If we run a food business anywhere in the UK, from a single coffee cart to a multi-site catering group, the law expects us to have a HACCP plan in place. Not a poster on the wall, not a folder we dust off once a year, but a working system that genuinely controls the hazards in our kitchen or production line.
At FoodSure, we spend our working days helping business owners across the country build HACCP plans that satisfy Environmental Health Officers and, more importantly, keep customers safe. This guide sets out exactly what a HACCP plan is, why it is a legal requirement, and how we can put one together step by step.
HACCP stands for Hazard Analysis and Critical Control Point. It is a structured way of thinking about food safety that was originally developed for NASA's space programme in the 1960s, where the cost of a foodborne illness in orbit was simply too high to risk. The principle transferred neatly to everyday food businesses: rather than testing finished products and hoping for the best, we map out every step of our process, work out where things could realistically go wrong, and build controls into the process itself.
A HACCP plan is the written record of that thinking. It documents the hazards we have identified (biological, chemical, physical and allergenic), the points in our process where those hazards need to be controlled, the limits we work to, how we monitor them, what we do when something goes outside those limits, and how we prove, through records, that the system is actually working day to day.
Yes. Regulation (EC) No 852/2004 on the hygiene of foodstuffs was retained in UK law after Brexit and remains the legal backbone of food hygiene regulation in England, Wales, Scotland and Northern Ireland. Article 5 of that regulation requires every food business operator, with the exception of primary producers such as farmers, to put in place, implement and maintain procedures based on HACCP principles.
Crucially, the law does not demand a specific certificate or a particular document format. It asks for procedures 'based on' the HACCP principles, and Article 5(2)(g) allows those procedures to reflect the size and complexity of the business. That flexibility is exactly why the Food Standards Agency built the Safer Food, Better Business (SFBB) pack for smaller caterers, while larger manufacturers are generally expected to run a full seven-principle HACCP system with more detailed documentation. Whichever route fits our business, the outcome the law is looking for is the same: hazards that are properly identified and genuinely controlled, with evidence to show it.
Every HACCP plan, however it is packaged, is built on the same seven principles set out in the Codex Alimentarius and mirrored in Article 5(2) of the regulation. We find it helps to think of them as a logical sequence rather than a checklist to tick in isolation.
Even in a small business, it helps to involve the people who actually run the process day to day, not just the owner. Start by describing the food itself: ingredients, intended use, shelf life, storage conditions and who it is likely to be served to, including any vulnerable groups.
Map every step from goods-in to service or despatch: receiving, storage, preparation, cooking, cooling, chilled or frozen storage, reheating, holding and serving. This diagram becomes the skeleton the rest of the plan hangs on, and an EHO will often ask to see it during an inspection.
At each step on the diagram, ask what could go wrong. Consider biological hazards such as Salmonella, Campylobacter, Listeria monocytogenes and E. coli O157, chemical hazards such as cleaning residues, physical hazards such as packaging fragments, and allergenic hazards from the fourteen major allergens. Not every hazard identified will need a formal control; some are managed through good hygiene practice alone.
A CCP is a step where a control measure is essential and where there is no later step that will remove the risk. In most catering settings, cooking, chilling, hot holding and reheating are the classic CCPs, alongside allergen handling at the point of preparation or service.
Attach a measurable limit to each CCP, for example a minimum core temperature of 75 degrees Celsius for cooking, and decide exactly how and how often it will be checked, and who is responsible.
Write down what staff must do the moment a limit is missed, and make sure temperature logs, delivery checks, cleaning schedules and training records are kept somewhere an inspector, or we ourselves, can find them quickly.
Not necessarily. For straightforward catering operations, the FSA's Safer Food, Better Business pack provides a simplified, diary-based route to compliance that most Environmental Health Officers recognise and accept. It is built around the same seven principles but presents them as practical daily checks rather than a technical document. Businesses with more complex processes, multiple sites, or export requirements typically need a bespoke HACCP plan, sometimes supported by BRCGS or SALSA certification for supply chain purposes. The right starting point depends on what we actually produce and who we sell to, which is exactly the kind of assessment we work through with clients at FoodSure.
A weak or missing HACCP system is one of the fastest ways to see a Food Hygiene Rating drop, and in more serious cases can lead to a Hygiene Improvement Notice or prosecution. It is also, in our experience, one of the easiest things to put right with the right support.
It is worth being clear about scope, because we still meet business owners who assume the rules apply to restaurants and factories but not to them. In practice, Article 5 applies to almost any organisation that handles food as part of its activity, whether or not that is the main purpose of the business. This includes obvious cases such as restaurants, takeaways, hotels, cafes and manufacturers, but also butchers, bakers, mobile caterers, market stalls, dark kitchens, care homes, schools, wholesalers, and even childminders registered as a food business. The only significant exclusion is primary production, such as farming and fishing at source, which falls under separate rules. If food is prepared, cooked, stored or served as part of what the business does, a HACCP-based system is expected.
We are often asked whether digital record-keeping is required, or whether a paper diary is still acceptable. Both are perfectly valid in the eyes of the law and of most Environmental Health Officers, provided the records are complete, accurate and genuinely kept in real time. Digital systems, from simple spreadsheets through to dedicated food safety apps, tend to reduce missed entries and make it easier to spot patterns, such as a fridge that keeps drifting towards its upper limit. Paper diaries remain entirely acceptable, particularly for smaller businesses, as long as they are actually filled in during the shift rather than reconstructed afterwards. What matters far more than the format is whether the records reflect what genuinely happened on the day.
The core legal requirement is consistent across England, Wales, Scotland and Northern Ireland, but a few details differ by nation. Scotland uses the Food Hygiene Information Scheme (FHIS) rather than the Food Hygiene Rating Scheme (FHRS) used elsewhere, and Scottish guidance for reheating tends to reference a higher temperature than the rest of the UK. Northern Ireland has its own display requirements for hygiene ratings and continues to track EU regulatory alignment more closely. Businesses operating across more than one UK nation should build these local differences into their HACCP plan rather than assuming a single national approach covers every site.
At FoodSure, we build HACCP plans that match the size and complexity of the business in front of us, rather than handing over a generic template and wishing everyone luck. Our team works with restaurants, manufacturers, caterers and retailers across the UK to develop process flow diagrams, run proper hazard analyses, set sensible critical limits, and put monitoring and record-keeping systems in place that staff will actually use. We also review and update existing HACCP plans that have fallen out of date, and prepare businesses for EHO inspections and BRCGS or SALSA audits. If a HACCP plan currently feels like a formality rather than a working system, we would be glad to help turn that around.
