What Is a HACCP Plan and Does Your Small Food Business Need One?

The short answer

If you run a food business in the UK - any food business, from a bakery to a brewery to a food truck - you are legally required to have food safety procedures based on HACCP principles. That's not optional. It's the law.

But here's where it gets confusing: the law doesn't say you need a formal "HACCP plan document." It says you need procedures based on HACCP principles. For many small producers, the gap between those two things is where the stress lives.

So let's clear it up.

What HACCP actually is

HACCP stands for Hazard Analysis and Critical Control Points. It's a systematic approach to food safety that was originally developed in the 1960s for NASA - they needed to make sure astronaut food wouldn't cause illness in space, where there's no hospital.

The core idea is simple: instead of testing finished products and hoping they're safe, you identify where things could go wrong during production and put controls in place to prevent problems before they happen.

HACCP is built on seven principles:

Principle 1: Hazard analysis. Identify every potential hazard in your production process - biological (bacteria, viruses), chemical (cleaning products, allergens), and physical (metal fragments, glass, hair).

Principle 2: Critical Control Points. Determine which steps in your process are critical for preventing or eliminating hazards. These are your CCPs - the moments where, if something goes wrong, the food becomes unsafe.

Principle 3: Critical limits. Set measurable boundaries for each CCP. For example, cooking temperature must reach 75°C core temperature to kill harmful bacteria.

Principle 4: Monitoring. Establish how you'll check that each CCP is within its critical limits. Who checks? How often? What do they measure?

Principle 5: Corrective actions. Define what happens when a critical limit is breached. If the cooking temperature doesn't reach 75°C, what do you do? Continue cooking? Reject the batch?

Principle 6: Verification. Confirm that your HACCP system is working. This includes reviewing records, calibrating equipment, and periodically reassessing your hazard analysis.

Principle 7: Record keeping. Document everything. Your HACCP plan, your monitoring records, your corrective actions. If it isn't written down, it didn't happen - at least as far as your auditor is concerned.

Who actually needs a HACCP plan?

Under EU Regulation 852/2004 (which is retained in UK law post-Brexit), all food business operators must implement food safety procedures based on HACCP principles. This applies to:

• Restaurants, cafés, and takeaways
• Bakeries and patisseries
• Craft breweries and distilleries
• Dairy producers and cheesemakers
• Meat and poultry processors
• Ready meal manufacturers
• Food-to-go kitchens
• Market stall holders
• Farm shops that produce food
• Any business that handles, prepares, or processes food

The only exemption is primary production (farming, fishing, harvesting) which follows different rules.

If you're a small producer with 1-25 employees, you need HACCP. The question isn't whether - it's how detailed and formal your plan needs to be.

The SALSA and BRCGS question

If you're planning to supply retailers, you'll almost certainly need SALSA certification (for small producers) or BRCGS certification (for larger operations). Both require a documented HACCP plan that follows the full 12-step Codex Alimentarius methodology.

This is where the "procedures based on HACCP principles" requirement becomes a "you need a proper written HACCP plan" requirement. SALSA auditors will want to see a formal document with product descriptions, process flow diagrams, hazard analysis tables, CCP control charts, and more.

What's actually in a HACCP plan?

A complete HACCP plan following the Codex methodology includes twelve sections:

1. Document control and scope - what the plan covers, who wrote it, when it was last reviewed
2. HACCP team - named individuals with defined roles and relevant qualifications
3. Product descriptions - detailed descriptions of every product you make, including ingredients, allergens, shelf life, and storage requirements
4. Intended use - who your products are intended for and how they should be used
5. Process flow diagrams - visual maps of every step from raw material receipt to finished product dispatch
6. Hazard analysis - identification and risk assessment of every potential hazard at every process step
7. CCP determination - using a decision tree to determine which hazards require critical control points
8. CCP control charts - documenting critical limits, monitoring procedures, corrective actions, and responsibilities for each CCP
9. Prerequisite programmes - the foundational practices that support your HACCP system (cleaning, pest control, personal hygiene, training, maintenance)
10. Approved suppliers - your supplier approval process, approved supplier list, and certification monitoring
11. Verification procedures - how you verify your system is working (internal audits, record reviews, equipment calibration)
12. Traceability and recall - your procedures for tracing ingredients and recalling products if something goes wrong

The traditional way: hire a consultant

The standard approach for small producers has been to hire a food safety consultant. A consultant will visit your premises, assess your processes, and write your HACCP plan for you.

The cost? Typically £2,000 to £5,000 for a full HACCP plan, depending on complexity. Turnaround is usually 4-8 weeks.

The plan you receive is professional and audit-ready. But there are drawbacks:

• It's expensive. For a business with 5 employees and tight margins, £3,000 is a significant investment.
• It takes weeks. You're waiting on someone else's schedule.
• It's static. When you add a new product or change a process, you need to pay for an update - or try to update it yourself and risk getting it wrong.
• It's someone else's work. You may not fully understand the methodology behind the plan, which makes it harder to implement and maintain.

The DIY approach: MyHACCP and templates

The FSA offers a free tool called MyHACCP that walks you through the methodology. It's thorough but time-consuming, and it requires you to have a solid understanding of food safety science - you need to identify your own hazards, assess your own risks, and determine your own CCPs.

Template packs are another option. You can buy pre-written HACCP documents for £200-500, but they're generic by nature. Your bakery in Manchester has different hazards from a seafood processor in Cornwall. Templates get you partway there, but auditors can spot a template-based plan that hasn't been properly customised.

A third option: AI-guided HACCP

This is the approach we built at FoodSafe.

Sage, FoodSafe's AI food safety expert, builds your HACCP plan through a conversation. You tell Sage what you make, how you make it, and where. Sage asks follow-up questions - the same questions a good consultant would ask - about your ingredients, your processes, your team, your environment.

As you talk, Sage works through the full 12-step Codex methodology. But unlike a chatbot generating text from templates, Sage applies deterministic food safety logic: the hazard identification, risk scoring, and CCP decisions are made by validated methodology, not by AI guessing. The AI guides the conversation. The food safety science makes the decisions.

The result is a professional PDF formatted exactly how auditors expect it - hazard analysis tables, CCP control charts, process flow diagrams, the lot. Your plan, built from your specific products and processes, ready for audit day.

And because it's part of your FoodSafe subscription, you can update it anytime your business changes. New product? New process? New kitchen? Talk to Sage again. No additional cost.

What to do next

If you don't have a HACCP plan, you need one. The question is which route makes sense for your business:

• If you have the budget and want someone else to handle everything, hire a consultant.
• If you have strong food safety knowledge and time, use MyHACCP or a template pack and build it yourself.
• If you want a professional plan without the consultant price tag, try Sage. It's included in FoodSafe's Professional plan, and you can try it free for 14 days.

Whatever route you choose, don't put it off. Your HACCP plan is the foundation of your entire food safety system. Everything else - your daily records, your audit preparation, your supplier management - builds on top of it.

Records kept. Standards kept. Compliance, kept.