HACCP Standard for Food Safety: 7 Principles, Implementation, and Certification

Search volume for HACCP runs into the thousands of queries every month worldwide, often appearing in mixed spellings such as HACCP, HASSP, or even ХАСП for Ukrainian readers. This guide covers what you actually need to know in 2026: legal requirements, the 7 principles, fines for non-compliance, and how to implement a working system in 90 to 180 days.

Over 12+ years working with food producers, our team has supported more than 200 HACCP, ISO 22000, and FSSC 22000 implementation projects. This guide is built from real audits and inspections, not press releases. Everything below maps directly to a production line, restaurant, or canteen on the ground.

In short, you'll find answers to four practical questions: whether your company is required to have HACCP (almost always yes), what it costs (€800–25 000 depending on the sector), how long it takes (1–8 months), and what an inspector actually looks at during a food safety audit. No filler, no links to dubious one-week HACCP courses.

HACCP (Hazard Analysis and Critical Control Points) is an international food safety management system built on 7 principles and 12 implementation steps from Codex Alimentarius. It is mandatory for food businesses across the EU under Regulation (EC) No 852/2004 and across Ukraine under Law No. 771/97-VR.

The core idea is simple. You don't rely on end-product testing. You analyze the production process, find the points where a hazard could appear (microbiological, chemical, physical, or allergenic), and place control points there with measurable limits. If a limit is breached, the product never leaves the line.

This is a fundamentally different approach from classic end-of-line quality control. Lab analysis of a finished batch only flags a problem after the unsafe product is already made, packed, and sometimes shipped. HACCP works preventively: it catches a hazard the moment it appears on the line, before the batch ever reaches packaging.

One important point: HACCP is a methodology, not a certification scheme. There is no single official certificate of HACCP from any international body. What people often call a HACCP certificate is usually an audit conformance statement or an ISO 22000:2018 / FSSC 22000 certificate, both of which embed HACCP as a mandatory component. If anyone offers to sell you a HACCP certificate without an audit, that paper is worthless to regulators and to any serious buyer.

Under the EU's Regulation (EC) No 852/2004 on the hygiene of foodstuffs, every food business operator must put in place, implement, and maintain procedures based on HACCP principles. There is no exemption based on size, sector, or ownership form. Equivalent requirements apply in Ukraine (Law No. 771/97-VR), the UK, and most jurisdictions that follow Codex.

This includes:

• Food producers, from meat plants to bakeries and confectioneries.
• Importers and distributors, even if you only repack or store.
• Processors of raw materials and ingredients.
• Retail: supermarket chains, neighborhood stores, markets.
• HoReCa: cafes, restaurants, coffee shops, canteens, catering.
• Education and healthcare: school and hospital canteens.
• Transport and logistics handling food.

Enforcement is carried out by national food safety authorities (the Food Standards Agency in the UK, regional competent authorities in EU member states, the State Service for Food Safety in Ukraine) through scheduled inspections or unscheduled visits triggered by consumer complaints. Across the EU, thousands of operators are sanctioned annually for missing or non-functional HACCP systems.

If you are a small operator and have just opened a coffee shop or pastry studio, don't assume nobody will notice. Inspectors actively visit new establishments within their first 12 months, partly on schedule, partly on competitor complaints. An inspection can happen as early as the third month. It is far cheaper to close the gap before the visit than to explain why the monitoring log has zero entries.

If you have searched for this system online, you've probably seen it written several ways. These are not different standards but the same system rendered in different alphabets. The Latin spellings are mostly an English-speaking concern, while the Cyrillic forms matter only if you operate in Ukraine or other Russian-speaking markets. Here is where each spelling comes from.

All four spellings refer to the same system. In international and English-language contexts, only HACCP matters. The other forms appear when the system was localized into Cyrillic-script regions, with two transliteration generations producing both ХАСП and ХАССП. HASSP is mostly a back-translation typo and is best avoided.

Practical tip for English-speaking teams: stick to HACCP everywhere. If your company also operates documents in Ukrainian or Russian, agree on a single Cyrillic spelling (ХАСП is the modern Ukrainian standard) and use it consistently across all internal documents.

Auditors notice inconsistency. If one order says HACCP, the log says ХАССП, and a workshop poster says HASSP, it looks like the documents were copy-pasted from different templates. Pick one form per language and apply it across every procedure.

Codex Alimentarius (CXC 1-1969 Rev. 2020) defines 7 base principles that every HACCP system rests on, regardless of sector. This is the foundation. Here is each one with a quick practical example:

• Principle 1. Hazard Analysis. List the biological, chemical, physical, and allergenic hazards at every step of the process. For a bakery this might include salmonella in eggs, detergent residues, metal shavings from equipment, and gluten cross-contact.
• Principle 2. Identify Critical Control Points (CCPs). From all process steps, pick the ones where the hazard can actually be reduced or eliminated. Classic CCPs: heat treatment, metal detection, pH control, filtration.
• Principle 3. Establish Critical Limits. For each CCP, set a measurable limit. Not enough to cook, but core temperature at or above 75 degC for at least 15 seconds.
• Principle 4. Monitor CCPs. Who, what, when, and how it gets measured. The monitoring log must include date, time, value, name, and signature of the person responsible.
• Principle 5. Corrective Actions. A pre-written plan: if temperature falls below the limit, the product is held, reworked, or discarded. No improvising on the floor.
• Principle 6. Verification. Periodic checks that the system actually works: lab tests on finished product, calibration of thermometers, internal audits.
• Principle 7. Documentation and Recordkeeping. All procedures, logs, reports, and records must be kept for at least 1 year (longer for some categories such as low-acid canned foods, depending on jurisdiction).

This is the short version. Each principle expands into dozens of operational decisions in practice. We covered each one in depth, with sector examples, in a separate guide: the 7 HACCP principles.

A note for plants with multiple production lines: the CCP set cannot be one-size-fits-all. Hazard analysis and a CCP table must be built separately for every product and every line. This is the most common reason mid-sized meat plant pre-audits drag from 3 weeks to 2 or 3 months.

The 7 principles describe what you have to do. The 12 steps describe how it gets done in practice. Codex Alimentarius CXC 1-1969 frames implementation as a sequence of 12 steps where the first 5 are preparatory and steps 6 to 12 directly carry out the 7 principles.

Realistic timelines from a standing start: 1 to 3 months for a small coffee shop, 4 to 8 months for a mid-sized producer, 6 to 12 months for a large plant. If HACCP is partly in place and you only need to bring it up to inspection level, the timeline halves. Step-by-step instructions with ready-to-use order and procedure templates are in our HACCP implementation guide.

The most common mistake at the start: management hands HACCP to a technologist to do in their spare time, with no change in their other duties. Four months later, the technologist hasn't kept up, the documents are 30 percent done, and the inspection is next week. Either allocate at least half a position for an internal coordinator from day one, or bring in an external consultant who can take 70 percent of the documentation and training load. Saving here always costs more later.

Documentation is 60 to 70 percent of HACCP work. Without it, an inspector won't see your system even if everything actually runs well. Four document layers must be in place:

• PRP (Prerequisite Programmes). Personnel hygiene, cleaning and disinfection, pest control, waste handling, equipment maintenance. This is the base layer; without it HACCP is impossible. For manufacturing, structured per ISO/TS 22002-1 (HoReCa can use a simplified version).
• HACCP plan. The main working document: process flow diagram, hazard analysis, CCP table, critical limits, monitoring procedures, and corrective actions.
• SOPs (Standard Operating Procedures). Cleaning of equipment, raw material intake, heat treatment, labeling, disposal. Each SOP is short (1 to 3 pages), with photos or diagrams.
• Monitoring logs and records. Daily temperature records, cleaning checklists, non-conformance reports, training logs. They must be filled out daily, in real time, in pen (not pencil) or in an electronic system protected against retroactive edits.

If there's no time to draft everything from scratch, look at our ready-made HACCP document templates, which can be adapted to your operation. The worst thing you can do is take someone else's full set as is and stamp it with your seal. The first 10 minutes of any inspection are spent looking for mismatches between the document and the actual kitchen.

One aspect that's often underrated: electronic vs paper logs. The law doesn't dictate format, but if records sit in Excel or Google Sheets without version control or change timestamps, inspectors treat them as unreliable. Two formats work in practice: paper logs with handwritten signatures and dates, or a dedicated electronic system (for example, an FSMS module in your ERP) with a full audit trail. A shared Excel sheet with no controls usually doesn't pass.

A question that comes up on almost every intake call: how does HACCP differ from ISO 22000, and where does FSSC 22000 fit? Short answer: HACCP is a methodology, ISO 22000 is a management system standard, and FSSC 22000 is a full GFSI-recognized certification scheme.

The logic: HACCP is the mandatory minimum, you cannot operate without it. ISO 22000 adds a management framework (HLS) on top of HACCP and makes the system audit-ready by an external body. FSSC 22000 takes ISO 22000, adds sector-specific PRPs from ISO 22002-x, and layers on 11 additional FSSC requirements. The resulting FSSC 22000 certificate is recognized by every major retailer in the EU, US, and Middle East.

If the goal is export or supplying major retail chains, FSSC 22000 is the endpoint. If you only need to comply with the law and pass the food safety inspection, a working HACCP system is enough. If you plan to grow into export within 1 to 2 years, start with ISO 22000 right away: moving from ISO 22000 to FSSC 22000 costs 40 to 60 percent less than jumping from HACCP-only to FSSC 22000.

For a business that runs only basic HACCP today and isn't planning ISO 22000 certification soon, we recommend commissioning an external pre-audit at least once a year. It costs a moderate amount (€500 to 1 500), but it shows true readiness for an inspection and surfaces accumulated weak spots: unsigned logs, expired calibrations, new processes that never got documented. You can book this kind of audit as part of our HACCP implementation service, which covers the full cycle: gap analysis, documentation, staff training, and final review.

HACCP is a universal methodology, but implementation varies sharply by sector. The same 7th principle means 80 pages of monitoring logs in a meat plant and one notebook a month in a school canteen. Here are the three most common scenarios:

Food manufacturing. The most complex and expensive tier: 12 to 25 CCPs, full PRP set per ISO 22002-1, mandatory lab control. Implementation budget €5 000 to 25 000 for a mid-sized producer, timeline 4 to 8 months. Often combined with ISO 22000 or FSSC 22000.

HoReCa (cafes, restaurants, coffee shops). 4 to 8 CCPs, simplified PRPs, focus on temperature control, personnel hygiene, and high-risk raw materials (eggs, fish, meat). Budget €1 500 to 5 000, timeline 2 to 4 months.

School and hospital canteens. A special case: a vulnerable audience (children, patients), additional regulatory requirements. 3 to 6 CCPs, a slimmer document set, but strict control on raw material intake and storage temperatures. Budget €800 to 3 000, timeline 1 to 3 months.

Sector differences show up not only in CCP counts but also in the inspector's focus. In schools, special attention goes to children's allergens and prohibited-food lists (menus for under-6s exclude several categories). In restaurants, the focus is on cold-storage temperatures and shelf life of semi-finished items. On production sites, inspectors run batch traceability tests: they pick a specific finished batch and ask you to show, within 30 minutes, what raw materials it came from, on which equipment, and under whose signed control.

Across 200+ implementation projects, we see the same set of mistakes recurring from site to site. Here are the top 5 by frequency (the percentage shows the share of our pre-audits where the issue surfaces).

The most expensive of these is #2 (record falsification). Most regulators apply not just the standard HACCP fine but an additional charge for providing false information. That can multiply the penalty and, in serious cases, trigger criminal liability for the senior officer. If you spot this practice in your operation, stop it today, even before the inspector arrives. Restarting monitoring from a clean sheet is far better than explaining handwriting and timestamp inconsistencies.

The second costliest mistake is #4 (no staff training). Roughly 80 percent of HACCP system breakdowns happen because the worker doesn't know why they're recording a number in a log. If you ask a chef in a restaurant why they measure chicken temperature at the oven exit and the answer is because they were told to write it down, your HACCP system isn't working. It only looks like it is. The fix is systematic internal training with examples of real food poisoning cases, not dry recitation of procedures during signoff.

Mistake #5 (incomplete hazard analysis) often appears because the team focuses on microbiology and forgets allergens and chemistry. EU Regulation 1169/2011 lists 14 mandatory allergen categories: gluten-containing cereals, crustaceans, eggs, fish, peanuts, soy, milk, nuts, celery, mustard, sesame, sulphur dioxide and sulphites, lupin, molluscs. If your HACCP plan has no separate section on allergen cross-contact control (production scheduling, dedicated equipment, cleaning validation), an inspector will flag it as a major non-conformance.

The legal framework for HACCP varies by jurisdiction, but the core obligations are similar. In the EU, Regulation (EC) No 852/2004 requires every food business operator to put HACCP-based procedures in place; member-state competent authorities enforce it. The European Food Safety Authority (EFSA) issues scientific opinions that feed into critical limits and hazard scoring.

In Ukraine, the same baseline is set by Law No. 771/97-VR (On Basic Principles and Requirements for Food Safety and Quality), aligned with EU practice. The Ministry of Agriculture's order on HACCP-based procedures (No. 590) defines the inspection minimum, and the voluntary national standard DSTU-ISO 22000:2019 mirrors ISO 22000:2018. Inspections are run by the State Service for Food Safety (DSSU).

Here is how an inspection cycle typically works (the structure is similar across EU and EU-aligned regulators):

• Scheduled inspections: yearly for high-risk plants (meat, fish, dairy, infant nutrition), every 2 to 3 years for medium risk (HoReCa, confectionery), every 5 years for low risk (packaged dry goods).
• Unscheduled: triggered by consumer complaint, foodborne illness, or non-conformities found in related inspections.
• Duration: from 1 day (small cafe) to 5 days (large producer).

An additional layer of protection is voluntary certification to ISO 22000:2018 (or its national equivalent). It isn't required, but it brings three practical benefits: it lowers the frequency of scheduled regulatory inspections (treated as evidence of adequate control), it opens the door to public-sector tenders, and it streamlines negotiations with retail chains. Realistic certification cost: €3 000 to 8 000 for a mid-sized producer, with the certificate issued 4 to 6 months from contract.

If you plan to integrate HACCP with ISO 22000 or move from HACCP-only to a full management system, start with a certification readiness assessment. In 5 to 10 working days you'll get a gap report and a clear plan for what to close. A separate offering, audit support during certification, puts your consultant on site to handle inspector questions instead of leaving the senior officer to wing it.

One further note relevant to 2024 to 2026: regulators across the EU and EU-aligned markets are moving to risk-based inspections. This means inspectors spend more time on operators with a history of non-compliance, complaints, or no recognized international certification. If you hold a current ISO 22000 or FSSC 22000 certificate, you typically slip into a lower risk band: inspections are rarer, document review is selective, and the focus shifts toward observing the process rather than auditing folders.

These are the questions that come up most often in search and on free consultations. Answers are short and direct. If your case doesn't fit a standard pattern, reach out to the Ekontrol team.