Food Safety & HACCP Compliance FAQ

Under the Food Safety Act 1990 and supporting regulations, all foods must reach a core temperature of 75°C to eliminate harmful bacteria. This applies to all cooked dishes served in your establishment. Use a calibrated probe thermometer and record readings as part of your SFBB (Safer Food, Better Business) documentation.

Source: Food Safety Act 1990; Food Safety and Hygiene (England) Regulations 2013 Reg.30

UK food hygiene regulations set the following holding temperatures:

• Cold holding: Maximum 8°C (legal limit), with 5°C recommended as best practice
• Hot holding: Minimum 63°C under the Food Safety and Hygiene (England) Regulations 2013

Foods held between 8°C and 63°C enter the danger zone where bacteria multiply rapidly. A tolerance of up to 4 hours outside these temperatures is permitted only if you can demonstrate safe practices.

Source: Food Safety and Hygiene (England) Regulations 2013 Reg.30; EC Reg 852/2004 Annex II Ch.IX

Under Regulation (EU) 1169/2011 (retained in UK law) and Natasha's Law (UK Food Information Amendment 2021), you must declare 14 allergens:

• Celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soybeans, and sulphur dioxide/sulphites (>10mg/kg)

Natasha's Law specifically requires that all prepacked for direct sale (PPDS) food must carry a full ingredients list with allergens emphasised in bold, italics, or CAPITALS. This includes sandwiches, salads, and baked goods wrapped on the same premises where they are sold.

Source: Retained EU Reg 1169/2011 Art.9; UK Food Information (Amendment) (England) Regulations 2019

The Food Hygiene Rating Scheme (FHRS) rates food businesses from 0 (urgent improvement necessary) to 5 (very good). Inspectors assess three areas: hygienic food handling, physical condition of the premises, and food safety management.

Penalties under the Food Safety Act 1990 s.35 for non-compliance include:

• Unlimited fines in the Magistrates' Court
• Up to 2 years' imprisonment on indictment
• Hygiene improvement notices, emergency prohibition notices, and voluntary closure

In Wales and Northern Ireland, display of FHRS stickers is mandatory. In England, it remains voluntary but strongly encouraged.

Source: Food Safety Act 1990 s.35; Food Hygiene Rating (Wales) Act 2013

Safer Food, Better Business (SFBB) is the Food Standards Agency's simplified HACCP-based food safety management system designed specifically for small businesses such as restaurants, cafés, and takeaways. Under EC Regulation 852/2004 Art.5 (retained in UK law), all food businesses must implement HACCP-based procedures.

SFBB satisfies this requirement by providing:

• Pre-written safe methods for cooking, chilling, cleaning, and cross-contamination prevention
• A diary for daily checks and record-keeping
• Opening and closing check templates

While SFBB is not legally mandatory by name, having some documented food safety management system is required. SFBB is the recommended approach for small operators.

Source: EC Reg 852/2004 Art.5 (retained UK law); FSA SFBB guidance

Under the Food Safety and Hygiene (England) Regulations 2013 Schedule 3 and EC Regulation 852/2004 Annex II Ch.VIII, food handlers with symptoms of vomiting, diarrhoea, or infectious illness must be excluded from food handling areas.

The FSA recommends a minimum 48-hour return-to-work rule — staff must be symptom-free for at least 48 hours before returning to duties involving food. For confirmed cases of certain pathogens (e.g., E. coli O157, Typhoid), clearance from an environmental health officer or medical professional may be required before returning.

You must keep records of staff illness and any exclusion periods as part of your food safety management system.

Source: Food Safety and Hygiene (England) Regulations 2013 Sch.3; EC Reg 852/2004 Annex II Ch.VIII

Under the Food Safety and Hygiene (England) Regulations 2013 Reg.9 (and equivalent devolved legislation), you must register your food business with your local authority at least 28 days before you begin trading. Registration is:

• Free of charge
• Cannot be refused — it is a notification, not a licence
• Required for every premises, including home-based businesses, market stalls, and mobile units

Failure to register is a criminal offence. After registration, you can expect an inspection within 28 days of opening, where your FHRS rating will be determined. Separate registration is needed for each premises you operate.

Source: Food Safety and Hygiene (England) Regulations 2013 Reg.9; EC Reg 852/2004 Art.6

The FDA Food Code 3-401.11 sets minimum internal cooking temperatures based on food type:

• Poultry (chicken, turkey, duck): 165°F (73.9°C) for 15 seconds
• Ground meats (beef, pork, sausage): 155°F (68.3°C) for 17 seconds
• Whole-muscle meats (steaks, chops, roasts): 145°F (62.8°C) for 15 seconds, with a 4-minute rest for roasts
• Fish and seafood: 145°F (62.8°C) for 15 seconds
• Reheated foods: 165°F (73.9°C) within 2 hours

These are non-negotiable minimums. Document all cooking temperatures in your HACCP logs.

Source: FDA Food Code 2022 §3-401.11; 21 CFR Part 117

The Food Safety Modernization Act (FSMA), codified primarily in 21 CFR Part 117 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food), requires:

• A written food safety plan with hazard analysis
• Preventive controls for identified hazards (process, allergen, sanitation, supply-chain)
• Monitoring procedures and corrective actions
• Verification activities including environmental monitoring
• A Preventive Controls Qualified Individual (PCQI) who has completed standardised training

FSMA shifted the FDA's approach from reactive response to prevention-based food safety. Very small businesses (under $1M average annual sales) have modified requirements but are not exempt.

Source: 21 CFR Part 117; FSMA §103 (21 U.S.C. §350g)

The Food Allergen Labeling and Consumer Protection Act (FALCPA) of 2004, updated by the FASTER Act of 2023, requires declaration of 9 major food allergens:

• Milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and sesame (added by the FASTER Act effective 1 January 2023)

For packaged foods, allergens must appear in a "Contains" statement or be identified in parentheses within the ingredient list. For restaurants and food service, the FDA Food Code §3-603.11 requires that you inform consumers of major allergens upon request. Many state and local health departments impose additional allergen disclosure requirements.

Source: FALCPA 2004 (21 U.S.C. §343); FASTER Act 2023 (Pub.L. 117-11); FDA Food Code §3-603.11

A Preventive Controls Qualified Individual (PCQI) is required under 21 CFR Part 117.126 for all food facilities subject to FSMA preventive controls. The PCQI must:

• Have successfully completed a standardised curriculum recognised by the FDA (typically the FSPCA course, approximately 2.5 days)
• Or possess equivalent job experience to develop and oversee the food safety plan
• Oversee the food safety plan — including hazard analysis, preventive controls, monitoring, corrective actions, and verification

The PCQI does not need to be an employee; you may hire an external consultant. However, at least one PCQI must be responsible for your facility's food safety plan at all times. Exemptions exist only for very small businesses under qualified exemptions in §117.5(a).

Source: 21 CFR §117.126; 21 CFR §117.180; FSPCA curriculum

The FDA Food Code §3-501.14 mandates a 2-stage cooling process for all cooked time/temperature control for safety (TCS) foods:

• Stage 1: Cool from 135°F to 70°F (57.2°C to 21.1°C) within 2 hours
• Stage 2: Cool from 70°F to 41°F (21.1°C to 5°C) within the next 4 hours
• Total cooling time must not exceed 6 hours

Acceptable cooling methods include shallow pans (no deeper than 4 inches), ice baths, blast chillers, and adding ice as an ingredient. If food does not reach 70°F within 2 hours, it must be reheated to 165°F and the cooling process restarted, or discarded.

Source: FDA Food Code 2022 §3-501.14; §3-501.15

FDA inspections are conducted under the authority of 21 U.S.C. §374. During an inspection, investigators may:

• Examine your food safety plan, HACCP records, and PCQI documentation
• Inspect equipment, storage, processing areas, and sanitation practices
• Collect samples for laboratory testing
• Review supplier verification records and recall procedures

If violations are found, the investigator issues a Form FDA 483 (Inspectional Observations). You have 15 business days to respond in writing with corrective actions. Failure to address 483 observations can escalate to:

• Warning Letters
• Import Alerts
• Injunctions or consent decrees
• Mandatory recall authority under FSMA §206

Source: 21 U.S.C. §374; FSMA §206; FDA Investigations Operations Manual Ch.5

Under FSMA §206 (21 U.S.C. §350l), the FDA has mandatory recall authority. Recalls are classified into three tiers:

• Class I: Reasonable possibility that exposure will cause serious adverse health consequences or death (e.g., undeclared allergens, Listeria contamination)
• Class II: May cause temporary or medically reversible adverse health consequences; probability of serious consequences is remote (e.g., mislabelled dates, minor contamination)
• Class III: Not likely to cause adverse health consequences (e.g., minor labelling errors, quality defects)

Firms are expected to maintain distribution records sufficient to facilitate recalls within 24 hours. Your food safety plan under 21 CFR Part 117 must include a recall plan that covers notification procedures, public warnings, and effectiveness checks.

Source: 21 U.S.C. §350l; 21 CFR Part 7 Subpart C; 21 CFR §117.139

Regulation (EC) 852/2004 Article 5 requires all food business operators (except primary producers) to implement procedures based on the 7 HACCP principles:

• Identify hazards and assess risks
• Determine Critical Control Points (CCPs)
• Establish critical limits at each CCP
• Implement monitoring procedures
• Establish corrective actions
• Implement verification procedures
• Maintain documentation and records

The regulation allows flexibility for small businesses (Recital 15 and Art.5(2)(g)): simplified approaches including industry guides of good practice are acceptable. You do not need a formal written plan if you can demonstrate equivalent food safety management through other documented methods.

Source: Reg (EC) 852/2004 Art.5; Commission Notice 2016/C 278/01

Regulation (EC) 178/2002 (the General Food Law) establishes the core principles of EU food legislation. Key requirements for your business include:

• Art.14: No unsafe food may be placed on the market
• Art.17: Food business operators bear primary responsibility for food safety
• Art.18: Traceability must be established at all stages — the "one step back, one step forward" principle
• Art.19: Operators must initiate withdrawal/recall procedures if food does not comply with safety requirements

For traceability, you must be able to identify your suppliers (one step back) and your customers (one step forward) for every product. Records must include the name and address of the supplier/customer, the nature and quantity of products, and the date of transaction. Internal traceability (linking incoming to outgoing products) is recommended but not legally required.

Source: Reg (EC) 178/2002 Art.14, 17, 18, 19

Regulation (EU) 1169/2011 Art.9 and Annex II requires declaration of 14 allergens that must be emphasised (bold, italics, underline, or contrasting font) in the ingredients list:

• Cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk, tree nuts (almonds, hazelnuts, walnuts, cashews, pecans, Brazil nuts, pistachios, macadamias), celery, mustard, sesame, lupin, molluscs, and sulphur dioxide/sulphites (>10mg/kg)

For non-prepacked food (restaurant meals, buffets), allergen information must be provided to the consumer before purchase. Member States may determine the format — this can be verbal communication supported by written records, menu labelling, or signage directing consumers to ask staff. A written record must always be available for verification.

Source: Reg (EU) 1169/2011 Art.9, Art.21, Art.44, Annex II

The Rapid Alert System for Food and Feed (RASFF), established under Regulation (EC) 178/2002 Art.50-52, is the EU's network for exchanging information about food safety risks. It includes:

• Alert notifications: Serious risk requiring rapid action — products already on the market
• Border rejections: Consignments refused entry at EU borders
• Information notifications: Risk identified but no rapid action required
• News notifications: Any food/feed safety-related information

As a food business operator, RASFF affects you when your products or ingredients are involved in a notification. If you receive a RASFF-related withdrawal request from your competent authority, you must act immediately — remove the product, notify your customers, and cooperate with the investigation. The RASFF portal is publicly accessible for monitoring alerts relevant to your supply chain.

Source: Reg (EC) 178/2002 Art.50-52; RASFF Annual Reports

Regulation (EC) 2073/2005 (as amended) sets two categories of microbiological criteria:

• Food safety criteria (Annex I Ch.1): Apply to products on the market — e.g., Listeria monocytogenes max 100 CFU/g in ready-to-eat foods throughout shelf life; Salmonella absent in 25g for many product categories
• Process hygiene criteria (Annex I Ch.2): Apply during manufacturing — e.g., E. coli limits in minced meat, Enterobacteriaceae in pasteurised products

You must conduct regular testing as part of your HACCP-based procedures. Pasteurisation must achieve 72°C for 15 seconds (or equivalent time/temperature combination). If process hygiene criteria are exceeded, you must review and improve your processes but need not withdraw the product from the market.

Source: Reg (EC) 2073/2005 Annex I Ch.1-2; Reg (EC) 852/2004 Annex II Ch.XI

The EU provides flexibility for small businesses through several mechanisms in Regulation 852/2004 and the Commission Notice 2016/C 278/01:

• Simplified HACCP (Art.5(2)(g)): Small businesses may use national guides to good hygiene practice instead of formal HACCP documentation
• Structural requirements (Art.13(3-5)): Member States may adapt Annex II requirements for traditional activities, regions with particular geographical constraints, and premises using traditional methods
• Direct supply (Art.1(2)(c)): Direct supply of small quantities of primary products to the final consumer or local retail is excluded from certain requirements
• Reg 853/2004 exemptions: Retail establishments supplying other retail up to a marginal, localised, and restricted basis are exempt from approval requirements

Contact your national competent authority to confirm which flexibility measures apply in your Member State.

Source: Reg (EC) 852/2004 Art.1(2)(c), Art.5(2)(g), Art.13; Commission Notice 2016/C 278/01

EU food law requires extensive documentation under multiple regulations:

• HACCP records (Reg 852/2004 Art.5(2)(g)): Monitoring logs, corrective actions, verification results — retained for a period appropriate to the nature and size of your business
• Traceability records (Reg 178/2002 Art.18): Supplier and customer identification, product details, dates of transaction — must be available to competent authorities on demand
• Temperature records: Cold chain monitoring, cooking temperatures, and any breaks in temperature control
• Training records: Evidence that all staff receive appropriate food hygiene training (Reg 852/2004 Annex II Ch.XII)
• Allergen records: Ingredient lists, recipes, and allergen cross-reference documentation (Reg 1169/2011)

While the EU does not prescribe a single retention period for all records, most Member States recommend minimum 2 years or the shelf life of the product plus 6 months, whichever is longer.

Source: Reg (EC) 852/2004 Art.5, Annex II Ch.XII; Reg (EC) 178/2002 Art.18; Reg (EU) 1169/2011

Yes. Following the 2018 revision of the Food Hygiene Act (食品衛生法), HACCP-based sanitation management became mandatory for all food businesses from 1 June 2021. There are two approaches:

• HACCP based on Codex principles: Required for large-scale manufacturers and processors — full 7-principle HACCP implementation
• HACCP based on guidelines (HACCPの考え方を取り入れた衛生管理): For small businesses (roughly 50 employees or fewer) — simplified approach using industry-specific manuals

Both approaches require written sanitation management plans, monitoring records, and corrective action documentation. Prefectural health centres (保健所) conduct inspections to verify compliance.

Source: Food Hygiene Act (食品衛生法) Art.51, 54; 2018 Revision (平成30年法律第46号)

The Ministry of Health, Labour and Welfare (MHLW) sets the following cooking temperature standards:

• General cooking: Core temperature 75°C for 1 minute or equivalent
• Norovirus prevention: 85–90°C for 90 seconds — this higher standard applies particularly to shellfish and foods prepared for vulnerable populations (hospitals, schools, elderly care facilities)
• Minced meat products: 75°C for 1 minute throughout

Japan's norovirus prevention guidelines are among the most stringent globally due to the high incidence of norovirus outbreaks linked to raw and undercooked shellfish. The MHLW publishes annual norovirus prevention notices each autumn (typically October–November).

Source: MHLW Large-Scale Cooking Facility Hygiene Management Manual (大量調理施設衛生管理マニュアル); Food Hygiene Act enforcement regulations

Japanese food hygiene regulations set the following temperature control standards:

• Cold holding: 10°C or below (legal requirement), with 5°C or below recommended as best practice by the MHLW
• Hot holding: 65°C or above
• Danger zone: 10°C–65°C — food must not remain in this range

The cooling standard is particularly specific: cooked foods should be cooled from cooking temperature to 20°C within 30 minutes, then from 20°C to 10°C within 60 minutes. This rapid cooling protocol is stricter than many international standards and reflects Japan's emphasis on preventing bacterial growth in the humid climate.

Source: MHLW Large-Scale Cooking Facility Hygiene Management Manual; Food Hygiene Act enforcement standards

Under the Food Labelling Act (食品表示法) and Food Labelling Standards (食品表示基準), Japan requires allergen declaration in two tiers:

• 8 mandatory allergens (特定原材料): Eggs (卵), milk (乳), wheat (小麦), buckwheat (そば), peanuts (落花生), shrimp (えび), crab (かに), and walnuts/kurumi (くるみ) — added as the 8th mandatory allergen in March 2023
• 20 recommended allergens (特定原材料に準ずるもの): Including almonds, cashews, sesame, soybeans, macadamia nuts, and others — labelling is strongly recommended but not legally required

For unpackaged foods (restaurant dishes), there is no legal obligation to declare allergens, but the Consumer Affairs Agency strongly recommends verbal or written disclosure. Many prefectures have additional local guidelines.

Source: Food Labelling Standards (食品表示基準) Art.3; Consumer Affairs Agency Notice (令和5年3月9日改正)

The Food Hygiene Act (食品衛生法) prescribes the following penalties:

• Individuals: Up to 3 years' imprisonment and/or a fine of up to 3 million yen for selling or distributing food that violates safety standards (Art.81-83)
• Corporations: Fines up to 300 million yen (約$2M USD) under the dual penalty provision (両罰規定 Art.87)
• Administrative actions: Business suspension orders, licence revocation, facility closure, and public naming

Prefectural governors and health centre directors have authority to issue immediate suspension orders without court proceedings when there is an imminent public health risk. Food poisoning incidents involving 50+ persons require mandatory reporting to the MHLW.

Source: Food Hygiene Act (食品衛生法) Art.81-83, Art.87; Art.60-61 (administrative measures)

Under the revised Food Hygiene Act (2021 enforcement), Japan consolidated its permit system into 32 business types (営業許可業種) requiring a permit (許可) from the prefectural health centre. Key categories include:

• 飲食店営業: Restaurant/food service
• 菓子製造業: Confectionery manufacturing
• そうざい製造業: Prepared food manufacturing
• 食肉販売業: Meat retail
• 魚介類販売業: Seafood retail

Each permit requires:

• A Food Hygiene Manager (食品衛生責任者) — one per establishment
• Facility standards compliance (water supply, handwashing, ventilation, waste disposal)
• A sanitation management plan based on HACCP principles
• Permit renewal every 5–8 years depending on the business type and prefecture

Source: Food Hygiene Act (食品衛生法) Art.55; Enforcement Ordinance Art.35

Japan's MHLW Norovirus Control Guidelines set strict protocols because norovirus is the leading cause of foodborne illness in Japan (accounting for approximately 50% of all outbreaks):

• Staff health checks: Daily health questionnaires before each shift — record symptoms including diarrhoea, vomiting, fever, and abdominal pain
• Exclusion period: Staff with symptoms must be excluded from food handling. Return only after negative stool test results — typically 48–72 hours after symptoms resolve
• Hand hygiene: Double handwashing (wash, rinse, wash again, rinse) is standard protocol in Japanese food service
• Cooking temperatures: All shellfish and foods for vulnerable populations must reach 85–90°C for 90 seconds
• Environmental disinfection: Sodium hypochlorite at 200ppm for surfaces and 1,000ppm for vomit/faecal matter cleanup

Source: MHLW Norovirus Control Guidelines (ノロウイルスに関するQ&A); Large-Scale Cooking Facility Manual

The Australia New Zealand Food Standards Code Standard 3.2.2 sets the following temperature requirements:

• Cooking: Core temperature of 75°C or equivalent time/temperature combination
• Cold holding: 5°C or below
• Hot holding: 60°C or above
• Danger zone: 5°C–60°C — potentially hazardous foods must not remain in this range except under controlled conditions

The new Standard 3.2.2A (effective 8 December 2023) introduced enhanced food safety requirements including mandatory food safety supervisors and strengthened temperature control documentation for Category 1 and 2 businesses.

Source: Food Standards Code Std 3.2.2 Div.3; Std 3.2.2A (Dec 2023)

The 2-hour/4-hour rule is an alternative to strict temperature control under Standard 3.2.2 Div.3 cl.8. It applies to potentially hazardous foods in the danger zone (5°C–60°C):

• Under 2 hours total: Food can be refrigerated for later use or kept for immediate service
• Between 2 and 4 hours total: Food must be used immediately — served or processed without delay
• Over 4 hours total: Food must be discarded

Critical points to remember:

• Time is cumulative — every period in the danger zone counts, including preparation, display, and transport
• You must have a system to track total time (labels, timers, or logs)
• Once food has been in the danger zone, returning it to the refrigerator does not reset the clock

Source: Food Standards Code Std 3.2.2 Div.3 cl.8; FSANZ guidance

Under Standard 1.2.3 of the Australia New Zealand Food Standards Code, you must declare 11 allergens plus sulphites:

• 11 allergens: Peanuts, tree nuts, milk, eggs, sesame seeds, fish, crustaceans, soybeans, lupin, wheat (and other gluten-containing cereals), and molluscs
• Sulphites: Must be declared when present at 10mg/kg or more

For packaged food: Allergens must appear in the ingredients list using prescribed names. Plain English allergen summary statements (e.g., "Contains: milk, eggs, wheat") are permitted and recommended.

For unpackaged food (restaurant meals): The Food Standards Code does not mandate a specific format, but state and territory laws typically require you to be able to inform consumers about allergens upon request. Written allergen matrices are strongly recommended.

Source: Food Standards Code Std 1.2.3; FSANZ Allergen Labelling Guidance

Standard 3.2.2 Div.3 cl.7(2) requires a 2-stage cooling process for cooked potentially hazardous foods:

• Stage 1: Cool from 60°C to 21°C within 2 hours
• Stage 2: Cool from 21°C to 5°C within a further 4 hours
• Total cooling time must not exceed 6 hours

Effective cooling methods include:

• Shallow pans (maximum depth 5cm)
• Dividing large quantities into smaller portions
• Ice baths or blast chillers
• Stirring food in containers placed in ice

If the Stage 1 target is not met within 2 hours, the food must be reheated to 60°C or above and the process restarted, or the food must be discarded.

Source: Food Standards Code Std 3.2.2 Div.3 cl.7(2)

Standard 3.2.2A (effective 8 December 2023) introduced a risk-based classification system for food businesses:

• Category 1 (highest risk): Businesses processing raw foods, catering for vulnerable populations, or handling unpackaged potentially hazardous foods requiring significant processing (e.g., hospitals, aged care, childcare, large manufacturers)
• Category 2 (medium risk): Businesses handling unpackaged potentially hazardous foods with less complex processing (e.g., most restaurants, cafés, takeaways, bakeries)
• Category 3 (lower risk): Businesses handling only packaged potentially hazardous foods or unpackaged low-risk foods (e.g., bottle shops, fruit stalls, packaged food retailers)

Category 1 and 2 businesses must have a Food Safety Supervisor with nationally recognised qualifications. Category 1 businesses face the most stringent documentation and record-keeping requirements.

Source: Food Standards Code Std 3.2.2A Div.3; FSANZ Implementation Guidance (2023)

Penalties under Australian food law vary by state and territory but are based on the Food Standards Australia New Zealand Act 1991 and state Food Acts. Typical maximum penalties include:

• Corporations: Fines up to $500,000 AUD for serious offences (e.g., selling unsafe food, failing to comply with food safety standards)
• Individuals: Fines up to $100,000 AUD and/or imprisonment
• Infringement notices: On-the-spot fines typically ranging from $500–$2,000 AUD for minor breaches

Enforcement authorities (state/territory food authorities and local councils) may also issue:

• Improvement notices requiring corrective action within a specified timeframe
• Prohibition orders immediately closing all or part of your operation
• Public naming ("name and shame") for serious offences, published on authority websites

Source: Food Act 2003 (NSW) s.110-118; Food Act 1984 (VIC) s.55-56; FSANZ Act 1991

Under Standard 3.2.2 cl.3 and the new Standard 3.2.2A, food businesses must ensure staff have adequate food safety skills and knowledge. Specific requirements include:

• Food Safety Supervisors: Required for Category 1 and Category 2 businesses — must hold a recognised Food Safety Supervisor certificate (nationally accredited units of competency: SITXFSA005 for hospitality, FBPFSY007 for food processing, or HLTFSE007 for health and community services)
• Food Handlers: Must have skills and knowledge in food safety and hygiene appropriate to their work — obtained through training or experience
• Refresher training: Food Safety Supervisor certificates must be renewed every 5 years

At least one Food Safety Supervisor must be reasonably available at all times when the business is operating. This person oversees food safety practices and can be the owner, manager, or a designated senior staff member.

Source: Food Standards Code Std 3.2.2 cl.3; Std 3.2.2A Div.4

The Safe Food for Canadians Act (SFCA, 2012) and its Safe Food for Canadians Regulations (SFCR, 2019) modernised Canada's food safety framework by consolidating four previous statutes. Key requirements include:

• Licensing: A Safe Food for Canadians (SFC) licence is required for interprovincial trade, import, and export of food
• Preventive Control Plans (PCPs): Written food safety plans required for licensed businesses
• Traceability: One-step-back/one-step-forward traceability for all food commodities
• Labelling: Modernised labelling requirements including bilingual (English/French) requirements

Businesses selling only within a single province may be subject to provincial regulations instead. The CFIA (Canadian Food Inspection Agency) is the enforcement authority for all SFCA/SFCR requirements.

Source: Safe Food for Canadians Act (S.C. 2012, c.24); SFCR (SOR/2018-108)

A Preventive Control Plan (PCP) is Canada's HACCP-based food safety system required under SFCR Part 4. Your PCP must include:

• Hazard analysis: Biological, chemical, physical, and radiological hazards
• Preventive controls: Measures to address identified hazards (process controls, sanitation, allergen controls, recall procedures)
• Monitoring procedures: How you verify controls are working
• Corrective actions: Steps when deviations occur
• Verification activities: Reviews, testing, and validation

A written PCP is mandatory for businesses holding an SFC licence (interprovincial/international trade). Businesses operating only within a single province may need equivalent documentation under provincial law. The CFIA provides the My Food Business toolkit as a guided resource for developing your PCP.

Source: SFCR Part 4 (SOR/2018-108 s.46-84); CFIA PCP Guidance

The Food Retail and Food Services Code (FRFSC) and provincial regulations set the following temperature requirements:

• Cold holding: 4°C or below
• Hot holding: 60°C or above
• Danger zone: 4°C–60°C
• Cooking temperatures:
  • Whole poultry: 82°C
  • Poultry parts, ground poultry: 74°C
  • Ground meat (beef, pork, veal): 71°C
  • Pork, fish, whole cuts of beef/veal: 63°C with 3-minute rest

Canada's cold holding requirement of 4°C is stricter than many jurisdictions. Temperature monitoring must be documented as part of your Preventive Control Plan, with calibrated thermometers checked regularly.

Source: Health Canada Food Retail and Food Services Code (2016); SFCR s.47

Under the Food and Drug Regulations (FDR) B.01.010.1–B.01.010.3 and the SFCR, Canada requires declaration of 11 priority allergens plus gluten and sulphites:

• 11 priority allergens: Peanuts, tree nuts (almonds, Brazil nuts, cashews, hazelnuts, macadamias, pecans, pine nuts, pistachios, walnuts), milk, eggs, fish, crustaceans, molluscs, soy, wheat, sesame, and mustard
• Gluten sources: Wheat, rye, barley, oats (or their hybridised strains)
• Sulphites: When present at 10ppm or more

Allergens must be declared using their common name in a "Contains" statement or within the ingredient list. For food service (restaurants, cafés), you must be able to provide allergen information to customers upon request. Health Canada recommends maintaining an allergen matrix for all menu items.

Source: FDR B.01.010.1–B.01.010.3; SFCR s.213-214; Health Canada Allergen Guidance (2021)

Under the SFCR s.90-92, record retention requirements for food businesses include:

• General records: Minimum 2 years from the date they were created
• Traceability records (SFCR s.91): Minimum 2 years — must enable one-step-back/one-step-forward identification within 24 hours of a CFIA request
• PCP-related records: Monitoring logs, corrective actions, verification results, and sanitation records — minimum 2 years
• Complaint and recall records: Maintained for at least 2 years after the complaint or recall is resolved

Records must be in English or French, legible, and accessible in Canada. They may be kept electronically if they can be produced in written form upon request. The CFIA may request records during inspections, investigations, or audits.

Source: SFCR s.90-92; CFIA Preventive Control Plan Guidance

The Safe Food for Canadians Act s.39-48 prescribes the following penalties for food safety violations:

• Summary conviction: Fines up to $250,000 and/or up to 2 years' imprisonment
• Indictable offence: Fines up to $5,000,000 and/or imprisonment
• Administrative Monetary Penalties (AMPs): Up to $10,000 for minor violations and up to $15,000 for serious/repeat violations (per violation)

The CFIA also has authority to:

• Suspend or revoke SFC licences
• Issue recall orders (SFCA s.19)
• Detain and seize food products
• Issue food safety orders requiring immediate corrective action
• Publish inspection results and enforcement actions

Subsequent offences carry increased maximum penalties. Directors and officers may be held personally liable if they directed or acquiesced in the violation.

Source: SFCA s.39-48; SFCA s.19 (recall); AMPs Regulations (SOR/2019-161)

A Safe Food for Canadians (SFC) licence is required under SFCR Part 3 for businesses that:

• Import food into Canada
• Export food from Canada
• Conduct interprovincial trade (sell food across provincial/territorial boundaries)
• Manufacture, process, treat, preserve, grade, or label food for any of the above activities

The licence is not required for businesses that sell food only within their own province (governed by provincial regulations instead) or for primary producers selling their own unprocessed products directly to consumers.

To obtain an SFC licence:

• Apply through the My CFIA portal
• Prepare a Preventive Control Plan
• Demonstrate traceability capability
• Licence is valid for 2 years and must be renewed

Source: SFCR Part 3 (s.27-44); CFIA SFC Licence Guidance

The Food Act 2014 replaced the Food Act 1981 and established a risk-based regulatory framework for all food businesses in New Zealand. Key features include:

• Risk-based measures: Businesses are categorised based on the risk level of their activities, not their size
• Three operating models: Food Control Plans (FCPs), National Programmes (Levels 1-3), and exemptions
• MPI (Ministry for Primary Industries) is the primary regulator
• Registration requirement: All food businesses must register with their local territorial authority or MPI

The Act places responsibility on the food business operator to identify and manage food safety risks appropriate to their activities. Transitional provisions have been completed, and all food businesses must now operate under the new framework.

Source: Food Act 2014 s.8-16, 31-42; MPI Guidance (2024)

Under the Food Act 2014 Part 2, the type of food safety system you need depends on your business risk level:

• Food Control Plan (FCP) — s.31-42: Required for higher-risk activities such as manufacturing, processing, or preparing food. FCPs are custom or template-based plans that identify hazards and set out how you will manage them. Verified by approved verifiers at prescribed intervals (annually for most businesses)
• National Programme (NP) — s.43-54: For lower-risk activities such as selling pre-packaged food, serving beverages, or basic food handling. Three levels:
  • Level 3: Lowest risk (e.g., selling only pre-packaged foods) — self-reporting
  • Level 2: Medium risk (e.g., preparing low-risk foods) — periodic verification
  • Level 1: Higher risk within NP (e.g., handling raw meat for immediate sale) — more frequent checks

Most restaurants, cafés, and caterers require an FCP. Most retail shops selling pre-packaged food operate under a National Programme.

Source: Food Act 2014 s.31-42 (FCP), s.43-54 (NP); Food Regulations 2015 Sch.1-3

The Food Regulations 2015 and MPI-approved FCP templates specify the following temperature standards:

• Cold holding: 5°C or below
• Hot holding: 60°C or above
• Cooking: Core temperature of 75°C or equivalent time/temperature combination
• Danger zone: 5°C–60°C

The 2-hour/4-hour rule applies (same as Australia):

• Under 2 hours in danger zone → refrigerate or use immediately
• 2–4 hours → use immediately
• Over 4 hours → discard

Temperature monitoring must be recorded as part of your FCP or National Programme documentation. Digital temperature loggers are recommended for cold storage units.

Source: Food Regulations 2015; MPI FCP Template (Hospitality) Sch.1

New Zealand follows the Australia New Zealand Food Standards Code Standard 1.2.3, requiring declaration of the same allergens as Australia — 11 allergens plus sulphites:

• 11 allergens: Peanuts, tree nuts, milk, eggs, sesame seeds, fish, crustaceans, soybeans, lupin, wheat (and cereals containing gluten), and molluscs
• Sulphites: When present at 10mg/kg or more

For packaged food: Allergens must be declared in the ingredients list using prescribed names. A summary "Contains" statement is recommended.

For unpackaged food (restaurant and café meals): While the Food Standards Code does not mandate a specific format, the Food Act 2014 requires that food must be safe and suitable. You must be able to provide accurate allergen information to consumers. MPI recommends allergen awareness training for all food handlers and written allergen charts for menu items.

Source: Food Standards Code Std 1.2.3 (ANZ); Food Act 2014 s.9; MPI Allergen Guidance

Record retention requirements vary by regulatory framework:

• Food Act 2014 (FCP records) — s.41: Records must be kept for a minimum of 4 years from the date they were created. This includes temperature logs, cleaning records, corrective actions, supplier information, and verification reports
• Animal Products Act 1999: Records related to animal products must be kept for 7 years
• National Programme records: Minimum 4 years retention aligned with FCP requirements

Records must be:

• Legible, in English (or te reo Māori), and accessible in New Zealand
• Available for inspection by MPI verifiers or territorial authority officers upon request
• Stored securely (electronic records are acceptable if they can be printed)

Verifiers typically review records during scheduled verification visits. Keep records organised by date and type for efficient audits.

Source: Food Act 2014 s.41; Animal Products Act 1999 s.24; Food Regulations 2015

The Food Act 2014 Part 5 prescribes escalating penalties for food safety offences:

• Corporations: Fines up to NZ$2,500,000 for the most serious offences (selling food that is unsafe or operating without required registration)
• Individuals: Fines up to NZ$500,000 and/or imprisonment
• Infringement offences: On-the-spot fines of NZ$1,000–$5,000 for minor breaches

MPI and territorial authorities can also:

• Issue improvement notices requiring corrective action
• Issue compliance orders with immediate effect
• Impose food safety officer directives including mandatory recall
• Suspend or cancel FCP or NP registration
• Prosecute through the courts for serious or repeated offences

Operating without the required FCP or National Programme registration is itself an offence carrying significant fines.

Source: Food Act 2014 s.231-257; Food Act 2014 s.283 (infringement offences)

Campylobacter is New Zealand's most notified foodborne illness, with New Zealand historically having one of the highest rates in the developed world. Key facts for food business operators:

• Primary source: Raw and undercooked poultry — Campylobacter jejuni is found on a significant percentage of raw chicken products
• Regulations: Food Standards Code Standard 1.6.1 sets microbiological limits. MPI's Campylobacter Risk Management Strategy has successfully reduced notified cases by over 50% since regulatory interventions in poultry processing began in 2007
• Prevention in your kitchen:
  • Cook poultry to 75°C core temperature
  • Prevent cross-contamination: separate chopping boards, utensils, and storage for raw poultry
  • Do not wash raw chicken — this spreads bacteria via splashing
  • Refrigerate poultry at 5°C or below at all times

MPI conducts ongoing surveillance of Campylobacter in the poultry supply chain. Your FCP should include specific controls for raw poultry handling.

Source: Food Standards Code Std 1.6.1; MPI Campylobacter Risk Management Strategy; Food Act 2014

The Codex Alimentarius is the international food standards body established by the WHO and FAO. Its most important food safety document is CXC 1-1969 (General Principles of Food Hygiene), Revision 5 (2020), which:

• Establishes the 7 HACCP principles used worldwide as the foundation of food safety management
• Defines Good Hygiene Practices (GHPs) as prerequisites to HACCP
• Introduces the concept of Good Hygiene Practices requiring greater attention — an intermediate step between basic GHPs and full CCPs

While Codex standards are not legally binding, they serve as the reference point for WTO disputes under the SPS Agreement. Most national food safety laws (EU, US, Japan, Australia, Canada, NZ) are based on Codex principles. Conforming to Codex standards positions your business for international trade compliance.

Source: Codex Alimentarius CXC 1-1969 Rev.5 (2020); WTO SPS Agreement Art.3

ISO 22000:2018 is the international standard for food safety management systems (FSMS). It integrates several frameworks:

• ISO High Level Structure (Annex SL): Compatible with ISO 9001 (quality) and ISO 14001 (environment) for integrated management systems
• HACCP principles: Based on Codex CXC 1-1969 but extended with the PDCA (Plan-Do-Check-Act) cycle
• Three-tier hazard control: PRPs → OPRPs → CCPs (see next question)
• Key clauses: Clause 7 (planning and control), Clause 8 (operation), Clause 9 (performance evaluation), Clause 10 (improvement)

ISO 22000 certification is voluntary but increasingly requested by:

• International buyers and retailers
• Supply chain partners
• Regulatory authorities as evidence of due diligence

Certification is issued by accredited certification bodies and requires annual surveillance audits with a full recertification every 3 years.

Source: ISO 22000:2018; ISO/TS 22003:2013 (certification body requirements)

The three-tier hazard control hierarchy defined in ISO 22000:2018 Clause 8 and Codex CXC 1-1969 Rev.5 consists of:

• Prerequisite Programmes (PRPs): Basic conditions and activities necessary for a hygienic environment — cleaning and sanitation, pest control, personal hygiene, maintenance, water quality, supplier management. PRPs are not specific to any particular hazard and apply universally
• Operational Prerequisite Programmes (OPRPs): Control measures for significant hazards that do not require critical limits but need specific monitoring — e.g., allergen segregation procedures, supplier verification for specific contaminants. If monitoring shows a deviation, an action threshold (not a critical limit) triggers predefined corrections
• Critical Control Points (CCPs): Points where control is essential to prevent, eliminate, or reduce a hazard to an acceptable level — with measurable critical limits (e.g., cooking temperature 75°C, pH ≤4.6). Deviations require immediate corrective actions and product disposition decisions

The decision to classify a control measure as PRP, OPRP, or CCP is based on your hazard analysis and should be documented in your food safety plan.

Source: ISO 22000:2018 Clause 8.5; Codex CXC 1-1969 Rev.5 (2020) Section II

The Global Food Safety Initiative (GFSI) benchmarks food safety certification schemes to ensure equivalence and reduce audit duplication. The major GFSI-recognised schemes (current versions) are:

• BRCGS Global Standard for Food Safety (Issue 9): Widely used in the UK, Europe, and globally — emphasises product safety, quality, and operational criteria. Graded (AA, A, B, C, D)
• SQF (Safe Quality Food) Edition 9: Popular in North America and Australia — three certification levels (Fundamentals, Food Safety, Food Safety & Quality)
• FSSC 22000 Version 6: Based on ISO 22000 + sector-specific PRPs (ISO/TS 22002 series) + FSSC additional requirements. Global reach, especially strong in manufacturing
• IFS Food Version 8: Predominant in Continental Europe, particularly France and Germany — scored system with KO (knock-out) criteria

GFSI certification is increasingly required by major retailers (Walmart, Tesco, Carrefour, Costco) for supplier approval. Choose the scheme most recognised by your target market and customers.

Source: GFSI Benchmarking Requirements v2020.1; BRCGS Issue 9; SQF Ed.9; FSSC 22000 v6; IFS Food v8

Food safety culture refers to the shared values, beliefs, and behaviours that shape how people in your organisation think about and manage food safety. It has become a formal requirement in major standards and regulations:

• Codex CXC 1-1969 Rev.5 (2020): Section I.3 introduced food safety culture as a general principle — management commitment, awareness, and continuous improvement
• BRCGS Issue 9 Clause 1.1.2: Requires a documented food safety and quality culture plan with measurable objectives
• IFS Food v8 Clause 1.1: Food safety culture assessment requirements
• FSSC 22000 v6 Additional Requirement 2.5.1: Mandates food safety culture elements including communication, training, feedback, and measurement
• EU Regulation 2021/382: Amended Reg 852/2004 to include food safety culture requirements (Annex II Ch.XIa)

Practical implementation includes: visible management commitment, regular staff communication about food safety priorities, recognition of good practices, incident reporting without blame, and measurable targets reviewed at management level.

Source: Codex CXC 1-1969 Rev.5 Section I.3; BRCGS Issue 9 cl.1.1.2; EU Reg 2021/382; FSSC 22000 v6 AR 2.5.1

TACCP (Threat Assessment Critical Control Points) and VACCP (Vulnerability Assessment Critical Control Points) extend the HACCP framework to address intentional contamination:

• HACCP: Addresses accidental contamination — biological, chemical, and physical hazards that occur unintentionally during processing
• TACCP (Food Defence): Addresses malicious contamination — deliberate adulteration, sabotage, or bioterrorism by individuals with intent to harm. Assesses: Who might attack? What is the target? How could it happen?
• VACCP (Food Fraud): Addresses economically motivated adulteration — substitution, dilution, mislabelling, or counterfeiting for financial gain. Assesses: Which ingredients are vulnerable? Where are the supply chain weak points?

Requirements in major standards:

• BRCGS Issue 9 Clause 4.2: Food defence/TACCP assessment required
• BRCGS Issue 9 Clause 5.4: Food fraud/VACCP vulnerability assessment required
• IFS Food v8 Clause 6: Food defence plan required
• FSSC 22000 v6 AR 2.5.3-2.5.4: Both food defence and food fraud mitigation required

Source: BRCGS Issue 9 cl.4.2, 5.4; IFS Food v8 cl.6; FSSC 22000 v6 AR 2.5.3-2.5.4; PAS 96:2017 (TACCP)

Selecting and preparing for a GFSI-recognised certification involves several key steps:

• Choose based on your market: BRCGS for UK/European retailers; SQF for North American markets; FSSC 22000 if you already have ISO 22000; IFS for French/German retail chains. Ask your key customers which scheme they accept
• Gap assessment: Conduct an internal or third-party gap analysis against the chosen standard before formal application
• Documentation: Prepare your HACCP/FSMS plan, PRPs, TACCP/VACCP assessments, food safety culture plan, training records, supplier approval procedures, and recall/withdrawal procedures
• Internal audits: Conduct at least one full internal audit cycle using the standard's checklist
• Select a certification body: Must be accredited (e.g., by UKAS, ANAB, or DAkkS for the specific GFSI scheme). Compare costs, auditor availability, and industry experience

The initial certification audit is typically conducted in two stages: a documentation review followed by an on-site assessment. Most schemes require annual surveillance audits and full recertification every 3 years (some require annual recertification).

Source: GFSI Benchmarking Requirements v2020.1; ISO/IEC 17021-1:2015; respective scheme requirements