Blog

What is HACCP? The Complete 2026 UK Guide for Food Businesses

Chef reviewing HACCP food safety documentation in a commercial kitchen

Every food business operator in the UK, from a single-owner cafe to a multi-site hotel chain, has the same legal duty. Article 5(1) of assimilated Regulation (EC) 852/2004 states it verbatim:

“Food business operators shall put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles.”

That single sentence is the reason HACCP matters. It applies to your restaurant, your takeaway, your cloud kitchen, your catering van and your deli counter. Get the procedures right and you protect customers, defend your Food Hygiene Rating, and secure a due diligence defence under the Food Safety Act 1990. Get them wrong and the ladder goes from improvement notice to prohibition to prosecution — and UK courts have just started issuing six-figure fines for food safety offences.

This guide is the complete UK-specific reference. It explains what HACCP actually is, how UK law applies it, the simplified routes for small operators (SFBB, CookSafe, Safe Catering), recent named prosecutions with their fines, the FHRS scoring mechanics that hinge on your HACCP documentation, and the certifications that do and don’t exist.

What does HACCP stand for? What is HACCP?

HACCP = Hazard Analysis and Critical Control Point.

It’s a structured, preventive, risk-based approach to food safety that identifies biological, chemical, physical and allergenic hazards at each step of a food process, then establishes controls that reduce those hazards to acceptable levels.

The idea was born in the 1960s at Pillsbury, working with NASA and the US Army Natick Laboratories. The goal was to guarantee zero-defect food for the Gemini and Apollo missions — astronauts could not afford food poisoning in space. Traditional safety by end-product testing was statistically impossible; Pillsbury microbiologist Dr Howard Bauman and Dr Paul Lachance adapted NASA’s failure-mode-and-effects approach into a process-based system that prevents hazards occurring in the first place.

HACCP was first presented publicly at the 1971 US National Conference on Food Protection. The Codex Alimentarius Commission adopted it internationally in 1997 as an Annex to the General Principles of Food Hygiene, revised in 2003, and in September 2020 restructured the General Principles so HACCP became Chapter Two. A 2022 editorial update introduced a simplified CCP decision tree in Annex IV.

In the UK, HACCP became mandatory via Council Directive 93/43/EEC, transposed as the Food Safety (General Food Hygiene) Regulations 1995, then replaced by Regulation (EC) 852/2004 (in force 1 January 2006). After Brexit, 852/2004 was retained, and from 1 January 2024 it was reclassified as “assimilated law” under the Retained EU Law (Revocation and Reform) Act 2023. Substantive HACCP obligations in Great Britain are unchanged.

Is HACCP a legal requirement in the UK? Yes — but read this carefully

Article 5(1) of Regulation 852/2004 applies to every food business operator, except primary producers. That means your restaurant, cafe, takeaway, hotel, butcher, bakery, caterer, manufacturer, retailer, care home, school, wholesaler, mobile trader, dark kitchen or childminder registered as a food business.

The critical nuance most guides miss: the law requires “procedures based on the HACCP principles” — not a textbook Codex plan produced by every business. The phrase “based on” plus the proportionality clause in Article 5(2)(g) is what legally legitimises the simplified routes — SFBB, CookSafe, Safe Catering — for small businesses.

In the FSA’s own words (Chapter 4.2 HACCP Based Procedures guidance): HACCP-based procedures “can reflect the size and complexity of the business.” A sole-trader cafe does not need the same documentation as a meat processing plant.

The enforcement layer in England and Wales is Regulation 19 of the Food Safety and Hygiene (England) Regulations 2013, which makes it a criminal offence to breach Article 5. Local authorities deploy Hygiene Improvement Notices, Hygiene Prohibition Notices and Emergency Prohibition Notices to enforce compliance. Scotland uses equivalent provisions under the Food Safety (Scotland) Regulations 2006 and the Food (Scotland) Act 2015.

Penalties on conviction:

  • Magistrates’ Court — unlimited fine (since LASPO 2015)
  • Crown Court — unlimited fine and up to 2 years’ imprisonment
  • Director disqualification possible
  • Loss of the Section 21 Food Safety Act 1990 due diligence defence — the defence that protects honest operators who took all reasonable precautions

Four-nations divergence — what changes if you operate across the UK

Nation Competent authority Principal regulation FHRS display Key nuance
England FSA Food Safety and Hygiene (England) Regs 2013 Voluntary (FSA pressing for mandatory) Food Safety Act 1990 framework
Wales FSA (in Wales) Food Hygiene (Wales) Regs 2006 Mandatory since 28 Nov 2013 — £200 fixed penalty for non-display 72.4% of Welsh businesses at 5-star (Nov 2023)
Scotland Food Standards Scotland (FSS) — separate body since 1 April 2015 Food Hygiene (Scotland) Regs 2006 Food Hygiene Information Scheme (FHIS) — Pass / Improvement Required (not FHRS 0-5) Compliance Notices Regs 2023 added graduated enforcement from 30 June 2023; reheat temperature 82°C
Northern Ireland FSA NI; DAERA approves certain meat and dairy establishments Food Hygiene Regs (NI) 2006 Mandatory since 7 October 2016 Windsor Framework — the live EU text of 852/2004 continues to apply in NI

If you run sites in more than one UK nation, your HACCP plan must account for these differences — Scotland’s 82°C reheat, FHIS rather than FHRS, and Northern Ireland’s mandatory display and live EU regulatory alignment. For the deeper breakdown see our EHO inspection guide.

The 7 HACCP principles, applied to UK kitchens

The seven principles are set out verbatim in Article 5(2) of Regulation 852/2004:

1. Conduct a hazard analysis

Identify every biological, chemical, physical and allergenic hazard that could occur at each step of your process. The FSA definition of a hazard: “something with the potential to cause harm to the consumer.”

UK-specific hazards to cover:

  • Biological: Salmonella, Campylobacter, Listeria monocytogenes, E. coli O157, Clostridium perfringens, Bacillus cereus, Staphylococcus aureus, norovirus. Listeria control in ready-to-eat foods is governed by assimilated Regulation (EC) 2073/2005.
  • Chemical: cleaning chemicals, mycotoxins (maximum levels in assimilated Reg. 1881/2006), acrylamide — all food business operators must adopt mitigation measures under assimilated Regulation 2017/2158.
  • Physical: glass, metal, hard or sharp plastic, stone, bone, jewellery, pest fragments.
  • Allergenic: the 14 declarable allergens under assimilated Regulation (EU) 1169/2011 Annex II. See our allergen matrix guide for the full breakdown.

2. Determine Critical Control Points (CCPs)

A CCP is a step where control is essential to eliminate or reduce a hazard to an acceptable level. The FSA’s MyHACCP tool offers both the traditional 2003 Codex decision tree (four questions) and the simpler six-question Campden BRI variant.

Typical UK CCPs: cooking, chilling, hot-holding, metal detection and allergen labelling.

3. Establish critical limits

The UK statutory limits most businesses rely on:

  • Hot hold: ≥ 63°C (Food Safety (Temperature Control) Regulations 1995)
  • Chilled storage: ≤ 8°C legal maximum (FSA recommends 5°C)
  • Cooking: 70°C core for 2 minutes — or equivalent (75°C/30 sec, 65°C/10 min, 80°C/6 sec)
  • Frozen storage: ≤ -18°C
  • Scotland reheat: 82°C (a UK-wide exception)

Hot-display derogation: a single period of up to 2 hours below 63°C is permitted, and up to 4 hours for cold display above 8°C, under Schedule 4 of the Food Safety and Hygiene (England) Regulations 2013.

4. Establish monitoring procedures

Temperature probe checks, visual inspection, automated sensor logs. Under SFBB, this includes daily “opening checks”, “operational checks” and “closing checks” recorded in the daily diary.

5. Establish corrective actions

What you do when a critical limit is breached. Examples: reheat or discard food that held below 63°C for more than 2 hours; reject or rework metal-detect fails; isolate and re-label mislabelled allergenic batches.

6. Establish verification procedures

Not the same as monitoring. Verification confirms the whole system works — internal audits, probe calibration (ice-point 0°C and boiling-point 100°C per MyHACCP), microbiological testing, and a scheduled annual review.

7. Establish documentation and record-keeping

Records “commensurate with the nature and size of the food business.” This is the bedrock of the due diligence defence. No records = no defence.

The 12-step Codex HACCP sequence

Auditors from BRCGS, SALSA and CIEH work in 12 logical steps, not 7 principles. The 12 = 5 preliminary tasks + 7 principles:

  1. Assemble the HACCP team and define scope
  2. Describe the product
  3. Identify intended use and users
  4. Construct a flow diagram
  5. On-site confirmation of the flow diagram
  6. Principle 1 — hazard analysis
  7. Principle 2 — CCPs
  8. Principle 3 — critical limits
  9. Principle 4 — monitoring
  10. Principle 5 — corrective actions
  11. Principle 6 — verification/validation
  12. Principle 7 — documentation/records

Using the 12-step framing in your written plan signals you know what good looks like. Most competitor content stops at the 7 principles.

UK simplified routes — SFBB, CookSafe, Safe Catering

This is the section your operators actually need. Around 70% of UK small and medium food businesses meet their Article 5 duty through one of the FSA’s simplified HACCP-based packs, not a bespoke Codex plan. None of the major competitor HACCP articles cover these routes.

Safer Food Better Business (SFBB) — England, Wales, NI

Free FSA pack built around the four Cs: Cross-contamination, Cleaning, Chilling, Cooking. Plus a Management section and a daily diary for opening/operational/closing checks and a 4-weekly review.

FSA description: “a food safety management system based on the principles of HACCP, but you will not find words such as ‘HACCP’ or ‘hazard’ in the pack because we have cut out all the jargon.”

Variants available: Caterers; Retailers; Indian cuisine (covering Indian, Pakistani, Bangladeshi, Sri Lankan); Chinese cuisine (with a Cantonese edition); Childminders (≤5 children); Residential care supplement.

Limits: SFBB does not adequately cover vacuum packing, sous vide, cook-chill, fermentation or raw milk. These activities need bespoke HACCP add-ons — see the FSA’s Annex 4 sous vide guidance and vacuum packaging guidance.

Download free at food.gov.uk/business-guidance/safer-food-better-business-sfbb, and see our dedicated SFBB guide for how to fill the pack in properly and the common mistakes that cost operators their FHRS rating.

CookSafe — Scotland

Food Standards Scotland’s equivalent for Scottish caterers. Five sections: Introduction, Flow Diagram, HACCP Charts, House Rules, Monitoring/Records, plus an Action Plan.

Unlike SFBB, CookSafe uses explicit HACCP language — hazards, flow diagrams, control measures. That makes it more overtly “HACCP-like” but equally a valid Article 5 compliance route. Available in Chinese, Punjabi, Bengali and Urdu.

Scottish operators can also use:

  • RetailSafe — retail equivalent
  • ButcherSafe — for butchers handling both raw and ready-to-eat foods

Safe Catering — Northern Ireland

FSA NI pack for caterers and retailers with a catering function. Described as “a food safety management guide for Northern Ireland” that helps businesses “produce a food safety management plan based on the Hazard Analysis Critical Control Points (HACCP) principles.” Now includes an acrylamide section.

MyHACCP — the free FSA tool for small manufacturers

myhaccp.food.gov.uk is the FSA’s free online tool for UK small food manufacturers (typically ≤50 employees). It generates a structured HACCP-based FSMS, a downloadable PDF plan, and monitoring record templates. Studies are stored online for 36 months.

Important: MyHACCP does not automatically confer legal compliance — implementation is what matters.

Which route fits your business?

Operation Minimum compliant route
Small cafe, restaurant, takeaway SFBB / CookSafe / Safe Catering
Complex small manufacturer MyHACCP
Vacuum pack, sous vide, cook-chill Bespoke HACCP (SFBB insufficient)
Approved establishment (meat cutting, slaughter, dairy, fishery, egg products) under Reg. 853/2004 Full bespoke HACCP plus approval number
Multi-site chain Centralised bespoke HACCP + site-level verification

HACCP in practice — sector-specific examples

Small restaurant or cafe

Operates under SFBB (England/Wales/NI) or CookSafe (Scotland). Daily diary covers opening, operational and closing checks. Critical limits anchor on the four Cs. One person carries food safety authority — usually the head chef or owner.

Butcher — Regulation 853/2004 approved establishments

Butchers beyond “marginal, localised and restricted” retail must operate from an approved establishment under assimilated Regulation (EC) 853/2004. Approval requires:

  • A full bespoke HACCP plan, not SFBB or ButcherSafe alone
  • A unique approval number
  • An identification mark (oval, applied to wrapping/packaging by the FBO) or a health mark applied by an Official Veterinarian or Meat Hygiene Inspector

From 9 May 2024, NI may use “EU” as well as “EC” on identification marks; “EC” suffix remains valid until 31 December 2028. FSS veterinary manager time is currently charged at £110.34/hour (since 31 March 2025).

Multi-site chain

The FSA’s acrylamide guidance explicitly recognises centralised control: “For larger centrally controlled and supplied chains with standardised menus, the legislation reflects that the controls can be managed from the centre.”

Central HACCP is validated at head office. Each site performs monitoring, verification and record-keeping. Supplier approval programmes (audits, CoAs, spec sign-off) are essential because centralised HACCP depends on ingredient consistency.

Cloud kitchen / dark kitchen

FSA-commissioned research (2025) found around 15% of outlets on UK delivery apps are dark kitchens. UK law treats them like any food business: register with the local authority 28 days before trading; every virtual brand must be linked to the registered physical premises.

The FHRS rating follows the physical kitchen. CCPs specific to this format include delivery temperature control (hot ≥ 63°C, cold ≤ 8°C in transit) and allergen-matrix management across brands sharing equipment. For the full picture see our delivery platform FHRS requirements guide.

Bakery with allergen-dedicated lines

Allergens qualify as a CCP or high-priority Operational Prerequisite Programme (OPRP). Codex 2020 defines “allergen cross-contact” formally.

Controls: dedicated allergen-free lines, colour-coded utensils, non-allergen-first scheduling, validated changeover cleaning (ATP or protein swab). Precautionary allergen labelling (“may contain”) is voluntary and should only be used where a real, risk-assessed cross-contact risk exists. UK regulators do not endorse VITAL thresholds (an Australian scheme).

Natasha’s Law applies to PPDS bakery items — full ingredient list with the 14 allergens emphasised. Our Natasha’s Law guide covers the full compliance requirements.

Hotel — banqueting, room service, bar

Modular HACCP covering each service stream:

  • Banqueting/buffet: hot ≥ 63°C or a single ≤ 2-hour display; cold ≤ 8°C or a single ≤ 4-hour display. Time/temperature CCPs with labelled start times.
  • Room service: delivery transit time and temperature as a CCP; insulated or heated trolleys.
  • Bar: glass-breakage register (physical CCP), sulphite-containing wines (allergen 12), chemical segregation.
  • Function sheets: capture menu, numbers, service times and allergen notifications per cover — a verification record linking guest declarations to kitchen production.

HACCP vs HARPC — killing the US confusion

If you search UK food safety content you’ll hit US articles about HARPC and wonder if it applies. For UK-only operators, it doesn’t.

HARPC = Hazard Analysis and Risk-Based Preventive Controls, introduced by the US Food Safety Modernization Act (FSMA) 2011 and codified at 21 CFR Part 117. It applies to facilities registered with the FDA under the Bioterrorism Act 2002.

Key differences from HACCP:

Feature HACCP (UK) HARPC (US)
Hazards Biological, chemical, physical, allergenic HACCP four + radiological + economically motivated adulteration
Hazard analysis approach Considers existing controls Conducted without existing controls in mind
Outputs CCPs Preventive Controls — process, allergen, sanitation, supply-chain, other
Supply-Chain Program Not mandated Mandatory written
Recall Plan Not mandated Mandatory written
Plan authorship Trained competent person Preventive Controls Qualified Individual (PCQI)
Review cycle Annual, and on any change Every 3 years

When HARPC matters for UK businesses: if you export to the US and are registered with the FDA, or if you’re drawn in via a US importer’s Foreign Supplier Verification Program (FSVP). In that case you need both a 852/2004-compliant HACCP plan and a HARPC-style Food Safety Plan. For UK-only operations, HARPC is not required. See our dedicated HACCP vs HARPC comparison for the deeper breakdown if you export to the US.

The certification landscape — what exists and what doesn’t

Business-level HACCP: no UK government certificate exists

The UK has no government-issued “HACCP certificate” for food businesses. Any private consultancy selling you a “HACCP certificate” is offering a documentation audit with no statutory weight.

What does exist for businesses:

  • Local authority inspection under the Food Safety and Hygiene Regs 2013 produces your FHRS rating. That’s the operative public badge. Not a certificate, a rating.
  • Voluntary third-party assurance schemes that audit HACCP implementation at site level:
    • BRCGS Global Standard for Food Safety, Issue 9 — launched August 2022, audits from February 2023. HACCP is a designated “fundamental” clause. Required by Tesco, Sainsbury’s, M&S, Asda, Morrisons and Waitrose for many of their suppliers.
    • SALSA (Safe and Local Supplier Approval) — joint venture of FDF, NFU and UKHospitality; IFST-accredited. Aimed at small UK producers (~5-50 FTE). Includes a dedicated HACCP section based on Codex principles.
    • Red Tractor — whole-chain UK assurance. Meat & Poultry Processing standard requires a Level 3+ qualified HACCP team leader.

Staff-level HACCP training — RQF Ofqual-regulated qualifications

These certify the individual, not the business:

Level Audience
Level 1 — HACCP Awareness Low-risk food handlers, induction
Level 2 — Award in HACCP Most food handlers in catering, retail, manufacturing
Level 3 — Intermediate HACCP Supervisors, managers, HACCP team members
Level 4 — Managing HACCP QA/technical leads, HACCP team leaders in manufacturing

Awarding bodies include CIEH, RSPH and Highfield. All Ofqual-regulated and suitable for Wales (Qualifications Wales) and NI (CCEA Regulation).

The clarifier that saves operators money

A “HACCP certified” claim in UK marketing usually means one of two things: (a) a named person holds an RQF HACCP qualification, or (b) the business holds BRCGS or SALSA certification. These are different things at different scales. If a supplier tells you they are “HACCP certified” without specifying which, ask.

The FHRS connection — how HACCP documentation directly sets your rating

Your HACCP plan doesn’t just satisfy the law. It’s the single biggest lever on your Food Hygiene Rating Scheme score.

Under the FSA FHRS Brand Standard Revision 8 (March 2025), an EHO scores your business on three elements:

Element Possible scores
Food hygiene and safety procedures 0, 5, 10, 15, 20, 25
Structural compliance 0, 5, 10, 15, 20, 25
Confidence in Management (CIM) 0, 5, 10, 20, 30 (no 15, no 25)

The CIM score is where HACCP documentation lives. Brand Standard descriptors:

  • CIM 0 — excellent FSMS, everything reviewed, excellent track record
  • CIM 5 — FSMS in place, records maintained, suitable training including induction
  • CIM 10 — generally satisfactory, records appropriate but some gaps
  • CIM 20 — FSMS inappropriate or inadequate, not all hazards understood, not all controls in place
  • CIM 30 — no evidence of FSMS, no documented procedures, no effective controls

The quirk most operators miss — CIM caps the whole rating

Because CIM has no score of 15, the jump from 10 to 20 is consequential:

  • CIM 20 caps your overall rating at 1 — not 2 or 3. (Rating 2 requires no individual score above 15, and CIM 20 exceeds that.) For the full breakdown of what each CIM score means in practice, see our Confidence in Management score guide.
  • CIM 30 caps your overall rating at 0 — urgent improvement necessary.

Put plainly: no documented HACCP plan = CIM 30 = rating 0. Inadequate HACCP plan = CIM 20 = rating 1. This is why HACCP documentation isn’t a nice-to-have. It’s the difference between a 5-star rating and a 1-star rating even if your kitchen is otherwise spotless.

Post-inspection stand-still: if CIM is scored 20 or 30, most local authorities apply a 3-month stand-still before CIM can be reassessed. A rushed re-inspection in that window can achieve at most a 4, not a 5.

What EHOs look for in your HACCP documentation

From FSA Chapter 4.2 auditing guidance and CIEH EHP commentary, these are the top red flags:

  1. Back-filled or pre-written records — diaries completed in one sitting before an inspection
  2. Copy-paste temperature logs — identical readings across weeks
  3. No probe calibration evidence against ice-point or boiling-point
  4. Procedures that don’t match kitchen reality — SFBB says cook to 75°C but the chef sous-vides at 60°C
  5. No review since opening or menu change
  6. No allergen matrix — post-Natasha’s Law, this is an instant red flag
  7. Staff who can’t explain “their” CCPs or critical limits

Every one of these is something an experienced EHO will spot in the first 15 minutes. See our EHO inspection guide for the deeper operator-side playbook.

Named UK HACCP prosecutions 2024-2026

These are real UK cases where HACCP documentation gaps were material to the conviction. Sources: local authority press releases, FSA, trade press.

  • MAM African and European Foods Ltd, Newcastle — January 2024. Newcastle Magistrates’ Court. Six offences under FSH(E)R 2013 including failure to implement an FSMS. Company fined £4,000, directors personally fined. Total plus costs: over £5,600. The FSMS failing: no documented HACCP-based procedures, no allergen controls.
  • Peter Thorsen (Grantham deli), South Kesteven DC — 2024. Grantham Magistrates’. Inability to demonstrate HACCP compliance plus placing unsafe Shropshire Blue cheese on the market. £25,000 fine, £32,312.72 total. No HACCP evidence despite years of council support; no date-code or temperature controls; repackaged cheese without use-by dating.
  • Bread Spread Ltd, Ealing Council — March 2025. Uxbridge Magistrates’. Listeria monocytogenes detected in sandwiches and on a tomato slicer in May 2024, triggering a nationwide FSA recall. Production continued after a Hygiene Emergency Prohibition Notice. 21 counts. Company £14,000, director £14,000, manager £673. Total £46,827. Poor Listeria controls; mislabelled shelf lives; ineffective cleaning of food-contact equipment; poor traceability that hindered the recall.
  • Yorkshire Abattoir Services Ltd, FSA — April 2025. Kirklees Magistrates’. Three charges of intentionally obstructing FSA officers. £46,800 fine, £62,800 total. By preventing inspection the business rendered its approved-establishment HACCP plan under Regulation 853/2004 unverifiable.
  • A C Hopkins (Taunton) Ltd, FSA — December 2024. North Somerset Magistrates’. Breach of a Remedial Action Notice requiring separation of uninspected from inspected sheep carcases. £16,000 fine, £24,245.78 total. CCP breakdown for cross-contamination; failure to operate documented segregation procedures in the 853/2004 HACCP plan.
  • Innventure Ltd (The Rusty Gun pub, Hitchin), Herts Trading Standards — May 2025. St Albans Magistrates’. Near-fatal anaphylaxis in a 9-year-old wheat-allergic boy served sausages containing wheat. £25,000 fine, £26,802.76 total including compensation. No consistent documented allergen-management process; verbal assurances not backed by a written matrix or allergen-verification CCPs. The judge noted the company had “not learnt” from two prior incidents.
  • JR Uxbridge Ltd (Javitri Indian restaurant), Hillingdon Council — April 2025. Uxbridge Magistrates’. Nut-allergic customer hospitalised after an undeclared-allergen meal. Five offences. £35,000 fine, £43,816 total. Significant failings in allergen information control; no documented allergen management within the FSMS; inadequate staff allergen training.
  • Gradegold Catering Ltd, Ealing Council — 2025. Ready-to-eat products (lettuce, grapes, melon, mango) illegally relabelled with extended use-by dates. Guilty plea to failure to implement HACCP-based procedures. £20,000 fine plus £7,700+ costs. No documented shelf-life validation; unsafe extensions to use-by dates on Listeria-supporting RTE foods.

For scale reference, the Asda Barnsley case (Barnsley Magistrates’, January 2026) produced a £500,000 fine for five Food Safety Act offences — £100,000 per offence. Primarily a retail date-code failure rather than pure HACCP documentation, but it shows where UK sentencing has moved in 2025-2026. See our cost of food safety non-compliance guide for the deeper analysis.

Cautionary context: the 2024 UK STEC O145 outbreak (293 cases, 2 deaths, recalls by Greencore, Samworth Brothers and THIS!) produced no prosecutions — the root cause was never identified, and UKHSA noted the implicated sandwich makers had “detailed and robust HACCP plans.” Strong documented HACCP does not guarantee immunity when supplier control breaks down upstream.

Does HACCP cover allergens? Yes, explicitly

The 14 declarable allergens under assimilated Regulation (EU) 1169/2011 are a distinct hazard category in UK law, and they must be controlled through your FSMS. That means:

  • A recipe allergen matrix mapping every menu item against the 14 allergens — see our allergen matrix guide
  • Supplier specifications verifying each ingredient’s allergen profile
  • Staff training on allergen handling, declaration and cross-contact
  • Segregation controls — dedicated equipment, validated cleaning between allergen and non-allergen prep

Natasha’s Law (Food Information (Amendment) (England) Regulations 2019, in force 1 October 2021) extends allergen labelling to Prepacked for Direct Sale (PPDS) items. The March 2025 FSA best-practice guidance recommends written allergen information for non-prepacked foods — not yet law, but the direction of travel toward Owen’s Law. See our Owen’s Law guide for the full regulatory picture.

How much should a HACCP plan cost?

Using free tools: £0.

SFBB, CookSafe and Safe Catering are free from the FSA or Food Standards Scotland. MyHACCP is free. For a small independent cafe or restaurant following FSA guidance carefully, there is no cost barrier to legal compliance.

Consultant-led HACCP development (typical UK rates):

  • Small independent: £400 - £1,500
  • Multi-site chain: £3,000 - £10,000
  • BRCGS/SALSA audit preparation: typically £1,500 - £5,000 additional

Staff HACCP training:

  • Level 2 Award: £25 - £100 per person (online)
  • Level 3 Intermediate: £150 - £400 (online or classroom)
  • Level 4 Manager: £500 - £1,500

Free FSA allergen training is available at allergytraining.food.gov.uk.

How often should I review my HACCP plan?

Whenever any of the following happen:

  • A process changes (new equipment, new cooking method, new shift pattern)
  • A supplier changes
  • An ingredient or recipe changes
  • A menu changes — including specials boards and seasonal rotations
  • A corrective-action incident occurs

Plus a scheduled annual formal review to confirm the plan still reflects what actually happens in the kitchen. The closing paragraph of Article 5(2) of 852/2004 makes this explicit — reviews are part of the statutory duty.

HACCP vs Food Safety Management System vs ISO 22000 — clarifying the terms

Operators hit three overlapping terms and get confused. Here’s the clarification:

  • HACCP — the specific, legally mandated methodology for hazard analysis and critical control. Under Article 5 of 852/2004. Not certifiable in its own right in the UK.
  • Food Safety Management System (FSMS) — the wider operational system that includes HACCP plus prerequisite programmes (cleaning, pest control, personal hygiene, supplier approval, training, traceability, allergen management, waste, structural hygiene). HACCP controls residual significant hazards via CCPs; prerequisite programmes sit underneath.
  • ISO 22000:2018 — a voluntary international management system standard that embeds HACCP inside an ISO 9001-style framework with context-of-organisation, leadership, OPRPs distinct from PRPs and CCPs, internal audit, management review and continual improvement via PDCA. Certifiable through third-party assessment.

In UK practice: HACCP compliance is mandatory. ISO 22000 certification is a commercial choice driven by supply chain or export requirements.

What good HACCP looks like in practice

The difference between documented HACCP that passes inspection and documented HACCP that earns a 5-star rating is not the volume of paperwork. It’s whether the records are created at the point of task rather than back-filled.

An EHO walking into your kitchen can tell within 10 minutes whether your records reflect actual practice. If your temperature logs all show identical readings, if your cleaning schedule is signed but the fridge seals are mouldy, if your allergen matrix is two menu versions out of date, the Confidence in Management score lands at 20 or 30 — and the whole rating falls with it.

The operational story behind Forkto’s platform is that records get captured when the team member is actually doing the task: temperature check, cleaning sign-off, allergen verification, opening and closing routines. Every entry time-stamped and attributed. Every supplier reformulation flows automatically into the recipe allergen matrix. Every CCP monitoring log is reviewable in minutes by a manager, an auditor, or an EHO.

If you want to see how that works in a UK hospitality kitchen, book a demo or browse our free downloadable checklists — no email required.

Last updated 21 April 2026. This guide reflects UK food law as at April 2026, including assimilated Regulation (EC) 852/2004, the Food Safety and Hygiene (England) Regulations 2013, the 2025 Food Law Codes of Practice (published October 2025), the March 2025 FSA best-practice allergen guidance, and the FHRS Brand Standard Revision 8 (March 2025). For the ongoing regulatory changes shaping 2026, see our food safety trends 2026 guide.