UK HACCP Master Guide for Commercial Kitchens
In This Guide
- What Is HACCP and the UK Legal Framework?
- The 7 HACCP Principles Explained
- Temperature Control by Food Category
- Equipment-Specific HACCP Monitoring
- Daily Record-Keeping and Retention
- EHO Inspections: What They’re Looking For
- HACCP and Allergen Management (Natasha’s Law)
- Safer Food Better Business Framework
- Staff Training and Competency
- Manager/Owner Audit Checklist
- Insurance and Liability Requirements
What Is HACCP and the UK Legal Framework?
HACCP (Hazard Analysis and Critical Control Points) is a systematic approach to food safety that identifies potential hazards and implements controls to eliminate or reduce them to acceptable levels. In the UK, HACCP is a legal requirement for all commercial food businesses under Regulation 852/2004 (retained UK law post-Brexit).
The legal framework comprises:
- Regulation 852/2004: Core HACCP and hygiene requirements for all food businesses
- Food Safety Act 1990: Enforcement mechanism; failure to comply can result in prosecution, fines up to £20,000, or imprisonment
- Food Safety and Hygiene (England) Regulations 2013: England-specific implementation; applies to all food businesses including restaurants, catering, care homes, schools
- FIC Regulation 1169/2011: Allergen labeling and prepacked food information rules (retained UK law)
- FSA Guidance: Free resources from Food Standards Agency including Safer Food Better Business
EHOs inspect food businesses for HACCP compliance. Non-compliance carries significant penalties including enforcement notices, prohibition of food handling, and criminal prosecution.
The 7 HACCP Principles Explained
HACCP implementation follows seven internationally recognized principles. Each principle builds on the previous one to create a complete food safety management system.
Principle 1: Conduct a Hazard Analysis
Identify all potential biological, chemical, and physical hazards in your operation—raw materials, equipment, staff, storage, preparation methods, customer use. For example: cross-contamination between raw meat and ready-to-eat foods; bacterial growth due to improper temperature control; allergen cross-contact; foreign objects in food.
Document hazards, their likelihood, and severity. This forms the basis for identifying Critical Control Points.
Principle 2: Determine Critical Control Points (CCPs)
A CCP is any step in your process where you can apply control to prevent, eliminate, or reduce hazards to an acceptable level. In a commercial kitchen, typical CCPs include: cooking (temperature control prevents bacterial survival), hot-holding (temperature prevents pathogen multiplication), chilling (rapid cooling stops toxin formation), cold storage (temperature prevents growth).
Not every step is a CCP; identify only those where control is essential to food safety.
Principle 3: Establish Critical Limits
Set measurable boundaries for each CCP that define the difference between safe and unsafe food. Critical limits are based on legislation, scientific literature, and expert guidance. For example: cooking hazard CCP = 75°C core temperature; hot-holding CCP = 63°C; chilling CCP = 8°C within 90 minutes; raw meat storage CCP = 5°C maximum.
Critical limits must be specific and measurable so that monitoring is objective and enforceable.
Principle 4: Monitor Critical Control Points
Implement procedures to monitor each CCP continuously or at defined intervals to verify the critical limit is being maintained. For cooking: use calibrated thermometers to check core temperature before service. For hot-holding: check temperature every 2 hours. For chilling: record internal temperature at the start and end of the rapid cool process. For cold storage: check fridge/freezer temperatures daily.
Monitoring must be documented in real time; records are legally required for 12 months.
Principle 5: Establish Corrective Actions
Define what staff will do if monitoring shows a critical limit has been exceeded. For example: if cooked food reaches only 72°C instead of 75°C, re-cook to 75°C and re-monitor. If chilled food takes 2 hours to cool to 8°C instead of 1.5 hours, discard it (hazard cannot be rectified). If a fridge has drifted to 10°C, repair/replace immediately and segregate affected food pending temperature recovery.
Corrective actions must be pre-planned, documented, and actioned immediately when a limit is breached.
Principle 6: Verification and Validation
Verify that your HACCP system is working by reviewing monitoring records, checking that corrective actions are being followed, testing equipment (e.g., thermometer calibration), and periodically revisiting hazard analyses. Validation means confirming that your chosen critical limits and controls are actually preventing hazards—for example, by testing finished products for bacterial contamination or allergen presence.
Conduct verification at least quarterly; document all checks.
Principle 7: Documentation and Record-Keeping
Maintain detailed records of hazard analysis, CCPs, critical limits, monitoring results, corrective actions, staff training, and verification activities. Records must be retained for a minimum of 12 months and must be made available to EHOs on request. Documentation demonstrates that your HACCP system is in place and operating effectively; it is your primary defense against enforcement action.
Records must include: who did it, when, temperature/observation, equipment used, corrective action taken (if any).
Temperature Control by Food Category
Temperature is the primary critical control point in most commercial kitchens. The table below sets out the critical limits by food category according to UK food safety law and FSA guidance.
| Food Category | Critical Limit | Monitoring Frequency | Notes |
|---|---|---|---|
| Cooked Meat (beef, pork, lamb) | 75°C core temperature | Check before service; record | Use calibrated probe thermometer; insert into thickest part; hold 2 seconds |
| Cooked Poultry (chicken, turkey) | 75°C core temperature | Check before service; record | Critical for Salmonella control; check thigh (not breast) |
| Cooked Seafood | 63°C core temperature | Check before service; record | Lower limit than meat; texture degrades at higher temps |
| Cooked Eggs | 75°C core temperature | Check if reconstituted; record | For omelettes, scrambled, cakes; applies to yolk + white |
| Mixed Dishes (casseroles, curries, stews) | 75°C core temperature | Check before service; record | Check thickest/densest part; ensure all components reach limit |
| Hot-Held Ready-to-Eat Food | 63°C minimum during holding | Every 2 hours; record | Applies to bain-marie, hot pass, carvery; prevents pathogen multiplication |
| Chilled Food (salads, deli meats, prepared meals) | 8°C maximum | Daily (at least once); record | Check multiple shelves; fridge should have thermometer |
| Raw Meat (beef, pork, poultry, offal) | 5°C maximum | Daily; record | Store separately from ready-to-eat; below other foods |
| Rapid Cooling (cooked food→8°C) | 60°C→8°C within 90 minutes | Check at start, mid-point, end; record | Use blast chiller or ice bath; stir large batches; use shallow containers |
| Frozen Food | -18°C minimum | Weekly (at least); record | Check freezer/deep freeze; note any ice crystal buildup |
| Thawed Food (from frozen) | Cook to 75°C; do not re-freeze | Check after cooking; record | Once thawed, must be cooked within 24–48 hrs (check supplier) |
Equipment-Specific HACCP Monitoring
Each type of catering equipment has specific monitoring and maintenance protocols to ensure food safety.
Refrigeration Units (Walk-In Fridges, Under-Counter Fridges, Reach-In Cabinets)
Daily Checks
- Check internal temperature with thermometer; record (must be ≤8°C)
- Inspect door seals for cracks; ensure door closes properly
- Check shelves are clean and unobstructed
- Verify no foodstuffs beyond use-by date are present
Weekly Checks
- Clean condenser coils (rear/underside); remove dust/debris
- Check for ice buildup on walls/floor (indicates thermostat drift)
- Test alarm function (if present)
Quarterly Checks
- Calibrate thermometer against ice bath or digital standard
- Deep-clean interior; disinfect walls and shelves
- Inspect drainage channel; clear blockages
Annual Checks
- Professional maintenance by competent engineer
- Certificate of compliance issued; retain for 12 months
- Replace gaskets if worn; test refrigerant levels
Blast Chillers
Per-Cycle Monitoring
- Record start temperature (should be ≥60°C)
- Record mid-point check (typically 30 mins): should be approaching 20°C
- Record final temperature (must reach ≤8°C) and time elapsed
- If target not reached within 90 minutes, discard food; investigate equipment fault
- Use pre-printed logging sheets or digital logging (software)
Weekly Maintenance
- Clean interior; remove food debris
- Test door seal; ensure air-tight closure
- Check display panel for error codes
Annual Service
- Professional engineer service and calibration
- Test temperature sensors; verify accuracy ±2°C
- Certificate issued; file for 12 months
Commercial Dishwashers
Daily Checks
- Check rinse temperature: must reach minimum 82°C (some models 65°C if chemicals assist)
- Verify detergent and rinse-aid are not depleted
- Inspect door seal; look for food residue
- Run test cycle with empty racks; listen for alarm/vibration
Weekly Checks
- Clean filter basket; remove trapped food particles
- Inspect spray arms; check nozzles are clear
- Empty drain trap; check for blockages
Quarterly Checks
- Calibrate rinse temperature sensor against digital thermometer
- Deep-clean interior with descaling agent (if hardness high)
- Test chemical dispenser calibration
Hot-Holding Equipment (Bain-Maries, Hot Plates, Carveries)
During Service
- Check temperature with probe thermometer: must be ≥63°C
- Record at least every 2 hours
- If temperature drops, discard or re-heat to 75°C immediately
Weekly Checks
- Clean heating elements; remove food debris
- Inspect thermostat setting; verify accuracy with separate thermometer
- Check for water leaks from steam table components
Ice Machines
Weekly Checks
- Visual inspection: no discoloration or slime growth on ice
- Check ice storage bin is clean; no debris or foreign objects
- Verify storage temperature (should be -18°C or below)
Quarterly Checks
- Clean water inlet lines; replace filters if present
- Sanitize ice-making surfaces according to manufacturer guidance
- Test water supply quality (hardness can affect ice purity)
Commercial Fryers
Daily Checks
- Check oil temperature reaches safe cooking range (typically 170–180°C)
- Record temperature before service start
- Inspect oil color; if darkened excessively, replace oil
- Check for water in oil (causes splattering and hazard)
Weekly Checks
- Clean fryer basket and mesh; check for corrosion
- Inspect thermometer for accuracy (test against standard)
- Check drainage system; ensure no oil leaks
Daily Record-Keeping and Retention
Record-keeping is mandatory under Regulation 852/2004. Records must demonstrate that your HACCP system is operating and that critical limits are being maintained. All records must be retained for minimum 12 months and made available to EHOs on request.
Essential Daily Records
- Temperature Logs: Fridge/freezer temps daily; cooking temps before service; hot-holding temps every 2 hours; blast chiller start/mid/end temps
- Cooking Records: Food type, cooking time, core temperature reached, staff member name, time
- Hot-Holding Checks: Equipment name, temperature, time of check, staff member
- Blast Chiller Logs: Start temp, time in chiller, intermediate temp, final temp, time elapsed, food description
- Cleaning Records: Equipment cleaned, method, chemicals used, time, staff member (daily or per shift)
- Chemical Inventory & Safety Data Sheets: Date purchased, supplier, product name, quantity used, SDS filed and accessible
- Corrective Action Logs: Date/time deviation identified, what happened, immediate action taken, outcome (e.g., discard, re-cook, repair equipment)
- Allergen Control Log: Any cross-contact incidents, corrective measures, staff informed
- Staff Training Records: Name, date, topic, duration, trainer name, competency assessment (pass/fail)
- Supplier Audits: Raw material supplier name, date of audit, any issues identified, corrective action requested
- Equipment Maintenance: Service date, engineer name, work carried out, calibration results, next service due
- Pest Control Records: Date treated, pest control contractor, area treated, chemicals used, findings
Record Retention and Storage
Minimum retention period: 12 months (from date of record creation). Records can be stored in paper format, electronic (spreadsheet), or integrated kitchen management software. All staff must understand they have a duty to complete records accurately and on time. Records must be filed in a manner that allows quick retrieval during an EHO inspection. Suggested approach: one file per week, clearly labeled with dates.
EHO Inspections: What They’re Looking For
Environmental Health Officers inspect food businesses on a risk basis (high-risk premises more frequently). Their primary focus during inspection is HACCP compliance. An EHO will examine your temperature records, equipment, staff knowledge, and corrective action logs.
Review daily fridge/freezer logs; check most recent cooking and chilling records; verify critical limits recorded and any deviations corrected immediately
Inspect fridges, freezers, cooking equipment; verify thermometers calibrated; check blast chiller for logging system
Verify all cleaning chemicals have accessible Safety Data Sheets; chemicals stored away from food; staff trained in safe use
Interview staff about temperature critical limits; ask what they would do if food didn’t reach safe temperature; review training records
Review allergen register; inspect food labels; verify staff awareness of major allergens; check cross-contact prevention measures
Request supplier details for key raw materials; verify you could trace a food safety incident back to source within 24 hours
Common EHO Findings and Enforcement Response
| Finding | Risk Level | Typical Enforcement Response |
|---|---|---|
| No daily temperature records for chilled food | High | Prohibition notice; immediate closure until records system established |
| Fridge consistently above 8°C; food served anyway | High | Enforcement notice (14 days to remedy); potential prosecution |
| Cooked chicken not reaching 75°C; staff unaware of requirement | High | Prohibition notice; mandatory staff retraining; reinspection in 48 hours |
| Cleaning chemicals stored above food; no SDS available | Medium-High | Enforcement notice; mandatory staff training; COSHH audit |
| Temperature records missing for past 3 months | High | Enforcement notice; requirement to maintain records going forward; potential fine |
| Allergen menu labels incomplete; cross-contact risk present | Medium | Warning letter; remedial notice; staff training requirement |
| Blast chiller not logging; cooling time unknown | Medium-High | Enforcement notice; immediate installation of logging system |
| Supplier audit not conducted; raw material traceability unclear | Medium | Improvement notice; requirement to establish supplier audit programme |
HACCP and Allergen Management
Natasha’s Law (October 2021)
Natasha’s Law requires that all prepacked food (food in its final packaging sold directly to consumers) must carry a full ingredient list and a clear allergen warning. This applies to deli counters, sandwich shops, bakeries, and any business packaging food on-site.
FIC Regulation 1169/2011 (Retained UK Law)
The Food Information for Consumers Regulation (retained in UK law) mandates that all food (prepacked and non-prepacked) must state the presence of one or more of 14 major allergens:
- Cereals containing gluten (wheat, barley, rye, oats)
- Crustaceans (prawns, crab, lobster)
- Eggs
- Fish
- Peanuts (legume, not tree nut)
- Tree nuts (almonds, hazelnuts, walnuts, cashews, etc.)
- Milk and milk products (including lactose)
- Sesame
- Celery
- Mustard
- Mollusks (mussels, clams, squid)
- Sulfites (added as preservative; levels ≥10 mg/kg)
- Lupin
- Soy
HACCP Allergen Checklist
- Conduct allergen hazard analysis: identify all allergens used in kitchen and potential cross-contact points
- Establish CCPs: segregate allergen ingredients; use dedicated preparation areas/equipment when possible; label allergen containers clearly
- Set critical limits: no cross-contact (binary: safe or unsafe); staff training on allergen awareness
- Monitor: visual inspection of allergen storage; staff awareness checks; verify labels before use
- Corrective action: if allergen found in wrong location, isolate affected food; re-audit preparation area; reconfirm staff training
- Record: document any allergen incidents; corrective measures taken; staff training records
- Communicate: display major allergens on menu; ensure wait staff can answer allergen questions accurately; provide detailed ingredient information on request (within 48 hours for prepacked food)
Safer Food Better Business Framework
Safer Food Better Business (SFBB) is a free framework developed by the Food Standards Agency to simplify HACCP for small food businesses (cafés, restaurants, takeaways, care homes). It follows the 7 HACCP principles but uses a structured, easy-to-complete format.
Identify your key food safety hazards (raw meat cross-contamination, temperature control, pest control) and the Critical Control Points you’ll monitor
Ensure all staff are trained in food safety to Level 2 minimum; keep records of training; designate a food safety supervisor
Establish cleaning schedules; provide adequate handwashing facilities; manage waste; prevent pest access; maintain equipment
Monitor and record fridge/freezer temperatures daily; check cooking temperatures before service; log hot-holding checks; monitor rapid cooling
Obtain written assurance from suppliers that they meet food safety standards; maintain supplier contact details for traceability; audit on-site suppliers (farmers markets)
Safer Food Better Business is recognized by EHOs as equivalent to a formal HACCP plan, provided it is correctly completed and monitored. Download the free toolkit from FSA Safer Food Better Business.
Staff Training and Competency
Mandatory Staff Training Levels
- Level 2 Food Safety in Catering (Level 3 in some contexts): Minimum requirement for all food-handling staff; covers personal hygiene, temperature control, cross-contamination, time control, cleaning. Duration ~6 hours. Must be renewed every 3 years.
- Level 3 Food Safety in Catering: Recommended for supervisors, chefs, kitchen managers; covers HACCP principles, risk assessment, monitoring, records. Duration ~16 hours.
- Level 4 Food Safety in Catering: For food safety managers and auditors; detailed HACCP, legislative knowledge, enforcement. Duration ~40 hours.
- Allergen Awareness: All staff, especially those handling food and speaking to customers; covers 14 major allergens, cross-contact prevention, customer communication. Duration ~2 hours; refresh annually.
- Induction Training (New Starters): Temperature critical limits, equipment-specific procedures (fridge, blast chiller, dishwasher), cleaning protocols, corrective action procedure. Duration ~4 hours; documented in training records.
Competency Assessment
All staff must demonstrate competency in their assigned role. Competency is assessed through: knowledge test (written or verbal Q&A); observed practice (e.g., using a thermometer correctly); and supervisor sign-off. Repeat assessment annually or if a serious food safety breach occurs (e.g., undercooked chicken served).
Manager/Owner Audit Checklist
Conduct an internal HACCP audit quarterly (4 times per year) to identify gaps before an EHO inspection. Use the checklist below; score each item as Compliant (Y), Non-Compliant (N), or Not Applicable (N/A).
Insurance and Liability Requirements
Public Liability Insurance
Required for all commercial food businesses. Minimum recommended cover: £5,000,000 (£5M). This covers claims from customers or third parties injured as a result of your food service operation.
Product Liability Insurance
Covers claims relating to food contamination, allergen issues, or foodborne illness. Often included in a combined catering liability policy. Minimum recommended: £1,000,000.
Employer’s Liability Insurance
Legally required if you have employees. Minimum cover: £6,000,000 (UK statutory minimum). Covers claims from staff injured during work.
Additional Considerations
- NCASS Membership (National Catering Association Standards): Professional body membership provides accreditation, liability support, and legal guidance; typically £500–£1,500 per annum depending on business size
- Enforcement Notice Insurance: Some policies cover costs of remedying EHO enforcement notices (e.g., equipment repair, staff retraining); check your policy wording
- Annual Policy Review: Ensure your insurance cover reflects your current menu complexity, allergen handling, and business scale
Authority Links and Regulatory References
Related Compliance Guides
Personal hygiene, handwashing, illness reporting, clean vs. dirty hands
Critical limits by food type, equipment monitoring, rapid cooling
14 major allergens, cross-contact prevention, labeling requirements
Level 2/3/4 requirements, competency assessment, refresh schedules
What inspectors look for, common findings, enforcement responses
Daily logs, 12-month retention, digital vs. paper, organization
Rapid cooling 60°C→8°C in 90 minutes, logging, maintenance
Daily/weekly/quarterly/annual checks, thermometer accuracy, temperature logging
Frequently Asked Questions
HACCP is a legal requirement under Regulation 852/2004. Operating without it is a criminal offense. An EHO can issue an enforcement notice requiring you to put a system in place within 14 days. If you fail to comply, you can be prosecuted under the Food Safety Act 1990, risking a fine up to £20,000 or imprisonment. Additionally, if a customer becomes ill due to food from your business and you have no HACCP records, you have no defense against a claim.
At least once per day. Check early in the morning before service begins and record the temperature. If you have multiple fridges, check each one. The temperature must be 8°C or below. If it’s above 8°C, investigate the cause (e.g., faulty thermostat, blocked condenser), take corrective action (repair or replace equipment), and assess whether any food has been stored unsafely. Document the issue and corrective action in your records.
75°C core temperature. Use a calibrated probe thermometer; insert it into the thickest part of the chicken (e.g., thigh, not breast); hold for 2 seconds. Do not rely on visual cues (color, juices). Record the temperature and time before serving. If chicken reaches only 72°C, re-cook to 75°C and re-check. This critical limit controls for Salmonella and other pathogens.
Minimum 12 months, measured from the date the record was created. For example, temperature logs from January 2026 must be retained until at least January 2027. Records can be paper, electronic (spreadsheet), or digital (management software). At the end of 12 months, you may destroy old records, but if an EHO requests records during an inspection, they must be available going back 12 months from the date of inspection. Best practice: keep all records for at least 18 months to allow for potential food safety investigations.
Natasha’s Law (October 2021) requires all prepacked food (food packaged in a way that prevents alteration and sold directly to consumers) to carry a full ingredient list and clear allergen labeling. It applies if you package food on-site for sale (e.g., deli sandwiches, bakery items, pre-prepared meals in a takeaway). If you sell non-prepacked food (made-to-order items served immediately), you must still declare allergens on request, but the requirement for pre-labeling is less strict. Consult your local EHO if you’re unsure whether your food falls under the prepacked category.
A CCP is a stage in your food process where you can apply control to prevent or reduce a hazard to an acceptable level. For example, cooking is a CCP (you control temperature to kill pathogens); cold storage is a CCP (you control temperature to prevent bacterial growth). Not every step is a CCP. To identify CCPs: (1) conduct a hazard analysis (identify biological, chemical, and physical hazards), (2) ask: “Can I apply control at this step to prevent or reduce the hazard?” If yes, it’s a CCP. Document all CCPs and their critical limits (measurable boundaries, e.g., 75°C for cooking).
EHOs inspect for HACCP compliance, focusing on: (1) temperature records (daily logs for fridges, cooking temps before service, hot-holding checks), (2) equipment condition and calibration (are thermometers accurate?), (3) staff knowledge (can they explain critical limits?), (4) corrective action logs (what happened when a critical limit was exceeded?), (5) allergen management (accurate labels, cross-contact prevention), (6) chemical safety (SDS available for all cleaning products). They will review records from the past 12 months. The more complete and accurate your records, the more confident an EHO will be that your system is working.
Do NOT serve the food. Immediate corrective actions: (1) re-cook the food to the correct critical temperature (e.g., 75°C for meat) and re-check with a calibrated thermometer, OR (2) discard the food if re-cooking is not safe or feasible. Document the incident: date, time, food type, initial temperature, what happened, corrective action taken, outcome. If the temperature fell below the critical limit due to equipment malfunction (e.g., broken oven thermometer), repair or replace the equipment immediately. Review the incident with staff to prevent recurrence. This documentation is critical if an EHO inspects; it shows you detected and acted on the hazard.
