Software for fire and security installers: a UK guide

Last updated: August 2026

The alarm goes off at ten past two on a Sunday morning. The keyholder does not answer, the customer rings you rather than the monitoring centre, and on Monday there is a letter from the force. It is the second false call on that site inside a year. One more and the customer loses police response, and the letter withdrawing it is copied to you, because you are the maintaining company.

Elsewhere, three hundred service visits are due this year that nobody will ever ring up to book. And in March the inspectorate will pull half a dozen job files at random and read them.

That is the real specification. Not a tidier diary.

Four product lines and three business shapes

A fire and security firm usually sells four largely separate product lines to the same customer. Intruder and hold-up alarms, under BS EN 50131 applied through PD 6662, and BS 8243 where police response is wanted. Fire detection and fire alarm systems, under BS 5839-1 in non-domestic premises. Video surveillance under BS EN 62676, with BS 8418 for detector-activated remotely monitored systems. And access control under BS EN 60839-11-1, meeting BS 7273-4 wherever an electrically locked door sits on an escape route.

Around those sit lone worker devices, door entry, gates and barriers, keyholding and monitoring. The last two are almost always bought in: the installer resells an Alarm Receiving Centre connection rather than running a centre.

Three business shapes fall out of that. Domestic-led installers doing house alarms, cameras and doorbells, mostly one-off work with little recurring revenue. Commercial install-and-maintain firms, roughly three to thirty engineers, which sell a system and then service it twice a year for a decade. And contractor-side firms subcontracting to M&E contractors on fit-out, working to a consultant’s specification and invoicing on application with retention held. Most firms of any size are a blend, and that is why the admin is hard: one office runs a construction programme, a maintenance book and a callout rota at the same time.

The revenue is concentrated, too. The BSIA represents over 520 member companies providing more than 70% of UK security products and services by turnover, so a few large firms carry most of the market and the tail is very small.

Fire risk assessment as a service, and extinguisher servicing as a business, are a different trade with a different round, covered in fire risk assessment and extinguisher servicing software.

Three false calls and the police stop coming

Nothing else in this trade has consequences this sharp, and most content written about it is out of date. The governing document in England, Wales and Northern Ireland is the NPCC police requirements for response to security systems, March 2024 edition.

There are now two response levels for a compliant Type A system: Level 1, immediate, always subject to demand and resources and never guaranteed, and Level 3, withdrawn, keyholder response only. Police Scotland keeps three: Level One immediate, Level Two desirable and resource dependent, and Level Three keyholder only. Anyone working both sides of that border is running two products.

The ladder for an intruder system: after two false calls in a rolling twelve months the customer is written to and the maintaining company is copied in. After three, response is withdrawn not less than fourteen days from the letter, and the maintaining company has to instruct the monitoring centre to stop passing activations to police. A hold-up alarm is stricter, at two. In Scotland three false calls downgrades Level One to Level Two rather than removing response outright.

Reinstatement is the installer’s job. The security company applies, having identified the cause, done the remedial work and evidenced ninety days free of false activations from the date of the last one. Six months withdrawn with no application and the URN is deleted. The regime watches the firm as well as the site: forces may monitor a company’s false alarm ratio and reserve the right to suspend companies that consistently exceed the force average.

Two administrative points belong on the office wall. The URN is applied for by the installer and issued and owned by the police, not by the customer and not by the ARC. And the £55.60 plus VAT application fee is payable by the system user, must be highlighted to them in writing, and any charge you add on top has to appear on the invoice separately, with a fraud warning attached to misrepresenting it.

The service round is generated by dates, not by customers

BS 5839-1 recommends a minimum of two inspection and test visits a year for most non-domestic fire alarm systems, and secondary summaries of the 2025 edition describe a five to seven month window around the six-month point as compliant. Monitored intruder systems with police response are typically serviced twice a year, bells-only once.

Nobody rings up to book any of it. The office generates the visit from a due date, chases access and gets an engineer there inside the window. Miss it and the customer’s fire file shows a gap that a fire officer, an insurer or an incoming facilities contractor will find. That is a compliance gap with your name on it, not a late job.

The quieter failure is that the book decays. Sites change hands, contacts leave, customers move premises, systems get replaced by a competitor, and the due-date list drifts out of line with reality one site at a time. Nothing tells you. You find out when you turn up.

Meanwhile the round competes for engineers with the callouts. The FIA’s market research has repeatedly recorded that recruiting engineers is getting harder and salaries are rising. The firm is capacity-constrained rather than demand-constrained, and the capacity is not interchangeable: the fire-qualified engineer cannot cover the access control job, and the apprentice cannot commission anything. Balancing a planned round against reactive work is a general problem too, covered in job scheduling for a small team.

The paperwork is the licence to trade

There is no statutory licence to install alarms, CCTV or fire alarms in the UK. What exists is third-party certification, voluntary in law and effectively mandatory in commerce, because insurers name it, police policy requires it and a facilities manager checks the register rather than a review site.

NSI and SSAIB are the two dominant UKAS-accredited certification bodies, and a firm may hold both. Insurance conditions commonly name an SSAIB-certificated or NSI Gold approved company. BAFE is a scheme owner rather than a certification body, and BAFE SP203-1 is modular: design, installation, commissioning and maintenance are certificated independently. Saying a firm is BAFE registered without naming the modules tells the customer’s compliance file nothing.

The audit is the point. SSAIB runs an initial certification audit then annual surveillance audits, and what the auditor does is sample completed jobs, examine the documentation and observe engineers. So the job file has to be retrievable by site and by date, years later, by somebody who was not there.

A single commercial job can produce a survey and risk assessment, a design proposal, a customer acceptance, RAMS under CDM 2015, installation and commissioning certificates, an as-fitted record amended from the design proposal, a certificate of compliance, a logbook, user training sign-off and a URN application. Fire alarm certificates are issued per stage and per organisation, each signed by a competent person, which is why a firm holding only the maintenance module still needs the design and installation certificates from whoever did those stages. The file has to be complete even when three companies contributed to it.

Two decisions taken at survey bite later. A maglock on an escape route is BS 7273-4 work, with a category to be agreed and recorded rather than a pair of wires. And a domestic camera that sees past the property boundary takes the householder outside the domestic exemption and makes them a data controller. That is the customer’s obligation, not yours, but you are the one in the room when it comes up.

Alarms are not construction, and that changes the invoice

Most people assume that installing an alarm in a building is a construction operation. By statute it is not, and this is where a great deal of published advice for this trade is simply wrong.

HMRC’s CIS manual at CISR14290 cites FA04/S74(3)(i) and excludes burglar alarms, CCTV employed for security purposes, public address systems, simple door entry systems and computerised locking systems, where the system is dedicated to that purpose, electronic in character, and its installation has no substantial effect on the fabric of the building.

Fire is split in two. CISR14160 puts fire alarm and detection systems limited to audible and visible warning outside CIS as well, as a public safety function. But structural fire protection, and detection that interacts with it, is inside. So the same firm’s panel and detectors sit outside the scheme while its fire shutter or damper work sits inside, and on a mixed subcontract only the construction element falls within CIS. The split on the invoice does real work.

The VAT domestic reverse charge follows CIS scope and inherits the same shape. HMRC’s lists put security system installation outside it when supplied on its own, and fire protection inside. The trap is that where excluded work forms part of a mixed supply containing specified construction services, the reverse charge applies to the whole supply, so the same engineer’s day can be standard rated on one job and reverse charged on the next. Domestic customers are never in it.

The defensible summary: a warning-only fire alarm is outside CIS and therefore outside the reverse charge, structural fire protection is inside both, and a mixed contract pulls everything in. Anything more confident is a question for your accountant, and worth the phone call, because it decides whether you charge VAT.

How Dispatch helps

Dispatch gives the install and the service round one home, so the job file an auditor samples is assembled as you work rather than reconstructed afterwards.

Certificates from your certification software, along with RAMS, method statements and as fitted records, attach to the job as PDFs, images or Word files and are kept for the life of the job, retrievable by site and by date years later. That is precisely what an NSI or SSAIB surveillance audit asks for. A completion report captures the write up and up to twelve photographs before a job can be marked Completed, on by default, so the evidence exists before anyone chases it.

Recurring visits, switched on in Settings, put a site back on the calendar on a repeating series. Book onto a week calendar where double bookings warn rather than block, because a ten minute call between two jobs is normal working. Two way job chat with photographs, opened from a link you text, keeps the customer conversation on the job instead of in someone’s messages.

Quote, invoice and take card payment into your own Stripe account, with CIS handled on the invoice once switched on in Settings.

Every feature is on every plan, everything runs in the UK, and there is a free plan. Put one maintenance visit through it and see how the file looks.