In the UK, businesses that occupy or control non-domestic premises must have a fire risk assessment. Under the Regulatory Reform (Fire Safety) Order 2005, the responsible person must carry out and regularly review a fire risk assessment, put appropriate fire safety measures in place, plan for emergencies, and provide staff with fire safety information, instruction, and training. Non-domestic premises include workplaces and commercial premises, and the law also applies to the common areas of multi-occupied residential buildings.
A compliant assessment must be suitable and sufficient. It is not enough to produce a generic checklist or keep an old document on file. The assessment must identify the fire hazards, identify people at risk, evaluate and reduce risk, record findings, prepare an emergency plan, provide training, and be reviewed and updated regularly.
Last Updated: 2026
Reviewed By: London Safety Certificate Compliance Team
Key Takeaways
- All businesses must conduct fire risk assessments to comply with fire safety regulations.
- Regular safety audits and annual reviews of fire risk assessments are recommended.
- Documentation of assessments and safety measures is crucial for compliance and insurance purposes.
- Employee safety training and detailed emergency evacuation plans are legally required.
- Non-compliance can result in fines, legal liabilities, and higher insurance premiums.
Table of Contents
Is a Fire Risk Assessment Report Mandatory for Commercial Premises?
Yes. For commercial and other non-domestic premises covered by the Fire Safety Order, a fire risk assessment is a legal requirement, and the responsible person must now keep a written record of the assessment. Since the changes introduced under Section 156 of the Building Safety Act 2022, responsible persons must record the fire risk assessment in full and also record their fire safety arrangements in all circumstances.
That means the answer to whether a fire risk assessment report is mandatory for commercial premises is effectively yes. If your business falls within the scope of the Fire Safety Order, you should expect to have a written and properly maintained fire risk assessment, not just informal notes or verbal checks.
Fire Risk Assessment Requirements for Businesses
The core fire risk assessment requirements for businesses are straightforward in principle, even if they need proper care in practice. The responsible person must assess the premises, identify the risks from fire, and decide what precautions are needed to keep people safe. The assessment must then be reviewed regularly and updated when necessary.
A business fire risk assessment should usually cover:
- sources of ignition
- combustible materials and dangerous substances
- people at risk, including vulnerable persons
- emergency routes and exits
- fire detection and warning systems
- firefighting equipment
- emergency fire evacuation procedures
- staff fire safety information and training
- the ongoing management of fire safety measures
These points reflect the main structure of the GOV.UK guidance and are central to meeting the legal requirement properly. For the core assessment process, see fire risk assessment must cover the following steps.
Who Completes a Fire Risk Assessment?
The legal duty sits with the responsible person, but the assessment can be completed either by the responsible person themselves or by someone appointed to help, provided the work is done competently. GOV.UK states that you can do the fire risk assessment yourself using standard guidance, but if you do not have the expertise or time, you need to appoint a competent person to help, such as a professional risk assessor.
This is an important distinction. The responsible person cannot avoid responsibility simply by passing the work to a third party. Even if a consultant or fire risk assessor is engaged, the responsible person remains responsible for ensuring that a suitable and sufficient fire risk assessment has been completed.
Who Can Carry Out a Fire Risk Assessment?
A fire risk assessment can be carried out by:
- the responsible person, if they are competent to do it
- a competent employee
- an external competent person, such as a professional fire risk assessor
If an external assessor is appointed, current fire safety guidance says the responsible person should record the identity of the individual or organisation engaged to undertake or review the assessment.
For businesses, the real question is not only who can carry out a fire risk assessment, but whether the person doing it has the right level of competence for the premises involved. A simple small office is not the same as a factory, warehouse, healthcare setting, restaurant, or mixed-use building. For the wider legal duty behind fire risk assessment, see what is the legal requirement for fire risk assessments.
What Does Suitable and Sufficient Mean?
A suitable and sufficient fire risk assessment is one that properly reflects the actual premises, the actual fire hazards, and the actual people at risk. It should not be copied from another building, based on assumptions, or left unchanged after important alterations.
A compliant assessment should identify what could cause a fire to start, who may be harmed, what fire precautions are already in place, whether those precautions are adequate, and what further action is needed. It should also remain current. If the premises changes, if staffing or layout changes, or if there is reason to think the assessment is no longer valid, it must be reviewed and updated.
Fire Risk Assessments for Businesses
Businesses of all sizes can fall under the Fire Safety Order if they occupy non-domestic premises. That includes offices, shops, warehouses, restaurants, workshops, industrial premises, and many other working environments. It also includes certain shared or common parts where more than one responsible person may be involved.
This is why fire risk assessment is not just a “large company” issue. Small businesses, office-based firms, and single-floor commercial premises still need to assess their fire risks properly if the law applies to them. The standard required may vary with the complexity of the premises, but the legal duty remains.
Fire Risk Assessment for Offices and Commercial Premises
For offices and similar commercial premises, the assessment should focus on the real risks created by the way the premises is used. That often includes electrical equipment, storage, escape routes, alarm arrangements, housekeeping, staff numbers, and the evacuation of visitors or contractors.
A fire risk assessment for offices should not be treated as a paperwork exercise. Even relatively low-risk office premises still need a review of alarm systems, emergency exits, staff awareness, firefighting equipment, and the overall adequacy of fire precautions.
Documentation and Fire Risk Assessment Policies
Good documentation is part of compliance. Businesses should not only keep the fire risk assessment itself, but also their fire safety arrangements, review records, and evidence of how fire safety is being managed in practice. Section 156 guidance makes clear that responsible persons must now record the fire risk assessment in full and record their fire safety arrangements in all circumstances.
In practical terms, that means businesses should maintain clear records of relevant fire safety matters such as:
- the current fire risk assessment
- review dates and review findings
- alarm and emergency lighting tests
- faults, defects, and remedial actions
- evacuation drills and staff training
- the identity of any person engaged to carry out or review the assessment
That kind of record-keeping helps demonstrate legal compliance and supports stronger day-to-day fire safety management. For the wider legal framework around business fire duties, see fire safety regulations.
Fire Risk Assessment Legal Requirements in the UK
The legal requirement for fire risk assessments in the UK is rooted in the fire safety law that applies in the relevant jurisdiction. In England and Wales, the key law for business premises is the Regulatory Reform (Fire Safety) Order 2005. GOV.UK also notes that there are different rules in Scotland and Northern Ireland, so businesses operating there should follow the relevant national framework.
For businesses in England and Wales, the main legal message is clear: if you are the responsible person for business or other non-domestic premises, you must carry out a suitable and sufficient fire risk assessment, record it in writing, maintain appropriate fire precautions, and review the assessment regularly.
What Happens If a Business Does Not Comply?
Failure to comply with fire safety law can lead to enforcement action, notices, prosecution, fines, and imprisonment. GOV.UK states plainly that you could be fined or go to prison if you do not follow fire safety regulations.
This is why the legal requirements for businesses to have a fire risk assessment should be treated as a serious compliance issue, not just a document for inspections. A poor-quality assessment, missing assessment, or unmanaged fire risk can expose the business to legal, operational, financial, and reputational damage.
Final Answer
The legal requirements for businesses to have a fire risk assessment are clear. If you are the responsible person for business or other non-domestic premises, you must carry out and regularly review a suitable and sufficient fire risk assessment, keep a written record of it, record your fire safety arrangements, and take the necessary precautions to keep people safe.
If the question is whether a fire risk assessment report is mandatory for commercial premises, the answer is yes in practice where the Fire Safety Order applies. If the question is who can carry it out, the answer is the responsible person if competent, or a competent person appointed to help. But responsibility for compliance remains with the responsible person. For the staff response side of workplace fire safety, see what responsibilities do all staff have during a fire incident.
Frequently Asked Questions
-
Is a fire risk assessment required by law?
Yes. Where the Fire Safety Order applies, the responsible person must carry out and regularly review a fire risk assessment.
-
Who can carry out a fire risk assessment?
The responsible person can do it if competent, or they can appoint a competent person to help, such as a professional fire risk assessor.
-
Who completes a fire risk assessment?
It may be completed by the responsible person or by a competent person engaged for that purpose, but the responsible person remains responsible for ensuring it is suitable and sufficient.
-
Is a fire risk assessment report mandatory for commercial premises?
Yes. A written record of the fire risk assessment is required, and responsible persons must now record the assessment in full.
-
What does suitable and sufficient mean?
It means the assessment properly identifies the fire hazards, the people at risk, the adequacy of current precautions, and what further action is needed.
-
What records should a business keep?
At minimum, the current fire risk assessment, fire safety arrangements, review records, and supporting fire safety records such as tests, faults, drills, and training records should be maintained.