HACCP Standard for Food Safety: 7 Principles, Implementation, and Certification

Search volume for HACCP runs into the thousands of queries every month worldwide, often appearing in mixed spellings such as HACCP, HASSP, or even ХАСП for Ukrainian readers. This guide covers what you actually need to know in 2026: legal requirements, the 7 principles, fines for non-compliance, and how to implement a working system in 90 to 180 days.

Over 12+ years working with food producers, our team has supported more than 200 HACCP, ISO 22000, and FSSC 22000 implementation projects. This guide is built from real audits and inspections, not press releases. Everything below maps directly to a production line, restaurant, or canteen on the ground.

In short, you'll find answers to four practical questions: whether your company is required to have HACCP (almost always yes), what it costs (€800-25 000 depending on the sector), how long it takes (1-8 months), and what an inspector actually looks at during a food safety audit. No filler, no links to dubious one-week HACCP courses.

HACCP (Hazard Analysis and Critical Control Points) is an international food safety management system built on 7 principles and 12 implementation steps from Codex Alimentarius. It is mandatory for food businesses across the EU under Regulation (EC) No 852/2004 and across Ukraine under Law No. 771/97-VR.

The core idea is simple. You don't rely on end-product testing. You analyze the production process, find the points where a hazard could appear (microbiological, chemical, physical, or allergenic), and place control points there with measurable limits. If a limit is breached, the product never leaves the line.

This is a fundamentally different approach from classic end-of-line quality control. Lab analysis of a finished batch only flags a problem after the unsafe product is already made, packed, and sometimes shipped. HACCP works preventively: it catches a hazard the moment it appears on the line, before the batch ever reaches packaging.

One important point: HACCP is a methodology, not a certification scheme. There is no single official certificate of HACCP from any international body. What people often call a HACCP certificate is usually an audit conformance statement or an ISO 22000:2018 / FSSC 22000 certificate, both of which embed HACCP as a mandatory component. If anyone offers to sell you a HACCP certificate without an audit, that paper is worthless to regulators and to any serious buyer.

Under the EU's Regulation (EC) No 852/2004 on the hygiene of foodstuffs, every food business operator must put in place, implement, and maintain procedures based on HACCP principles. Size and ownership form don't change that. The one real carve-out is primary production, such as growing crops or extracting honey at the apiary, along with closely related operations. Equivalent requirements apply in Ukraine (Articles 20 and 21 of Law No. 771/97-VR), the UK, and most jurisdictions that follow Codex. Ukrainian law lets small sites take a simplified approach, but it doesn't exempt them.

This includes:

• Food producers, from meat plants to bakeries and confectioneries.
• Importers and distributors, even if you only repack or store.
• Processors of raw materials and ingredients.
• Retail: supermarket chains, neighborhood stores, markets.
• HoReCa: cafes, restaurants, coffee shops, canteens, catering.
• Education and healthcare: school and hospital canteens.
• Transport and logistics handling food.

Enforcement is carried out by national food safety authorities (the Food Standards Agency in the UK, regional competent authorities in EU member states, the State Service for Food Safety in Ukraine) through scheduled inspections or unscheduled visits. In Ukraine, the frequency of scheduled checks depends on the site's risk category, and unscheduled ones follow a detected non-compliance or a reasonable suspicion. While martial law is in force, Cabinet of Ministers Resolution No. 303 suspends scheduled checks there, but unscheduled ones still go ahead when there's a threat to life or health.

If you are a small operator and have just opened a coffee shop or pastry studio, don't assume nobody will notice. In Ukraine, a new site is normally first inspected within 6 months of state registration, or within 3 months of getting an operating permit (Cabinet of Ministers Resolution No. 896). Martial law has put scheduled visits on hold, but one customer who falls ill after your dessert can bring an inspector in for an unscheduled check. It is far cheaper to close the gap before the visit than to explain why the monitoring log has zero entries.

If you have searched for this system online, you've probably seen it written several ways. These are not different standards but the same system rendered in different alphabets. The Latin spellings are mostly an English-speaking concern, while the Cyrillic forms matter only if you operate in Ukraine or other Russian-speaking markets. Here is where each spelling comes from.

All five spellings refer to the same system. In international and English-language contexts, only HACCP matters. The other forms appear when the system was localized into Cyrillic-script regions, with two transliteration generations producing both ХАСП and ХАССП. HASSP is mostly a back-translation typo and is best avoided. НАССР is not a transliteration at all: it is Latin HACCP typed on a Cyrillic keyboard, since four of the five letters look identical. It never belongs in a document, yet it is the most searched form in Ukraine.

Practical tip for English-speaking teams: stick to HACCP everywhere. If your company also operates documents in Ukrainian or Russian, agree on a single Cyrillic spelling (ХАСП is the modern Ukrainian standard) and use it consistently across all internal documents.

Auditors notice inconsistency. If one order says HACCP, the log says ХАССП, and a workshop poster says HASSP, it looks like the documents were copy-pasted from different templates. Pick one form per language and apply it across every procedure.

Codex Alimentarius (CXC 1-1969 Rev. 2020) defines 7 base principles that every HACCP system rests on, regardless of sector. This is the foundation. Here is each one with a quick practical example:

• Principle 1. Hazard Analysis. List the biological, chemical, physical, and allergenic hazards at every step of the process. For a bakery this might include salmonella in eggs, detergent residues, metal shavings from equipment, and gluten cross-contact.
• Principle 2. Identify Critical Control Points (CCPs). From all process steps, pick the ones where the hazard can actually be reduced or eliminated. Classic CCPs: heat treatment, metal detection, pH control, filtration.
• Principle 3. Establish Critical Limits. For each CCP, set a measurable limit. Not enough to cook, but core temperature at or above 75 degC for at least 15 seconds.
• Principle 4. Monitor CCPs. Who, what, when, and how it gets measured. The monitoring log must include date, time, value, name, and signature of the person responsible.
• Principle 5. Corrective Actions. A pre-written plan: if temperature falls below the limit, the product is held, reworked, or discarded. No improvising on the floor.
• Principle 6. Verification. Periodic checks that the system actually works: lab tests on finished product, calibration of thermometers, internal audits.
• Principle 7. Documentation and Recordkeeping. Procedures, logs, reports, and records have to be kept for a period set by national law. In Ukraine it's at least 3 months after the product's shelf life ends (Article 21 of Law No. 771/97-VR), so canned goods with a two-year shelf life mean more than two years of archive.

This is the short version. Each principle expands into dozens of operational decisions in practice. We covered each one in depth, with sector examples, in a separate guide: the 7 HACCP principles.

A note for plants with multiple production lines: the CCP set cannot be one-size-fits-all. Hazard analysis and a CCP table must be built separately for every product and every line. This is the most common reason mid-sized meat plant pre-audits drag from 3 weeks to 2 or 3 months.

The 7 principles describe what you have to do. The 12 steps describe how it gets done in practice. Codex Alimentarius CXC 1-1969 frames implementation as a sequence of 12 steps where the first 5 are preparatory and steps 6 to 12 directly carry out the 7 principles.

Realistic timelines from a standing start: 1 to 3 months for a small coffee shop, 4 to 8 months for a mid-sized producer, 6 to 12 months for a large plant. If HACCP is partly in place and you only need to bring it up to inspection level, the timeline halves. Step-by-step instructions with ready-to-use order and procedure templates are in our HACCP implementation guide.

The most common mistake at the start: management hands HACCP to a technologist to do in their spare time, with no change in their other duties. Four months later, the technologist hasn't kept up, the documents are 30 percent done, and the inspection is next week. Either allocate at least half a position for an internal coordinator from day one, or bring in an external consultant who can take 70 percent of the documentation and training load. Saving here always costs more later.

Documentation is 60 to 70 percent of HACCP work. Without it, an inspector won't see your system even if everything actually runs well. Four document layers must be in place:

• PRP (Prerequisite Programmes). Personnel hygiene, cleaning and disinfection, pest control, waste handling, equipment maintenance. This is the base layer; without it HACCP is impossible. For manufacturing, structured per ISO/TS 22002-1 (HoReCa can use a simplified version).
• HACCP plan. The main working document: process flow diagram, hazard analysis, CCP table, critical limits, monitoring procedures, and corrective actions.
• SOPs (Standard Operating Procedures). Cleaning of equipment, raw material intake, heat treatment, labeling, disposal. Each SOP is short (1 to 3 pages), with photos or diagrams.
• Monitoring logs and records. Daily temperature records, cleaning checklists, non-conformance reports, training logs. They must be filled out daily, in real time, in pen (not pencil) or in an electronic system protected against retroactive edits.

If there's no time to draft everything from scratch, look at our ready-made HACCP document templates, which can be adapted to your operation. The worst thing you can do is take someone else's full set as is and stamp it with your seal. The first 10 minutes of any inspection are spent looking for mismatches between the document and the actual kitchen.

One aspect that's often underrated: electronic vs paper logs. The law doesn't dictate format, but if records sit in Excel or Google Sheets without version control or change timestamps, inspectors treat them as unreliable. Two formats work in practice: paper logs with handwritten signatures and dates, or a dedicated electronic system (for example, an FSMS module in your ERP) with a full audit trail. A shared Excel sheet with no controls usually doesn't pass.

A question that comes up on almost every intake call: how does HACCP differ from ISO 22000, and where does FSSC 22000 fit? Short answer: HACCP is a methodology, ISO 22000 is a management system standard, and FSSC 22000 is a full GFSI-recognized certification scheme.

The logic: HACCP is the mandatory minimum, you cannot operate without it. ISO 22000 adds a management framework (HLS) on top of HACCP and makes the system audit-ready by an external body. FSSC 22000 takes ISO 22000, adds sector-specific PRPs from ISO 22002-x, and layers on 11 additional FSSC requirements. The resulting FSSC 22000 certificate is recognized by every major retailer in the EU, US, and Middle East.

If the goal is export or supplying major retail chains, FSSC 22000 is the endpoint. If you only need to comply with the law and pass the food safety inspection, a working HACCP system is enough. If you plan to grow into export within 1 to 2 years, start with ISO 22000 right away: moving from ISO 22000 to FSSC 22000 costs 40 to 60 percent less than jumping from HACCP-only to FSSC 22000.

For a business that runs only basic HACCP today and isn't planning ISO 22000 certification soon, we recommend commissioning an external pre-audit at least once a year. It costs a moderate amount (€500 to 1 500), but it shows true readiness for an inspection and surfaces accumulated weak spots: unsigned logs, expired calibrations, new processes that never got documented. You can book this kind of audit as part of our HACCP implementation service, which covers the full cycle: gap analysis, documentation, staff training, and final review.

HACCP is a universal methodology, but implementation varies sharply by sector. The same 7th principle means 80 pages of monitoring logs in a meat plant and one notebook a month in a school canteen. Here are the three most common scenarios:

Food manufacturing. The most complex and expensive tier: 12 to 25 CCPs, full PRP set per ISO 22002-1, mandatory lab control. Implementation budget €5 000 to 25 000 for a mid-sized producer, timeline 4 to 8 months. Often combined with ISO 22000 or FSSC 22000.

HoReCa (cafes, restaurants, coffee shops). 4 to 8 CCPs, simplified PRPs, focus on temperature control, personnel hygiene, and high-risk raw materials (eggs, fish, meat). Budget €1 500 to 5 000, timeline 2 to 4 months.

School and hospital canteens. A special case: a vulnerable audience (children, patients), additional regulatory requirements. 3 to 6 CCPs, a slimmer document set, but strict control on raw material intake and storage temperatures. Budget €800 to 3 000, timeline 1 to 3 months.

Sector differences show up not only in CCP counts but also in the inspector's focus. In schools, special attention goes to children's allergens and prohibited-food lists (menus for under-6s exclude several categories). In restaurants, the focus is on cold-storage temperatures and shelf life of semi-finished items. On production sites, inspectors run batch traceability tests: they pick a specific finished batch and ask you to show, within 30 minutes, what raw materials it came from, on which equipment, and under whose signed control.

Across 200+ implementation projects, we see the same set of mistakes recurring from site to site. Here are the top 5 by frequency (the percentage shows the share of our pre-audits where the issue surfaces).

The most expensive of these is #2 (backfilled records). A log where a whole week of entries shares one handwriting and one pen proves nothing, and an experienced inspector spots it in a minute. From there, the inspector's real question is whether HACCP works on the site at all. In Ukraine, a legal entity that hasn't implemented HACCP faces 30 minimum wages, and the law treats breaches of the traceability and record-keeping rules as a separate offense (8 minimum wages, or 5 for a sole proprietor). If you spot this practice in your operation, stop it today, even before the inspector arrives. Restarting monitoring from a clean sheet is far better than explaining handwriting and timestamp inconsistencies.

The second costliest mistake is #4 (no staff training). Roughly 80 percent of HACCP system breakdowns happen because the worker doesn't know why they're recording a number in a log. If you ask a chef in a restaurant why they measure chicken temperature at the oven exit and the answer is because they were told to write it down, your HACCP system isn't working. It only looks like it is. The fix is systematic internal training with examples of real food poisoning cases, not dry recitation of procedures during signoff.

Mistake #5 (incomplete hazard analysis) often appears because the team focuses on microbiology and forgets allergens and chemistry. EU Regulation 1169/2011 lists 14 mandatory allergen categories: gluten-containing cereals, crustaceans, eggs, fish, peanuts, soy, milk, nuts, celery, mustard, sesame, sulphur dioxide and sulphites, lupin, molluscs. Ukraine's Law No. 2639-VIII on consumer food information carries the same list in its Annex 1, and failing to give consumers allergen information costs a legal entity 30 minimum wages under Article 65 of Law No. 2042-VIII. If your HACCP plan has no separate section on allergen cross-contact control (production scheduling, dedicated equipment, cleaning validation), an inspector will flag it as a major non-conformance.

The legal framework for HACCP varies by jurisdiction, but the core obligations are similar. In the EU, Regulation (EC) No 852/2004 requires every food business operator to put HACCP-based procedures in place; member-state competent authorities enforce it. The European Food Safety Authority (EFSA) issues scientific opinions that feed into critical limits and hazard scoring.

In Ukraine, the same baseline is set by Law No. 771/97-VR (On Basic Principles and Requirements for Food Safety and Quality), aligned with EU practice. The Ministry of Agriculture's order on HACCP-based procedures (No. 590) defines the inspection minimum, and the voluntary national standard DSTU-ISO 22000:2019 mirrors ISO 22000:2018. Inspections are run by the State Service for Food Safety (DSSU). Penalties, though, sit in a different act: Article 65 of Law No. 2042-VIII on state control. The penalty articles that used to be in Law No. 771/97-VR were repealed.

Here is how the inspection cycle works in Ukraine (EU competent authorities also plan official controls on a risk basis, though each sets its own frequencies):

• Scheduled checks: the site's risk category under Cabinet of Ministers Resolution No. 896 sets a ceiling, not a fixed calendar. Very high risk means up to 4 inspections and 1 audit a year; high, up to 3 and 1; medium, up to 2 and 1; low, up to 1 inspection a year and 1 audit every two years; negligible, up to 1 inspection every two years and no audit.
• Unscheduled: after a detected non-compliance or on reasonable suspicion (Article 18 of Law No. 2042-VIII). Under martial law, Resolution No. 303 suspends scheduled checks, while unscheduled ones go ahead when there's a threat to life or health, for example after a complaint from a consumer who was harmed.
• Notice: a HACCP audit is announced at least 3 working days ahead, and inspections come unannounced.

An additional layer of protection is voluntary certification to ISO 22000:2018 (or its national equivalent). It isn't required, and in Ukraine a certificate on its own doesn't change how often the regulator visits. What it does is open the door to tenders that ask for a certified management system and make negotiations with retail chains easier. Realistic certification cost: €3 000 to 8 000 for a mid-sized producer, with the certificate issued 4 to 6 months from contract.

If you plan to integrate HACCP with ISO 22000 or move from HACCP-only to a full management system, start with a certification readiness assessment. In 5 to 10 working days you'll get a gap report and a clear plan for what to close. A separate offering, audit support during certification, puts your consultant on site to handle inspector questions instead of leaving the senior officer to wing it.

One further note on risk categories. Ukrainian state control is risk-based by law, and each site's score comes from the criteria in Resolution No. 896. They include the type of activity (producing food that needs an operating permit scores 30 points, without a permit 20), the results of previous checks, and how HACCP performs. If hygiene rules have been met and HACCP procedures applied effectively over the last 12 months, that criterion scores 0. A non-compliance found at the last check adds 10. An ISO 22000 or FSSC 22000 certificate isn't on the list, so it won't lower your category by itself. A HACCP system that actually works will, and in our experience annual surveillance audits do a good job of keeping it in shape.