What records must UK food businesses keep about their suppliers?

Under Article 18 of assimilated Regulation 178/2002, every food business must maintain one-up one-down traceability. You must record the name and address of each supplier, a description of the food, the quantity, and the date of delivery. Records must be produced to authorities on demand. Failure to produce them is a criminal offence.

How long should I keep supplier records in the UK?

Article 18 does not set a fixed retention period, but FSA best practice is to keep records at least until the food is reasonably assumed to have been consumed. Industry norms: shelf-life plus 6 months for products with best-before dates; 6 months for highly perishable use-by products; up to 5 years for long-life or ambient goods.

What is one-up one-down traceability?

It means every UK food business must be able to identify (one step back) the supplier they received each ingredient or product from, and (one step forward) the business customer they supplied it to. Direct-to-consumer sales are out of scope. The rule is in Article 18 of Regulation 178/2002, which applies as assimilated direct legislation in Great Britain and directly in Northern Ireland under the Windsor Framework.

What certifications should a UK food supplier have?

Demand BRCGS Food Safety or SALSA certification for manufactured food suppliers — these are evidence of an audited food safety management system. Demand Red Tractor when you make a 'British' claim on menus. Demand a Defra-approved organic control body certificate if you use the word 'organic' on packaging or menus — this is a legal requirement. MSC or ASC chain-of-custody certification is required if you market seafood as MSC/ASC.

What's the difference between SALSA and BRCGS certification?

SALSA (Safe And Local Supplier Approval) is for small UK producers under 50 FTE and £10m turnover — typical cost £775 to £1,550 a year. BRCGS Food Safety is for mid-to-large manufacturers supplying retailers and major foodservice — typical cost £4,000 to £12,000+ per site a year. BRCGS is GFSI-benchmarked and graded AA to D; SALSA is pass/fail. Use SALSA as a stepping stone for small suppliers, BRCGS for anyone supplying retail own-label or major chains.

How do I verify a food supplier's certification is genuine?

Use the scheme directories directly. SALSA at salsafood.co.uk, BRCGS at directory.brcgs.com, Red Tractor at checkers.redtractor.org.uk, Soil Association at soilassociation.org/certification. For meat, dairy and other Products of Animal Origin (POAO), cross-check the approval number on the FSA's monthly list of approved establishments or the equivalent Food Standards Scotland register.

What does the Section 21 due diligence defence mean for supplier records?

Section 21 of the Food Safety Act 1990 gives a defence if you can prove you took all reasonable precautions and exercised all due diligence. For supplier-related offences, courts look at: did you obtain and verify supplier specifications, did you audit suppliers proportionate to risk, did you conduct goods-in checks, did you act on non-conformances. Garrett v Boots established that larger professional buyers are expected to actively test supplier claims, not just rely on declarations.

What are the 14 UK-regulated allergens suppliers must declare?

Celery, cereals containing gluten (wheat, rye, barley, oats), crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soybeans, and sulphur dioxide or sulphites above 10 mg/kg or 10 mg/L. These are listed in Annex II of assimilated Regulation 1169/2011 and enforced by the Food Information Regulations 2014.

Do I need to know if a supplier is an 'approved establishment' under Regulation 853/2004?

Yes, for any supplier of Products of Animal Origin (POAO) — meat, fish, dairy, eggs. Approved establishments carry an oval identification mark or health mark. The format is typically 'UK XX 123 EC' (moving to 'EU' from 31 December 2028 for NI). Verify on the FSA's monthly approved establishments list for England and Wales, the FSS register for Scotland, or the equivalent NI list.

What are the biggest red flags when vetting a food supplier?

Refusal or reluctance to share specifications and certificates; spec sheets more than 12 months old; certifications that can't be verified on the scheme directory; no written allergen management policy; no batch coding or traceability; no recall procedure; a history of FSA Allergy Alerts or Product Recalls against the business or its ingredients; no site-visit access; unusually low pricing against market; and undisclosed sub-suppliers or contract manufacturers.

How to Choose Food Suppliers UK: 10-Step Guide & Certifications (2026)

Your suppliers are your first line of food safety. Every allergen declaration on your menu, every use-by date on a product label, every FHRS score at your next inspection starts with a supplier specification sheet that is either accurate or isn’t.

UK courts have made this increasingly expensive for operators who get it wrong. The 2024-2026 prosecution run has included £7.56 million for a supermarket selling food past use-by, £46,827 for a sandwich maker whose supplier chain let Listeria through, £43,816 for a restaurant whose allergen controls failed a nut-allergic customer, and indefinite food-industry bans for three directors of a rat-infested Knowsley bakery that was supplying other food businesses.

This guide is the complete UK-specific framework for choosing and managing food suppliers in 2026 — the legal requirements, the certifications that matter, what a proper supplier specification sheet contains, the 10-step selection process, and the real prosecutions that show what happens when it goes wrong.

What UK law requires of food businesses and their suppliers

Article 18 — one-up one-down traceability

Article 18 of assimilated Regulation (EC) 178/2002 is the single most important supplier-record rule in UK food law. It applies to every food business in Great Britain as assimilated direct legislation, and directly in Northern Ireland under the Windsor Framework.

Article 18(1) verbatim:

“The traceability of food, feed, food-producing animals, and any other substance intended to be, or expected to be, incorporated into a food or feed shall be established at all stages of production, processing and distribution.”

The rule resolves into two parts:

One step back (Article 18(2)): identify any person from whom you’ve been supplied food or an ingredient. Systems must make that information available to competent authorities on demand.
One step forward (Article 18(3)): identify the business customers you supplied product to. Sales direct to the final consumer are out of scope.

The minimum information to record, per FSA traceability guidance:

Name and address of supplier or customer
Description of the food
Quantity
Date of the transaction or delivery

Retention period. Article 18 does not set a fixed period. FSA best practice is to keep records at least until the food is reasonably assumed to have been consumed, and produce them on demand. Failure to produce is a criminal offence. Pragmatic UK norms:

Shelf-life + 6 months for best-before products
6 months for highly perishable use-by products
Up to 5 years for long-life and ambient goods

Internal (process) traceability — matching specific inputs to specific outputs — is not required by Article 18. It may be required by sector legislation or by private standards like BRCGS.

Article 19 couples with Article 18: food business operators must withdraw or recall unsafe food and notify competent authorities. When traceability fails, the recall cost lands on the business.

Section 21 of the Food Safety Act 1990 — the due diligence defence

Section 21(1) verbatim:

“it shall… be a defence for the person charged to prove that he took all reasonable precautions and exercised all due diligence to avoid the commission of the offence by himself or by a person under his control.”

This defence applies to offences under Part II of the Food Safety Act 1990, including section 7 (food injurious to health), section 14 (food not of the nature/substance/quality demanded) and section 15 (false labelling). Regulation 12 of the Food Safety and Hygiene (England) Regulations 2013 mirrors the defence for hygiene offences.

Both limbs must be satisfied — reasonable precautions AND due diligence. The burden is on the accused on the balance of probabilities.

What a supplier-related due diligence defence looks like in court:

Documented HACCP plan integrating supplier risk assessment
Written supplier specifications with allergen information
Signed supplier contracts
Records of supplier audits proportionate to risk
Goods-in checks — temperature, pack integrity, dates, quantity
Staff training records
Corrective-action records when supplier non-conformances occur

Garrett v Boots is the key case for hospitality buyers. It established that larger or professional buyers are expected to actively test supplier claims — blanket reliance on a supplier declaration is not sufficient. If you’re a multi-site operator and a supplier’s spec sheet is wrong, courts expect you to have checked.

Procedural note: if you plan to rely on the act or default of another person as part of your defence, section 21(5) requires written notice to the prosecutor at least 7 clear days before the hearing. See our due diligence defence guide for deeper case analysis.

Food Information Regulations 2014 — supplier allergen obligations

The Food Information Regulations 2014 (SI 2014/1855) enforce assimilated Regulation (EU) 1169/2011 in Great Britain, with parallel instruments in Scotland, Wales and NI.

The 14 UK-regulated allergens (Annex II of FIC):

Celery
Cereals containing gluten (wheat, rye, barley, oats)
Crustaceans
Eggs
Fish
Lupin
Milk
Molluscs
Mustard
Tree nuts
Peanuts
Sesame
Soybeans
Sulphur dioxide and sulphites (above 10 mg/kg or 10 mg/L)

Article 8 of FIC makes the food business operator under whose name the food is marketed responsible for the accuracy of allergen information. Article 9 sets the mandatory particulars.

Practically: your supplier is legally responsible for accurate allergen information on the spec sheet and label. But the Garrett v Boots principle means you are responsible for actively verifying that information reflects reality — supplier declarations are the start of your due diligence, not the end.

Natasha’s Law (Food Information (Amendment) (England) Regulations 2019) extended allergen labelling to Prepacked for Direct Sale items from 1 October 2021. Every supplier of a PPDS-bound ingredient must provide complete allergen information. See our full allergen matrix guide for how to operationalise this across a menu.

Regulation 853/2004 — approved establishments for Products of Animal Origin

If you buy meat, fish, dairy, eggs or other Products of Animal Origin (POAO), your supplier is almost certainly operating under assimilated Regulation (EC) 853/2004.

Sectors that require approval:

Slaughterhouses
Cutting plants
Game-handling establishments
Meat processing (including rendered fats, gelatine, collagen)
Minced meat and meat preparations
Dairies and liquid-milk establishments
Egg packing centres and egg product plants
Fishery product establishments
Bivalve mollusc dispatch and purification centres
Wholesale markets
Cold stores that re-wrap POAO

The identification mark is an oval containing:

Country (“UK” or “United Kingdom”)
Approval number
Abbreviation

Typical format: “UK XX 123 EC”. For Northern Ireland: “UK (NI)”. The “EC” suffix is permitted until 31 December 2028, after which “EU” applies.

Competent authorities:

FSA approves slaughterhouses, cutting plants and game-handling establishments in England, Wales and NI
Food Standards Scotland for Scotland
Local authorities for most other POAO establishments

Verification: the FSA publishes a monthly list of approved food establishments in England and Wales. FSS maintains a Scotland list. Northern Ireland has its own register. Cross-checking an approval number is a 2-minute task that closes a significant due diligence gap.

Retail exemption (Article 1(5)): retail supply direct to the final consumer is generally outside 853/2004. “Marginal, localised and restricted” inter-retail supply is also exempt.

The post-Brexit position in 2026

Under the Retained EU Law (Revocation and Reform) Act 2023, from 1 January 2024 “retained EU law” was renamed “assimilated law”. The core UK food legislation is preserved:

Regulation (EC) 178/2002 (general food law, including Article 18 traceability)
Regulation (EC) 852/2004 (food hygiene, including HACCP)
Regulation (EC) 853/2004 (POAO approved establishments)
Regulation (EU) 1169/2011 (food information to consumers)
Regulation (EC) 2073/2005 (microbiological criteria)

All remain in force as assimilated law in Great Britain. The FSA has confirmed that references in existing guidance to “EU” or “EC” regulations should now be regarded as assimilated law where applicable.

Northern Ireland continues to apply the live EU (not assimilated) versions under the Windsor Framework. Operators with supply chains crossing GB and NI need to track both versions.

Delegated powers to restate or replace assimilated law expire 23 June 2026 — a date worth noting for any supplier contracts running past that window.

The certifications that matter — and how to verify each one

SALSA (Safe And Local Supplier Approval)

UK food safety standard, aimed at small and micro producers under 50 FTE and £10m turnover. Non-profit joint venture of the Food & Drink Federation, NFU and UK Hospitality; IFST-accredited.

Variants: Food and Drink Standard; Brokers, Storage and Distribution Standard; SALSA plus Beer (with Cask Marque); SALSA plus Cheese (with the Specialist Cheesemakers Association).

Audit frequency: annual on-site; approval takes 1-3 months from payment; audits run 5-6 hours.

Cost: roughly £775-£1,550+ per year. Discounted SME rates available through regional programmes.

Verification: directory at salsafood.co.uk — search by company or certificate number and view the certificate PDF.

SALSA is not GFSI-benchmarked, positioned as a stepping stone for small UK manufacturers. Widely accepted by hospitality buyers who want evidence of audited food safety but don’t need BRCGS.

BRCGS Food Safety (Global Standard, Issue 9)

Issue 9 was published August 2022, with audits from 1 February 2023. It’s the first GFSI-benchmarked food safety standard, used by 70% of the top 10 global retailers and 60% of the top 10 QSR chains. Over 22,000 sites certified globally.

Standards suite: Food Safety, Packaging Materials, Storage & Distribution, Agents & Brokers, Consumer Products, Retail, Gluten-Free, Plant-Based, Ethical Trade & Responsible Sourcing.

Grading system:

Grade	Conditions	Certificate validity
AA	≤5 minors	12 months
A	5-10 minors	12 months
B	11-16 minors OR 1 major + ≤10	12 months
C	17-24 minors OR 1 major + ≤16 OR 2 majors + ≤10	6 months
D	25-30 minors OR 1 major + ≤24	6 months
Uncertified	below D thresholds	n/a

A “+” suffix denotes an unannounced audit (mandatory at least every 3 years).

Cost: £4,000-£12,000+ per site per year depending on size and certification body.

Verification: BRCGS Directory at directory.brcgs.com. The new BRCGS Verify tool is rolling out from 2025 with authoritative certificate data.

Red Tractor

UK farm-to-fork assurance across 11 sectors: beef, lamb, pork, poultry, dairy, dairy goats, combinable crops and sugar beet, fresh produce, livestock markets, livestock transport, seed potatoes.

The Union Flag in the logo means the product was farmed, processed and packed in the UK. A plain Union Jack on packaging often only denotes UK processing — not farming — so check before making “British” claims.

Membership: approximately 48,000 farmers.

Audit frequency: annual for most sectors; 18-monthly for dairy, beef and lamb; plus unannounced spot checks.

Verification: Industry Checker/Tracker at checkers.redtractor.org.uk.

Caveat: in October 2025 the ASA ruled a Red Tractor advert misleading on environmental claims. If your menu makes welfare or environmental claims based on Red Tractor status, word them carefully.

Organic — Defra-approved control bodies

Any business producing, processing, packing, importing or selling organic food, feed or seed must be certified by a Defra-approved control body. Selling unapproved product as “organic” is a criminal offence.

Code (GB / NI)	Control body
GB-ORG-02 / XI-ORG-02	Organic Farmers & Growers CIC
GB-ORG-04 / XI-ORG-04	Organic Food Federation
GB-ORG-05 / XI-ORG-05	Soil Association Certification Ltd
GB-ORG-06	Biodynamic Association Certification
GB-ORG-13	Quality Welsh Food Certification Ltd
GB-ORG-17	OF&G (Scotland) Ltd
XI-ORG-07	Irish Organic Association (NI only)
XI-ORG-09	Organic Trust CLG (NI only)

Rules:

Product must contain ≥95% organic agricultural ingredients to be labelled “organic”
The certifier code must appear in the same visual field as the EU organic logo
Inspection is at least annual (announced + unannounced) plus UKAS/Defra surveillance

Verification: Soil Association licensee search at soilassociation.org/certification.

RSPCA Assured

UK’s only welfare-dedicated farm assurance scheme (rebranded from Freedom Food in 2015). Covers pigs, laying hens, pullets, broilers, turkeys, ducks, dairy and beef cattle, sheep, farmed Atlantic salmon and rainbow trout. 4,000+ farms and businesses assessed, covering around 64 million animals.

Risk flag: 2024 undercover investigations exposed welfare failures on some RSPCA Assured farms and abattoirs. If you use the scheme in marketing claims, combine with your own due diligence.

Verification: request a current RSPCA Assured membership certificate; cross-check at business.rspcaassured.org.uk.

MSC (wild) and ASC (farmed) seafood

The MSC blue fish label certifies wild-capture fisheries against the MSC Fisheries Standard. The Chain of Custody (CoC) Standard applies to every business in the supply chain including restaurants and foodservice — with 7,000+ CoC businesses at 51,000+ sites globally.

ASC is the parallel responsible-farmed-seafood scheme (green label), with a joint MSC-ASC CoC.

Verification: fisheries.msc.org — “Track a Fishery” database.

Fairtrade / FLOCERT

The Fairtrade Foundation UK licenses the FAIRTRADE Mark; FLOCERT (ISO 17065-accredited) is the global certifier.

Key commodities: coffee, tea, cocoa, sugar, bananas, plus cotton, flowers, wine, gold, fresh fruit, herbs and spices.

Each organisation has a unique FLO ID — lookup at flocert.net/fairtrade-customer-search.

Certification shortlist — demand vs nice-to-have

Demand as a risk-management baseline:

BRCGS or SALSA for any manufactured food supplier — primary evidence of an audited FSMS
Red Tractor if you make a “British” claim on your menu
Defra-approved organic control body certificate if you use the word “organic” (legal requirement)
MSC or ASC Chain of Custody if you market seafood as MSC/ASC

Nice-to-have for premium positioning:

Organic beyond the legal minimum
Fairtrade
RSPCA Assured (combine with your own due diligence)
MSC blue label marketing beyond CoC compliance

What a good supplier specification sheet looks like

BRCGS Issue 9 requires sites to maintain “detailed specifications to facilitate the production of food product which is lawful and consistent with compositional and safety standards and good manufacturing practice.”

A supplier spec sheet accepted by a professional UK hospitality buyer should contain every one of the following:

Full ingredients list with the 14 UK-regulated allergens emphasised (bold, caps or colour contrast) per assimilated Regulation 1169/2011
Manufacturing and packaging site details, including approval number — the oval health or identification mark for POAO; BRCGS Clause 3.5.1.5 requires knowing the identity of the last manufacturer or packer where sourcing is via brokers
Shelf-life — both primary (use-by for microbiologically perishable; best-before for durability) and secondary (once-opened)
Storage conditions — the manufacturer’s recommended storage temperature. UK legal maximum is ≤8°C for chilled high-risk food; industry best practice is ≤5°C. Hot-held ≥63°C; frozen ≤-18°C
Allergen handling — dedicated lines versus shared lines, validated allergen cleaning, any “may-contain” precautionary labelling
Nutritional information per 100 g or 100 ml per FIC Annex XV — energy, fat, saturates, carbohydrate, sugars, protein, salt
Batch and traceability coding, plus date-mark format — critical for targeted withdrawal under Article 18 and 19
Certifications and accreditations — with certificate numbers, expiry dates and issuing body so you can verify independently
Contact for complaints and recalls — 24/7 for higher-risk categories
Reformulation notification commitment — essential for allergen management; any recipe change must trigger immediate update to your matrix
Version control and review dates — BRCGS Issue 9 requires review whenever the product changes; industry norm is annual minimum plus any change

The 10-step supplier selection framework

Step 1 — Define requirements

Volumes, quality standards, delivery frequency, mandatory certifications, price point, service targets (on-time-in-full). The food business operator is legally responsible for placing only safe food on the market — this is the starting point.

Step 2 — Research candidate suppliers

Trade directories (Food Manufacture, Big Hospitality, The Caterer)
UKHospitality networks
Trade shows — IFE, HRC at ExCeL, Casual Dining
Wholesale markets — New Smithfield (meat), Billingsgate (fish), New Covent Garden (produce)
SALSA directory for smaller UK manufacturers

Step 3 — Request specifications and certifications

For every candidate:

Full product specification sheet
HACCP summary
BRCGS / SALSA / Red Tractor certificate with expiry
Public Liability and Product Liability insurance certificates
Allergen matrix
A sample Certificate of Analysis (CoA)

Step 4 — Independently verify certifications

Use the verification URLs above. For POAO, cross-check the approval number on the FSA or FSS approved-establishments list. For organic, verify the licensee code is active. For BRCGS, confirm the grade (AA through D).

Never accept a PDF certificate without verifying it on the issuing body’s database. Certificate fraud happens.

Step 5 — Financial due diligence

Companies House search — is the company active, who are the directors, are accounts filed?
Credit check — are they likely to continue trading?
Check FSA news-alerts for any past Allergy Alerts or Product Recalls linked to the company

Step 6 — Site visit or audit

Proportionate to risk. For high-volume or high-risk suppliers (meat, dairy, ready-to-eat), a physical site visit before first order is normal. For lower-risk packaged goods, a documentation-only remote audit may suffice.

Step 7 — Sample product evaluation

Taste, texture, consistency. But also: does the delivery temperature match the spec? Does the label match the spec? Do the batch codes work in your traceability system?

Step 8 — Commercial negotiation

Pricing, payment terms, minimum order quantities, delivery schedule, penalties for late or incomplete delivery, price-change notice periods. Get everything in writing.

Step 9 — Contract and Service Level Agreement

Explicitly cover:

Specification change notification (within 14 days is normal)
Recall procedure and responsibilities
Insurance obligations
Liability caps and food-safety carve-outs
Audit rights
Termination conditions

Step 10 — Onboarding and ongoing performance review

First-90-day review, then annual. KPIs: on-time delivery, rejection rate, complaint rate, temperature-on-arrival compliance, specification accuracy. A supplier whose performance degrades over time is a prosecution risk in waiting.

How to spot a bad supplier — the red flags

Decades of UK food-safety prosecutions share the same early warning signs. If a candidate supplier shows any of these, walk away:

Refusal or reluctance to share specifications or certifications
Spec sheets more than 12 months old, or obviously generic templates
Certifications that can’t be verified on the scheme directory
No written allergen management policy
No batch coding or traceability system — which makes them uninsurable against recall
No documented recall procedure
A history of FSA Allergy Alerts or Product Recalls — check food.gov.uk/news-alerts by supplier name
Unusually low pricing against prevailing market — ask where the cost saving comes from
No site-visit access
Undisclosed sub-suppliers or contract manufacturers — you can’t do due diligence on what you can’t see

Delivery checks and goods-in procedures

Article 18 traceability starts the moment product crosses your back door. Every delivery should be checked against a documented procedure — see our goods-in delivery checks guide for the operational playbook. The essentials:

The goods-in checklist

Driver ID and supplier match — is this who you expected?
Vehicle condition — is the refrigerated trailer actually cold? (Industry practice: check the unit temperature display and record)
Delivery temperature — for chilled, ≤8°C legal max (≤5°C best practice); for frozen, ≤-18°C; for hot, ≥63°C
Pack integrity — no crushed, leaking, or compromised packaging
Date marks — nothing past or near its use-by
Quantity against delivery note
Labelling accuracy — allergens emphasised where required
Batch/lot codes recorded for traceability
Visual inspection — no obvious pest damage, contamination or off-odours

When to reject a delivery

Reject and document any delivery that:

Arrives at a non-compliant temperature
Has damaged or compromised packaging on primary product
Has dates that won’t cover your planned shelf-life use
Shows signs of pest damage or contamination
Doesn’t match the specification on paperwork

Document every rejection. This is evidence for your due diligence defence.

Recent UK supplier-chain prosecutions

These 2024-2026 UK cases show what happens when supplier controls fail. All primary-sourced from the local authority or FSA press release.

FGS Ingredients Ltd / peanut-in-mustard (September-November 2024). Mustard powder of Indian origin contaminated with peanuts entered the UK supply chain. The FSA issued 3 primary Allergy Alerts plus 31 follow-ups covering 59 brands and 307 products including Iceland, Papa John’s, Waitrose, Domino’s, Spar and Harvester. FSA root-cause conclusion: the food business operator’s peanut-allergen controls failed. Every downstream brand then had to manage recall cost and reputation fallout.

Bread Spread Ltd (Uxbridge Magistrates’, March 2025). Listeria monocytogenes detected in sandwiches and on a tomato slicer; nationwide FSA recall; production continued after a Hygiene Emergency Prohibition Notice. Total fine £46,827 including a £14,000 personal director fine. The HACCP plan didn’t match operational reality. Poor traceability hindered the recall.

Fears Animal Products and others / Operation Bantam (Inner London Crown Court, August 2025). Conspiracy to defraud — diversion of 1.9 tonnes of Category 3 animal by-products into the human food chain. Anthony Fear: 42 months immediate custody, 6-year director disqualification. Azar Irshad: 35 months immediate custody, indefinite food-industry prohibition. The operators relying on these products as suppliers had no way of knowing — which is exactly why independent verification of supplier-declared species and grade is a real part of due diligence.

Vitago Foods (Stevenage, January 2025). Rat-urine-contaminated food repackaged; director furnished false information to officers. Total £29,126.84 across company and individual. Had any downstream buyer conducted a proper site visit in the six months before, the offence would have been caught.

Hypergood Ltd / Royal Gourmet (Uxbridge Magistrates’, March 2025). Frozen dim sum supplier to other food businesses. Mouse droppings, poor temperature control. Inspected 22 times since 2022 with only 6 compliant outcomes. Total £113,415. Every downstream buyer served customers food from a known non-compliant supplier.

SG Perkins (Bath Magistrates’, July 2024). Falsified Salmonella testing certificates — 13 of 16 reports faked. Total £50,830.75, prosecuted by the FSA National Food Crime Unit with Devon County Council Trading Standards. This is exactly why “verify on the scheme directory” is a non-negotiable step — a certificate PDF can be faked, a scheme database cannot.

For the full picture of 2024-2026 UK food safety prosecutions see our UK food recalls and fines report.

Post-Brexit supplier documentation

The Retained EU Law (Revocation and Reform) Act 2023 kept the core food law framework in place. The practical changes for supplier relationships in GB:

EU terminology is now “assimilated”. References to “Regulation (EC) X” in contracts and spec sheets remain valid but are now assimilated law in GB.
Delegated powers to replace assimilated law expire 23 June 2026. Supplier contracts running past this date should include a regulatory-change clause.
Supremacy of EU law is abolished. Domestic UK legislation now takes precedence over assimilated direct legislation in any conflict.
Northern Ireland continues to apply live EU law under the Windsor Framework. If you operate across GB and NI, both legal frameworks apply — and your supplier documentation needs to reflect the destination, not just the origin.

Windsor Framework “Not for EU” labelling Phase 3 commenced 1 July 2025 for composites, fruit, vegetables, fish, eggs, honey and pet food moving GB → NI. Any supplier moving these categories into NI from GB needs to comply.

The reality for UK food businesses

Every prosecution above shares a pattern. The downstream operator didn’t know something about their supplier that they could have known if they had verified independently. The specification was out of date; the certificate wasn’t checked on the directory; the goods-in records showed a problem that wasn’t acted on; the allergen matrix didn’t reflect a supplier reformulation.

The businesses that maintain clean records are not lucky. They operate the 10-step framework consistently, they verify certifications at the issuing body rather than accepting PDF certificates, they audit suppliers proportionate to risk, they capture goods-in checks at the point of delivery rather than back-filling them, and they update their allergen matrix the day a supplier notifies them of a reformulation.

That’s the operational story Forkto was built for. Supplier specifications stored digitally and linked to recipes. Allergen matrices that update automatically when a supplier flags a change. Goods-in checks captured on a phone at the back door, time-stamped, attributed, and ready to produce for an EHO or an insurer or a court.

If you’d like to see how it works in a UK kitchen, book a demo or browse our free downloadable checklists — no email required.

Last updated 28 April 2026. This guide reflects UK food law as at April 2026 including assimilated Regulation (EC) 178/2002 Article 18 traceability, the Food Safety Act 1990 section 21 due diligence defence, assimilated Regulation (EC) 853/2004 approved establishment framework, and the current certification landscapes for SALSA, BRCGS (Issue 9), Red Tractor, Soil Association, RSPCA Assured, MSC and Fairtrade. Verify specific certification details with the relevant issuing body before commercial decisions.