Fire Risk Assessment Law for UK Businesses

Fire Risk Assessment for Businesses in England: What the Law Requires in 2026

There is a version of this topic that gets written about endlessly online.

It involves lengthy extracts from government documents, vague reassurances, and the kind of language that makes your eyes glaze over somewhere around paragraph three.

This is not that version.

If you run a business from commercial premises in England and you are responsible for fire safety, this guide tells you plainly what the law requires of you, what has changed recently, including legislation coming into force this April, and what the real consequences are of getting it wrong.

No filler. No scaremongering. Just the stuff that actually matters.

Is a Fire Risk Assessment Actually a Legal Requirement?

Yes. Unambiguously.

The Regulatory Reform (Fire Safety) Order 2005 is the main piece of legislation governing fire safety in buildings in England and Wales. It applies to all workplaces and the common parts of buildings containing two or more domestic premises. It places legal duties on anyone in control of these premises to carry out and record a fire risk assessment and put in place and maintain general fire precautions.

That covers offices, warehouses, retail units, workshops, restaurants, care homes, schools, essentially any non-domestic premises you can think of.

A suitable and sufficient fire risk assessment must be completed and fully recorded, regardless of building size or number of employees. This requirement was strengthened under changes introduced via the Building Safety Act 2022.

If your fire risk assessment exists only in your head, or was never written down, it is not legally compliant. Full stop.

Who Is the "Responsible Person"?

The "responsible person" is whoever has control of the premises.

This often includes employers, building owners, landlords, and facilities managers. In multi-occupancy buildings, responsibilities may overlap and must be clearly defined and coordinated between parties.

Here is the bit people frequently miss. Even if you appoint a professional assessor to carry out the fire risk assessment on your behalf, the legal duty remains with you personally.

If the assessment turns out to be inadequate, the consequences land on the responsible person, not the assessor who wrote it.

That is not a technicality. It is a meaningful distinction that business owners regularly discover the hard way.

New Legislation Coming Into Force April 2026

Before getting into the five steps, it is worth flagging something genuinely new and timely.

New legislation designed to improve evacuation arrangements for residents who could face challenges leaving their building in the event of a fire comes into force in England on 6 April 2026. The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 introduce a new process called Residential Personal Emergency Evacuation Plans (RPEEPs). They apply to residential buildings in England that are 18 metres or 7 storeys or higher, or over 11 metres where a simultaneous evacuation strategy is in place, and place new legal duties on responsible persons, usually building owners, landlords, or managers.

Under the new regulations, the responsible person must take steps to identify residents who might not be able to leave the building without help if a fire occurs. Where such residents are identified, they must be offered a person-centred fire risk assessment. The responsible person must also develop and maintain a building-wide emergency evacuation plan.

If you manage or own a qualifying residential building, this is not something you can sit on. The deadline is here.

For commercial premises, the broader direction of travel is equally clear: the expectation that responsible persons make specific, documented evacuation provision for anyone who may need assistance has been significantly strengthened. Vague references to "informing reception" are no longer considered adequate by fire inspectors.

The Five Steps of a Fire Risk Assessment

The Fire Safety Order structures the fire risk assessment process around five key steps. Here is what each of them means in practice, without the jargon.

Step 1: Identify the Fire Hazards

Every fire needs three things: a source of ignition, a source of fuel, and oxygen. Step one is about understanding where all three exist in your premises.

Ignition sources include electrical equipment and wiring, heating appliances, cooking equipment, and (increasingly prominent in 2026) lithium-ion batteries in laptops, phones, e-bikes, and power tools. Battery thermal runaway fires are a rapidly growing risk category that many older assessments simply do not address.

Fuel sources include anything combustible: paper, cardboard, packaging materials, flammable liquids, and plastics. In a warehouse the fuel load can be enormous. In an office it is more modest but still significant.

Oxygen is everywhere, of course. But ventilation systems, air conditioning, and compressed gas cylinders can all increase the available oxygen in specific areas.

The goal of step one is not just listing what is present. It is understanding how hazards could realistically combine in your specific premises.

Step 2: Identify the People at Risk

This step is not a headcount. It is about understanding who is in your building, whether anyone faces particular risk, and what specific arrangements might be needed to protect them.

Consider employees in higher-risk areas, lone workers, people on site outside normal hours, visitors unfamiliar with the building, contractors, delivery personnel, and anyone with a disability or mobility impairment who may need additional help to evacuate.

A fire risk assessment must be reviewed immediately if changes occur to the number or characteristics of occupants, including where vulnerable individuals are newly identified.

Step 3: Evaluate, Remove, or Reduce the Risks

This is where genuine expertise makes the biggest difference.

Having identified the hazards and the people at risk, step three requires you to evaluate how serious each risk is and decide what to do about it. Some risks can be removed entirely. Others can be reduced through changes to processes, storage arrangements, or maintenance schedules. All remaining risks need appropriate fire precautions in place.

Fire precautions are the measures that protect people once a fire has started, your alarm and detection system, means of escape, emergency lighting, fire-fighting equipment, and evacuation procedures.

Fire risk assessments should be reviewed when fire safety equipment changes, including when a new alarm system or extinguishers are installed, or when escape routes are altered.

The risk assessment and the fire safety systems in your building are not separate considerations. One should directly inform the other.

Step 4: Record Your Findings and Prepare an Emergency Plan

A suitable and sufficient fire risk assessment must be fully recorded, regardless of building size or number of employees. Failing to adequately document findings can itself be treated as a breach of the law. You must document how fire safety is planned, controlled, monitored, and reviewed, beyond just the risk assessment findings.

Beyond the document itself, you need an emergency plan. This sets out what people should do when a fire is discovered, how evacuation should work, the roles of any fire wardens, how the fire service is called, and any specific arrangements for people who need assistance.

Staff training sits within this step too. Every employee should receive fire safety instruction on induction and at regular intervals thereafter. Evacuation drills should be carried out at least annually for most commercial premises.

Step 5: Review and Update Regularly

A fire risk assessment is not a one-off task.

UK fire safety legislation does not define a specific review period. Instead it requires assessments to be reviewed regularly and updated whenever they are no longer valid.

In practice, a formal review at least annually is what enforcing authorities and insurers expect as a minimum. More importantly, certain events should trigger an immediate review regardless of when the last one was carried out.

A fire risk assessment must be reviewed straight away following building alterations, refurbishments, or layout changes, and also following any fire incident, near miss, or change in occupancy.

An assessment completed two years ago and never revisited is not compliance. It is a liability in waiting.

Who Can Carry Out a Fire Risk Assessment?

The law requires the assessment to be carried out by a "competent person." There are no prescribed qualifications, the test is whether the person has sufficient training, experience, and knowledge to carry out the assessment properly for the type of premises involved.

A competent assessor is someone who understands fire behaviour, relevant legislation, and the specific hazards associated with your type of building.

For small, low-risk premises with a straightforward layout, an informed business owner can carry out their own assessment using government guidance. For larger, more complex, or higher-risk environments, appointing a professional assessor is the more defensible choice.

The recognised standard for professional fire risk assessors working on non-housing premises, offices, shops, factories, schools, and restaurants, is PAS 79-1:2020. For housing assessments, the relevant standard is BS 9792:2025.

When appointing a professional, look for assessors registered with BAFE or holding recognised qualifications such as the IFE Level 4 Certificate. A good assessor will visit your premises, ask detailed questions, and produce a document that genuinely reflects the hazards and risks specific to your building. Anyone who quotes without visiting, or delivers a completed document within the hour, should raise immediate concern.

Common Mistakes That Leave Businesses Exposed

Here are the failures fire inspectors encounter most frequently, and that can leave a business legally exposed even when the owner believes they are compliant.

Using a generic template without tailoring it.

A template completed without a physical site visit is very unlikely to be suitable and sufficient. It is also straightforward for an inspector to identify.

Not reviewing after changes.

A reconfigured warehouse, a new shift pattern, an expanded kitchen operation, any significant change should trigger a review. A surprising number of businesses simply do not do this.

Identifying actions but not completing them.

An assessment that flags a need to upgrade detection or replace a faulty fire door, then gets filed away without follow-through, demonstrates awareness of a risk and a failure to act. That is not a position you want to be explaining to a fire inspector.

Inadequate consideration of people who need help evacuating.

Documented, specific plans for individuals who may need assistance are increasingly what fire inspectors expect. A generic note does not meet the standard.

Treating it as a one-off exercise.

With enforcement increasing across the UK, 2026 is shaping up to be a year when businesses can no longer afford to overlook their fire safety responsibilities.

What Happens If You Get It Wrong?

Failing to carry out a fire risk assessment, or having an inadequate one, is a criminal offence. Fire and rescue authorities have significant powers, including enforcement notices requiring you to remedy failings within a set timeframe, prohibition notices restricting or preventing use of premises where there is serious risk to life, prosecution leading to unlimited fines, and for the most serious offences, up to two years in prison.

The insurance implications are equally serious.

If a fire occurs and your insurer discovers that no adequate fire risk assessment was in place, they can void your claim entirely, leaving you personally liable for all losses. In one real-world case, a Hampshire company and its former director were ordered to pay more than £100,000 following an insufficient fire risk assessment.

For a small or medium business recovering from a serious fire, an invalidated insurance claim is almost invariably the end of the business.

The Relationship Between Your Fire Risk Assessment and Your Fire Alarm System

This point is frequently under appreciated, and it matters directly for the fire safety systems in your building.

Your fire alarm system must comply with British Standard BS 5839-1, which covers design, installation, commissioning, and ongoing maintenance.

The type and configuration of that system should be informed by your fire risk assessment. The category of detection, the placement of detectors, and the response the system is capable of should all reflect the hazards and occupancy identified in the assessment.

A fire alarm installed without reference to a current fire risk assessment may not be appropriate for the actual risks in your premises, even if it is technically compliant with the standard it was installed under.

The two documents - your fire risk assessment and your fire alarm commissioning certificate should be consistent with each other. If one changes, the other should be reviewed.

A Practical Starting Point

If you do not have a current, written, site-specific fire risk assessment in place, that is where to start. Today, not next quarter.

If you have one but it has not been reviewed in the last twelve months, or since anything significant changed in your premises, it is overdue.

If your fire alarm system, extinguisher provision, emergency lighting, or evacuation procedures have not been checked against your assessment findings, that alignment is worth examining now.

A fire risk assessment is not simply about satisfying a legal requirement. It is about protecting people, preserving property, and safeguarding your business future.

Getting that right is what separates a business that is genuinely protected from one that just has the paperwork.

FIDEC Security Solutions Ltd installs and maintains commercial fire alarm systems for businesses across England. If you have questions about how your fire alarm specification relates to your fire risk assessment, we are happy to give you a straight answer.