Fire Risk Assessment Law for UK Businesses

Key takeaway

A fire risk assessment is a live control document, not a form to file away. It should identify the hazards, people at risk, emergency plan, maintenance actions and review triggers, then drive the fire alarm, extinguishers, escape routes, training and any remedial work.

If you are responsible for fire safety at commercial premises in England or Wales, you need a written fire risk assessment that reflects the building and how people use it. This guide explains the core duty, the review process and the separate residential evacuation rules that took effect in England in April 2026.

Is a Fire Risk Assessment Actually a Legal Requirement?

Yes. Unambiguously.

The Regulatory Reform (Fire Safety) Order 2005 is the main piece of legislation governing fire safety in buildings in England and Wales. It applies to all workplaces and the common parts of buildings containing two or more domestic premises. It places legal duties on anyone in control of these premises to carry out and record a fire risk assessment and put in place and maintain general fire precautions.

That covers offices, warehouses, retail units, workshops, restaurants, care homes, schools: essentially any non-domestic premises you can think of.

Who Is the "Responsible Person"?

The "responsible person" is whoever has control of the premises: this often includes employers, building owners, landlords, and facilities managers. In multi-occupancy buildings, responsibilities may overlap and must be clearly defined and coordinated between parties.

Appointing an assessor does not transfer the responsible person's duties under the Fire Safety Order. The responsible person should check that the assessor is competent and act on the findings.

What changed in April 2026?

The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 came into force on 6 April 2026. They apply in England to buildings with at least two domestic premises that are at least 18 metres high or have at least seven storeys. They also cover buildings over 11 metres where a simultaneous evacuation strategy is in place. The regulations contain detailed scope and exceptions that responsible persons should check for each building.

Under the new regulations, the responsible person must take steps to identify residents who might not be able to leave the building without help in a fire. Where such residents are identified, they must be offered a person-centred fire risk assessment, and the responsible person must develop and maintain a building-wide emergency evacuation plan.

These regulations concern residential buildings. They do not create a new general RPEEP duty for every commercial workplace. Existing fire risk assessment and emergency planning duties still require responsible persons to consider people who may need help to evacuate.

The Five Steps of a Fire Risk Assessment

Step 1: Identify the Fire Hazards

Every fire needs three things: a source of ignition, a source of fuel, and oxygen. Step one is about understanding where all three exist in your premises.

• Ignition sources: Electrical equipment and wiring, heating appliances, cooking equipment, and lithium-ion batteries in laptops, phones, e-bikes, and power tools. The assessment should cover battery charging and storage where these activities take place.
• Fuel sources: Anything combustible: paper, cardboard, packaging materials, flammable liquids, and plastics.
• Oxygen: Everywhere, but ventilation systems, air conditioning, and compressed gas cylinders can all increase the available oxygen in specific areas.

Step 2: Identify the People at Risk

This step is not a headcount. It is about understanding who is in your building and whether anyone faces particular risk. Consider employees in higher-risk areas, lone workers, people on site outside normal hours, visitors unfamiliar with the building, contractors, delivery personnel, and anyone with a disability or mobility impairment who may need additional help to evacuate.

Step 3: Evaluate, Remove, or Reduce the Risks

Having identified the hazards and the people at risk, step three requires you to evaluate how serious each risk is and decide what to do about it. Some risks can be removed entirely. Others can be reduced through changes to processes, storage arrangements, or maintenance schedules.

Fire precautions are the measures that protect people once a fire has started, including your alarm and detection system, means of escape, emergency lighting, fire-fighting equipment, and evacuation procedures. The risk assessment and the fire safety systems in your building are not separate considerations. One should directly inform the other.

Step 4: Record Your Findings and Prepare an Emergency Plan

A suitable and sufficient fire risk assessment must be fully recorded. Failing to adequately document findings can itself be treated as a breach of the law. You must document how fire safety is planned, controlled, monitored, and reviewed: beyond just the risk assessment findings.

Beyond the document itself, you need an emergency plan setting out what people should do when a fire is discovered, how evacuation should work, the roles of fire wardens, how the fire service is called, and specific arrangements for people who need assistance.

Staff training sits within this step too. Employees need suitable fire safety instruction, and the emergency plan should be tested often enough for the risks and use of the premises. GOV.UK guidance should be checked for the building type.

Step 5: Review and Update Regularly

A fire risk assessment is not a one-off task. UK fire safety legislation does not define a specific review period: it requires assessments to be reviewed regularly and updated whenever they are no longer valid.

Many organisations schedule an annual review, but the law does not set that interval. Review sooner if the assessment may no longer be valid, including after these changes:

• Following building alterations, refurbishments, or layout changes
• Following any fire incident or near miss
• Following a change in occupancy or the identification of new vulnerable individuals
• When fire safety equipment changes, including when a new alarm system or extinguishers are installed

Who Can Carry Out a Fire Risk Assessment?

The law requires the assessment to be carried out by a "competent person." There are no prescribed qualifications. The test is whether the person has sufficient training, experience, and knowledge for the type of premises involved.

For small, low-risk premises, an informed business owner can carry out their own assessment using government guidance. For larger, more complex, or higher-risk environments, appointing a professional assessor is the more defensible choice.

PAS 79-1:2020 provides a methodology for fire risk assessments in premises other than housing. It is not a legal qualification. When appointing an assessor, ask for evidence of competence, relevant experience, insurance and any third-party registration they rely on. Check the register and its scope directly.

Common Mistakes That Leave Businesses Exposed

• Using a generic template without tailoring it. A template completed without a physical site visit is very unlikely to be suitable and sufficient, and straightforward for an inspector to identify.
• Not reviewing after changes. A reconfigured warehouse, a new shift pattern, or an expanded kitchen operation should trigger a review.
• Identifying actions but not completing them. An assessment that flags a need to upgrade detection then gets filed away without follow-through demonstrates awareness of a risk and a failure to act.
• Inadequate consideration of people who need help evacuating. Documented, specific plans for individuals who may need assistance are what fire inspectors increasingly expect.
• Treating it as a one-off exercise. Review the assessment when the premises, work or people at risk change, and after a fire or near miss.

If your premises needs a fire alarm system that reflects the risks identified in the assessment, FIDEC installs and maintains commercial fire alarm systems. Contact FIDEC Security Solutions, call 0333 3662 007, or email info@fidecss.co.uk.

Questions people ask