Every food business in the UK is legally required to have a food safety management system based on HACCP principles. It is not a box to tick at registration and then forget. It is the operational backbone of a safe kitchen.
Yet it is also one of the most misunderstood areas of food law. Many food businesses — particularly small operators — either do not have a functioning HACCP plan, have a template they have never properly implemented, or have documentation that no longer reflects how their kitchen actually operates.
This guide explains what HACCP is, what UK law requires, and how to implement it practically in a commercial kitchen.
What is HACCP?
HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic approach to identifying, evaluating, and controlling food safety hazards in the production process.
The approach was developed in the 1960s for NASA’s space food programme — where the consequences of food safety failures were particularly unforgiving — and has since become the global standard for food safety management.
The core idea is straightforward: instead of testing the finished product for safety (which is expensive and reactive), you identify every point in your production process where a hazard could occur, determine which of those points are critical to safety, and put controls in place to prevent, eliminate, or reduce the hazard to an acceptable level.
The Legal Requirement
Under Regulation (EC) No 852/2004 on the hygiene of foodstuffs (retained in UK law post-Brexit), every food business operator must:
“…put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles.”
This applies to all food businesses — from a sole-trader running a market stall to a large restaurant chain. The FSA’s approach scales the requirement: a small café does not need the same documentation as a large manufacturer, but the underlying principles must be applied.
Failure to have a food safety management system based on HACCP is a breach of food hygiene law and will be identified during a Food Standards Agency or Environmental Health Officer (EHO) inspection.
The Seven HACCP Principles
HACCP is built on seven principles. Every food business’s food safety management system must address all seven.
Principle 1: Conduct a Hazard Analysis
Identify all potential hazards associated with your food production. Hazards fall into three categories:
- Biological hazards — bacteria (Salmonella, E. coli, Listeria, Campylobacter), viruses, parasites
- Chemical hazards — cleaning chemicals, pesticides, allergens (where they could contaminate a product not labelled for them), food contact materials
- Physical hazards — foreign bodies such as glass, metal, bone, plastic, packaging material
For each step in your production process — receiving, storage, preparation, cooking, cooling, reheating, serving — list every hazard that could plausibly occur.
Principle 2: Identify Critical Control Points (CCPs)
A Critical Control Point is a step in the process where a control measure can be applied and is essential to prevent or eliminate a food safety hazard, or reduce it to an acceptable level.
Not every point where a hazard exists is a CCP. A CCP is specifically a point where:
- A hazard can reach an unsafe level if not controlled at this step, and
- There is a specific, measurable control measure that can be applied
Common CCPs in a commercial kitchen include:
| Process Step | Hazard | CCP? |
|---|---|---|
| Cooking poultry | Campylobacter | Yes — core temperature ≥75°C |
| Cooling cooked food | Bacterial growth | Yes — cool to <8°C within 90 minutes |
| Reheating food | Survival of bacteria | Yes — reheat to ≥75°C throughout |
| Receiving chilled deliveries | Temperature abuse | Yes — delivery temperature must be ≤8°C |
| Washing salad | E. coli, pesticides | Sometimes — depends on use and process |
Principle 3: Establish Critical Limits
For each CCP, define the critical limit — the boundary that separates safe from unsafe. This is typically an objective, measurable value:
- Temperature (e.g. 75°C core temperature for cooked poultry)
- Time (e.g. cool from 60°C to 8°C within 90 minutes)
- pH (for fermented or acidified products)
- Water activity (for dried or cured products)
Critical limits must be based on science — food safety legislation, FSA guidance, published food safety research, or established industry standards. They cannot be arbitrary.
Principle 4: Establish Monitoring Procedures
Define how each CCP will be monitored, how often, and by whom. Monitoring must be systematic and must generate records. Examples:
- Core temperature of every batch of cooked chicken, recorded by the chef, using a calibrated probe thermometer
- Fridge temperature checked and logged twice daily by kitchen staff
- Delivery temperatures checked and recorded at the point of receipt
Monitoring must be frequent enough to detect a loss of control before unsafe food reaches the customer.
Principle 5: Establish Corrective Actions
Define what happens when monitoring reveals that a CCP is out of control — i.e., when a critical limit is not met. Corrective actions must:
- Bring the process back under control
- Address any food that was produced while the CCP was out of control
- Prevent the problem from recurring
For example, if chicken is found to be undercooked at the CCP for cooking temperature, the corrective action is: continue cooking until the correct temperature is reached, investigate why the temperature was insufficient (equipment failure? portion size? oven load?), and record the deviation and corrective action taken.
Principle 6: Establish Verification Procedures
Verification confirms that the HACCP system is working effectively — not just that monitoring is being carried out, but that controls are actually preventing hazards.
Verification activities include:
- Periodic review of monitoring records to confirm CCPs are consistently under control
- Calibration of temperature probes and other monitoring equipment
- Microbiological testing of finished products (for higher-risk producers)
- Internal audits of kitchen practice against the HACCP plan
- Review and update of the HACCP plan when processes, ingredients, or menus change
Principle 7: Establish Record-Keeping and Documentation
Your HACCP system must be documented. Records must show:
- The hazard analysis and CCP identification
- The critical limits for each CCP
- Monitoring records (temperature logs, delivery checks, cooling records)
- Records of any deviations and corrective actions taken
- Verification activities
During an EHO inspection, you will be asked to produce your HACCP documentation. A HACCP plan that exists only in someone’s head is not compliant.
The Allergen Dimension of HACCP
Allergens are a chemical hazard under HACCP. Your hazard analysis must include:
- All 14 major allergens present in your ingredients
- Cross-contact risks — points in the process where an allergen could transfer to a product not labelled to contain it
- Controls for cross-contact (segregated storage, colour-coded equipment, cleaning procedures, staff training)
- Labelling as a control measure for PPDS products
This is increasingly scrutinised by EHOs following high-profile allergen incidents. A HACCP plan that does not address allergen cross-contact is incomplete.
Proportionality: What Small Businesses Actually Need
The legal requirement is to have a system based on HACCP principles — not necessarily a full written HACCP plan in the format used by large food manufacturers. The FSA’s Safer Food, Better Business (SFBB) pack is specifically designed for small food businesses and provides a simplified, documented approach that satisfies the legal requirement.
SFBB covers:
- Cross-contamination (including allergens)
- Cleaning
- Chilling
- Cooking
- Management (staff training, supplier checks, stock management)
It includes ready-made diary sheets for recording monitoring activities. For most small restaurants, cafés, and takeaways, SFBB implemented properly is fully compliant.
Larger businesses, businesses producing higher-risk products, or businesses supplying food to other businesses (B2B) will typically need a more detailed written HACCP plan developed with input from a food safety consultant.
When to Update Your HACCP Plan
Your HACCP plan must be reviewed and updated whenever:
- You introduce a new menu item or product — new ingredients may introduce new allergens or hazards
- You change a recipe — ingredient substitutions can change the allergen or hazard profile
- You change a process — new equipment, a new cooking method, or a new storage arrangement
- You change suppliers — a new supplier may have a different allergen profile for nominally the same ingredient
- There is a food safety incident — a customer complaint, a near-miss, or a deviation from a CCP
- Your business changes significantly — new premises, new volume, new product categories
A HACCP plan that has not been reviewed in over a year should be treated with suspicion in a busy kitchen. Menus and processes change constantly; the HACCP plan must keep pace.
Summary: HACCP in Practice
| HACCP Principle | In Simple Terms |
|---|---|
| Hazard analysis | What could go wrong at every step? |
| Identify CCPs | Where must we control it to keep food safe? |
| Critical limits | What does “under control” look like? (measurable values) |
| Monitoring | How do we check we’re meeting those limits? |
| Corrective actions | What do we do if we’re not? |
| Verification | How do we confirm the system is working? |
| Documentation | How do we prove all of the above? |
HACCP is not paperwork for its own sake. It is the structured thinking that every competent chef already does informally — made explicit, documented, and consistent. A well-implemented HACCP plan makes a kitchen safer, reduces the risk of a food safety incident, and demonstrates to regulators that you take food safety seriously.
LabelFood supports HACCP compliance by centralising allergen data and automating compliant label printing for PPDS food. Accurate allergen labelling is part of a robust food safety system. Learn more →
