HACCP for restaurants: the complete 2026 guide (method + FSMS + software)

In short. HACCP isn't optional in food service. It's a legal obligation under EU Regulation 852/2004 (and the equivalent UK food safety regs post-Brexit). Concretely: 7 principles to master, an up-to-date food safety management system, traceable temperature records, and the paperwork ready the day the inspector walks in. This guide gives you the full method to pass your inspections cleanly in 2026.

Context / Definition

HACCP (Hazard Analysis and Critical Control Points) is the international food safety method that applies to every professional handling food. In food service, it's been mandatory under EU Regulation 852/2004 since 1 January 2006, and the same framework has been kept by UK food safety law post-Brexit. It doesn't only apply to big brigades or starred kitchens: a food truck, a 30-cover bistro, the kebab shop on the corner — same obligations as a five-star hotel.

Before we get into the detail, a blunt observation: most operators I've worked with know HACCP exists. They know it's mandatory. But the day the inspector turns up, they spend 20 minutes hunting for their temperature logs, the folder is full of crossed-out pages, and the FSMS hasn't been touched in 18 months. This guide exists so that doesn't happen to you.

HACCP is mandatory in restaurants: what the law says

EU Regulation 852/2004 on the hygiene of foodstuffs is the legal base. It applies to every food business operator, with no exemption for size or format. Fine dining, food truck, caterer, brasserie, school canteen — same rules.

In France this is layered with the order of 21 December 2009. In the UK it's the Food Safety Act 1990 and the Food Hygiene (England/Scotland/Wales) Regulations 2013, all aligned with the EU Hygiene Package framework. Breach can lead to administrative and criminal sanctions all the way to closure and fines that start at £5,000 and can run unlimited for the worst cases (€75,000 in France).

EHO inspections (Environmental Health Officers in the UK, DDPP in France) typically happen every 3 to 5 years for an establishment with no history. But a customer complaint, a food poisoning report, or a routine check can land any time.

For a full read on the regulatory frame, see the 2026 restaurant legal obligations.

What the inspector will look at first

When the EHO walks into your kitchen, they have a checklist. The points that swing a score:

• Temperature traceability: are your logs current, legible, dated?
• State of your FSMS: does it exist, is it signed, does it match what's actually happening on the line?
• Cleaning and disinfection: schedule current, products approved, frequencies followed?
• Food handling: use-by dates respected, FIFO/FEFO applied, raw/cooked separation?
• Staff training: at least one person trained in food safety in the last 5 years?

That's not exhaustive. But those 5 axes are the difference between a good visit and a bad one.

The 7 HACCP principles: full method

HACCP runs on 7 structured principles applied in order. It's not a menu you pick from — it's a chain. One weak link and you're exposed.

Principle 1 — Analyse hazards

Identify every biological hazard (bacteria, viruses, parasites), chemical (poorly rinsed cleaning chemicals, allergen cross-contact) and physical (foreign bodies, glass shards) that can show up at every step of your production.

In practice: map every step (delivery, storage, defrosting, prep, cooking, cooling, service) and list what can go wrong at each one.

Principle 2 — Identify Critical Control Points (CCPs)

A CCP is a step where a control measure can be applied and is essential to prevent or eliminate a hazard. Classic example: cooking poultry is a CCP — if the core temperature doesn't reach 70°C / 158°F, the salmonella risk isn't gone.

Don't confuse CCPs with PRPs (Prerequisite Programmes): PRPs are baseline hygiene measures (cleaning, training, delivery checks). CCPs are the points where control is critical for safety.

Principle 3 — Set critical limits

For each CCP, you set a hard limit. The main ones in food service:

• Chilled storage (dairy, meat, fish): 0°C to +4°C depending on the product
• Frozen storage: -18°C / 0°F minimum
• Cooking (poultry, white meats): 70°C / 158°F core temp minimum
• Cooling (cook-chill): from +63°C to +10°C in under 2 hours

Principle 4 — Set up monitoring

Define WHO checks, WHEN and HOW. Temperature logs are the most visible example: who reads the walk-ins, how often, on what record?

Monitoring has to be systematic, traceable and realistic. A monitoring plan nobody follows because it's too heavy is worth nothing — not legally, not practically.

Principle 5 — Define corrective actions

If a limit is breached, what's the procedure? In practice: if your walk-in climbs to 8°C overnight, you need a documented decision about what happens to the food in there. Bin it? Cook immediately? Call the engineer?

Without a written corrective procedure you're exposed twice over: you can't fix the problem, and you can't prove you reacted.

Principle 6 — Verify the system works

Audit your HACCP regularly: is it actually working? Does it still match your operation? Changed your menu, added an outside catering arm, hired new staff? Your HACCP needs to move with you.

Verification means internal audits (self-checks), microbiological swabs of surfaces and food, and an annual FSMS review.

Principle 7 — Document and keep records

Everything has to be written down. Temperature readings, corrections, training delivered, micro analyses, incidents and how you handled them. Documentation is the proof you're in control — without it, you can't show the inspector anything.

It's the most neglected principle. And the one that costs the most when you get inspected.

The 6 obligations of the restaurant FSMS

The Food Safety Management System (FSMS) — Plan de Maîtrise Sanitaire (PMS) in France, often built around Safer Food Better Business (SFBB) in the UK — is the document that formalises your HACCP approach. It's mandatory for every commercial food service business. It bundles 6 things in one place:

1. Good Hygiene Practices (GHP): cleaning, disinfection, uniforms, staff health
2. Operational Prerequisite Programmes: equipment maintenance, pest control, water quality
3. The HACCP plan: the 7 principles applied to your specific operation
4. Non-conformity management: corrective procedures for each type of deviation
5. Traceability: delivery records, labelling of decanted products, temperature records
6. Recall management: procedure for handling a product recall — see food recall management

An FSMS sitting in a drawer that hasn't been read in 2 years won't help you on inspection day. The inspector checks that the document matches what's actually happening — they can ask a member of staff to walk them through the procedures, they look at whether the forms are filled in day to day.

For a deeper take on building an operational FSMS, see our turnkey FSMS guide.

Case study — La Verrerie's inspection in 2017

In 2017 I'd been running La Verrerie in Gaillac for two years. Hotel-restaurant, modern bistro food, 14 rooms, a spa, a brigade of 8 in season. Revenue was up, things were ticking. I thought I was reasonably tight on HACCP.

One March morning the inspector walked in. No notice. Badge, hello, off she went.

First question: "Can I see your walk-in temperature records?"

I had them. Somewhere. In a folder, in the back kitchen. 30 minutes of digging, looking for the right pages in the right order, realising 3 weeks of records were missing because the cook who usually did them was off sick. A 21-day gap in traceability.

The rest of the inspection went OK. Temperatures were fine, use-by dates respected, cleaning schedule current. But that gap in the records, plus the time wasted hunting for them, cost me.

Final score: 12/20. Not a disaster. Not a win either.

What I would have killed for that morning: a tool where I type "March 2017 temperatures" and get an export in 10 seconds. Automated alerts when a reading was missing. Anything other than a 3-inch paper folder nobody looked at between inspections.

That's one of the concrete reasons I built Onrush — because I lived through this exact scene.

Stock traceability and FIFO/FEFO is one of the elements directly inspected — better to have it automated before they walk in.

Paper folder vs HACCP software: comparison

The question everyone asks after their first inspection: do I keep going with paper, or move to a digital tool?

A paper folder can do the job if you're properly rigorous and your operation is simple. In the real world of a brigade under pressure, with turnover, a chef out now and then — paper makes gaps.

Which HACCP software in 2026 suits you depends on your size, your setup, and what you want to automate first.

Common HACCP mistakes in food service

Mistake 1: Temperature records, "more or less" "We do them most days" doesn't cut it. Traceability means every day, with the time, the value, and who did it. A gap in the records is a gap in your defence.

Mistake 2: Training one person on HACCP When that person is on holiday or leaves, nobody else knows what to do. The inspector can ask any staff member to explain a procedure. Train the whole team to a baseline — including casuals.

Mistake 3: Not dating decanted product labels Anything taken out of its original packaging needs a label with the open date and a calculated use-by date. "It's three days old" in someone's head isn't traceability.

Mistake 4: An unsigned cleaning schedule The cleaning schedule has to be signed by whoever did it. Unsigned = unproven.

Mistake 5: Ignoring recall alerts The FSA publishes product recalls in the UK; rappel.conso.gouv.fr in France. You're obliged to check whether a recalled product is in your stock and act. No documented procedure on this point is a non-conformity.

Mistake 6: Storing fresh meat above 0-3°C with no records Regulation requires 0°C to +3°C for fresh meat, offal and game. A lot of places store at +4°C, even +5°C. The gap looks tiny — under inspection, it isn't.

To prepare specifically for an inspection, the full detail lives in pass an EHO/FSA inspection without stress.

Conclusion

HACCP isn't an admin chore to suffer through. It's a frame that, when it's well built, protects you as much as your customers: you know what comes into your kitchen, how it's stored, how it's produced, and you can prove it.

Three things to take away:

1. The 7 principles are a chain, not a menu. You can't apply principle 4 (monitoring) without first doing principle 2 (identifying your CCPs). The method is sequential. Skip a step and you have holes.

2. The FSMS lives with the operation. New menu, new hires, new supplier — the FSMS moves with you. A document frozen since opening day will get caught at inspection. Plan a yearly review at minimum.

3. The documentation is your defence. The day something goes wrong — a customer complaint, an incident, a bad inspection — your records speak for you. Without them, you have nothing. With them well kept, you take the situation back in 5 minutes.

I learned that lesson at La Verrerie in 2017, 30 minutes hunting for temperature logs in front of an inspector. It hasn't happened to me a second time. Not because I got more careful with paper — because I automated what could be automated.

No system means your business runs you. Get the system, then the system carries you through inspection day.

Last updated 2026. Written by Cyril Quesnel, founder of Onrush, ex-cook (La Verrerie, Gaillac, 2015-2018; Lunch Wagon, Albi, 2023-2026). Regulatory sources: EU Regulation 852/2004, French order of 21 December 2009, UK Food Safety Act 1990, FSA, food.gov.uk.