforeseen situation in which protocols designed for elite competition and mass participation became blurred, creating ambiguity in how they were applied and understood. Read that sentence again as a property director, because it describes almost every event contract I have seen for an atrium, a mall concourse or a car park activation.

The organiser had procedures. The venue had procedures. Neither document said who decides when a participant, a contractor or a member of the public becomes a contamination risk to everyone else in the building. The result was a decision made in real time by people who had no written authority to make it, and a refund bill sent to more than a thousand entrants.

Hyrox China isolated the affected lanes, disinfected them and removed contaminated equipment overnight. That is the right response. It is also the response that costs the most, because it happens after the fact and under scrutiny. The BBC's report on the apology and rule change sets out the sequence: incident, apology, refunds, new rules. Every step after the first one was avoidable.

Your event contract probably names a hirer but not a decision-maker

Most venue hire agreements I have reviewed name the organiser, the dates, the insurance certificate and the deposit. Very few name the person who can stop the event. That gap is the one that matters when a competitor, a stallholder or a performer creates a condition that affects other people in the building.

In a shopping centre the exposure is wider than a race. You have centre management staff, cleaning contractors, security, tenants, their staff, and shoppers who did not consent to anything. An event in the mall concourse puts all of them inside the same risk envelope as the participants. If the organiser's rulebook has no protocol for a contamination event, your venue is relying on a document that was never written for your building.

The new Hyrox rule is specific: a race director may withdraw a racer on medical grounds, and the withdrawal is recorded as Did Not Finish. That is a named role, a defined trigger and a recorded outcome. Your event contracts need the same three elements, written for your building type, before the event licence is signed.

Refunds and deep cleaning are the cheap part of getting this wrong

Hyrox refunded entry costs to participants who started before 2.40pm on the Saturday but had not finished by that time, and to all athletes who departed in heat batches between 2.40pm and 8.40pm. That is a defined group, a defined window and a defined cost. It is also the kind of calculation your finance director will ask you to reproduce if a similar incident happens in a centre you run.

The deeper cost sits in the evidence trail. When an insurer, a local authority environmental health officer or a prospective tenant's solicitor asks what happened, they will want the event risk assessment, the named decision-maker, the trigger conditions and the record of what was done. If the organiser's rulebook had no protocol for the specific event, your venue's own documentation is the only thing that stands between you and an uninsured claim.

Public sector venues have a further layer. The guidance on contract modifications under the Procurement Act 2023 sets out ten grounds on which a public contract may be modified, including urgency and the protection of life. If you operate a council-owned centre and need to change an event contract mid-term because a risk has materialised, that guidance is the framework your legal team will use. Knowing it exists before the incident is the difference between a controlled variation and a breach.

Your next event licence needs a named decision-maker and a written trigger

The Hyrox rule change took effect immediately, on the organiser's own statement. Your equivalent change does not need a global announcement, but it does need to be in writing before your next event licence is signed. That means three things.

There is a deadline attached to this now. The Terrorism (Protection of Premises) Act 2025, Martyn's Law, received Royal Assent on 3 April 2025 with a transition period of at least 24 months, so commencement is expected around spring 2027. Premises and qualifying events where 800 or more people may be present fall into the enhanced tier, where the maximum penalty is £18m or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000; the standard tier maximum is £10,000. Every event contract you sign between now and then runs past that date.

• A named decision-maker in the event contract, with the authority to pause or stop the event on welfare or contamination grounds.
• A defined trigger, written in plain English, that does not rely on the organiser's own rulebook to define what counts as a risk.
• A record of the decision, including the time, the person who made it and what was done, kept with the event file.

For shopping centres, add the shared surfaces. Handrails, seating, play equipment, trolley bays and the equipment the organiser brings in. The Hyrox incident involved shared high-intensity stations and communal equipment, and the venue carpet had to be replaced overnight. Your cleaning specification and your event contract should say who is responsible for each surface, and how quickly that responsibility transfers back to the centre at the end of the event.

If your centre falls within the enhanced tier under the Terrorism (Protection of Premises) Act 2025, the Home Office scope guidance shows how the responsible person is identified for a group of buildings with multiple uses. The same logic applies to event responsibility: one named person, one documented scope, one record. If you cannot point to that person for an event in your building, you have the same gap Hyrox admitted to.

Your 60-second self-check

• Does your current event contract name the person who can stop the event on welfare or contamination grounds, and have you confirmed they know they hold that authority?
• Could you produce the event risk assessment and the post-event cleaning record for the last event held in your centre, today, without asking the organiser?
• Does your venue's own documentation define what happens when a participant or performer creates a contamination risk to other building users, or does it rely on the organiser's rulebook?

Three yes answers take a minute. The audit or the renewal conversation they prepare you for takes considerably longer, and the free 5-minute Director's Risk Check at hermanwa.com/risk-check gives you a control score and a board-ready briefing on where your portfolio's event exposure actually sits. You can send it to a colleague to answer if the event files live with them.

Herman's verdict

The rule that would have prevented the refunds was written after the refunds were paid, and that is the only fact in this story that matters to a venue operator. Your event contract is either a document that names a decision-maker and a trigger, or it is a document that names a hirer and a deposit. The second one is cheaper to sign and considerably more expensive to rely on.

— Herman