A small food business in the EU must have food safety procedures based on HACCP principles. What is required: a written plan that fits your menu, regular checks at the points that matter, a note of what you did when something went wrong, and records that show all of this. What is not required: a certificate, a consultant or a thick folder. The law asks for records that fit the nature and size of the business.
What the law says
The rule is in Article 5 of Regulation (EC) No 852/2004. It applies in every EU country, to every stage after primary production. You must put in place, carry out and keep up a procedure based on seven principles:
- Identify the hazards that must be prevented, removed or reduced.
- Identify the critical control points, the steps where control is needed.
- Set critical limits at those points.
- Monitor the critical control points.
- Set corrective actions for when a point is not under control.
- Check regularly that the measures work.
- Keep documents and records that fit the nature and size of the business.
Annex II of the same regulation sets the general hygiene rules. Its chapters cover premises, equipment, waste, water, personal hygiene, the food itself and training. Since 2021, Annex II also has a chapter on food safety culture (Chapter XIa).
Traceability comes from a second law. Under Article 18 of Regulation (EC) No 178/2002, you must be able to say who supplied each food and ingredient, and which businesses you supplied.
What a small business needs
In practice, a small café needs these things:
- Registration with the food authority (Article 6 of Regulation 852/2004).
- A short written plan: your hazards, your control points with their limits, and what you do when a limit is missed.
- Regular checks of the control points, for example fridge temperatures at opening.
- A record of every corrective action.
- A cleaning plan and a record of cleaning.
- Invoices and delivery notes that show where each product came from.
- Hygiene training for staff that fits their work (Annex II, Chapter XII).
- Regular pest control checks.
What is not required
- No certificate. EU law does not require a HACCP certificate or an ISO standard for a café. Certification is voluntary.
- No consultant. You can write the plan yourself. National guides exist for this purpose.
- Not every step needs a control point. The regulation says that in some cases good hygiene practice can replace the monitoring of critical control points.
- No set format. The law does not say paper or software. You must show the records in the way your authority asks (Article 5(4)). Paper, a spreadsheet or an app can all work.
- No retention period in EU law. Article 5 asks you to keep records for an appropriate period. Your national rules set the number of years.
Use your national guide
Regulation 852/2004 encourages national guides to good hygiene practice. These guides turn the seven principles into forms and checklists for one type of business. In England and Wales, the Food Standards Agency publishes the Safer food, better business pack for caterers. It covers cross-contamination, cleaning, chilling, cooking and management, and comes with a diary for daily records. The diary can be kept on paper or electronically. Northern Ireland has its own safe catering guidance. In other countries, ask your food authority which guide it uses.
Many national guides use these temperature values:
- Chilled food: 0 to +5 °C.
- Frozen food: -18 °C or colder.
- Cooking: 75 °C in the core of the food.
- Hot holding: 63 °C or above.
National rules differ. In England, Wales and Northern Ireland, for example, the legal limit for chilled food is 8 °C. Check the values in your national guide and write them into your plan.
Cleaning is part of the plan
Cleaning needs a plan and records in the same way as temperatures. Annex II, Chapter I, says food premises must be kept clean and in good repair. Chapter V says equipment that touches food must be effectively cleaned and, where needed, disinfected. A cleaning plan turns this into daily work. For each area and each piece of equipment, write down:
- What is cleaned, and how often.
- Which product is used, and how.
- Who cleans it, and who checks.
Then keep a daily record: the date, the area, and the initials of the person who cleaned and of the person who checked. If a clean is missed, write it in the corrective action log with what you did.
Do it in the app
In EZLineGo you set up the cleaning plan once and then record each clean, temperature check and corrective action from your phone. Bluetooth thermometers in the fridges record by themselves and alert you when a value goes out of range, and at an inspection you show the records as a PDF. There is a Free plan, and the HACCP logs are part of Pro, which costs 15 EUR a month and which you can try free for 30 days.