Regulation 852/2004 and the Food Safety Act 1990, UK wide
Food Safety and HACCP
Every food business operator has to run a permanent food safety procedure based on HACCP principles and has to be able to show an officer that it is actually running. AL23 Safety builds and maintains those procedures, from a single kitchen to a multi-line factory, for food businesses UK wide.
What is HACCP support?
A permanent operating procedure, not a folder on a shelf
Article 5 of Regulation (EC) 852/2004 requires you to put in place, implement and maintain a permanent procedure based on the HACCP principles. The word doing the work is "maintain". A plan written for a menu you no longer serve does not satisfy Article 5 whatever the folder looks like.
Our support covers the whole system rather than the plan alone. The prerequisite programmes it rests on, the hazard analysis, the monitoring records that prove critical limits were met and the allergen and traceability controls an officer asks about first.
The seven principles in Article 5(2)
Article 5(3) requires revision whenever you modify the product, the process or any step. Article 5(4) requires records to stay current and proportionate.
- 01
Identify any hazards that must be prevented, eliminated or reduced to an acceptable level.
- 02
Identify the critical control points at the step or steps where control is essential.
- 03
Establish critical limits at those points, separating acceptability from unacceptability.
- 04
Establish and implement effective monitoring procedures at each critical control point.
- 05
Establish the corrective action to take when monitoring shows a point is out of control.
- 06
Establish verification procedures, carried out regularly, confirming that principles 1 to 5 work.
- 07
Establish documents and records commensurate with the nature and size of the business.
Who needs one
Every food business operator apart from primary production
Article 5 reaches all food business operators except primary producers, who are governed by Annex I and good hygiene practice instead. The practical triggers are these.
- Opening, extending or refurbishing a kitchen, production area, bakery or servery.
- Changing a recipe, a supplier, a process step or a piece of equipment, which triggers the revision duty in Article 5(3).
- Packing food on site before it is ordered, which brings prepacked for direct sale labelling into scope.
- Preparing for a retailer or third-party technical audit that expects a full HACCP plan rather than a Safer Food Better Business diary.
- Recovering from a hygiene rating you would rather not display, a hygiene improvement notice or a request to close voluntarily.
- Bidding for catering, care or education contracts that require a documented food safety management system.
The regulations that apply
Your legal framework, in plain terms
The Food Safety Act 1990 is the parent Act for England, Wales and Scotland and carries the offences, the enforcement powers and the due diligence defence in section 21. Alongside it sit the assimilated European regulations, principally Regulation (EC) 852/2004 on hygiene, Regulation (EC) 178/2002 on general food law and Regulation (EU) 1169/2011 on food information. These were renamed from retained to assimilated law by the Retained EU Law (Revocation and Reform) Act 2023 with effect from 1 January 2024. Use that term in your documents. The Food Safety and Hygiene (England) Regulations 2013, SI 2013/2996, provide the enforcement machinery in England. Wales, Scotland and Northern Ireland have their own 2006 hygiene regulations. In Scotland the competent authority is Food Standards Scotland.
Regulation 852/2004 Article 5
The HACCP duty. A permanent, implemented, maintained procedure with records proportionate to your size.
Regulation 852/2004 Article 4 and Annex II
General hygiene requirements across Chapters I to XII, covering premises, equipment, water, personal hygiene, packaging, heat treatment and training.
Regulation 178/2002 Articles 14, 18 and 19
The food safety requirement, one step back and one step forward traceability and the duty to withdraw or recall unsafe food.
Regulation 1169/2011 Articles 9(1)(c) and 21
Mandatory declaration of allergenic ingredients, emphasised within the ingredients list by bold, contrasting colour or underlining.
Food Safety Act 1990 section 21
The due diligence defence, available to the operator who took all reasonable precautions and exercised all due diligence. In practice that means the records.
What the service covers
From prerequisite programmes to a tested recall
- Prerequisite programme review covering cleaning, pest control, supplier approval, water quality, waste, glass and hard plastic control and calibration.
- Hazard analysis by product and process flow, with critical control points set where control is genuinely essential rather than everywhere.
- Critical limits, monitoring, frequency, responsible person and corrective action for each control point, written in language the person doing the check can follow.
- Verification and review, including internal audit, calibration checks and the triggers that force revision under Article 5(3).
- Safer Food Better Business implementation for smaller operations, covering the diary, the safe methods for cross-contamination, cleaning, chilling and cooking, plus the four-week review.
- Full HACCP plan development for manufacturing and higher risk operations, using the FSA MyHACCP structure where it fits.
- Allergen management from delivery to plate, covering segregation, cleaning validation, recipe control and label accuracy, including prepacked for direct sale labelling under Natasha's Law.
- Food hygiene rating preparation against the three elements assessed and the evidence an officer looks for.
- Traceability and recall testing, including a mock recall against a real batch code.
- Enforcement support where a notice has been served, covering the response, the evidence pack and the re-rating request.
Allergens and Natasha's Law
The Food Information (Amendment) (England) Regulations 2019, SI 2019/1218, came into force on 1 October 2021. Food packaged at the same place it is offered to consumers and in that packaging before it is ordered must carry the name of the food and a full ingredients list with the 14 regulated allergens emphasised. Sandwiches made on site and put in a chiller are the classic example. Before that date the information could be given verbally. It cannot now. Loose food is different. The information may be given by any means, including orally, provided a clear signpost tells the customer how to obtain it.
Precautionary allergen labelling, the "may contain" statement, remains voluntary and guidance based. The FSA technical guidance updated on 4 September 2023 says to apply one only where risk assessment shows an unavoidable cross-contamination risk that cleaning and segregation cannot control. Name the specific allergen rather than a category. A Board discussion paper of 5 September 2024 examined thresholds without deciding anything. We have found no 2025 or 2026 publication changing that position.
Our process
Walk the floor, then build the plan
- 01
Walk the process
We follow your product from goods in to service or dispatch, watching what people actually do rather than what the manual says.
- 02
Analyse the hazards
We build the flow diagram, verify it on the floor, then work through microbiological, chemical, physical and allergenic hazards step by step.
- 03
Set the controls
We fix the critical control points, critical limits, monitoring and corrective actions, then design record sheets short enough that they get filled in honestly.
- 04
Implement and train
We brief the team, run the system alongside you and correct the drift that appears in the first fortnight.
- 05
Verify and review
We audit against the plan, test traceability with a mock recall and set review triggers so the system moves when your menu does.
What you get
The documented system an officer will accept
- A documented HACCP plan with process flow diagrams, a hazard analysis table and a critical control point summary.
- A monitoring pack of record sheets, opening and closing checks, temperature logs and corrective action forms.
- An allergen matrix by dish or product line, plus a labelling specification for prepacked for direct sale items.
- A prerequisite programme file covering cleaning schedules, pest control, supplier approval and calibration.
- A gap report against the three food hygiene rating elements, with actions ranked by what will move the rating.
- A traceability and recall procedure with the results of a tested mock recall.
What we need from you
Recipes, records and access while you trade
- Menus, recipes, specifications and any current process flow.
- Your existing food safety management system, diary or SFBB pack, in whatever state it is in.
- Supplier list, delivery records and any approved supplier documentation.
- The last two environmental health inspection reports and any notices served.
- Access to the site while it is working. A plan written in a quiet office on a closed day is a fiction.
Why AL23 Safety
Designed for the shift, not the folder
Accountable
If your plan is a template with somebody else's product names in it, we say so rather than hand back a tidier version of a document that would fail on the first question.
Practical, not just compliant
Records get completed only if they are short, obvious and owned. We design for the shift, not the auditor.
Joined up
Food premises also carry machinery, chemical, slip and fire risks. We cover those in the same visit rather than send a second consultant.
UK wide
We support food manufacturers, caterers, retailers and care and education kitchens across the UK. Our sector work in food manufacturing and hospitality sits behind it.
Facing an inspection you are not ready for
Tell us the date. We will tell you what is exposed
A short call is usually enough for us to say whether your system needs building, rebuilding or simply evidencing better.
Common questions
Answers, up front
Cannot see your question? Get in touch and we will answer it directly.
Contact usSafer Food Better Business is the FSA's free HACCP-based pack for small businesses. It is one way to comply with Article 5, not the only way and not itself a legal requirement. It works for straightforward catering. It is usually not enough for manufacturing or where a retailer audit expects flow diagrams and validated critical limits.
Three elements are assessed. Compliance with food hygiene and safety procedures, compliance with structural requirements and confidence in management and control procedures. The third is where most businesses lose points, since it rests on your documented system, your training records and the officer's judgement. The conversion from those scores to the published rating comes from the FSA's FHRS Brand Standard. We work from the current version rather than reproduce a table from memory. An appeal goes in writing to the local authority within 21 days of notification. A right to reply has no time limit. A revisit can be requested once improvements are made, subject to a standstill period. Display is a legal requirement in Wales and Northern Ireland and voluntary in England.
A hygiene improvement notice under regulation 6 of the Food Safety and Hygiene (England) Regulations 2013 requires specified measures by a date at least 14 days away. It is appealable to the magistrates' court. A hygiene emergency prohibition notice under regulation 8 is different. It is served where there is an imminent risk of injury to health, takes effect immediately, must be posted conspicuously on the premises and ceases after three days unless the authority applies to the court.
There is no legal requirement in Great Britain to hold a specific certificate. Annex II Chapter XII of Regulation 852/2004 requires food handlers to be supervised, instructed or trained commensurate with their work. Those maintaining the HACCP procedure must have adequate training in the HACCP principles. In practice Level 2 is the default expectation for food handlers, with Level 3 for supervisors and HACCP team members. The three-year refresh often quoted is convention among retailers and auditors rather than statute. A Level 2 certificate does not legally expire. Courses sit with our health and safety training team.
Cost is driven by the number of process flows, the number of sites and whether we are building from nothing or repairing something. A single-site caterer is a different job from a factory with six lines and a segregation problem. Most small operations can be assessed in a day, with documentation following within two weeks. Tell us your operation and we will scope it properly.
Related services