Does My Small Business Need a Fire Risk Assessment?

If you run a small business and you've been putting off a fire risk assessment because you've heard that businesses with fewer than five employees don't need a written one, you need to know this: that exemption was removed on 1 October 2023. If you've been relying on it, you are no longer compliant.

The short answer is yes — your business needs a fire risk assessment, and it always has. The change in October 2023 closed the last loophole that let very small businesses avoid putting it in writing. Here's what the law actually requires, what changed, and what happens if you don't act.

The law that applies to every business

The Regulatory Reform (Fire Safety) Order 2005 — the RRO 2005 — governs fire safety in all non-domestic premises in England and Wales. It applies whether you run a café with two staff members, a one-person accountancy practice, a workshop, or a shop. The size of your business is irrelevant. If people work in or visit your premises, you are legally required to carry out a fire risk assessment.

The RRO 2005 places a duty on the "responsible person" to carry out a "suitable and sufficient" fire risk assessment and implement any measures needed to reduce the risk of fire. For most small businesses, the responsible person is the employer, the business owner, or whoever is in control of the premises — which almost certainly means you.

Sole traders are not exempt. Micro-businesses are not exempt. Home workers whose clients visit the premises are not exempt. The only premises the RRO 2005 does not cover are single private dwellings. If your premises are non-domestic, the law applies to you.

What changed in October 2023

Before October 2023, there was one meaningful exemption for small businesses: if you employed fewer than five people, you were not legally required to record your fire risk assessment in writing. The assessment still had to happen — but the absence of a written record was not, on its own, a breach.

Section 156 of the Building Safety Act 2022 removed that exemption. From 1 October 2023, every responsible person must record their fire risk assessment and fire safety arrangements in full, regardless of how many people they employ. A mental note no longer satisfies the law. If you cannot produce a written FRA, you are non-compliant — full stop.

The penalties changed at the same time. The maximum fine for non-compliance was increased from Level 3 (£1,000) to Level 5, which is unlimited. The risk of imprisonment — up to two years for serious breaches — was retained. These are not theoretical figures: the fire and rescue authorities do prosecute, and courts have imposed significant penalties on small business owners whose premises put people at risk.

What "suitable and sufficient" actually means in practice

The RRO 2005 does not require you to eliminate every conceivable fire risk — that would be impossible. It requires you to take reasonable steps: actions that are practical, affordable, and appropriate for your type of premises. For most small businesses, this means identifying the main hazards (ignition sources, combustible materials, people at risk), assessing the likelihood and potential severity of a fire, putting basic controls in place, and recording the whole thing in writing.

The complexity of an FRA scales with the complexity of the premises. A small ground-floor office with two staff is not the same exercise as a multi-storey building with public access. What matters is that the assessment is genuine, documented, and kept under review — not that it runs to dozens of pages.

What happens if you do not have one

The local fire and rescue authority enforces the RRO 2005 for workplaces. Inspectors can visit without prior notice. If you cannot produce a written fire risk assessment, they can issue an enforcement notice requiring you to produce one — or, in serious cases, a prohibition notice that stops you using the premises at all until the situation is remedied.

There is also a commercial risk. Many business insurers require evidence of a current fire risk assessment as a condition of cover. If a fire occurs and you cannot produce one, your insurer may have grounds to reduce or reject your claim. The cost of not having an FRA can easily exceed the cost of the assessment itself many times over.

The myths that keep small businesses non-compliant

"I have fewer than five employees, so I'm exempt." This was true before 1 October 2023. It is not true now. Every business must record its FRA in writing, regardless of employee count.

"I have smoke alarms, so I'm covered." Detection equipment is one small part of fire safety. The RRO 2005 requires a structured assessment of hazards, risks, and control measures across the whole premises — not just alarm installation.

"Nothing has ever gone wrong here, so we must be safe." The law requires you to assess the risk before a fire, not to respond to one. Past luck is not a legal defence and does not constitute a fire risk assessment.

"A professional assessment will cost hundreds of pounds." For straightforward small business premises, the responsible person can carry out the assessment themselves, provided they are competent to identify the risks. The law does not require you to hire a consultant.

Next steps

If you do not have a written fire risk assessment, the action is straightforward: get one done. For most small businesses, a structured self-assessment is entirely appropriate. The responsible person does not need formal qualifications — they need to understand the premises and work through the assessment methodically.

For a full breakdown of each obligation under the RRO 2005 and how they apply to your business, see fire risk assessment for small businesses: your legal obligations under the RRO 2005.

FRASafe's small business fire risk assessment walks you through every area required by the RRO 2005. Complete it online in 30 to 45 minutes for £45 — a PDF you can show your insurer, your landlord, or the fire authority. Start your assessment free.