Fire risk assessments: the law, how often, and who's liable

If you control a building that other people use — a school, a care home, an office, the common parts of a block of flats — you are almost certainly required to have a current fire risk assessment. Not a tick-box, not a folder gathering dust: a live document that reflects the building as it is today. Get it wrong and the liability is personal and criminal.

Who has to do it

The duty sits with the Responsible Person — under the Regulatory Reform (Fire Safety) Order 2005 (the "RRO"), that's the employer, owner, or whoever has control of the premises. In a managed building it can be more than one person, and they must co-operate. You can delegate the work of assessing to a competent person, but you cannot delegate the duty. If it goes wrong, it's your name on the prosecution.

Since the Building Safety Act 2022 amended the RRO (in force 1 October 2023), Responsible Persons must also record the assessment in full and record who they are — the old exemption for small premises with fewer than five employees is gone.

What it has to cover

A fire risk assessment isn't a document you buy; it's a process you carry out and then write down. It must:

• identify the fire hazards and the people at risk;
• evaluate, remove or reduce the risks;
• record the significant findings and the actions taken;
• set out the fire-safety arrangements — detection, alarms, escape routes, signage, emergency lighting, extinguishers;
• and be reviewed and kept current.

The standard most assessors work to is PAS 79, and the government publishes guidance for different premises types.

How often

This is the question everyone asks, and the honest answer is: the law gives no fixed number. The RRO requires the assessment to be reviewed regularly and kept up to date, and redone whenever there's reason to suspect it's no longer valid or there's been a significant change — a refurbishment, a change of use, new occupants, an incident.

The workable rule most estates teams adopt:

• Review annually, and
• Fully reassess every one to two years, or immediately on any material change.

Buildings with a "sleeping risk" — HMOs, care homes, hotels, student accommodation — sit at the higher-frequency end, because the consequences of a failure are worse.

What happens if you don't

Enforcement is by the local Fire and Rescue Authority. They can serve alterations, enforcement and prohibition notices, and prosecute. Penalties for serious breaches are unlimited fines and up to two years' imprisonment. Prosecutions of landlords, managing agents and care providers are routine, and the Responsible Person is the one in the dock.

Where it fits in the bigger picture

Fire is one of a dozen statutory regimes you're carrying at once — it sits alongside EICR electrical safety, gas safety, legionella and the rest. The failure mode is rarely "we didn't know it mattered" — it's "the review date slipped and nobody noticed." Our complete guide to UK property compliance maps the full set.

That slippage is exactly what software should prevent. Proprietas tracks your FRA review date per building, drives the status from valid to due-soon to overdue, and chases it at 90/60/30/7 days — so the date never quietly passes. You can try it on your own certificate before committing to anything.

This is a plain-English overview, not legal advice — your specific duties depend on your buildings and how they're used.