Building Safety Act 2022: Why Every Business Owner Now Needs a Written Fire Risk Assessment

If a fire safety inspector walked into your business premises tomorrow and asked to see your written fire risk assessment, could you produce one? If the answer is no — or if you have an assessment that only lists "significant findings" rather than a full record — you are in breach of the law and liable for an unlimited fine.

Until October 2023, most small business owners had no legal obligation to write down their fire risk assessment at all. That changed when Section 156 of the Building Safety Act 2022 came into force, and the consequences of not knowing about it are serious.

The rule that no longer exists: the 5-employee threshold

Under the original Regulatory Reform (Fire Safety) Order 2005, a written fire risk assessment was only required in two situations: where the responsible person employed five or more people, or where the premises were subject to a licensing regime or an alterations notice.

This created a widespread belief among sole traders and micro-business owners that a written FRA was optional for them. Many carried out a mental walk-around, noted the risks in their head, and considered themselves compliant. In legal terms, they were — right up until 1 October 2023.

Section 156 of the Building Safety Act 2022 removed that threshold entirely. The number of employees you have is now irrelevant. Every responsible person — from a sole trader running a one-room office to a business owner managing a commercial unit — must record their fire risk assessment in full.

What Section 156 actually changed

The Building Safety Act 2022 is often associated with higher-risk residential buildings — the tall blocks that came under scrutiny after the Grenfell Tower fire. But Section 156 applies to every premises covered by the RRO 2005, not just high-rise residential buildings. That means your office, workshop, studio, or shop floor is in scope.

Three specific changes came into force on 1 October 2023:

1. The fire risk assessment must be recorded in full. Previously, only "significant findings" needed to be written down. Now the entire assessment — every hazard identified, every control measure in place or needed — must be documented. A one-page summary of headline risks no longer satisfies the law.
2. Fire safety arrangements must also be recorded in writing. This covers how you manage fire safety day-to-day: evacuation procedures, maintenance schedules for fire equipment, staff responsibilities, and how you would handle a fire emergency. These must be written down and kept up to date.
3. The identity of the assessor must be recorded. If you engaged a third party to carry out or review your fire risk assessment, you must record their name and, where applicable, their organisation. This creates an audit trail and ties into a separate provision — not yet in force — requiring that appointed assessors be demonstrably competent.

These are not minor administrative additions. They fundamentally change what a compliant fire risk assessment looks like for businesses that previously operated on informal or partial records.

What the penalties look like

The same legislation that tightened the written FRA requirements also increased the penalties for non-compliance. Before 1 October 2023, offences under Article 32 of the RRO 2005 carried a maximum fine of Level 3, which was £1,000. That ceiling is now gone. Offences committed from October 2023 are subject to a Level 5 fine, which is unlimited.

Enforcement typically follows a fire safety inspection by your local fire and rescue service. Inspectors can ask to see your written FRA at any time. If you cannot produce one — or if what you produce is clearly inadequate — they can issue an enforcement notice requiring you to put things right, or a prohibition notice restricting use of the premises. In serious cases, prosecution follows.

An unlimited fine is not a theoretical risk reserved for large companies. Fire and rescue services enforce against businesses of all sizes, and the trend since 2023 has been towards more active enforcement of the new written record requirements.

Who counts as the responsible person?

Under the RRO 2005, the responsible person is whoever has control of the premises. For most small businesses, that is the employer or business owner. For tenants, it is typically the occupier — not the landlord — for the parts of the building they control. In multi-occupancy buildings, there can be more than one responsible person, each with duties over their own area.

If you run your business from leased premises, you are almost certainly the responsible person for your unit. Your landlord may be the responsible person for shared areas such as corridors and stairwells. The full breakdown of RRO 2005 duties for small business owners covers this in detail, but the key point is that being a tenant does not exempt you from the written FRA requirement.

What a compliant written FRA must contain

A written fire risk assessment should cover five broad areas, as set out in the RRO 2005 and government guidance:

• Identification of fire hazards — ignition sources, fuel sources, and oxygen sources present in the premises.
• People at risk — employees, visitors, contractors, and anyone who might be in or near the building in a fire.
• Evaluation of risk and existing measures — what controls are already in place and whether they are adequate.
• Recommended actions — specific steps to reduce risk where current measures fall short.
• Review and revision details — when the assessment was carried out, who carried it out, and when it should next be reviewed.

All of this must be written down, not held in the assessor's head or summarised on a single A4 sheet. You must also record your fire safety arrangements separately: how you manage evacuation, how you test fire alarms, who is the nominated fire marshal, and how visitors are accounted for.

If you are uncertain whether your business needs a fire risk assessment at all, the answer for any non-domestic premises with at least one employee or open to the public is almost always yes — and now, without exception, it must be in writing.

The competency requirement: coming soon

Section 156 also introduced a legislative requirement that anyone appointed to carry out or review a fire risk assessment must be competent. This provision has not yet been brought into force — the government is expected to introduce regulations specifying what competency means in practice.

When it does come into force, "I hired someone" will not be enough. You will need to demonstrate that the person you used was qualified for the task. The identity recording requirement already in force is partly preparatory for this: it creates a traceable record of who did what, ready for when the competency standard is defined.

Next steps

If your business premises fall under the RRO 2005 and you do not have a written fire risk assessment that meets the post-October 2023 requirements, the steps are straightforward. Carry out a full assessment of your premises — or commission one from a competent assessor — and record all findings in writing. Document your fire safety arrangements separately. Record the assessor's identity. Keep both documents somewhere you can produce them if asked.

FRASafe's small business fire risk assessment walks you through every area required by the RRO 2005. Complete it online in 30–45 minutes for £45 — a PDF you can show your insurer, landlord, or council.

Start your small business fire risk assessment on FRASafe.

Summary

Section 156 of the Building Safety Act 2022 came into force on 1 October 2023 and removed the old "5 employees" threshold for written fire risk assessments. Every responsible person — regardless of business size — must now record their full FRA in writing, document their fire safety arrangements, and record the identity of whoever carried out the assessment. The penalty for non-compliance is an unlimited fine. If your current FRA does not meet these standards, it is non-compliant.