HACCP: what it means, the 7 principles and the UK law

HACCP at a glance

• HACCP stands for Hazard Analysis and Critical Control Point. It's a way of finding what could make food unsafe and controlling it at the steps that matter.
• In the UK, food businesses after primary production must have procedures based on the seven HACCP principles. The law allows a simpler approach for simple businesses.
• Most small caterers and retailers meet the duty with the official packs: Safer Food, Better Business in England and Wales, CookSafe or RetailSafe in Scotland, Safe Catering in Northern Ireland.
• Not having HACCP-based procedures is a criminal offence in every UK nation. Directors and managers can be prosecuted personally.
• What officers want is evidence that the procedures are followed, which in practice means records.

What does HACCP stand for and what does it mean?

HACCP stands for Hazard Analysis and Critical Control Point. The international standard is the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), last revised in 2022.

In the FSA's plain terms, you look at what you do and what could go wrong, then decide what to control, what to do when it goes wrong, how to check it works and what to record (FSA HACCP guidance).

Four terms do most of the work:

GOV.UK's food safety management guide sorts hazards into three main types, and puts allergens in the chemical group:

HACCP is the method. What it produces is your procedures and records: a full HACCP plan, or an official pack such as Safer Food, Better Business that has done the hazard analysis for common tasks.

Where did HACCP come from?

HACCP started in the early 1960s with food for NASA's Gemini and Apollo astronauts. Paul Lachance at NASA worked with Pillsbury microbiologist Howard Bauman and the US Army Natick Laboratories (NASA Spinoff).

Testing the finished food wasn't enough: in the early Gemini days the team destroyed "one batch after another when irregularities were found". From 1963 the Apollo Program Office required contractors to identify and control potential points of failure, based partly on the military's Failure Mode and Effects Analysis, and the team applied that to food.

Pillsbury presented HACCP at the first National Conference on Food Protection in 1971. After two botulism deaths from canned soup that summer, the US Food and Drug Administration asked Pillsbury to train its inspectors in it.

The UK first wrote hazard analysis into general food hygiene law in the Food Safety (General Food Hygiene) Regulations 1995. Regulation 4(3) required owners to identify steps "critical to ensuring food safety" using five principles, with no separate step for critical limits, corrective action or documentation. The full seven-principle duty arrived with Regulation (EC) 852/2004, which applied from 1 January 2006. It stayed in UK law after Brexit.

Is HACCP a legal requirement in the UK?

Yes. Article 5(1) of Regulation 852/2004 says: "Food business operators shall put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles." Based on leaves room for something simpler than a textbook plan.

Two limits on the duty matter:

• It's meant to be flexible. Recital 15 of 852/2004 says the requirements should work "in all situations, including in small businesses": some businesses have no identifiable critical control points, good hygiene practice can replace monitoring, critical limits needn't be numbers, and records should avoid "undue burdens for very small businesses".
• Very simple businesses may not need written procedures at all. The FSA says food safety procedures "may not be necessary if processes in your business are very simple", and you can comply by following good hygiene practice, after checking with your council (FSA, Managing food safety).

Article 5(4) adds that you must give the council evidence of compliance "taking account of the nature and size of the food business", and keep the documents up to date.

Each UK nation turns the duty into an offence through its own hygiene regulations:

In England, Schedule 2 to the 2013 Regulations lists Article 5(1) as a "specified EU provision", so breaking it is an offence under regulation 19. HACCP also sits under the wider Food Safety Act 1990, which the hygiene regulations are made under.

What are the seven principles of HACCP?

Codex sets out seven principles. Article 5(2) of Regulation 852/2004 lists the same seven as letters (a) to (g), in slightly different words.

Codex separates two ideas people mix up. Validation of control measures is "obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome", proving a limit works before you rely on it. Verification is "the application of methods, procedures, tests, and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended". The FSA's MyHACCP tool puts both under principle 6 as "validation, verification and review" (MyHACCP).

Article 5(2) also says that whenever you change the product, the process or any step, you must review the procedure and make the necessary changes.

What has to happen before the seven principles?

Codex says prerequisite programmes, including good hygiene practices (GHPs), should be "well-established, fully operational and verified" before HACCP, because "HACCP application will not be effective without prior implementation of prerequisite programmes including GHPs". MyHACCP lists premises designed for good hygiene, trained staff, safe water and adequate temperature control.

Codex says "for some GHPs, based on safety concerns with food, greater attention may be needed", such as cleaning surfaces that touch ready-to-eat food rather than walls. That is how a small kitchen controls hazards that aren't at a CCP, such as allergens.

Codex then sets out 12 application steps. The first five come before the principles:

1. Assemble the HACCP team and identify scope. Decide which products and processes are covered. MyHACCP says the team may be one or two people in a small business who know how the food is made.
2. Describe the product, including how it's stored and distributed.
3. Identify its intended use and who will eat it, including vulnerable groups.
4. Draw a flow diagram of every step.
5. Confirm the flow diagram on site, during all stages and hours of operation.

Steps 6 to 12 are the seven principles in order.

What is a critical control point?

A critical control point is a step where control is essential, usually because no later step will put the problem right, such as cooking raw chicken. Handwashing matters as much but is a prerequisite, because it applies at every step.

Codex only sets CCPs for significant hazards. Annex IV of the Codex text gives an example decision tree, asked at each step where a significant hazard has been identified:

Codex says the tree "should be flexible", and your business may have no CCPs at all, which Recital 15 of 852/2004 accepts.

UK numbers that often become critical limits:

Where no number exists, such as cooling, you set and prove your own limit. SFBB's "Prove it" method asks you to test the temperature at the centre as food chills, try different cooling methods and use the fastest (SFBB Prove it).

Worked example: a HACCP chart for a batch-cooked curry

An English restaurant cooks chicken curry in the morning, cools and chills it, and reheats portions for evening service. Your own hazard analysis decides your CCPs.

Verification for this kitchen might be a weekly look through the logs by the head chef, a monthly probe check in iced water (should read -1°C to 1°C) and boiling water (99°C to 101°C), as in SFBB's Prove it method, and a review whenever the recipe, equipment or batch size changes (see the food probe accuracy test).

The checks themselves have their own guides: cooked food temperature checks, hot holding temperature checks and food cooling temperature checks.

Do you need a full HACCP plan, SFBB, CookSafe or Safe Catering?

Every route below counts if it fits what you do. GOV.UK adds that your local food safety team "might advise that you need an HACCP plan if your business is larger or higher-risk".

CookSafe uses HACCP language (flow diagrams, HACCP charts, house rules); SFBB uses "safe methods" and a daily diary. Either only counts if it matches your kitchen.

Who is responsible for HACCP?

The legal duty falls on the food business operator, which means you, or your company if you trade as one. Inside your business:

• Owners and directors carry the legal risk. In England, if a company commits an offence with the "consent or connivance" of a director, manager or similar officer, or through their neglect, that person can be prosecuted too (reg 20).
• Whoever develops and maintains the procedures must have had "adequate training in the application of the HACCP principles" (852/2004, Annex II, Chapter XII).
• Food handlers must be "supervised and instructed and/or trained in food hygiene matters commensurate with their work activity". They do the monitoring and corrective actions, so they need to know their part of the plan.
• Managers and supervisors usually check records and sign off reviews.

The law doesn't name a course level. A Level 2 or Level 3 HACCP certificate is one way to show training. It isn't a legal requirement in itself.

What HACCP records do you need to keep?

Article 5(2)(g) asks for documents and records "commensurate with the nature and size of the food business". A café needs far less than a factory, but enough to show it does what its procedures say.

You'll usually need:

• The procedures: your HACCP plan or completed pack, including the hazard analysis, CCPs, limits and corrective actions. Article 5(4)(b) requires it to be current.
• Monitoring records: temperatures, times and checks at each CCP.
• Corrective action records: what went wrong and what was done.
• Verification and review records: probe checks, reviews and changes. SFBB has a four-weekly review that "requires completion even if no problems have been found" (SFBB diary).
• Training records: the FSA calls keeping them "a good idea" so you can show officers.
• Supplier records for traceability, including names, addresses, products, quantities and dates.

The FAO says entries should be legible, signed, dated, with units, and backed up if electronic (FAO, HACCP documentation and record-keeping).

How is HACCP enforced and what are the penalties?

Council environmental health officers check food safety management at inspections. Under the food hygiene rating scheme, one of the three scores is how you manage food safety, "looking at processes, training, and systems". Weak procedures can hold your rating down even if the kitchen is clean.

Enforcement steps. An officer who believes you're breaking the hygiene regulations can serve a hygiene improvement notice. It must say what's wrong and what to do, and give at least 14 days to comply (reg 6). Not complying is an offence. Where there's an imminent risk of injury to health, an officer can impose an immediate prohibition by notice and then apply to a magistrates' court for an order (reg 8).

Penalties. In England, an offence under regulation 19 can be punished:

• in the magistrates' court, by a fine up to the statutory maximum. For offences committed on or after 12 March 2015 that maximum is unlimited in England and Wales (LASPO 2012, s85).
• in the Crown Court, by an unlimited fine, up to two years in prison, or both.

Courts in England and Wales follow the Sentencing Council guidelines for individuals and organisations. The guidelines cover regulation 19(1) in England and regulation 17(1) in Wales. An offender who made "significant efforts" that were "inadequate on this occasion" falls in the low culpability band, and HACCP records are how you show those efforts.

Time limit. In England, prosecution must start within three years of the offence or one year from the prosecutor discovering it, whichever is earlier (reg 18).

Defence. You aren't guilty if you can show you took all reasonable precautions and exercised all due diligence to avoid the offence (reg 12). Without records, that's hard to prove.

Recent cases where HACCP failures were among the charges:

In all three, HACCP failings were charged alongside dirt, pests or untrained staff.

HACCP myths and mistakes

The usual failure is a plan that says cooling is probed while the log is blank or filled in on Friday. Keep logs where staff fill them in at the time; an app such as Pilla timestamps each check against the person who did it.

HACCP FAQs

Does HACCP apply to farms?

Not as a legal duty. Article 5 applies only to businesses after primary production, and the regulation's recitals say applying HACCP to primary production "is not yet generally feasible". Farms follow the general hygiene rules for primary production instead.

Can a restaurant use MyHACCP?

It can, but it isn't the main audience. The FSA built MyHACCP for small UK food manufacturers. It says the tool may also help "larger catering operations such as central production units in hospitals, universities and similar". Most restaurants find SFBB, CookSafe or Safe Catering a better fit.

How long should HACCP records be kept?

Regulation 852/2004 says documents and records must be kept "for an appropriate period" without naming a number. The FSA notes that the General Food Law (Regulation 178/2002) doesn't set a period for traceability records either, though rules for some sectors may. Your council can tell you what it expects for your type of business.