Article 5 of Regulation (EC) No 852/2004 — HACCP: hazard analysis and critical control points

Rationale and origin

Article 5 is the centrepiece of Regulation (EC) No 852/2004 and of the EU Hygiene Package as a whole. It completes the shift from prescriptive public inspection to operator self-control: the food business operator bears primary responsibility for food safety Article 1(1) of Regulation (EC) No 852/2004, in line with the general responsibility principle of the EU General Food Law Article 17 of Regulation (EC) No 178/2002. The chosen method is HACCP (Hazard Analysis and Critical Control Points), developed within the Codex Alimentarius. The Regulation does not transpose the international standard wholesale: it requires permanent procedures "based on" the HACCP principles Article 5(1) of Regulation (EC) No 852/2004, and the difference matters. Recital 15 of the Regulation — the legislature's own interpretive context — states that HACCP requirements should take account of the principles contained in the Codex Alimentarius and should provide sufficient flexibility to be applicable in all situations, including in small businesses; it recognises that in certain food businesses it is not possible to identify critical control points and that, in some cases, good hygienic practices can replace the monitoring of critical control points; that the requirement to establish "critical limits" does not imply that a numerical limit must be fixed in every case; and that documentation requirements need to be flexible in order to avoid undue burdens for very small businesses. The Commission's reference guidance built on this basis is Commission Notice 2022/C 355/01 on the implementation of food safety management systems (see Sources).

The obligation presupposes the prerequisite programmes (PRPs): the good hygiene practices imposed by Article 4 and Annex II Article 4(2) of Regulation (EC) No 852/2004 are the foundation on which HACCP-based procedures are built: without PRPs under control, the hazard analysis has nothing to stand on.

Who is covered

The obligation binds all FBOs carrying out any stage of production, processing and distribution of food after primary production Article 5(3) of Regulation (EC) No 852/2004: manufacturers, warehouses, transporters, restaurants, bars and cafes, food trucks, retail shops. The size of the business is irrelevant to whether the obligation exists; it is relevant only to how it is discharged, since proportionality operates on documentation and on the manner of demonstrating compliance Article 5(4) of Regulation (EC) No 852/2004, not on the existence of the duty.

Paragraph 3 excludes primary production and the associated operations listed in Annex I Article 5(3) of Regulation (EC) No 852/2004. The exclusion concerns Article 5 only: primary producers remain bound by the hygiene provisions of Annex I, Part A Annex I, Part A, point 2 of Regulation (EC) No 852/2004. Part B of the same Annex recommends that guides to good practice contain information on hazards and their control in primary production Annex I, Part B, point 1 of Regulation (EC) No 852/2004: extending the HACCP principles to the primary stage is thus entrusted to the voluntary instrument of the guides, which the legislature regards as a long-term objective.

What is required: the seven principles

Paragraph 2 lists the seven principles that the permanent procedures must incorporate Article 5(2) of Regulation (EC) No 852/2004:

Three textual points deserve emphasis. First, point (a) asks for the identification of the hazards that "must" be controlled, which presupposes a prior description of products, processes and intended use. Second, point (c), read with recital 15, does not require numerical limits in every case: for some CCPs an observable limit may suffice. Third, point (g) builds proportionality directly into the text ("commensurate with the nature and size of the food business"): the records of a small cafe need not replicate those of an industrial plant.

Paragraph 2 closes with a second subparagraph imposing review: when any modification is made in the product, process or any step, the FBO shall review the procedure and make the necessary changes Article 5(2) of Regulation (EC) No 852/2004. Updating is event-driven, not periodic: a new supplier, new equipment, a new preparation or a new sales channel (e.g. delivery) all trigger the review.

Paragraph 4 governs evidence and documentation: the FBO must provide the competent authority with evidence of compliance in the manner the authority requires, taking account of the nature and size of the business (point (a)); ensure that documents describing the procedures are up to date at all times (point (b)); and retain any other documents and records "for an appropriate period" (point (c)) Article 5(4) of Regulation (EC) No 852/2004. The retention period is not quantified by the Regulation: Commission Notice 2022/C 355/01 suggests linking it to the shelf life of the product, and national practice or sectoral guides make it concrete. Paragraph 5 allows detailed implementing arrangements under the committee procedure of Article 14(2) Article 5(5) of Regulation (EC) No 852/2004 Article 14(2) of Regulation (EC) No 852/2004, in particular facilitating the use of guides for the application of HACCP principles.

Relationship with other provisions

Article 5 must be read systematically. With Article 4: the general and specific hygiene requirements are the prerequisites on which HACCP rests Article 4(1) of Regulation (EC) No 852/2004. With Article 6: registration of the establishment is the administrative precondition of the activity, while the HACCP-based procedures are its management precondition Article 6(2) of Regulation (EC) No 852/2004. With Articles 7, 8 and 9: guides to good practice are the instrument — voluntary in use — that helps operators, especially small ones, apply the HACCP principles Article 7 of Regulation (EC) No 852/2004. With Annex II, Chapter XII: those responsible for developing and maintaining the Article 5(1) procedure must have received adequate training in the application of the HACCP principles Annex II, Chapter XII, point 2 of Regulation (EC) No 852/2004: training and self-control are two sides of the same obligation. With Regulation (EC) No 2073/2005: microbiological criteria are the technical benchmark for validating and verifying HACCP-based procedures Article 3 of Regulation (EC) No 2073/2005, with defined sampling obligations Article 4 of Regulation (EC) No 2073/2005. With Regulation (EU) 2017/625: official controls verify the operator's own-check procedures as well Article 9 of Regulation (EU) 2017/625. Since 2021, Chapter XIa of Annex II requires a food safety culture that presupposes a living, not merely documentary, HACCP system Annex II, Chapter XI bis of Regulation (EC) No 852/2004, introduced by Regulation (EU) 2021/382 Article 1 of Regulation (EU) 2021/382.

Practical application and interpretive issues

Flexibility for small businesses. This is the main issue. Recital 15, point (g) of paragraph 2 and point (a) of paragraph 4 together support a graduated application: Commission Notice 2022/C 355/01 explains that for certain businesses (typically catering and retail: bars, restaurants, small shops) implementing the prerequisite programmes, possibly supplemented by simplified HACCP-based procedures drawn from sectoral guides, can satisfy the paragraph 1 obligation where no CCP can or needs to be identified. Flexibility is not an exemption: the hazard analysis must still be carried out, and the decision not to identify CCPs must be reasoned and withstands scrutiny during official controls.

HACCP procedure versus the self-control manual. The Regulation requires procedures, not a document with a particular name. The "HACCP manual" or food safety management manual — a standing feature of practice in several Member States, notably Italy, where it is called "manuale di autocontrollo" — is the documentary form used to describe the procedures and discharge point (g). It is useful, and competent authorities normally expect it, but it is the means, not the end: a formally impeccable manual that is not implemented breaches Article 5 Article 5(1) of Regulation (EC) No 852/2004, while procedures genuinely implemented but inadequately documented breach point (g) Article 5(2) of Regulation (EC) No 852/2004. On how to structure the document, see writing a HACCP manual.

Consultants and certificates. No provision requires the FBO to outsource HACCP to an external consultant: responsibility lies, and remains, with the operator Article 17 of Regulation (EC) No 178/2002. Nor does the Regulation provide for any certificate issued by third parties: the obligations are self-control, registration and training (see why no certificate exists under Regulation 852/2004). HACCP training attestations are governed by national or regional law, as explained for Italy in the HACCP training page.

Penalties

Article 5 contains no penalty of its own: measures and penalties for infringements of food law are a matter for the Member States, which must make them effective, proportionate and dissuasive Article 17(2) of Regulation (EC) No 178/2002. In Italy, failure to put in place HACCP-based self-control procedures is an administrative offence under Legislative Decree No 193 of 6 November 2007 Article 6 of Italian Legislative Decree No 193/2007, which distinguishes failure to establish the procedures from failure to implement them correctly; amounts and enforcing authorities are set out in the page on Italian penalties. For a comparison across Member States, see the country pages.

As at the date of this page, no ruling of the Court of Justice of the European Union deals specifically with the interpretation of Article 5 of Regulation (EC) No 852/2004. Of systemic relevance is CJEU, Fourth Chamber, 13 November 2014, Case C-443/13, Reindl (ECLI:EU:C:2014:2370), on the obligation of FBOs at the distribution stage to comply with the microbiological criteria of Regulation (EC) No 2073/2005 Article 3 of Regulation (EC) No 2073/2005: microbiological criteria are the main legal benchmark for verifying procedures based on the HACCP principles.

Article 5 is directly applicable and requires no transposition. Member States act on three levels: penalties for non-compliance Article 17(2) of Regulation (EC) No 178/2002, national guides to good practice assessed under Article 8 Article 8(1) of Regulation (EC) No 852/2004, and national or regional rules on the training of food handlers. For Italy: penalties in Legislative Decree 193/2007 Article 6 of Italian Legislative Decree No 193/2007, training regulated at regional level (HACCP training in Italy), general framework in the Italy page.