Fire Risk Assessment for Small Businesses: Your Legal Obligations Under the RRO 2005

If you run a small business and you do not have a written, recorded fire risk assessment, you are already breaking the law. Not potentially breaking it. Not at risk of breaking it. Already in breach.

Many small business owners have heard the old rule: fewer than five employees means you do not need to write it down. That rule no longer exists. Since the Fire Safety Act 2021, every business operating from non-domestic premises must record its fire risk assessment in full, regardless of how many people work there. A sole trader with one member of staff is subject to exactly the same recording obligation as a company with fifty.

This guide covers everything you need to know: who the law applies to, what you are required to do, how enforcement works, and what the consequences are when businesses get it wrong.

Does the RRO 2005 Apply to My Business?

The Regulatory Reform (Fire Safety) Order 2005 (RRO 2005) is the primary fire safety legislation for England and Wales. It applies to virtually all non-domestic premises: offices, shops, warehouses, workshops, pubs, restaurants, gyms, schools, places of worship, and the common areas of residential buildings.

If you operate your business from commercial premises, whether you own the building, rent a unit, or share a space with other tenants, the RRO 2005 applies to you. It also covers self-employed people working from business premises, family-run businesses, and the voluntary sector. The only premises it does not cover are domestic dwellings used purely as a home, with no business activity taking place.

The scope is deliberately broad. The intention of the legislation is that anyone who has control of a non-domestic space takes responsibility for fire safety within it.

Who Is the "Responsible Person" for Fire Safety?

The RRO 2005 places its duties on what it calls the "responsible person." Understanding who this is matters because this is a personal legal obligation, not simply a corporate one. Getting it wrong can expose you individually to prosecution.

The responsible person for fire safety is typically:

• The employer, if the premises are a workplace
• The owner of the premises, if the building is not a workplace
• The occupier, if they have day-to-day control of the building
• A managing agent or facilities manager, where they have been given control

If you are a business tenant operating from a rented commercial unit, you are almost certainly the responsible person for the interior of your space. Your landlord may hold responsibility for common areas, corridors, and the building structure. In many premises there are two or more responsible persons, and the law requires them to cooperate and share relevant fire safety information.

This distinction matters because prosecution under the RRO 2005 is not limited to limited companies. Directors, business owners, and individuals who have control of premises can be personally prosecuted. At Crown Court, the maximum penalty is an unlimited fine combined with up to two years in prison.

What Are You Legally Required to Do?

As the responsible person, your core legal duties under the RRO 2005 are:

• Carry out a suitable and sufficient fire risk assessment of your premises
• Record that assessment in writing (required for all businesses, regardless of size, since the Fire Safety Act 2021)
• Put in place and maintain appropriate fire precautions based on your findings
• Review the assessment regularly and whenever significant changes occur
• Provide fire safety information, instruction, and training to all employees
• Maintain adequate means of escape and keep escape routes clear at all times

The phrase "suitable and sufficient" carries real legal weight. It means your assessment must be specific to your premises and your actual circumstances. A generic template downloaded from the internet is not suitable and sufficient. It will not reflect your layout, your ignition sources, your occupancy pattern, or the vulnerable people who use your building. If a fire service inspector asks to see your assessment and finds a generic document that does not reflect reality, expect an enforcement notice.

The 5-Step Fire Risk Assessment Process

The government publishes official guidance structured around five steps. For most small business premises, including offices and shops, this is the framework your assessment should follow.

Step 1: Identify fire hazards

Look for sources of ignition (electrical equipment, heating systems, cooking appliances), sources of fuel (paper, packaging, flammable liquids, soft furnishings), and sources of oxygen (open windows, air conditioning units). The goal is to identify what could start a fire and what could allow it to spread.

Step 2: Identify people at risk

Consider everyone who uses the building: employees, customers, contractors, and visitors. Pay particular attention to people who may need additional help evacuating, including anyone with a mobility impairment, lone workers, people unfamiliar with the building layout, and anyone in areas where a fire could develop quickly before the alarm is raised.

Step 3: Evaluate, remove, or reduce the risks

For each hazard you have identified, decide what action to take. Can you eliminate it entirely? If not, can you reduce the risk or put precautions in place to limit the consequences? This is where you determine what fire safety equipment your premises need: alarms, extinguishers, emergency lighting, fire doors, and signage.

Step 4: Record, plan, inform, instruct, and train

Write down your significant findings and the actions you have taken or plan to take. Produce a written emergency evacuation plan. Make sure every employee knows how to raise the alarm, where the exits are, where the assembly point is, and what they must not do during an evacuation. If any employee or regular visitor has a disability that affects their ability to self-evacuate, you are required to produce a Personal Emergency Evacuation Plan (PEEP) for that individual.

Step 5: Review and keep up to date

A fire risk assessment is not a one-time document. It must be reviewed regularly and updated whenever circumstances in your premises change materially.

How Often Should You Review Your Fire Risk Assessment?

There is no fixed legal interval. The law does not require annual reviews. Instead, your assessment must be reviewed whenever there is reason to believe it is no longer valid. In practice, most businesses review annually as a sensible baseline, but these events should trigger an immediate review regardless of when you last updated it:

• Structural changes or refurbishment to the premises
• A change in the use of any part of the building
• A significant increase or decrease in occupancy
• Introduction of new materials, processes, or equipment that affect fire risk
• A fire, near-miss, or unexplained false alarm at the premises
• Changes to fire safety equipment or systems
• Employing someone with a disability who requires a PEEP
• A notice or request from the fire service following an inspection

If you move to new premises, your existing assessment does not transfer. You need a fresh assessment for the new building, reflecting its layout, condition, and specific hazards.

The Mistakes That Get Small Businesses Into Trouble

Most fire safety failures in small businesses are not the result of deliberate disregard. They are the result of owners not knowing what the law requires, or assuming the requirements are lighter than they are. These are the failures that come up repeatedly in enforcement actions.

Not writing it down. The most common gap in micro businesses. Many owners did a mental walk-around, decided things looked fine, and never recorded anything. Since the Fire Safety Act 2021, this is not enough for any business, no matter how small.

Using a generic template. A pre-filled form with a few details changed is not a fire risk assessment under the law. Fire service inspectors know what a genuine assessment looks like. A templated document that does not reflect your actual premises is unlikely to satisfy an inspection.

Blocked escape routes. The most common physical failing found during fire safety inspections. Stock, deliveries, furniture, and waste gradually accumulate in corridors and near fire exits. Keeping escape routes clear is an ongoing responsibility.

Untested equipment. Fire extinguishers require annual servicing. Alarms need weekly testing and regular maintenance. Emergency lighting requires monthly checks and annual discharge tests. Letting this lapse is a common trigger for enforcement notices.

No staff training. Every employee must receive fire safety training. They need to know how to raise the alarm, where the exits are, where the assembly point is, and what they must not do during an evacuation. Training must be refreshed regularly and whenever working arrangements change.

Assuming the landlord has covered it. Your landlord may hold responsibility for common areas and the building structure. They are not responsible for fire safety within your leased space. That responsibility belongs to you as the occupier.

Who Enforces Fire Safety Law and What Can They Do?

Many business owners assume fire safety is enforced by the Health and Safety Executive or their local council. For most commercial premises, it is neither. Enforcement of the RRO 2005 is the responsibility of your local fire and rescue service.

Fire safety inspectors can visit your premises without prior notice. If they identify problems, they have a range of powers available, starting with informal advice and escalating through formal enforcement notices (requiring specific remedial action within a set timeframe), prohibition notices (which can close your premises immediately where there is a risk of serious personal injury), and criminal prosecution.

The penalties are real and regularly applied. A bar in Huddersfield was fined £160,000 after ignoring fire safety enforcement notices issued by West Yorkshire Fire and Rescue Service. At Crown Court, the statutory maximum is an unlimited fine combined with up to two years in prison. These consequences are not reserved for businesses that cause fires. They are applied to businesses that fail to take their obligations seriously before anything goes wrong.

Can You Do Your Own Fire Risk Assessment?

Yes, in many cases. The RRO 2005 does not require you to hire a professional assessor. For simple, low-risk premises with a small number of occupants, a self-assessment is entirely legitimate, provided it is thorough, site-specific, and properly recorded. A well-run small office or a straightforward retail unit are exactly the type of premises for which a competent owner can produce a valid assessment themselves.

Where you should consider bringing in a professional: if your premises are large or complex, if you accommodate significant numbers of members of the public, if you have previously received an enforcement notice, or if your lease or business insurance requires a third-party assessment.

FRASafe's small business fire risk assessment walks you through every area required by the RRO 2005. Complete it online in 30 to 45 minutes for £45, and you will have a PDF you can show your insurer, your landlord, or the fire service.

Next Steps

If you do not have a written fire risk assessment for your business premises, start there. Not a mental checklist. Not a downloaded template. A genuine, site-specific, recorded assessment that reflects your actual building, your actual occupants, and the actual risks you face.

If you already have an assessment, check when it was last reviewed and whether anything has changed since it was completed. Most businesses that receive enforcement action are not ones that never had an assessment. They are ones that had one and let it go stale.

Use our small business fire risk assessment tool to complete a compliant, RRO 2005-aligned assessment online today. It takes most businesses 30 to 45 minutes, and produces a PDF report you can keep on file and share with anyone who needs to see it.