Blog

The Due Diligence Defence: Section 21 Food Safety Act 1990 Explained (2026)

Food business owner reviewing due diligence records with a legal adviser

Every UK food business has, by default, the potential to be prosecuted. The offences under the Food Safety Act 1990 are strict liability — the prosecution doesn’t need to prove you meant to do anything wrong, only that the unsafe food was sold, or the labelling was wrong, or the premises were in breach. Intent doesn’t matter. What matters, when it goes to court, is whether you can prove you took all reasonable precautions and exercised all due diligence.

That proof is the Section 21 due diligence defence. It’s the single most important piece of UK food safety law for operators who actually run their businesses properly — because without it, every slip at the till or every mislabelled PPDS sandwich would automatically end in a fine or worse.

This guide is a complete UK-specific reference to how the defence works, the cases that shaped it, what evidence wins, what evidence loses, and how to build a business that is genuinely — not theoretically — protected.

The statutory basis — Section 21 verbatim

Section 21(1) of the Food Safety Act 1990 (legislation.gov.uk):

“In any proceedings for an offence under any of the preceding provisions of this Part (in this section referred to as ‘the relevant provision’), it shall, subject to subsection (5) below, be a defence for the person charged to prove that he took all reasonable precautions and exercised all due diligence to avoid the commission of the offence by himself or by a person under his control.”

Four features of the statute matter:

  1. Both limbs must be satisfied — all reasonable precautions AND all due diligence. Missing either one defeats the defence.
  2. The burden reverses. The defendant proves the defence on the balance of probabilities — not beyond reasonable doubt, but actively.
  3. “By himself or by a person under his control” means a failure by an employee doesn’t automatically defeat the defence, provided the employer’s own system and supervision were diligent (Tesco v Nattrass).
  4. Section 21(5) procedural notice. If you plan to rely on another person’s act or default, or on information supplied by another, you must serve written notice on the prosecutor identifying that person at least 7 clear days before the hearing. Without notice, the defence cannot be run without the court’s leave.

The modified defence for retailers and caterers

Section 21(2)-(4) provides a modified defence specifically for defendants charged under section 14 (food not of the nature/substance/quality demanded) or section 15 (false description), where the defendant neither prepared the food nor imported it into Great Britain.

Under this version, the defence can succeed by proving either:

  • The offence was due to the act or default of another person not under the defendant’s control, or to reliance on information supplied by another; reasonable checks were done (or reasonable reliance placed); and the defendant had no reason to suspect non-compliance (section 21(3)); OR
  • The same plus the sale was not under the defendant’s own name or mark, and the defendant could not reasonably have known (section 21(4))

This is the supplier-reliance version of the defence. It’s how a restaurant that buys ready-made sauces from a supplier can still defend itself when the supplier got the labelling wrong — provided the restaurant did proper checks.

Which offences it applies to

  • Part II Food Safety Act 1990 — sections 7 (injurious food), 8 (selling food failing safety requirements), 14 (nature/substance/quality), 15 (false description)
  • Regulation 12 of the Food Safety and Hygiene (England) Regulations 2013 — mirrors s.21 for breaches of regulation 19(1) and Article 14(1) of Regulation 178/2002 (placing unsafe food on the market). This is the offence most often charged today.
  • General Food Regulations 2004 — for Articles 14 and 18 of Regulation 178/2002

Scotland, Wales and Northern Ireland have materially equivalent provisions. Scotland’s Food (Scotland) Act 2015 adds a Compliance Notices regime — compliance with a notice defeats prosecution, offering a route out short of trial.

Where the defence does NOT apply

  • Gross negligence manslaughter
  • Fraud Act 2006 offences
  • Corporate manslaughter (different framework)
  • The irrebuttable presumption under Article 24(1) of Regulation (EU) 1169/2011 that food past its use-by date is unsafe. Confirmed in the Tesco Stores v Birmingham City Council judicial review (2020). You can run s.21 on procedural grounds but cannot argue the food was actually safe.

Related sections that matter

  • Section 20 FSA 1990 — offences due to the fault of another person. That person can be prosecuted regardless of whether proceedings are brought against the first defendant.
  • Section 36 FSA 1990 — offences by bodies corporate. Directors, managers, secretaries and similar officers are personally liable where the company’s offence is committed with their consent or connivance, or is attributable to any neglect on their part.

Section 36 is why Bakery Quality First directors ended up personally fined with indefinite Prohibition Orders after a rat-infested Knowsley pastry factory was prosecuted. The company defence collapsed; the personal liability didn’t.

The four-limb test courts actually apply

Practitioner consensus (Kingsley Napley, Pinsent Masons, Hickman & Rose, Reed Smith) distils the Tesco v Nattrass line of authority into four operational limbs. A successful s.21 defence has to pass all four:

1. Set up a system designed to prevent the offence

A HACCP plan — or an SFBB / CookSafe / Safe Catering pack — tailored to your actual menu, suppliers, premises and staff. Generic off-the-shelf packs that have never been adapted fail this limb. Food Standards Scotland is explicit on this point: CookSafe is built for adaptation, not unthinking cut-and-paste.

See our HACCP guide for the substantive requirements.

2. Take all reasonable steps to ensure the system works

  • Staff training with competency assessment, not just a certificate
  • Clear responsibility at each shift
  • Documented supplier approval and verification
  • Supervision that catches drift before it becomes incident

Hicks v Sullam (1983) confirmed that training records are core evidence. But certificates alone are no longer enough — post-Hannah Jacobs, courts expect competency checks.

3. Verify the system is effective

  • Internal and third-party audits
  • Probe and scale calibration
  • Environmental monitoring where relevant
  • Direct engagement of the “directing mind” — directors and senior management — with review outputs

This is where paper systems most often collapse. Plans written in 2021 and never reviewed fail limb 3 even if they look immaculate.

4. Act promptly when the system fails

  • Incident response
  • Root-cause analysis
  • Documented corrective and preventive action
  • Updated procedures and retraining

Courts read the CAPA trail. Every missed corrective-action record is evidence of limb-4 failure.

Operator takeaway: having a system is limb 1 only. Limbs 2, 3 and 4 are what distinguishes a successful s.21 plea from a failed one.

Key UK case law — the seven cases every food operator should know

Tesco Supermarkets Ltd v Nattrass [1972] AC 153 (HL)

Facts: Tesco advertised Radiant washing powder at a reduced price. A branch ran out of discounted stock and an assistant restocked full-price packs without removing the poster. A customer was overcharged; Tesco was prosecuted under the Trade Descriptions Act 1968.

Held: Defence succeeded. The store manager was “another person” under the Act, not the “directing mind and will” of the company. Tesco had designed an effective corporate compliance system.

Principles still routinely applied to s.21 FSA 1990:

  • An employee who is not part of the “directing mind and will” can be “another person” for defence purposes
  • The burden is on the defendant on the balance of probabilities
  • Due diligence is shown by a system — design, training, supervision
  • Due diligence by an individual employee is insufficient if the employer was not also diligent
  • Proportionality: what is reasonable depends on the gravity of the offence and the size and nature of the business

Carrick DC v Taunton Vale Meat Traders Ltd (1994) 158 JP 347

Facts: Wholesale butcher prosecuted over meat allegedly not of the quality demanded. The defendant relied on supplier specifications plus its own reasonable checks.

Held: Defence succeeded. Reasonable reliance on supplier information, combined with the defendant’s own verification, satisfied s.21.

Principle: Supplier specs support the defence, but only when paired with active verification. Blanket reliance on paperwork alone is not enough.

Sherratt v Gerald’s American Bar (1970) 68 LGR 256

Facts: Retailer sold a watch described as “waterproof”. An elementary precaution — dipping the watch in water — was not carried out.

Held: Defence failed.

Principle: Sampling and simple verification tests are part of the minimum. Relying on a description without any check will not support the defence.

Garrett v Boots the Chemists Ltd (1980) 88 ITSA MR 238

Facts: Boots sold pencils with excessive lead content. The defence rested on supplier assurances.

Held: Defence rejected.

Principle, quoted in practitioner literature: “What might be reasonable for a large retailer might not be reasonable for the village shop.” Proportionality cuts both ways — larger operators are expected to do more, not less. A multi-site chain cannot rely on supplier warranties alone.

Hicks v Sullam Ltd (1983) 91 ITSA MR 122

Principle: Staff training is a core precaution. Training records and the quality of supervision are material to both limbs of the defence.

Riley v Webb (1987) 151 JP 372

Principle: Engaging a competent contractor (for example a pest control company) can support the defence. But the defendant must still verify the contractor is performing and act on reports. The lesson translates directly to supplier audits.

The modern cases — 2020 to 2026

Tesco Stores Ltd v Birmingham City Council (2020 JR; conviction 2021). £7.56m fine at Birmingham Magistrates’ Court for 22 offences across 67 items past use-by. The High Court confirmed Article 24(1) of Regulation 1169/2011 creates an irrebuttable presumption that food past use-by is unsafe. Expert microbiological evidence arguing actual safety is inadmissible. Lesson: once you’re past use-by, s.21 cannot rescue you on the merits.

R v Kuddus and Rashid (Manchester Crown Court 2018; Kuddus appeal [2019] EWCA Crim 837). Megan Lee (15) died in January 2017 from anaphylaxis after a Royal Spice takeaway, ordered via Just Eat and flagged “nuts, prawns”. No allergen management system existed; the SFBB pack sat unread by the till. Convictions under HSWA 1974 and regulation 19 of the 2013 Regulations. The manslaughter conviction was quashed on narrow knowledge grounds; the regulatory convictions stood. Lesson: an unused SFBB pack is not a defence — it’s evidence against you.

Pret A Manger (Colnaghi acquittal, Bristol Crown Court, 4 May 2021). Rare jury acquittal under s.14 FSA 1990 after a customer was given a sesame sandwich following verbal assurance it was sesame-free. Pret’s voluntarily implemented full-ingredient labelling (ahead of Natasha’s Law), Allergy Plan, training records and store-level allergen guides established s.21 even though an individual employee failed to follow procedure. Lesson: a genuine, documented, actively enforced corporate system can save you from an employee failure.

Asda Stores Ltd (Plymouth Magistrates’ Court, 23 April 2025). £410,000 plus £20,582.70 costs for 62 expired items across two Cornish stores. The court found written procedures existed but were not adhered to. Asda’s response to customer and Trading Standards concerns was judged insufficient. Lesson: writing procedures is limb 1 only. Limbs 2-4 must evidence live operation.

Holy Zam Zam 4 (Uxbridge Magistrates’, 17 February 2026). Eight offences under the 2013 Regulations and FSA 1990. Total penalties £24,122. No viable s.21: unlabelled food from unverified suppliers, no cooking records, incorrect allergen information.

Coroners’ inquests that expose the gap

James Atkinson inquest (Newcastle, January 2024, Regulation 28 PFD 2024-0043). Peanut flour substituted for almond flour on a pizza ordered via Deliveroo; menu listed almond but not peanut. No criminal prosecution. The case exposed the two-day lag in updating menus on aggregator platforms and the question of platform-versus-operator liability.

Hannah Jacobs inquest (East London Coroner, 16 August 2024, Costa Coffee / SBR Trading franchise). Barista had completed online training but had not used the under-till allergen guide. Narrative conclusion identified a procedure-to-practice gap and a competency assessment failure. Lesson: certificates prove attendance, not competence.

The empirical reality on allergen prosecutions

Walker et al. (2022) reviewed UK allergen prosecutions 2014 to 2020 and found only two acquittals across approximately 70 cases. The defence exists, but once an allergen case reaches trial, it very rarely succeeds. The decisive factor is almost always whether there is a documented, actively implemented allergen management system.

What evidence actually supports the defence

The FSA is explicit: “Maintaining monitoring records will assist in any ‘due diligence’ defence if you are charged with any offence under the law” (SFBB introduction).

Here’s what wins cases:

1. Documented, adapted HACCP / SFBB / CookSafe / Safe Catering pack — required under Article 5 of Regulation (EC) 852/2004 (assimilated). Must be adapted to the business. FSS expressly warns against unadapted templates. See our HACCP guide.

2. Supplier specifications, certifications and questionnaires — paired with verification. Per Carrick v Taunton Vale and Garrett v Boots, blanket reliance fails. See our food suppliers UK guide for the verification framework.

3. Staff training records with refresh dates and competency checks. Annex II Chapter XII of Regulation 852/2004 requires food handlers to be trained commensurate with their activity. Industry norm: Level 2 Food Safety refreshed every 2-3 years; Level 3 for supervisors. Certificates alone are no longer sufficient.

4. Temperature logs showing monitoring AND corrective action. Williams Fry commentary: “presenting corresponding temperature records consistent with the HACCP risk assessment will be the only practical acceptable means to demonstrate due diligence.” Deviations must be recorded with the action taken and by whom.

5. Cleaning schedules signed at the point of task. Contemporaneous sign-off. Dated and initialled, with any issue recorded and resolved.

6. Version-controlled allergen matrix. Post Natasha’s Law, PPDS foods require a full ingredient list with the 14 regulated allergens emphasised. Version control allows reconstruction of what was in force on the date of sale. See our allergen matrix guide.

7. Incident and complaint logs with actions taken. Root-cause analysis, product holds, CAPA records. Required under BRCGS; treated by courts as evidence of limbs 3 and 4.

8. Calibration records. Dated thermometer and scale calibration underpins every temperature and weight record in the file. Uncalibrated probes undermine all temperature evidence.

9. Internal audit records with director / senior manager sign-off. Evidences the directing mind’s engagement — critical after Tesco v Nattrass.

10. Labels retained for PPDS items. Article 18 of Regulation 178/2002 requires one-step-forward, one-step-back traceability. Retaining exemplar labels (physical or digital with date and version) permits reconstruction of what was on pack at the time of sale.

11. Supplier due diligence questionnaires. Standard part of approved-supplier programmes; evidence of reasonable reliance under s.21(3) and (4).

12. The Section 21(5) notice filed on time. Not evidence strictly — procedural. But without it the defence collapses.

What does NOT work as a defence

Back-filled records. Identical handwriting across multiple dates, Tipp-Ex corrections, ink inconsistent with the claimed date. Kingsley Napley notes inaccurate records are a common trigger for prosecution and a primary reason defences fail. EHOs spot back-filled records in the first 15 minutes on site.

Generic HACCP packs not adapted to the business. An unadapted SFBB binder with blank “our method” sections, or a CookSafe House Rules template lifted wholesale, is treated as evidence the system was never implemented. Royal Spice had an unread SFBB pack by the till.

“The supplier is certified” without verification. Garrett v Boots is the authority. Blanket supplier assurances fail — active testing (audits, sampling, certificate verification via the scheme’s own directory) is required. Large operators are held to a higher standard.

Training certificates without competency checks. A certificate proves attendance, not competence. Hannah Jacobs showed that online modules completed at home without supervision didn’t save the defence.

Documented procedures diverging from actual practice. The Owen Carey inquest (Byron Burgers, 2019) is the canonical example. Procedures met industry norms but verbal training “may not catch the less diligent staff” and the system “broke down” at the point of communication. Haute Dolci and Hannah Jacobs / Costa show the same pattern: the allergen guide existed, but was not consulted.

Sole reliance on an individual employee’s diligence. Tesco v Nattrass is explicit: due diligence by an employee is insufficient if the employer was not also diligent. A single server or till operator as the allergen gatekeeper, without a cross-check or system support, will fail the defence.

Failure to serve the Section 21(5) notice on time. Seven clear days before the hearing. Omission is fatal without the court’s leave.

The devolved-nations picture

The substantive s.21 defence is materially the same across the UK, but the procedural and enforcement environment varies:

Nation Defence provision Key nuance
England s.21 FSA 1990 + reg.12 Food Safety and Hygiene (England) Regs 2013 Main practice jurisdiction; most case law
Wales Equivalent regulations Mandatory FHRS display since 2013 adds reputational stake
Scotland Food (Scotland) Act 2015 + Food Safety and Hygiene (Scotland) Regs 2013 Compliance Notices regime provides an alternative to prosecution — compliance defeats prosecution
Northern Ireland Equivalent regulations + Safe Catering pack Mandatory FHRS display since 2016; lower enforcement volume but same framework

If you operate across UK borders, your s.21 defence needs a four-nation evidence trail, not just an English one.

The “directing mind” question — why director-level engagement matters

Tesco v Nattrass turned on who was the “directing mind and will” of the company. The House of Lords found a store manager wasn’t — the company had a proper corporate system designed by senior management.

In 2026, the directing-mind question is sharper. Section 36 FSA 1990 can reach directors personally if the offence is attributable to their neglect. Practically this means:

  • Senior management review of food safety data should be documented and happen regularly
  • Named responsibility for food safety at board or director level
  • Evidence of response when KPIs drift or incidents happen
  • Investment in the system — training budget, digital FSMS, audit programme — signed off by the directing mind

A company whose records show the board never looked at food safety is a company whose director defence is already weak.

The real stakes in 2026

UK food safety sentencing has moved meaningfully upward in 2024-2026. Recent fines include:

  • Tesco Stores — £7.56m (2021)
  • Asda Barnsley — £500,000 (February 2026)
  • CDS/The Range Kidderminster — £400,000 (December 2025)
  • Asda Plymouth — £410,000 (April 2025)
  • Royal Gourmet / Hypergood — £113,415 (March 2025)
  • Bread Spread Ltd — £46,827 Listeria case (March 2025)
  • Javitri Indian Restaurant — £43,816 allergen prosecution (April 2025)

Plus Operation Bantam (42 months and 35 months immediate custody for meat-diversion defendants, August 2025) and the suspended sentence plus 5-year food-industry ban for Margaret Omo-Osagie (Wolverhampton, March 2024).

Full detail in our UK food recalls and fines 2026 report, and the wider commercial impact — insurance premium uplift, platform delisting, staff turnover, reputation — is covered in our real cost of food safety non-compliance guide.

The common pattern: the businesses that faced large fines either had no defence at all, or had procedures that didn’t reflect actual practice. The businesses that survived — Pret Colnaghi is the clearest example — had documented, adapted, actively-implemented, audited systems.

How digital record-keeping strengthens the defence

The biggest evidential weakness in paper-based food safety records is back-filling. Every EHO and every magistrate knows that identical handwriting across multiple dates means records were created in one sitting. That’s fatal to limb 2 (system operation) and limb 3 (verification).

Digital food safety management systems solve this at the evidential layer:

  • Timestamped entries that cannot be retrospectively changed
  • User-attributed records — who did what, when
  • Audit trail of changes — if a record is amended, the original is preserved
  • Real-time escalation evidence showing incidents were flagged and responded to
  • Multi-site consistency evidence across a chain
  • Automatic retention and retrieval at the timescales courts expect

Courts have not yet produced an appellate decision on digital versus paper records, but EHOs and magistrates already accept digital records provided they are tamper-evident. The direction of travel is clear — the same way typed contracts replaced handwritten ones.

What operators should actually do this quarter

  1. Audit your HACCP pack or SFBB binder. Is every section adapted to your actual operation, or are there template paragraphs still in place?
  2. Spot-test your training records. Can every food handler answer the 14 allergens question if you ask them right now?
  3. Verify every supplier certificate on the scheme directory. Not the PDF certificate — the scheme’s live database.
  4. Review your allergen matrix against current supplier specifications. Has any supplier reformulated in the last 90 days without you updating?
  5. Check your temperature log for plausibility. If the readings are identical across weeks, they’re not credible.
  6. Schedule a director-level food safety review. Documented. Signed. Repeatable quarterly.
  7. Confirm the Section 21(5) notice template exists in your legal file and that someone knows to file it within 7 clear days of any hearing.

Where Forkto fits

Every successful due diligence defence is a set of records that reflect what actually happened in the kitchen. Every failed defence is a set of records that don’t.

That evidential gap is what forkto’s platform was built to close. Clipboards replaced by phones. Records created at the point of action — temperature check, cleaning sign-off, allergen verification, opening and closing routines — every entry time-stamped, user-attributed, and instantly retrievable when a prosecutor, insurer or EHO asks. Supplier specifications linked to recipes so an allergen matrix updates automatically on reformulation. Audit trails a director can sign off in minutes rather than hours.

The companies that survive food safety prosecutions in 2026 will not be the ones with the biggest legal budgets. They will be the ones whose records show they were genuinely doing the right thing every day.

If you want to see how that looks in a UK hospitality operation, book a demo or browse our free downloadable checklists — no email required.


Last updated 5 May 2026. This guide reflects UK food law and case law as at May 2026, including Section 21 of the Food Safety Act 1990, Regulation 12 of the Food Safety and Hygiene (England) Regulations 2013, and the key appellate and modern first-instance authorities. This is not legal advice — consult a qualified regulatory food safety solicitor for any specific prosecution or enforcement matter.