If you run a small business in the UK, you must carry out a fire risk assessment by law. Article 9(1) of the Regulatory Reform (Fire Safety) Order 2005 (RRO 2005) places a legal duty on the "responsible person" — typically the employer or business owner — to carry out a suitable and sufficient fire risk assessment for all non-domestic premises. This duty applies regardless of the size of your business, whether you employ one person or 100, and whether you own, rent, or share your premises.
What is a fire risk assessment?
A fire risk assessment is a structured evaluation of your business premises that identifies potential fire hazards, evaluates the risk they pose to people (employees, customers, contractors, visitors), and determines what fire safety measures are necessary to protect everyone who uses the building. The assessment must be recorded in writing if you employ five or more people, or if a licence, registration or certificate is required for your premises — but best practice is to record every fire risk assessment regardless of business size.
The purpose of the fire risk assessment is not to prevent every fire, but to ensure that if a fire does occur, everyone can escape safely. This means identifying all potential sources of ignition, all combustible materials, all people at risk, and all escape routes, then ensuring the escape routes remain clear, fire detection systems work, and everyone knows what to do.
The Regulatory Reform (Fire Safety) Order 2005
The Regulatory Reform (Fire Safety) Order 2005 (RRO 2005) is the primary fire safety legislation in England and Wales. It replaced over 70 pieces of fire safety law and introduced a single framework based on risk assessment. The RRO 2005 applies to virtually all non-domestic premises including offices, shops, factories, warehouses, restaurants, hotels, schools, and care homes. Scotland has equivalent legislation under the Fire (Scotland) Act 2005 and Fire Safety (Scotland) Regulations 2006. Northern Ireland uses the Fire and Rescue Services (Northern Ireland) Order 2006.
Under Article 8, the responsible person must take general fire precautions to ensure the safety of employees and other relevant persons. Under Article 9, the responsible person must carry out a fire risk assessment and implement the findings. Failure to comply is a criminal offence punishable by an unlimited fine and up to two years' imprisonment under Article 32.
Who is the responsible person?
The responsible person is defined in Article 3 of the RRO 2005. For most small businesses, the responsible person is the employer. If you are self-employed and in control of premises, you are the responsible person. If you are a landlord and have let premises under a lease, responsibility may lie with the tenant — but if the landlord retains control of common areas (stairwells, corridors, shared kitchens), the landlord remains responsible for those areas. In shared premises, there can be more than one responsible person — each must cooperate and coordinate fire safety measures under Article 22.
The responsible person does not need to personally carry out the fire risk assessment, but they remain legally accountable for ensuring it is completed by a competent person and that the findings are implemented. Many small business owners choose to carry out their own fire risk assessment — the law permits this, provided the person has sufficient training, experience or knowledge.
The 5-step fire risk assessment process
Step 1: Identify fire hazards
Walk through your premises and identify all potential sources of ignition and all combustible materials. Sources of ignition include electrical equipment (computers, printers, heaters, kettles, phone chargers), cooking equipment (ovens, toasters, microwaves), smoking materials (if smoking is permitted anywhere on site), naked flames (candles, gas heaters), and hot processes (welding, grinding, soldering). Combustible materials include paper and cardboard, packaging materials, textiles and upholstery, cleaning products, flammable liquids (petrol, solvents, aerosols), waste bins, and wooden furniture.
Also identify structural hazards that could accelerate fire spread: poor compartmentation (missing or damaged fire doors), blocked fire escape routes, flammable wall linings or cladding, and unprotected openings (holes in walls or ceilings where cables pass through).
Step 2: Identify people at risk
Consider all groups of people who could be in or near the building. For a small business, this typically includes employees (full-time, part-time, temporary staff), customers or clients, contractors and delivery drivers, visitors, and people in adjoining premises who could be affected by fire in your building. Pay particular attention to vulnerable people: those with mobility impairments, people with hearing or visual impairments, young children, elderly people, and pregnant women. You must ensure your fire safety arrangements account for these groups — this may require personal emergency evacuation plans (PEEPs) for disabled workers or clear visual alarm signals for those with hearing loss.
Step 3: Evaluate, remove, reduce and protect
For each fire hazard identified, apply the hierarchy of fire safety measures: eliminate the hazard if possible (remove unnecessary combustible materials, prohibit smoking, replace a petrol-powered tool with an electric equivalent); reduce the hazard (store flammable liquids in a metal cabinet, switch off electrical equipment when not in use, maintain clear zones around ignition sources); protect people from the remaining risk (install smoke detectors, provide clearly marked escape routes, fit fire doors, train staff in fire procedures).
Check that your premises have adequate means of escape. For most small businesses, this means at least two escape routes from any room where people work or visit, with fire exit doors that open in the direction of escape and are never locked during working hours. The guidance in BS 9999:2017 or the Government Fire Safety Risk Assessment guides provide detailed travel distance tables — typically, no person should have to travel more than 18 metres to reach an exit in a low-risk building.
Step 4: Record, plan, inform, instruct and train
If you employ five or more people, you must record the significant findings of the fire risk assessment in writing under Article 9(7) of the RRO 2005. The record should include: identified fire hazards, people especially at risk, the risk rating (likelihood and consequence), existing control measures, additional measures required, the person responsible for implementing them, and the target date for completion. Best practice is to record all fire risk assessments regardless of employee numbers.
Prepare a fire emergency plan — a written document that sets out what to do if a fire is discovered: how the alarm is raised, who calls 999, where the assembly point is located, and who has responsibility for checking the building is clear. Inform all employees of the contents of the fire emergency plan, provide fire safety training on their first day, and repeat that training at least annually or whenever the premises change significantly.
Step 5: Review
Under Article 9(3) of the RRO 2005, you must review your fire risk assessment regularly and whenever there is reason to suspect it is no longer valid. Specific events that trigger a review include any fire or near-miss incident, a change in the layout of the premises (new partitions, relocated equipment), a change in the use of the premises (office converted to storage), new or increased fire hazards (storage of flammable materials), a change in the number or type of occupants (increased staff numbers, members of the public now allowed on site), or following a fire authority enforcement notice. As a minimum, fire risk assessments for small business premises should be reviewed annually.
Do I need a fire alarm system?
There is no automatic legal requirement for a fire alarm system — but Article 8(1)(a) requires the responsible person to take adequate measures for detecting fire and giving warning in case of fire. For very small, low-risk premises with a simple layout and quick escape routes, battery-operated smoke alarms may be sufficient. For premises with multiple rooms, more than one floor, or where people are present overnight, a wired or wireless interlinked fire alarm system is usually necessary.
The British Standard for fire detection and alarm systems is BS 5839-1:2017. For most small businesses, a Grade D system (mains-powered detectors with battery backup, interlinked) or a Grade A system (professionally installed and maintained) will be appropriate. Whatever system you choose, it must be tested weekly by pressing the test button, and records of all tests and faults must be kept in a fire logbook.
Do I need fire extinguishers?
Under Article 8(1)(b), the responsible person must ensure the premises are equipped with appropriate fire-fighting equipment. For most small businesses, this means portable fire extinguishers sited on exit routes, near fire hazards, and on each floor. The type of extinguisher depends on the hazards present: water or foam extinguishers for ordinary combustibles (paper, wood, textiles), CO₂ extinguishers for electrical fires, and wet chemical extinguishers for cooking oil fires in kitchens.
Extinguishers must be serviced annually by a competent person and the service date recorded on a label attached to the extinguisher. Employees do not have a duty to fight a fire — extinguishers are provided for optional use by those who feel confident to do so and only if the fire is small and the escape route remains clear.
Fire door and emergency lighting requirements
Fire doors are a critical part of fire safety in any building with more than one room or floor. Fire doors are designed to hold back smoke and fire for a specified period (typically 30 or 60 minutes) to allow safe escape. They must be fitted with self-closing devices, intumescent strips, and cold smoke seals. Fire doors must never be propped open unless they are fitted with automatic release mechanisms linked to the fire alarm. Wedging a fire door open with a fire extinguisher is one of the most common fire safety contraventions found by fire authorities.
Emergency lighting is required under Article 8(1)(b) if the premises lack adequate natural light to allow safe escape in the event of mains power failure. For most small business premises, this means emergency lighting in corridors, stairwells, and on final exit doors. Emergency lights must be tested monthly (press and hold the test button until the light dims) and undergo an annual 3-hour duration test. Records of all tests must be kept.
Common fire safety mistakes in small businesses
The most common fire safety failings identified by fire and rescue authorities include: fire doors wedged or propped open, final exit doors locked during working hours, escape routes blocked by stored goods or equipment, combustible materials stored under stairs or in escape routes, electrical equipment left on overnight or over weekends without a risk assessment, portable heaters placed too close to combustible materials, kitchen extraction systems not cleaned regularly (grease build-up), flammable liquids stored in inappropriate containers or locations, no fire drills conducted, and fire safety training not provided to new starters.
Another frequent issue is failing to update the fire risk assessment following any change in the use or layout of the premises. A fire risk assessment conducted for an office with 5 staff is no longer valid if the business grows to 15 staff or if a storage area is converted to a workshop.
Do I need a professional fire risk assessor?
The law does not require you to use a professional fire risk assessor. Article 9(1) requires the fire risk assessment to be carried out by a competent person — someone with sufficient training, experience, knowledge or other qualities. For many small, low-risk premises (small offices, retail shops, low-risk storage), the business owner can carry out their own fire risk assessment after reading the relevant government guidance and completing basic fire safety training.
The government publishes free fire safety risk assessment guides for different premise types. The guide for offices and shops is particularly relevant to small businesses. Reading and applying the appropriate guide, combined with a thorough walk-through of your premises, is often sufficient for a simple fire risk assessment.
However, for higher-risk premises (those with sleeping accommodation, healthcare settings, complex layouts, significant numbers of vulnerable people, or hazardous processes), engaging a professional fire risk assessor registered with a body such as the Institution of Fire Engineers or the Fire Industry Association is advisable. Certification schemes such as the Fire Risk Assessment Competency Council (FRACC) provide assurance of competence.
Enforcement and penalties
Fire and rescue authorities enforce the RRO 2005. Inspectors have the power under Article 27 to enter premises at any reasonable time, inspect fire safety arrangements, take samples, and require the production of documents including the fire risk assessment. Non-compliance can result in an enforcement notice requiring specific improvements within a fixed period, an alteration notice restricting the use of premises, or a prohibition notice closing the premises immediately if there is serious risk to life.
Failing to comply with the RRO 2005 is a criminal offence under Article 32. On summary conviction, penalties include a fine of up to £5,000 and/or up to six months' imprisonment. On conviction on indictment, penalties include an unlimited fine and/or up to two years' imprisonment. In 2022/23, fire and rescue authorities in England issued 5,142 enforcement notices and secured 252 prosecutions.
Fire risk assessment for home-based businesses
If you run a business from home, the fire safety requirements depend on whether the premises are considered domestic or non-domestic. If you work alone from home and have no employees or visitors attending the premises for business purposes, the RRO 2005 does not apply — domestic premises are excluded under Article 6. However, if you employ staff who work in your home, or if clients or customers visit for business purposes, the areas used for business purposes become non-domestic and the RRO 2005 applies.
For home-based businesses with employees or business visitors, you must carry out a fire risk assessment covering the business areas of the home, ensure adequate means of escape (separate from the domestic escape route if possible), provide fire detection (interlinked smoke alarms as a minimum), and provide fire safety information and training to employees.
Using AI to generate a fire risk assessment
Generating a compliant, premises-specific fire risk assessment from scratch can take several hours, particularly if you are unfamiliar with fire safety terminology or struggle with written documents. AI-powered tools like Anyrisks allow you to describe your premises in plain language — the type of building, the business activity, the number of floors, the type and number of occupants — and receive a fully written fire risk assessment tailored to your premises in under 2 minutes.
The AI applies the RRO 2005 five-step structure, references the relevant government guidance, identifies the specific fire hazards present in your type of premises, and proposes appropriate control measures. The output is delivered as a PDF and an editable Word document for £29, with a money-back guarantee if you are not satisfied within 24 hours. You must still review the assessment to confirm it accurately reflects your premises, and you remain legally responsible for implementing the findings — but the time required to produce a professional, regulation-compliant document is reduced from hours to minutes.
Further reading
For additional fire safety guidance, see our detailed guide to fire risk assessments. For other types of risk assessment required by small businesses, see health and safety risk assessments, COSHH risk assessments, and manual handling risk assessments. For businesses operating from leased premises, see our risk assessment for landlords guide. For understanding your broader legal obligations, see risk assessment legal requirements.