Fire Risk Assessment Law for UK Businesses

There is a version of this topic that gets written about endlessly online. It involves lengthy extracts from government documents, vague reassurances, and the kind of language that makes your eyes glaze over somewhere around paragraph three.

This is not that version.

If you run a business from commercial premises in England and you are responsible for fire safety, this guide tells you plainly what the law requires of you, what has changed recently, including legislation coming into force this April, and what the real consequences are of getting it wrong.

Is a Fire Risk Assessment Actually a Legal Requirement?

Yes. Unambiguously.

The Regulatory Reform (Fire Safety) Order 2005 is the main piece of legislation governing fire safety in buildings in England and Wales. It applies to all workplaces and the common parts of buildings containing two or more domestic premises. It places legal duties on anyone in control of these premises to carry out and record a fire risk assessment and put in place and maintain general fire precautions.

That covers offices, warehouses, retail units, workshops, restaurants, care homes, schools: essentially any non-domestic premises you can think of.

Who Is the "Responsible Person"?

The "responsible person" is whoever has control of the premises: this often includes employers, building owners, landlords, and facilities managers. In multi-occupancy buildings, responsibilities may overlap and must be clearly defined and coordinated between parties.

Here is the bit people frequently miss. Even if you appoint a professional assessor to carry out the fire risk assessment on your behalf, the legal duty remains with you personally. If the assessment turns out to be inadequate, the consequences land on the responsible person, not the assessor who wrote it.

New Legislation Coming Into Force April 2026

The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 come into force on 6 April 2026. They introduce a new process called Residential Personal Emergency Evacuation Plans (RPEEPs) for residential buildings 18 metres or 7 storeys or higher.

Under the new regulations, the responsible person must take steps to identify residents who might not be able to leave the building without help in a fire. Where such residents are identified, they must be offered a person-centred fire risk assessment, and the responsible person must develop and maintain a building-wide emergency evacuation plan.

For commercial premises, the broader direction is equally clear: the expectation that responsible persons make specific, documented evacuation provision for anyone who may need assistance has been significantly strengthened.

The Five Steps of a Fire Risk Assessment

Step 1: Identify the Fire Hazards

Every fire needs three things: a source of ignition, a source of fuel, and oxygen. Step one is about understanding where all three exist in your premises.

• Ignition sources: Electrical equipment and wiring, heating appliances, cooking equipment, and lithium-ion batteries in laptops, phones, e-bikes, and power tools. Battery thermal runaway fires are a rapidly growing risk category that many older assessments simply do not address.
• Fuel sources: Anything combustible: paper, cardboard, packaging materials, flammable liquids, and plastics.
• Oxygen: Everywhere, but ventilation systems, air conditioning, and compressed gas cylinders can all increase the available oxygen in specific areas.

Step 2: Identify the People at Risk

This step is not a headcount. It is about understanding who is in your building and whether anyone faces particular risk. Consider employees in higher-risk areas, lone workers, people on site outside normal hours, visitors unfamiliar with the building, contractors, delivery personnel, and anyone with a disability or mobility impairment who may need additional help to evacuate.

Step 3: Evaluate, Remove, or Reduce the Risks

Having identified the hazards and the people at risk, step three requires you to evaluate how serious each risk is and decide what to do about it. Some risks can be removed entirely. Others can be reduced through changes to processes, storage arrangements, or maintenance schedules.

Fire precautions are the measures that protect people once a fire has started, including your alarm and detection system, means of escape, emergency lighting, fire-fighting equipment, and evacuation procedures. The risk assessment and the fire safety systems in your building are not separate considerations. One should directly inform the other.

Step 4: Record Your Findings and Prepare an Emergency Plan

A suitable and sufficient fire risk assessment must be fully recorded. Failing to adequately document findings can itself be treated as a breach of the law. You must document how fire safety is planned, controlled, monitored, and reviewed: beyond just the risk assessment findings.

Beyond the document itself, you need an emergency plan setting out what people should do when a fire is discovered, how evacuation should work, the roles of fire wardens, how the fire service is called, and specific arrangements for people who need assistance.

Staff training sits within this step too. Every employee should receive fire safety instruction on induction and at regular intervals thereafter. Evacuation drills should be carried out at least annually for most commercial premises.

Step 5: Review and Update Regularly

A fire risk assessment is not a one-off task. UK fire safety legislation does not define a specific review period: it requires assessments to be reviewed regularly and updated whenever they are no longer valid.

In practice, a formal review at least annually is what enforcing authorities and insurers expect. More importantly, certain events should trigger an immediate review:

• Following building alterations, refurbishments, or layout changes
• Following any fire incident or near miss
• Following a change in occupancy or the identification of new vulnerable individuals
• When fire safety equipment changes, including when a new alarm system or extinguishers are installed

Who Can Carry Out a Fire Risk Assessment?

The law requires the assessment to be carried out by a "competent person." There are no prescribed qualifications. The test is whether the person has sufficient training, experience, and knowledge for the type of premises involved.

For small, low-risk premises, an informed business owner can carry out their own assessment using government guidance. For larger, more complex, or higher-risk environments, appointing a professional assessor is the more defensible choice.

The recognised standard for professional fire risk assessors working on non-housing premises is PAS 79-1:2020. When appointing a professional, look for assessors registered with BAFE or holding recognised qualifications such as the IFE Level 4 Certificate.

Common Mistakes That Leave Businesses Exposed

• Using a generic template without tailoring it. A template completed without a physical site visit is very unlikely to be suitable and sufficient, and straightforward for an inspector to identify.
• Not reviewing after changes. A reconfigured warehouse, a new shift pattern, or an expanded kitchen operation should trigger a review.
• Identifying actions but not completing them. An assessment that flags a need to upgrade detection then gets filed away without follow-through demonstrates awareness of a risk and a failure to act.
• Inadequate consideration of people who need help evacuating. Documented, specific plans for individuals who may need assistance are what fire inspectors increasingly expect.
• Treating it as a one-off exercise. With enforcement increasing across the UK, 2026 is a year when businesses can no longer afford to overlook their fire safety responsibilities.

If your premises needs a fire alarm system that reflects the actual risks identified in your assessment, FIDEC installs and maintains commercial fire alarm systems across Manchester and the UK, starting with a free site survey and a fixed-price quote. Contact FIDEC Security Solutions, call 0333 3662 007, or email info@fidecss.co.uk.