HACCP is not a binder of documents for the inspector - it is a working system that holds product safety at every stage: from receiving raw materials to dispatch. For any food manufacturer, implementing procedures based on HACCP principles is not a matter of goodwill but a direct legal requirement. Let's break down what it is, why it is mandatory, and walk through all 7 principles so you can build them on your own site.
What HACCP is in plain terms
HACCP (Hazard Analysis and Critical Control Points) is a food safety management system. Its logic is simple: instead of checking the quality of the finished product at the end of the line, you identify in advance every point in the process where a threat to consumer health could arise, and you bring exactly those points under tight control.
Threats (hazards) are grouped into three categories:
- Biological - pathogenic microorganisms (salmonella, listeria, E. coli), moulds, parasites.
- Chemical - residues of cleaning agents, pesticides, antibiotics, allergens, substance migration from packaging.
- Physical - metal, glass, plastic, bone, foreign objects.
The core idea. HACCP shifts control from the final product to the process. We control not the "batch in the warehouse" but the temperature, time, concentration and other parameters at the few points where they are critical for safety.
Is HACCP mandatory: what food safety law says
Yes, it is mandatory. Food safety regulations require that, during production processes, the manufacturer develops, implements and maintains procedures based on HACCP principles. This applies to everyone who produces, processes, stores, transports or sells food products - from a large plant to a bakery, a cafe or an in-store culinary kitchen.
It is important to understand the distinction: the law requires you specifically to implement procedures based on HACCP principles, not to obtain a certificate. Mandatory certification of a HACCP system is generally not required - but the system itself must genuinely work and be backed by documents and records.
Liability. The absence or sham nature of HACCP procedures is a breach of technical regulations. Compliance is overseen by the food safety authority, and penalties can escalate up to heavy sanctions and suspension of operations if the violation has created a risk to people's life and health.
The foundation: prerequisite programs (PRPs)
Before you build HACCP, you need a foundation - prerequisite programs (PRPs). These are the basic sanitary and hygiene conditions without which hazard analysis hangs in the air. They include good manufacturing practice (GMP), cleaning and disinfection, water control, pest control, staff hygiene and training, the condition of premises and equipment, traceability and waste handling.
The stronger your PRPs, the fewer critical control points you have: routine risks are handled by hygiene and standard procedures, and only the truly critical operations fall under the HACCP spotlight.
The 7 HACCP principles step by step
The seven principles are set out in the Codex Alimentarius and mirrored in international standards (the ISO 22000 series). This is the sequence by which the HACCP team builds and maintains the system.
You describe the product and process, build a flow diagram, list the possible biological, chemical and physical hazards for each step, and assess their significance by likelihood and severity of consequences.
From all the hazardous steps you single out those where control is critical and where no subsequent step will eliminate the hazard. A "decision tree" is used for selection. Classic CCPs are heat treatment, cooling and metal detection.
For each CCP you set a measurable safety boundary: core product temperature, holding time, pH, water activity, concentration. The limit must be measurable in real time.
You define what, how, how often and who measures at each CCP in order to catch a breach of a critical limit in time. Monitoring is accompanied by records.
You define in advance what to do in case of a deviation: how to handle non-conforming product, how to bring the process back under control and how to prevent recurrence. Everything is recorded.
You confirm that the system works as intended: internal audits, calibration of instruments, laboratory testing, review of records and revision of the HACCP plan when changes occur.
You maintain and keep the system documents (HACCP plan, procedures) and the records of monitoring, deviations, corrective actions and verification. Records are the main evidence that the system works during an inspection.
Worth remembering. Principles 1-3 are the "design" of the system (where the hazard is and which boundaries are safe). Principles 4-5 are "operation" (we monitor and react). Principles 6-7 are "proof" (we confirm it works and record everything in writing).
What a critical limit and monitoring look like in practice
So that principles 3-5 do not stay abstract, it is convenient to describe each CCP as a row in a table. Below is a simplified example of a HACCP worksheet form for a single point.
| Element | Content for the "heat treatment" CCP |
|---|---|
| Hazard | Survival of pathogenic microorganisms under insufficient treatment |
| Critical limit | Reaching the specified core product temperature and holding it for the set time (per technological documentation) |
| Monitoring | What: core temperature. How: with a calibrated probe thermometer. When: every batch. Who: the responsible operator |
| Corrective action | Isolate the batch, continue treatment or dispose of it, find and eliminate the cause |
| Record | Heat-treatment control log with signature and time |
You take the specific values of temperature, time and other limits from technological documentation and the standards for your product type, rather than setting them "by eye".
How implementation unfolds: a roadmap
Implementation is a project that spans several months; the duration depends on the complexity of the production and the maturity of your sanitation. A typical sequence looks like this.
The manager appoints a working group of specialists from different functions (technologist, sanitation, production, quality) and assigns responsibilities.
You assess the sanitary condition, GMP, raw material and personnel flows, and equipment state. You close the basic non-conformities before launching the hazard analysis.
You prepare product specifications, intended use and consumer profile, then build and verify the process flow diagrams on site.
You apply principles 1-2: identify significant hazards and critical control points.
You describe the limits, monitoring, corrective actions, verification and record forms (principles 3-7) and draw up the worksheets.
Operators must understand their CCPs, the limits and the actions to take on a deviation, and they must keep records correctly.
The system starts running, records accumulate, internal audits are carried out and the plan is revised whenever the product or process changes.
The regulatory inspection: what inspectors look at
During scheduled and unscheduled inspections, the food safety authority assesses not the presence of a handsome volume but whether the system works. The typical focus of an inspection:
- Whether documented and implemented procedures based on HACCP principles and a team appointment order exist.
- Whether CCPs and critical limits are defined, and whether they match the process and product.
- Whether monitoring records are kept regularly, not backdated just before the visit.
- How deviations and corrective actions are recorded - whether there is any response to breaches of limits.
- Whether measuring instruments are calibrated, and whether verification and laboratory control are performed.
- Whether PRPs are observed: sanitation, disinfection, pest control, staff hygiene.
The main sign of a sham system is perfectly filled-in logs in which not a single deviation has ever been recorded. A genuinely working HACCP always has records of corrective actions: the process is alive, and deviations arise and get resolved within it.
HACCP and ISO 22000: what's the difference
These concepts are often confused. HACCP under food safety law is the mandatory minimum: a set of procedures based on the 7 principles. ISO 22000 is an international voluntary standard for a food safety management system that includes HACCP as its core but builds full management around it: context and objectives, risk management, interaction along the supply chain, prerequisite programs and continual improvement.
| Criterion | HACCP (food safety law) | ISO 22000 |
|---|---|---|
| Status | Mandatory for food manufacturers | Voluntary |
| What it is | Procedures based on 7 principles | Food safety management system |
| Scope | Hazard analysis and CCP control | HACCP + PRPs + management + supply chain |
| Certificate | Generally not required | Confirmed by certification |
| Purpose | Legal compliance | Tenders, exports, work with retail chains, reputation |
The practical takeaway: HACCP is required of everyone by default, while ISO 22000 makes sense to implement when you need external proof of the system's maturity - for major customers, retail chains or entering export markets.
Frequently asked questions
Does a small cafe or bakery need HACCP?
Yes. Food safety requirements apply to all organisations and sole traders working with food products, including catering, bakeries, culinary kitchens and packing operations. The volume of documentation for a small operation will be smaller, but procedures based on HACCP principles must be implemented and genuinely work.
Is it mandatory to obtain a HACCP certificate?
The law requires you to implement and maintain procedures based on HACCP principles, not to obtain a certificate. Mandatory certification is generally not required. A certificate (for example, ISO 22000) is a voluntary step that is useful for tenders, retail chains and exports, but it does not replace a working system.
How does a critical control point differ from an ordinary control step?
A CCP is a step at which control is critical for safety and after which there is no step capable of eliminating or reducing the hazard to an acceptable level. Ordinary hygiene measures belong to prerequisite programs, whereas CCPs require defined critical limits, monitoring and records.
How long does HACCP implementation take?
The timeline depends on the complexity of the production, the number of processes and the maturity of sanitation. Usually it is a project of several months: a PRP audit, process descriptions, hazard analysis, plan development, staff training and launch with accumulation of records. Getting the prerequisite programs in order typically takes the longest.
What are the consequences of not having HACCP?
It is a breach of technical regulations. Compliance is overseen by the food safety authority, and penalties can escalate up to heavy sanctions and suspension of operations if the violation has created a risk to people's life and health. Beyond the fine, the risks include product recall and reputational losses.
We'll help you implement HACCP without the box-ticking
G-Invest runs a readiness audit, develops a HACCP plan with worksheets for your CCPs, sets up prerequisite programs and prepares production for a regulatory inspection - so that the system genuinely works rather than sitting in a binder.