If you run a restaurant, cafe, catering company, or any business that handles food, HACCP is not optional — it is a legal requirement across the European Union and in most countries worldwide. Yet for many small food business owners, the acronym alone triggers anxiety. This guide walks you through everything you need to know: what HACCP is, how the seven principles work in practice, what inspectors actually look for, and how modern software makes the whole process far less painful.
What Is HACCP and Who Needs It?
HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic, science-based approach to identifying and controlling food safety hazards before they cause harm. Rather than testing the final product, HACCP prevents problems from occurring in the first place — making it a proactive rather than reactive food safety system.
In the European Union, Regulation (EC) No 852/2004 on the hygiene of foodstuffs mandates that all food business operators — with very limited exceptions for primary producers and small local suppliers — implement and maintain HACCP-based procedures. This applies to restaurants, cafes, bakeries, food manufacturers, caterers, school canteens, hospital kitchens, food trucks, and any other entity that prepares, processes, stores, distributes, or serves food commercially.
Outside the EU, equivalent legislation exists in the UK (Food Safety Act 1990 and Regulation (EC) 852/2004 as retained law post-Brexit), the United States (FDA Food Safety Modernization Act — FSMA), Canada, Australia, and virtually every developed food-regulatory framework. The principles are universal.
The 7 HACCP Principles Explained Clearly
The Codex Alimentarius Commission — the international food standards body — defines seven principles that form the backbone of any HACCP plan. Here is what each one means in practical terms for a food business.
Identify all potential biological, chemical, and physical hazards at every step of your process — from receiving raw materials to serving the customer.
Determine which steps are "critical" — where a control measure is essential to prevent, eliminate, or reduce a food safety hazard to an acceptable level.
Set measurable boundaries for each CCP — such as a minimum cooking temperature of 75 °C, a maximum cold-storage temperature of 5 °C, or a minimum pH of 4.6.
Define how you will measure and record each critical limit during operations — who does it, when, using which equipment, and how often.
Plan what to do when monitoring reveals that a critical limit has been breached — discard food, re-cook, isolate the batch, identify the root cause, and prevent recurrence.
Confirm that your HACCP system is actually working as intended — through periodic reviews, calibration checks, additional testing, and internal audits.
Maintain records that prove your HACCP system is in operation — temperature logs, corrective action forms, training records, and the HACCP plan itself.
Principle 1 in depth: Three categories of hazard
Hazard analysis starts by mapping your entire process flow — from delivery bay to plate. For each step, you consider three hazard categories:
- Biological: bacteria (Salmonella, Listeria monocytogenes, E. coli O157:H7, Campylobacter), viruses (norovirus, hepatitis A), and parasites.
- Chemical: cleaning product residues, pesticides, allergens migrating between dishes, heavy metals, or unauthorized additives.
- Physical: glass fragments, metal shavings, bone splinters, personal effects (jewellery, plasters), and packaging materials.
Not every hazard becomes a CCP. You assess each hazard for likelihood and severity. Only hazards that pose a significant risk — and can be controlled at a specific step — qualify as CCPs.
HACCP vs GMP vs GHP — Understanding the Difference
HACCP does not stand alone. It sits on top of two foundational layers that must already be in place:
| System | What it covers | Relationship to HACCP |
|---|---|---|
| GHP — Good Hygiene Practices | Personal hygiene, pest control, waste management, potable water, premises design and maintenance | Prerequisite programme (PRP) — must exist before HACCP |
| GMP — Good Manufacturing Practices | Supplier control, equipment calibration, labelling, traceability, allergen management | Operational prerequisite programme (oPRP) — supports HACCP |
| HACCP — Hazard Analysis Critical Control Points | Systematic identification and control of significant food safety hazards at CCPs | Top tier — only effective when GHP and GMP are functioning |
Think of it as a pyramid: you cannot build a reliable HACCP plan on a kitchen with poor hygiene practices. Inspectors will check all three levels, not just your temperature logs.
Common CCPs in Restaurants
While every HACCP plan is site-specific, certain CCPs appear in almost every food service operation. Here are the most common ones and the critical limits typically associated with them:
- Cooking / heat treatment: Core temperature must reach at least 75 °C for poultry, minced meat, and reheated foods (some national guidelines require 70 °C held for 2 minutes as equivalent). This is usually CCP 1 in any restaurant HACCP plan.
- Chilling / cold storage: Refrigerators must maintain ≤ 5 °C; frozen storage at ≤ -18 °C. The temperature danger zone (5–63 °C) is where bacteria multiply fastest.
- Hot holding: Ready-to-eat hot food held for service must stay above 63 °C to prevent bacterial growth.
- Cross-contamination prevention: Separation of raw and ready-to-eat foods, colour-coded chopping boards and knives, and handwashing checkpoints between handling different food categories.
- Supplier/goods-in temperature check: Chilled deliveries rejected if temperature on arrival exceeds 8 °C; frozen goods rejected above -12 °C.
Not all of these will be CCPs for every business — some may be controlled adequately through GHP/GMP procedures rather than formal CCP monitoring. Use the CCP decision tree from Codex Alimentarius to determine which steps genuinely require critical limit monitoring.
HACCP Documentation Requirements
Regulation (EC) 852/2004 explicitly requires food businesses to keep documents and records "commensurate with the nature and size of the food business." In practice, inspectors expect to see:
- The HACCP Plan document — process flow diagram, hazard analysis table, CCP summary sheet with critical limits and monitoring procedures.
- Temperature monitoring logs — refrigerator/freezer temperatures recorded at least twice daily, cooking core temperature checks, hot-holding logs.
- Corrective action records — what went wrong, when, what action was taken, and who authorised it.
- Verification records — calibration certificates for probe thermometers (typically annually), results of any microbiological testing, internal review dates.
- Cleaning and disinfection schedules — what is cleaned, how often, with which product, and by whom.
- Supplier records — approved supplier lists, delivery notes, allergen declarations from suppliers.
- Staff training records — food hygiene certificate dates, HACCP training confirmations.
How Often to Review and Update Your HACCP Plan
Your HACCP plan is not a document you write once and file away. Regulation (EC) 852/2004 requires that it be reviewed whenever any change occurs that could affect food safety. This includes:
- Introduction of new menu items or recipes with different allergen profiles or cooking processes
- New equipment or changes to kitchen layout
- Change of supplier or raw material specification
- Staff turnover that affects HACCP-trained personnel
- Any corrective action that reveals a systemic failure in the current plan
- Following an inspector visit that identified non-conformances
As a baseline, most food safety consultants recommend a formal annual review even when no changes have occurred — and documentation of that review date is itself a verification record.
Inspector Visits — What They Actually Check
The detail of inspection varies by country, but the core focus is consistent across Europe:
- Poland (Sanepid — Państwowa Inspekcja Sanitarna): Inspectors check HACCP documentation, temperature records, staff hygiene certificates (Orzeczenie lekarskie), condition of premises and equipment, and allergen information. Frequency: typically 1–3 unannounced visits per year for restaurants, more for food manufacturers. Non-compliance can result in fines, mandatory closure orders, or prosecution.
- United Kingdom (FSA — Food Standards Agency / local authority EHOs): The Food Hygiene Rating Scheme (scores 0–5) depends heavily on HACCP compliance. Environmental Health Officers look at food management systems, condition of food, and hygiene of premises and facilities. A rating below 3 requires mandatory display in Wales and Northern Ireland.
- Belgium (AFSCA — Agence fédérale pour la sécurité de la chaîne alimentaire): AFSCA uses a risk-based inspection frequency (A/B/C/D ratings). They audit HACCP plans, traceability systems, and labelling compliance. Fines can reach €2,500 for a first offence and €5,000 for repeat violations.
In all jurisdictions, inspectors are more interested in evidence that the system is working than in a perfectly formatted document. Complete, up-to-date records are your best defence.
HACCP for Small Businesses: The Simplified Approach
EU guidance acknowledges that a formal HACCP plan for a sole-trader bakery should not look identical to one for a large catering company. Regulation (EC) 852/2004 permits a flexible approach for small and medium businesses, provided the outcome — safe food — is reliably achieved.
For very small businesses (fewer than 10 employees, limited product range, direct-to-consumer sales), national food safety authorities often publish simplified HACCP templates — sometimes called "safe catering packs" or "HACCP light." In Poland, Sanepid provides guidance through the GIS portal; in the UK, the FSA offers the Safer Food Better Business pack; in Belgium, AFSCA provides Autocontrôle simplifié guidance.
The key simplifications allowed for small businesses include:
- Using industry-standard CCPs and critical limits rather than full custom hazard analysis (for standard menus)
- Combining monitoring and corrective action records into a single daily log
- Conducting HACCP reviews informally but recording the date and outcome
Even with simplification, the non-negotiable minimum remains: a written food safety plan, temperature records, and corrective action documentation.
Digital HACCP Management vs Paper Logs
Traditionally, HACCP documentation meant clipboards, paper temperature sheets, and filing cabinets full of corrective action forms. Many kitchens still operate this way — and it is legally valid. But paper systems have well-documented weaknesses:
- Records are filled in retrospectively (at the end of a shift rather than in real time)
- Temperatures are sometimes copied from memory rather than actually measured
- Paper is destroyed by water, grease, and heat — exactly the conditions of a busy kitchen
- Retrieving a specific record during an inspection is slow and stressful
- There is no automatic alert when a refrigerator drifts above 8 °C overnight
Digital HACCP platforms solve these problems by creating timestamped, cloud-backed records that are accessible instantly during an inspection. Staff log temperatures on a tablet or phone; the system flags deviations automatically and prompts the corrective action workflow. Compliance managers can review the entire food safety audit trail from any device.
For multi-site food businesses, the difference is even more significant: a single dashboard showing compliance across all locations, automatic reminders for calibration due dates, and instant detection of a site where records have not been completed that day.
The business case is straightforward. The time saved on paperwork pays for the software within weeks. The risk reduction — avoiding a food poisoning outbreak, a failed inspection, or a reputational crisis — is worth considerably more.