HACCP (Hazard Analysis and Critical Control Points) is the internationally recognised, preventive food-safety framework built on seven principles and implemented through twelve steps, codified by the Codex Alimentarius. It is mandatory in most major markets: the US requires HACCP for meat, poultry, seafood, and juice and a HACCP-based Preventive Controls plan for most other facilities; the EU requires HACCP-based procedures under Regulation (EC) 852/2004; and Japan has required HACCP-based hygiene control for nearly all food businesses since June 2021. The nearest major US deadline is FSMA 204 (Food Traceability Rule), extended in 2025 to July 20, 2028. Certification against a GFSI standard (FSSC 22000, BRCGS, SQF) sits on top of the legal baseline for businesses selling to major retailers or exporting.
What HACCP Is — and Why It Exists
HACCP is a systematic method for making food safe by building controls into the process rather than inspecting the finished product. It asks three questions at every step: what could go wrong (the hazard), where can we control it (the critical control point), and how do we prove we did (monitoring and records).
The framework was born in the 1960s from a collaboration between Pillsbury, NASA, and the US Army Laboratories, who needed to be certain that food for astronauts would not cause illness in space — where end-product testing that destroyed the sample was useless. The answer was to design safety in and document control at every step. The approach was later adopted by the Codex Alimentarius Commission (the joint FAO/WHO food standards body), whose General Principles of Food Hygiene made HACCP the global reference.
Because every major regulator anchored its rules to the same Codex principles, HACCP became the common language of food trade: a plan built correctly in one country speaks the same grammar as the rules in another.
Source: Codex Alimentarius — FAO/WHO →The Seven Principles
These seven principles are the heart of HACCP and appear in near-identical form in US, EU, Japanese, and Codex frameworks.
Conduct a Hazard Analysis
Identify biological, chemical, and physical hazards at every process step and assess which are significant enough to require control.
Determine the Critical Control Points
Find the steps essential to controlling each significant hazard — the points where loss of control means an unacceptable risk with no later catch.
Establish Critical Limits
Set measurable, validated boundaries for each CCP — a minimum core cooking temperature, a maximum chill time, a metal-detector sensitivity.
Establish Monitoring
Define what is measured, how, how often, and by whom, so a deviation is caught in real time before unsafe product moves on.
Establish Corrective Actions
Predefine what happens when a limit is breached: bring the CCP back into control and decide the fate of the affected product.
Establish Verification
Confirm the system actually works — validate critical limits, calibrate instruments, review records, and reanalyse periodically.
Establish Documentation and Records
Keep the plan and its monitoring, corrective-action, and verification records as the evidence that control was maintained.
The Twelve Steps: Principles in Practice
Codex frames implementation as twelve steps. The first five prepare the ground; steps six to twelve are the seven principles. Skipping the preparatory five is the most common reason HACCP plans fail.
| Step | Action | Maps To |
|---|---|---|
| 1 | Assemble the HACCP team | Preparatory |
| 2 | Describe the product | Preparatory |
| 3 | Identify the intended use | Preparatory |
| 4 | Construct the flow diagram | Preparatory |
| 5 | Confirm the flow diagram on site | Preparatory |
| 6 | Conduct a hazard analysis | Principle 1 |
| 7 | Determine the CCPs | Principle 2 |
| 8 | Establish critical limits | Principle 3 |
| 9 | Establish monitoring | Principle 4 |
| 10 | Establish corrective actions | Principle 5 |
| 11 | Establish verification | Principle 6 |
| 12 | Establish documentation and records | Principle 7 |
CCPs, Prerequisite Programmes, and oPRPs
The single most misunderstood part of HACCP is the boundary between a critical control point and the hygiene foundations around it.
The Foundation
Cleaning and sanitation, pest control, staff hygiene, maintenance, water quality, supplier control. These manage the general environment and must be working before HACCP can be validated. Strong PRPs reduce the number of CCPs you need.
The Controlled Steps
Specific, monitored steps that control identified significant hazards — cooking, chilling, pasteurisation, metal detection. Each has a validated critical limit, real-time monitoring, and defined corrective actions.
The United States: FSMA and Traditional HACCP
US food safety splits between traditional mandatory HACCP and the broader FSMA framework.
Mandatory HACCP Sectors
- Meat and poultry — USDA FSIS HACCP, mandatory since the late 1990s
- Seafood — FDA Seafood HACCP (21 CFR Part 123)
- Juice — FDA Juice HACCP (21 CFR Part 120)
FSMA Preventive Controls (PCHF)
For most other FDA-regulated facilities, the Preventive Controls for Human Food rule requires a written food safety plan built on hazard analysis and risk-based preventive controls — a HACCP-derived framework that adds supply-chain controls, a recall plan, and a Preventive Controls Qualified Individual (PCQI) to oversee it.
FSMA 204: The Traceability Rule
The European Union: Regulation (EC) 852/2004
The EU requires all food business operators — processors, restaurants, caterers, retailers — except primary producers to put in place, implement, and maintain permanent procedures based on the HACCP principles.
- Flexibility for small businesses: simplified, generic HACCP-based guides are permitted where proportionate to the risk
- Traceability: the General Food Law (Regulation 178/2002) requires 'one step back, one step forward' traceability for all food and feed operators
- Official controls: Regulation (EU) 2017/625 governs how member-state authorities verify compliance
The EU model influenced Japan's system and shares the Codex backbone with the US, which is why an EU-compliant HACCP plan transfers readily to other markets.
Japan: Mandatory HACCP Since 2021
Japan amended its Food Sanitation Act in 2018, and from June 1, 2021 (after a one-year transition) HACCP-based hygiene control became mandatory for essentially all food business operators. Japan uses a two-tier structure:
| Tier | Who | Approach |
|---|---|---|
| HACCP-based sanitation management (Standard A) | Larger manufacturers and processors | Full Codex seven principles |
| HACCP-considerate sanitation management (Standard B) | Small businesses, restaurants, certain retailers | Simplified approach following industry-association handbooks |
There is no separate national HACCP certificate in Japan; compliance is confirmed through routine inspections by local public-health centres. This guide is written by a Japanese Gyoseishoshi (administrative-law professional) who prepares food-business licensing and hygiene documentation.
US vs EU vs Japan: How the Rules Compare
| Aspect | United States | European Union | Japan |
|---|---|---|---|
| Core instrument | FSMA (PCHF) + sector HACCP | Regulation (EC) 852/2004 | Food Sanitation Act |
| Mandatory since | Meat/poultry 1990s; PCHF 2016+ | 2006 | June 2021 |
| Scope | Most food facilities | All operators except primary production | Nearly all food businesses |
| Small-business flexibility | Qualified facility exemptions | Simplified generic guides | Standard B handbooks |
| Traceability | FSMA 204 (from 20 Jul 2028) | One step back / forward (178/2002) | Voluntary guidelines |
| National certificate | No — plan required | No — procedures required | No — inspection-based |
| Codex basis | ✓ | ✓ | ✓ |
HACCP vs ISO 22000 vs FSSC 22000: What Buyers Ask For
Legal compliance requires a working HACCP plan. Selling to major retailers or exporting usually requires third-party certification on top.
HACCP
The core hazard-control method — the seven principles applied to your process. The legal baseline in most markets.
ISO 22000
A food safety management system that embeds HACCP inside an ISO management structure: leadership, planning, communication, continual improvement.
FSSC 22000
ISO 22000 plus sector prerequisite requirements (ISO/TS 22002) and FSSC additions — GFSI-recognised, the passport for global retail supply chains.
HACCP and Food-Safety Milestones
Frequently Asked Questions
HACCP Build Checklist
| # | Item | Status |
|---|---|---|
| 1 | Prerequisite programmes documented and functioning (sanitation, pest, hygiene, maintenance, supplier) | □ |
| 2 | Multi-disciplinary HACCP team assembled | □ |
| 3 | Each product described (composition, packaging, shelf life, storage) | □ |
| 4 | Intended use and vulnerable consumers identified | □ |
| 5 | Flow diagram drawn and confirmed on the factory floor | □ |
| 6 | Hazard analysis completed for every step (biological, chemical, physical) | □ |
| 7 | CCPs determined using the Codex decision tree | □ |
| 8 | Validated critical limits set for each CCP | □ |
| 9 | Monitoring procedures defined (what, how, frequency, who) | □ |
| 10 | Corrective actions and product disposition predefined | □ |
| 11 | Verification and validation scheduled; instruments calibrated | □ |
| 12 | Record-keeping system in place; annual reanalysis scheduled | □ |
| 13 | Market-specific rules mapped (FSMA/PCHF, 852/2004, Food Sanitation Act) | □ |
| 14 | FSMA 204 exposure assessed if handling Food Traceability List foods (2028) | □ |
| 15 | Certification path chosen if buyers require GFSI (FSSC 22000 / BRCGS / SQF) | □ |
Build Your Food Safety System with Confidence
Explore the MmowW SafeKitchen Library — evidence-based food safety guidance for operators worldwide.