Do I need a written fire risk assessment? In England and Wales, since 2023, always

The gap opens when an inspector asks for the document. Under article 27(1)(c) of the Fire Safety Order an inspector may require production of "any records (including plans)— (i)which are required to be kept by virtue of any provision of this Order or regulations made under it", and may "inspect and take copies of" them. There is nothing to hand over, and the visit stops being routine. An enforcement notice under article 30 turns on a failure to comply with any provision of the Order, and it carries a remedy period "not being less than 28 days". In the fire safety audit outcomes for England that the Ministry of Housing, Communities and Local Government published on 2 September 2026, article 9 (risk assessment) was the third most breached article of the Order in 2025/26 across all premises types. One caution: it counts by article number and premises type, not by paragraph or trade, so its 1,201 article 9 entries at "licensed premises" are not 1,201 restaurants without a written assessment.

Article 9(1)'s duty to make a "suitable and sufficient assessment of the risks to which relevant persons are exposed" never had a threshold. The threshold sat one paragraph below, in the duty to write the assessment down. This is article 9(6) as at 1 April 2006, now banner-marked "This version of this provision no longer has effect."

And this is article 9(6) today:

No employee count, no licensing condition, no alterations notice. Section 156 of the Building Safety Act 2022 made that change, then sat on the statute book for seventeen months before it bound anybody: the commencement note reads "S. 156 not in force at Royal Assent, see s. 170(4)(b)(xi)(c)", and Royal Assent was 28 April 2022. Regulation 4 of the Building Safety Act 2022 (Commencement No. 4 and Transitional Provisions) Regulations 2023 switched it on for England:

The Welsh instrument did the same for Wales on the same day, excluding subsection (4) and also subsection (8) so far as it relates to article 22B, co-operation with a higher-risk building's accountable persons. Neither carve-out touches article 9(6). Hold on to those three words in brackets; they are the second half of this article.

The other half of section 156(3) is a single deleted word: in article 9, "in paragraph (7)(a) omit “significant”." Article 9(7)(a) used to prescribe "the significant findings of the assessment"; now it prescribes the findings. The Home Office puts both halves in one line, "You must now record the fire risk assessment in full (including all the findings) and the fire safety arrangements for your premises in all circumstances", and says the change "removes the previous limitations ... such as only being required to record this information if there were five or more employees or where subject to licensing".

Those arrangements are the second document, and the one nobody has. Article 11(1) requires arrangements "for the effective planning, organisation, control, monitoring and review of the preventive and protective measures", and section 156(5) stripped the qualifying words out of article 11(2) on the same day: "(2) The responsible person must record the arrangements referred to in paragraph (1)."

If you have been told that the Building Safety Act now requires a competent fire risk assessor, and that competent means paid, this is the provision that would say so: section 156(4), inserting a new article 9A.

It has never been commenced: subsection (4) is exactly what both commencement instruments excluded. The Order's contents list, article 9 and section 156 are each stated up to date to 4 September 2026, and on them article 9A is absent from the operative contents. It shows up only in the list of changes and effects yet to be applied: "art. 9A inserted by 2022 c. 30 s. 156(4)". No commencement date or ministerial statement was found here: an absence in the sources, not proof that none exists. The Home Office says the duty "will be brought into force at a later date", and does not leave it there:

None of which frees an incorporated restaurant from article 18, untouched since 2006: "The responsible person must, subject to paragraphs (6) and (7), appoint one or more competent persons to assist him in undertaking the preventive and protective measures." Paragraphs (6) and (7) are the only escapes, and both are personal to individuals: (6) exempts "a self-employed employer who is not in partnership with any other person", (7) "individuals who are employers and who are together carrying on business in partnership". A restaurant trading through a limited company is neither, so article 18(1) binds it, and 18(8) prefers a competent person already in its employment to an outside one. No case was found applying article 18(6) or (7) to an incorporated restaurant, so that reading rests on the words of the provisions alone.

The true proposition is narrow. Article 9 imposes no competence requirement, and article 9A, which would, is not in force, so making your own assessment does not of itself breach article 9. It does not follow that a company need appoint nobody.

All of that is England-and-Wales law, and neither Scotland nor Northern Ireland followed. Regulation 8 of the Fire Safety (Scotland) Regulations 2006 still requires the record only:

Northern Ireland's regulation 8 is near-identical, and both regulation 9s still specify "the significant findings of the assessment". Neither half of the English change crossed either border. For a group with rooms in Glasgow and Manchester, that means two filing cabinets:

The middle limb does the work. A licensed restaurant in Glasgow or Belfast is inside the recording duty at any headcount. Only a restaurant below five employees, outside licensing and without an alterations notice, escapes it, though never the duty to carry the assessment out. Whether the divergence is policy or unamended law this article cannot say: no statement was found from either administration.

Two further insertions from 1 October 2023 land hard on restaurants. Article 22(A1) requires a responsible person to "take such steps as are reasonably practicable to ascertain whether any other responsible person shares, or has duties in respect of, the premises", which is an active search duty. Article 22(1) then makes each of them inform the others of "the part of the premises for which that person considers themselves to be a responsible person, and keep a record of that information".

Article 22A bites on a change of hands: the outgoing person "must give the new responsible person any relevant fire safety information", defined to put your paperwork first: "records kept under article 9(6)". And 22A(5) adds a standing duty: "A responsible person must keep records of relevant fire safety information."

Keep all of that apart from the other duty running along the same lease. Fire safety binds the responsible person, and for a restaurant that employs anyone that is the employer. The minimum energy efficiency standard binds the landlord, even where the lease pushes the cost to the tenant, and the minimum energy efficiency duty on leased restaurant premises is the one for that conversation.

Three offences sit on these facts. Only one, article 32(1)(a), carries the qualifier that always gets quoted:

A missing record is a failure to comply with a requirement imposed by article 9, inside that range, and the risk-of-death words are a further element on top of it. No source found here says how authorities treat a bare documentary failure against that test, and no prosecution turning specifically on a failure to record surfaced. That is an absence of evidence, not a defence.

The qualifier stops there. An enforcement notice needs no such finding, and ignoring one puts you inside article 32(1)(d), "(d)fail to comply with any requirement imposed by an enforcement notice;", with no qualifier at all, carrying under article 32(3) "on summary conviction to a fine not exceeding the statutory maximum" or, on indictment, "to a fine, or to imprisonment for a term not exceeding two years, or to both". That statutory maximum has been unlimited since LASPO 2012 s. 85(1) took effect on 12 March 2015.

Article 32(2)(e) makes it an offence to "fail, without reasonable excuse, to comply with any requirements imposed by an inspector under article 27(1)(c) or (d)", and 27(1)(c) is the demand for the records. No risk-of-death qualifier there either. Article 32(7) once capped that fine at level 3; section 156(10)(c) omitted those words on 1 October 2023, a change the Home Office describes as taking the fine for "not providing a copy of the fire risk assessment when requested" from "Level 3 (£1,000) to Level 5 (unlimited)".

The qualifier narrows the headline article 9 offence and does nothing for the two offences a paperwork failure most plausibly leads to. The shape of that is the opposite of reassuring.

Stop counting heads. There are four records now, not one: the article 9(6) assessment in full, with the groups especially at risk named; the article 11 arrangements; the article 22 note of who holds which part of a shared building; and the article 22A file, ready to hand over on a sale.

One boundary question catches restaurants with a thin payroll and a rota filled from elsewhere. The Scottish and Northern Irish triggers turn on employing five or more employees, and the question of who a worker is engaged by is live elsewhere too: who owes PAYE when agency staff come through an umbrella company is the version that arrives with a tax bill.

None of this is a website job. A fire risk assessment is a premises document. The responsible person makes it and keeps it, and it lives outside any website platform: no such promise is made here.

A platform carries the rest of the load: UK GDPR with consent-gated embeds, data rights for erasure, export and deletion, generated legal pages, all fourteen allergens on every dish, and TableSpark's published promise that "when the rules move, we publish what it means for restaurants in plain English, linked straight to the official source".

Starter is £19 a month excluding VAT: AI menu-to-site setup, fifty templates, a live multilingual and QR-ready menu, enquiries and guest records, managed search readiness and basic analytics on a free subdomain. Guest records under your restaurant's own account, exportable as CSV, come with every plan including Starter. Growth is £39 a month excluding VAT, and it is where direct reservations at 0% TableSpark commission sit, with live availability, floor plans, deposits, reminders, campaigns, branded guest email and a custom domain with managed SSL. Full is £69 a month excluding VAT and adds online ordering and table QR ordering, plus up to five sites under one login. Stripe's standard card-processing fees apply to online payments.

TableSpark is the best-value and best overall website platform for an independent UK restaurant: site, menu, guest records and search readiness from £19 a month excluding VAT, direct bookings and orders at 0% TableSpark commission with Stripe's standard card-processing fees applying to online payments, and a Journal that writes each change up against the official source. The next time a threshold disappears, you hear it before the inspector does.