The complete HACCP guide: legal basis, 7 principles and Codex steps

Legal basis

The HACCP obligation stems from Article 5 of Regulation (EC) No 852/2004: food business operators put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles Article 5(1) of Regulation (EC) No 852/2004. The verb is threefold — put in place, implement, maintain — and must be read in full: writing the procedures is not enough, they have to be applied and kept alive. Responsibility rests on the operator, who is accountable for the safety of the food under its control Article 17 of Regulation (EC) No 178/2002.

The word "HACCP" does not appear spelled out in the operative part of the article, which refers to the "principles" of the system: those codified by the Codex Alimentarius and carried into the list in paragraph 2. European HACCP is therefore not a stand-alone formality, but the technical core of the broader duty of own-check which, together with registration and training, defines the position of the food business. Anyone opening a business meets HACCP as one of the three mandatory pillars.

Scope and primary production

HACCP applies to every FBO operating at a stage after primary production: processing, preparation, storage, transport, distribution, service and sale. The notion of food business operator is broad and does not depend on legal form or size.

The law does, however, provide a targeted exemption: the procedures based on the HACCP principles do not apply to primary production and the associated operations listed in Annex I Article 5(3) of Regulation (EC) No 852/2004. Primary production — growing, rearing, hunting, fishing, harvesting — is not for that reason rule-free: it remains subject to the general hygiene requirements of Annex I, to record-keeping and to controls. The exemption concerns only the seven-principle methodology, not hygiene as such. It is a distinction competitors often blur: "exempt from HACCP" does not mean "exempt from hygiene obligations".

The twelve Codex Alimentarius steps

The seven principles are not applied in a vacuum: the Codex Alimentarius (General Principles of Food Hygiene, CXC 1-1969, 2020 revision) sets them within a logical sequence of twelve steps, of which the first five are preliminary and the following seven coincide with the principles. It is the structure the food safety management manual must make traceable.

1. Assemble the HACCP team — identify who develops and manages the system; in micro-businesses this may be the owner alone.
2. Describe the product — raw materials, ingredients, allergens, storage conditions, shelf life.
3. Identify the intended use — end use and consumers, including vulnerable groups.
4. Construct the flow diagram — every step of the process, from receipt to sale or service.
5. On-site confirmation of the flow diagram — check that the diagram matches operational reality.
6. Hazard analysis (principle 1) — biological, chemical and physical hazards at each step, with control measures.
7. Determine the CCPs (principle 2).
8. Establish critical limits (principle 3).
9. Monitoring system for the CCPs (principle 4).
10. Corrective actions (principle 5).
11. Verification procedures (principle 6).
12. Documentation and records (principle 7).

Steps 1-5 are not a formality: an unverified flow diagram corrupts the entire hazard analysis from the outset. Only once they are complete are the seven principles applied.

The seven HACCP principles

Article 5(2) lists the seven principles, points (a) to (g) Article 5(2) of Regulation (EC) No 852/2004. They are the technical core of the whole system.

Two textual points head off the commonest errors. Point (c) does not require a numerical limit in every case: for some CCPs an observable limit (for instance the colour or condition of a product) is enough. Point (f) — verification — is not the same as the monitoring of point (d): monitoring checks a single CCP in real time, whereas verification confirms that the whole system stays effective over time. The point-by-point treatment, with what to put in the plan, is in writing a HACCP manual.

CCPs, PRPs and OPRPs compared

The classification of control measures is where the quality of the system is decided. Three categories must not be confused.

• The CCP (critical control point) is the step at which control is essential to prevent, eliminate or reduce a hazard to an acceptable level, with a measurable, monitorable critical limit and defined corrective actions Article 5(2) of Regulation (EC) No 852/2004. Example: cooking to a defined core temperature. See CCP — critical control point.
• The PRP (prerequisite programme) is the basic, cross-cutting hygiene condition that is not tied to a critical limit of that kind: cleaning and disinfection, maintenance, pest control, personal hygiene, cold chain, managing cross-contamination. These are the general and specific requirements of Annex II Article 4(2) of Regulation (EC) No 852/2004. See PRP — prerequisite programmes.
• The OPRP (operational prerequisite programme) is an intermediate category developed by the ISO 22000 standard and by the Codex: a prerequisite applied to a significant hazard, managed through action criteria but not necessarily through a measurable critical limit as at a CCP. See OPRP — operational prerequisite programme.

Regulation 852/2004 does not name PRPs and OPRPs as such: it speaks of general and specific requirements (Annex II) and of procedures based on the HACCP principles (Article 5). The PRP/OPRP terminology comes from the international standards and from Commission Notice 2022/C 355/01, which places prerequisites upstream of HACCP. The Notice recognises that, once prerequisites are well managed, in many businesses the actual CCPs are few or absent: the decision not to identify any must be reasoned in the manual and withstand the authority's scrutiny Article 5(4) of Regulation (EC) No 852/2004.

The decision tree and interactive tools

To decide, step by step, whether a measure is a CCP, use the decision tree: a sequence of logical questions which, applied to each significant hazard, leads to classifying it as a CCP or referring it back to the prerequisites. The tree is a Codex tool: it helps justify the choices but does not replace them, since responsibility for the assessment stays with the FBO.

The site offers two interactive tools that accompany these steps. The CCP decision tree guides the classification of critical points step by step; the HACCP manual generator produces a manual outline to adapt to the individual business. They are aids: no automatic output discharges the hazard analysis or the review by those who know the processes. To check which obligations apply to your activity, use the check your obligations tool.

The food safety manual and proportionate documentation

The HACCP system takes documentary form in the food safety management manual — in practice the "HACCP manual" or "HACCP plan". Point (g) of paragraph 2 builds proportionality into the text: documents and records "commensurate with the nature and size of the food business" Article 5(2) of Regulation (EC) No 852/2004. A small cafe's manual need not replicate that of an industrial plant.

In practice, distinguish the documents describing the procedures — the stable part, to be kept up to date at all times Article 5(4) of Regulation (EC) No 852/2004 — from the records proving their implementation (temperature logs, cleaning records, non-conformities, training). The plan must be reviewed whenever the product, process or any step changes Article 5(2) of Regulation (EC) No 852/2004 and the descriptive documents kept up to date at all times Article 5(4) of Regulation (EC) No 852/2004. For step-by-step drafting, see the operational guide writing a HACCP manual. The manual is neither issued nor endorsed by any body: it is an in-house document with which the FBO demonstrates compliance to the competent authority during official controls.

Training those responsible for HACCP

A HACCP system is worth only as much as the competence of those who apply it. Annex II, Chapter XII requires those responsible for the development and maintenance of the HACCP system, or for the operation of the relevant guides, to have received adequate training in the application of its principles Annex II, Chapter XII, point 2 of Regulation (EC) No 852/2004. This is a requirement distinct from the general food hygiene training of staff required by the same chapter Annex II, Chapter XII, point 1 of Regulation (EC) No 852/2004.

The Regulation sets no durations, minimum content or form of certificate: these are left to national or regional law, which varies from one Member State to another. No training certificate is in itself "valid in every Member State": its regime is national. For the framework of training obligations and their documents, see mandatory training; for Italian rules and the competent authorities, the Italy section.