What is a fire risk assessment? The law, the 5 steps and UK penalties

What is a fire risk assessment? It's the legal check the person in charge of a business premises has to make of how a fire could start there, who it could harm and what has to be in place so everyone gets out. In England and Wales the duty sits in article 9 of the Regulatory Reform (Fire Safety) Order 2005. Scotland and Northern Ireland have their own laws, and the rules on writing it down are different in each.

Fire risk assessment at a glance

• Almost every non-domestic premises needs one: restaurants, cafés, pubs, takeaways, shops, hotels, and the common parts of blocks of flats.
• The duty falls on the "responsible person" (the "dutyholder" in Scotland). For a workplace that's normally the employer.
• Since 1 October 2023, every responsible person in England and Wales must record the whole assessment, however few staff they have. Scotland and Northern Ireland still only require a record in some cases, such as five or more employees or a licence.
• The law sets no fixed review date: you review regularly and whenever something significant changes. The new "competent assessor" rule for England and Wales has been passed but isn't in force yet. Wales passed further changes in 2026 that also aren't in force yet.
• Failing the duty is a crime where it puts someone at risk of death or serious injury. One Truro takeaway director got a suspended prison sentence in March 2026.

What is a fire risk assessment, and how is it different from a general risk assessment?

The Order asks for "a suitable and sufficient assessment of the risks to which relevant persons are exposed for the purpose of identifying the general fire precautions" you need. "Relevant persons" means anyone who is or may be lawfully on the premises, plus anyone in the immediate vicinity who is at risk from a fire there. So the flat above your takeaway counts, even if the tenant never walks into your shop.

It's a separate duty from the general workplace risk assessment under the Management of Health and Safety at Work Regulations. The two overlap, and many businesses keep them together, but different people enforce them and the recording rules differ.

There's also a template version of this page: our fire risk assessment workflow has three versions you can open and run.

Who is the responsible person?

Article 3 of the Order gives two answers. In a workplace, it's the employer, if the workplace is to any extent under their control. In any other premises, it's the person who has control of the premises in connection with a trade, business or other undertaking, or the owner where nobody else does.

In practice, for a restaurant that's the company running it. If you lease a unit in a shopping centre, you're responsible for your unit, and the landlord or managing agent is usually the responsible person for the shared corridors, the fire alarm panel and the service yard. Where there's more than one responsible person, article 22 makes you co-operate and co-ordinate. Since October 2023 you also have to find out who the others are and give them your name, a UK address and which part of the building you control.

Being the responsible person doesn't mean doing the assessment yourself. You can hire someone to do it. You stay legally responsible for it.

The law in each UK nation

The rules are close in substance. The detail is where you get caught out. Many guides write the English rules and stop there.

England

The Order extends to England and Wales only and has been in force since 1 October 2006. Section 156 of the Building Safety Act 2022 changed it from 1 October 2023. The main changes for a business:

• Every assessment must be recorded. Article 9(6) now simply says the responsible person must "make a record of the assessment or review". As originally made, that applied only where "(a) he employs five or more employees; (b) a licence under an enactment is in force in relation to the premises; or (c) an alterations notice requiring this is in force". That exemption has gone.
• Your fire safety arrangements must be recorded too, again whatever your size.
• Shared buildings. Responsible persons must identify each other and share information (art 22). If you hand over to a new responsible person, for example when you sell the business or the lease ends, you must pass on the relevant fire safety records (new art 22A).
• Residents' information. In buildings with two or more homes, the responsible person has to give residents fire safety information (new art 21A).
• Higher fines. The level 3 cap on some summary offences was removed, so those are now unlimited too.

Section 156 also inserts a new article 9A, requiring anyone you appoint to help with the assessment to be competent. That subsection hasn't been commenced. legislation.gov.uk still lists article 9A as an outstanding change, current to 14 October 2026. Many assessor websites write as if it's already law. It isn't yet.

One earlier change matters for anyone with flats above or alongside their premises. Section 1 of the Fire Safety Act 2021 confirmed that, where a building contains two or more homes, the Order covers the structure, external walls (including windows and balconies), common parts and the flat entrance doors. It came into force on 16 May 2022 in England and 1 October 2021 in Wales.

The Fire Safety (England) Regulations 2022 came into force on 23 January 2023 and apply in England only. They add duties for responsible persons in buildings with flats. Under regulation 9, any building with two or more homes and common escape routes must display fire safety instructions and give residents a copy. If your restaurant is the responsible person for a mixed-use block, check which of these apply to you.

The Home Office publishes a five-step checklist (last updated 20 January 2025) and a shorter guide for small premises. Both say they apply to England.

Wales

Wales uses the same Order, and the Building Safety Act changes above came into force in Wales on 1 October 2023 too. The article 9A competence rule isn't in force in Wales either.

Wales has also gone further. The Building Safety (Wales) Act 2026 received Royal Assent on 27 April 2026. Section 121 inserts three new articles into the Fire Safety Order for Wales:

• Art 22C: responsible persons must co-operate with the "accountable persons" for regulated buildings and with the duty holders for relevant houses in multiple occupation (HMOs).
• Art 22D: they must share information with an accountable person who asks in writing, with at least 14 days to reply.
• Art 22E: they must give information to HMO duty holders.

Schedule 3 to the same Act partly disapplies the Order for occupied regulated buildings and relevant HMOs, so a separate Welsh regime takes over for those buildings. It also prospectively repeals parts of section 156 of the 2022 Act for Wales.

None of this is in force yet. Most of the Act starts on dates the Welsh Ministers set by order, and we found no commencement order bringing in section 121 by 14 October 2026. If you run a café or restaurant in the ground floor of a block in Wales, watch for that order: once it's in, you'll owe the building's accountable person co-operation and information.

Scotland

Scotland never used the Fire Safety Order. The duties are in Part 3 of the Fire (Scotland) Act 2005. Section 53 makes employers assess the workplace, and section 54 does the same for anyone else who has control of relevant premises. Both are in force from 1 October 2006. The person with the duty is called the "dutyholder".

The detail is in the Fire Safety (Scotland) Regulations 2006. Under regulation 8 you only have to record the assessment if you have five or more employees, if the premises need a licence or registration, or if an alterations notice requires it. A licensed restaurant or pub always needs a licence, so in practice it records. A small unlicensed café with four staff doesn't have to. Write it down anyway. "We did it, honestly" isn't much use when the fire officer asks to see it.

The Scottish Government's non-domestic fire safety guidance includes a 2022 guide for existing non-residential premises. The Scottish Fire and Rescue Service adds that "Even where external assistance is used, the dutyholder remains legally responsible".

Northern Ireland

Northern Ireland's duties are in the Fire and Rescue Services (Northern Ireland) Order 2006. Article 25 covers employers and article 26 covers others in control of premises. The detail is in the Fire Safety Regulations (Northern Ireland) 2010, in operation from 15 November 2010.

Regulation 8 has the same three recording triggers as Scotland: five or more employees, a licence or registration, or an alterations notice. Regulation 9 asks for the "significant findings". The Northern Ireland Fire and Rescue Service uses the same five steps as England and tells businesses it can't carry out the assessment for them.

The five steps

All three governments use the same five steps. The Home Office checklist sets them out like this:

1. Identify the fire hazards. Sources of ignition (fryers, grills, toasters, electrical equipment, smoking, arson), sources of fuel (oil, packaging, linen, rubbish) and sources of oxygen.
2. Identify the people at risk. Staff, customers, contractors, people sleeping on site, people in the flat above, and anyone who would struggle to get out: young workers, disabled staff or guests, lone workers closing up.
3. Evaluate, remove or reduce the risks, and protect people. Remove what you can, then put in detection and warning, escape routes, emergency lighting, signs and firefighting equipment.
4. Record, plan and train. Write down the findings and what you did, make an emergency plan, and train staff.
5. Review. Go back to it regularly and whenever something changes.

The checklist adds a detail people miss: "You must also keep a record that you have reviewed your FRA, and the date you did so."

What a restaurant or café assessment should cover

For a food business, the kitchen gets most of the assessment. It's the room with the hot oil in it. The Home Office small premises guide gives specific advice for cooking:

• Never leave cooking unattended.
• Clean filters and ducts over cooking ranges regularly, because built-up grease is fuel.
• Have gas appliances maintained by a competent person.
• Store bulk cooking oil outside the building where possible.
• "If there is risk from cooking, involving fat fryers or similar equipment, a fire blanket and a Class F fire extinguisher ... should be provided".
• Have "a water-based extinguisher (possibly supplemented by a carbon dioxide extinguisher) on each floor".

Outside the kitchen, an inspector will look at your escape routes, fire doors, alarm and detection, emergency lighting and staff training. Pilla's checklists cover the routine checks your assessment relies on: fire alarm testing, fire door checks, fire exit checks, fire extinguisher checks and fire emergency training. The kitchen's other hazards, like burns and knives, belong in the kitchen risk assessment, and the wider premises in the restaurant risk assessment. Faulty wiring and overloaded sockets overlap with the electrical risk assessment, and flammable cleaning chemicals with your COSHH assessment.

Which extinguisher for which fire?

The guide's own advice for small premises comes down to this:

Your supplier or assessor will set the exact number and type. The assessment is what justifies the choice.

Can you do your own fire risk assessment?

Yes, if you're competent to do it and the premises are simple. GOV.UK's workplace fire safety guidance says: "You can do the fire risk assessment yourself with the help of standard fire safety risk assessment guides." If you don't have the expertise or time, appoint a "competent person" such as a professional assessor.

The small premises guide says a simple assessment "can often be completed, without specialist knowledge" if your premises fit its scope. Most food businesses don't fully fit. This decision table is ours, built from the guide's scope list:

If any answer is yes, a professional assessment is the safer route. Many assessors work to PAS 79-1:2020, BSI's code of practice for fire risk assessment in premises other than housing. BSI says it "gives recommendations and corresponding examples of documentation for undertaking and recording the significant findings". It isn't law, but asking an assessor whether they follow it is a fair test. The guide is advice. Until article 9A comes into force there's no statutory competence test for assessors in England and Wales, and no licence is needed to sell assessments.

What does a professional assessment cost?

We found no official figure. Assessors publish their own ranges. One London and Surrey firm gives £180 to £420 as an "indicative planning range" for straightforward small premises, before VAT. Online report generators sell for £29 to £45. A generic template the assessor never checked against your building is unlikely to be "suitable and sufficient".

How often should you review it?

The law doesn't give a date. Article 9(3) of the Order says you must review it regularly, and in particular if you have reason to suspect it's no longer valid or there's been a significant change. Scotland's regulation 3 and Northern Ireland's regulations say much the same.

Triggers for a restaurant include:

• A refit, new layout or new extraction.
• New cooking equipment, such as an extra fryer or a charcoal grill.
• A change of use upstairs, such as staff starting to sleep there.
• A fire, a near miss or an alarm fault.
• A fire officer's visit or a letter from the landlord.
• A change in staff or opening hours, such as lone closing.

Many assessors recommend an annual review, which is a sensible habit and their own advice. The law works on triggers.

Enforcement, penalties and real cases

Fire and rescue authorities enforce the Order in most premises. Inspectors can give informal advice, serve an alterations notice, an enforcement notice or, where the risk is serious, a prohibition notice that closes all or part of the building.

Under article 32, failing to comply with the duties is an offence where it "places one or more relevant persons at risk of death or serious injury in case of fire". In England and Wales, the magistrates' court fine is the "statutory maximum", which has been unlimited since 12 March 2015 under section 85 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012. In the Crown Court it's an unlimited fine, up to two years in prison, or both. Under article 32(8), directors and managers can be prosecuted personally where a company's offence was committed "with the consent or connivance of, or to be attributable to any neglect on the part of" them. Article 33 gives a defence if you prove you "took all reasonable precautions and exercised all due diligence to avoid the commission of such an offence". That defence doesn't cover failures under article 8(1)(a) or article 12.

In Scotland, section 72 of the Fire (Scotland) Act 2005 makes it an offence where the failure "puts a relevant person at risk of death, or serious injury". The fine is up to £20,000 in summary proceedings, or up to two years in prison or a fine on indictment. Northern Ireland's article 41 follows the English model: the statutory maximum summarily, and up to two years or a fine on indictment.

How long after a breach can you be prosecuted? The usual six-month limit for magistrates' court cases doesn't apply to these offences, because they can be tried either way:

The Canterbury takeaway below was inspected in June 2021 and sentenced in July 2023.

Sentencing guidelines. In England and Wales there's no Sentencing Council guideline for fire safety offences. The Council considered including them in its 2016 health and safety guideline but decided against it, because it "felt that applying the factors in the Guidelines to offences involving risk of fire had the potential for distorting sentence levels". The Court of Appeal recorded this in R v Butt [2018] EWCA Crim 1617. Courts can use the health and safety guideline as a "useful check" on the final figure, but not to set the fine. Earlier, in New Look Retailers v LFEPA [2010] EWCA Crim 1268, the court said: "The terms of Article 32 do not of themselves imply that fines for breaches of Article 32 should be in a different scale from those imposed under the 1974 Act." We found no Scottish Sentencing Council guideline and no Northern Ireland guideline for fire safety offences, so courts there sentence on the facts and case law.

Three cases from the official record:

• Canterbury Masala Ltd (England, 2023). Kent Fire and Rescue Service inspected a Canterbury takeaway in June 2021. The company pleaded guilty to four breaches, including no fire detection and warning system, no sufficient fire risk assessment and two counts about escape routes. Folkestone Magistrates fined it £4,000 on 5 July 2023 and ordered £19,293 in costs plus a £190 victim surcharge.
• Ashford 23 Ltd / Central Grill, Truro (England, 2026). Cornwall Council reported that the sole director pleaded guilty to five counts, including failing to make a suitable and sufficient fire risk assessment, after the fire service found people sleeping on the first floor above the takeaway. On 18 March 2026 at Truro Crown Court he got 16 months in prison suspended for two years, 200 hours' unpaid work, £4,800 costs and a £154 surcharge.
• Cameron House Resort (Scotland, 2021). A fire at the Loch Lomond hotel on 18 December 2017 killed two guests, Simon Midgley and Richard Dyson. A night porter had put ashes and embers from an open fire in a polythene bag in a cupboard. The sentencing statement records that the company's 2016 fire risk assessors had "observed that there was no written policy covering the emptying of the open fires" and recommended one. The deputy general manager given the job didn't think hot ashes were an issue, and when the assessors flagged it again in 2017, managers challenged them and the report was revised. Dumbarton Sheriff Court fined the company £500,000 on 29 January 2021.

The assessors spotted the risk in 2016. The fire started in 2017.

Common myths

Business owners and assessors keep asking about the same four things online.

"Small businesses with under five staff don't need it written down." That was true in England and Wales until 30 September 2023. It's still true in Scotland and Northern Ireland, unless you hold a licence. Plenty of guides still repeat the old English rule, three years on.

"The law says a qualified assessor must do it." Not yet. Article 9A isn't in force, and one online generator tells buyers that "The law requires the fire risk assessment to be carried out by a competent person". What the law requires today is that the assessment is suitable and sufficient. On X, a fire safety firm put it plainly on 5 October 2026: "Nobody in England needs a licence to sell a fire risk assessment." They pointed to new Level 3, 4 and 5 qualifications built on BS 8674. An assessor added the same day that competence is "knowing what you're competent to assess, recognising where that competence ends".

"Cooking means you have to use a professional." Another generator site says a professional is "strongly recommended" for premises with cooking facilities. That's advice. The law doesn't say it, though cooking near exits does take you outside the small premises guide.

"A flat above my takeaway needs its own assessment." On the Safelincs fire safety forum in February 2025, an owner asked exactly this about a takeaway with a single one-bed flat above and separate entrances. The answer: "No. The commercial FRA should consider the effect of a fire there on other relevant persons (flat above) but the flat does not require an FRA". Two or more flats with a shared building is different, because of the 2021 Act.

Fire risk assessment checklist

• Name the responsible person, and the other responsible persons in the building.
• Walk the premises and list ignition sources, fuel and who's at risk.
• Check detection and alarms, escape routes, fire doors, emergency lighting, signs and extinguishers.
• Write down the findings, the actions, who does them and by when.
• Write an emergency plan and train staff on it, including drills.
• Record the review date each time you review.
• Keep it where an inspector, a new manager or the next responsible person can find it.

Recent and upcoming changes

• 16 May 2022 (England), 1 October 2021 (Wales): Fire Safety Act 2021 clarifies that the Order covers the structure, external walls and flat entrance doors in buildings with two or more homes.
• 23 January 2023 (England): Fire Safety (England) Regulations 2022 in force for buildings with two or more homes.
• 1 October 2023 (England and Wales): Building Safety Act 2022 s156 makes recording universal, adds the shared-building duties and removes the level 3 fine cap.
• 20 January 2025: Home Office five-step checklist updated.
• 27 April 2026: Building Safety (Wales) Act 2026 receives Royal Assent. The new articles 22C to 22E aren't in force yet.
• Not yet commenced: article 9A competence requirement for England and Wales.

Fire law isn't employment law, so the Employment Rights Act 2025 timeline doesn't change any of this.

FAQ

Does a sole trader need a fire risk assessment?

Usually, yes, if you run non-domestic premises such as a shop, café or market unit. The duty depends on the premises, not on having employees. A purely private home is outside the Order.

Who checks your fire risk assessment?

In most premises, the local fire and rescue service. They'll ask to see the assessment and your test records. Don't confuse them with the council's environmental health officer, who inspects food hygiene and some health and safety.

Is a fire risk assessment the same as a fire safety certificate?

No. The old fire certificates went when the risk assessment regimes replaced them. Nobody issues a "certificate" for a fire risk assessment. It's your own document, and you're responsible for it even if someone else wrote it.

Do I need a new assessment if I take over an existing restaurant?

You need to make sure there's a suitable and sufficient assessment for how you'll run it. In England and Wales, the outgoing responsible person must hand you the relevant records under article 22A. Review them against your menu, layout and staffing before you open.