Restaurant legal obligations 2026: the complete guide (hygiene + FIC + tax)

In short. In the UK, a restaurant operator must comply with 7 mandatory domains: HACCP hygiene, allergens, price display, itemised receipts, tax (VAT, HMRC), fire safety, and disability access. Non-compliance can cost you unlimited fines for category 1 offences under the Food Safety Act 1990 — and repeat offences trigger prohibition orders. This guide covers it all, domain by domain.

Context / Definition

Opening a restaurant in the UK means stepping into a dense regulatory frame. Food hygiene, employment law, tax, premises safety, consumer information: each domain has its rules, its inspections, its penalties. Most operators are vaguely aware these duties exist. Few really master them — until the day an EHO inspection or an improvement notice catches up with them.

What are a restaurant's obligations in 2026?

A restaurant operator must cover 7 mandatory compliance domains. None are optional, none cancels another out.

The 7 domains:

1. Food hygiene and HACCP
2. Allergen information
3. Price display and itemised receipts
4. Company registration and licensing
5. Tax (VAT, HMRC-compliant tills)
6. Employment duties (PAYE, contracts)
7. Fire safety and disability access

It's not exhaustive in the sense that each domain itself contains dozens of sub-duties. But these are the 7 entry doors of an inspection — EHO, Trading Standards, HMRC, fire authority.

Domain 1 — Food hygiene and HACCP

The regulation rests on retained EU Regulation 852/2004 and the EU Hygiene Package (UK retained law). Any establishment that prepares or serves food must implement a documented Food Safety Management System (FSMS).

The FSMS includes:

• HACCP procedures (hazard analysis, critical control points)
• Cleaning and disinfection schedule
• Temperature logs (storage, cooking, cooling)
• Food traceability
• Staff food-hygiene training (Level 2 certificate required for at least one person per site)

For more on this, read HACCP in detail — the complete implementation guide.

Domain 2 — Allergens

EU FIC 1169/2011 (UK retained as Food Information Regulations 2014) requires you to inform customers about the 14 major allergens. In foodservice, the information can be oral — but it must be reliable, verifiable, and available in writing on request.

In practice: every dish needs a spec listing allergens. A menu with symbols is enough if it's legible and current. For details on the legal format expected, see allergen obligations.

Domain 3 — Price display and itemised receipts

Two distinct duties, both from Trading Standards rules:

• Price display: menu legible from outside (or at the entrance), with prices including VAT and drinks listed. Menu inside the dining room is also required.
• Itemised receipt: required as soon as the customer asks — even handwritten. It must list the items, the total including VAT, and the establishment's name.

Domain 4 — Registration and licensing

• Registration with Companies House (or HMRC for sole traders) depending on structure
• Food business registration with your local authority at least 28 days before opening
• Premises licence (required to sell alcohol, under the Licensing Act 2003)
• Personal licence for the designated premises supervisor (DPS)

Domain 5 — Tax

• VAT: 20% standard rate on dine-in food and alcohol; 0% on most cold takeaway food (but 20% on hot takeaway). The mixed-rate handling is a frequent source of error.
• HMRC-compliant tills: required for VAT-registered businesses. The till software must produce auditable records (Making Tax Digital).
• Tax filings: VAT quarterly under MTD, Corporation Tax or Self Assessment depending on legal structure.

Domain 6 — Employment duties

• PAYE registration as soon as you hire your first employee
• Right-to-work checks before any start date — including casuals
• Employment contracts: permanent, fixed-term, zero-hours — each status has its rules. Casuals working without a contract are a frequent breach in hospitality.
• National Minimum Wage / Living Wage: applies to all sites — minimum rates, breaks, holiday pay, pension auto-enrolment.

Domain 7 — Fire safety and disability access

• Fire risk assessment: required under the Regulatory Reform (Fire Safety) Order 2005, reviewed regularly.
• Required equipment: extinguishers, clear emergency exits, emergency lighting, evacuation signage.
• Disability access: under the Equality Act 2010, all establishments must make reasonable adjustments. New builds must comply with Approved Document M.

How do I prepare for an EHO inspection?

The Environmental Health Officer (EHO) — sitting within your local authority's Environmental Health team — is the main authority for hygiene inspections in foodservice. An inspection can be scheduled or unannounced. Preparation is what makes the difference between a warning and an improvement notice.

The 6 things the inspector looks for first:

1. The FSMS up-to-date and accessible — not in a locked drawer, not printed in 2018 with no revision
2. Temperature logs for the last 15 days — fridges, walk-ins, cooking probes
3. Dish specs with allergens — per dish, legible, dated
4. The cleaning schedule — with frequencies, products used, areas covered
5. Staff food-hygiene certificates (Level 2)
6. Food traceability — delivery notes, supplier labels kept

To prepare for an inspection in detail, see the EHO inspection prep guide. And to build a compliant FSMS, see FSMS required.

Real case — La Verrerie, 2015

When I took over La Verrerie out of administration in 2015, I'd done my full analysis before signing: margins, menu, online presence, reviews, footfall. What I hadn't seen coming was the state of regulatory compliance. The previous operator had been running with the gaps that years accumulate.

On takeover, I found 4 major non-compliances:

• No FSMS — or rather, an empty folder with a few pages printed in 2011, never updated
• Missing temperature logs for several months
• No formalised dish specs — allergens not documented
• Non-compliant till (record-keeping requirements weren't met)

Result: 3 months of remediation before the full reopening. Three months rebuilding the FSMS from scratch, training the team, investing in a compliant till, redoing every dish spec on the menu.

It wasn't in my initial business plan. It wasn't budgeted. And it was non-negotiable.

What stuck with me from this experience: these non-compliances weren't intentional oversights. It was accumulated negligence, "we'll deal with it later" piled up over years. The previous operator wasn't acting in bad faith — they were overwhelmed, with no tool, no method. That's exactly what I've seen in most operators since: no bad intent, no tool.

Regulatory compliance isn't a tick-box exercise once. It's a system to maintain over time.

For day-to-day product alerts and traceability, see also food recalls FSA.

Compliance table — The 7 domains, controlling authority and penalties

Keep this table on the wall. Each row is a possible inspection entry door.

The number to remember: unlimited fines for category 1 offences (allergen breaches, serious hygiene failures). It's not a theoretical penalty — it's the legal ceiling for a documented breach after an ignored improvement notice. Lower-level offences typically start at £5,000.

Common mistakes

Mistake 1 — The FSMS created once, never updated An FSMS dated 2019 with a menu revised 3 times since is a useless FSMS. The inspector spots it in 30 seconds. Updating the FSMS at every menu change or supplier change is an implicit duty — not a detail.

Mistake 2 — Missing or unsigned temperature logs Logs must be dated, signed and kept for 15 days minimum. A log printed automatically without a human signature is often challenged on inspection. Human traceability counts.

Mistake 3 — Price display only on the inside menu The outside-display duty is often forgotten. A menu visible from the street or at the entrance is required. Trading Standards check it — and fines for non-compliant display are systematic.

Mistake 4 — Allergens orally only, no written documentation "We tell them, we know our menu by heart" — that's not legally enough. If a customer asks for the information in writing, the establishment must be able to provide it. Without a dish spec listing allergens, it's a breach of the Food Information Regulations.

Mistake 5 — Mixing up VAT rates A dessert taken away in a sealed container = 0%. The same dessert eaten in = 20%. Hot takeaway = 20%. These distinctions are frequently misapplied, generating tax assessments at the next inspection.

Mistake 6 — Not keeping your premises licence current Premises licences need a designated premises supervisor at all times, and the personal licence holder must hold a current licence. Many operators forget. In case of an inspection or dispute, an out-of-date licence can invalidate the alcohol licence.

To master HACCP temperature standards 2026 and avoid undocumented deviations, read the dedicated guide.

Conclusion

A restaurant's legal obligations in 2026 cover 7 domains — and none can be handled once and forgotten. It's a living system that evolves with your menu, your team, your suppliers and the inspections you face during the year.

Three things to remember:

1. The FSMS isn't a document, it's a practice. It must be updated at every menu change, supplier change, equipment change or staff change. A 2019 FSMS in a 2026 establishment is a breach in waiting.

2. Unlimited fines and prohibition orders aren't abstract threats. They're the end of the chain that starts with an ignored warning, an untreated improvement notice. Compliance costs less than non-compliance.

3. The regulation is dense, but manageable with method. I turned around two establishments with compliance gaps on takeover — La Verrerie in 2015, the Lunch Wagon in 2023. Both got back on track, kept up, and were sold on. Not because I had a dedicated legal team — because I had a method and a tool to let nothing slip.

Last updated 2026. Written by Cyril Quesnel, founder of Onrush, chef and entrepreneur (La Verrerie 2015-2018, Lunch Wagon 2023-2026).