HACCP: A Practical Guide to Food Safety for Ukrainian Businesses

HACCP (Hazard Analysis and Critical Control Points) is a preventive system for managing food safety. It doesn't test the finished product and hope for the best. Instead, it identifies where things can go wrong during production and puts controls in place before a hazard reaches the consumer.

The concept goes back to the 1960s. NASA needed a guarantee that astronaut food wouldn't cause illness in space, so the Pillsbury Company, working with NASA and the US Army, built a systematic approach to preventing contamination rather than relying on end-product testing. That logic still holds.

Since then, HACCP has become the global baseline for food safety. The Codex Alimentarius Commission, a joint body of the WHO and FAO, adopted HACCP principles as the international reference standard. The European Union built its food hygiene regulations (Regulation (EC) No 852/2004) on the same foundation. Ukraine, through its Law "On Basic Principles and Requirements for Food Safety and Quality" (Law No. 771/97-VR, amended), has made HACCP mandatory for food operators.

If you handle food in Ukraine, HACCP is a legal requirement. Full stop.

Under Ukrainian legislation, every food business operator must implement procedures based on HACCP principles. This isn't limited to large factories. Manufacturers, processors, distributors, retailers, HoReCa establishments, anyone touching the food supply chain, all fall under the requirement.

There are scaled exemptions for micro-businesses (fewer than 10 employees with annual turnover below a threshold), but even they must follow simplified food safety procedures. If you're producing, packaging, storing, transporting, or selling food, you need HACCP in some form.

The State Service of Ukraine on Food Safety and Consumer Protection (Derzhprodspozhyvsluzhba) enforces these requirements. Inspections have picked up since Ukraine's EU integration trajectory accelerated. Non-compliance can mean fines, suspended operations, or product recalls. In 2025, the number of planned inspections of food operators nearly doubled compared to 2023.

Exporters face an additional layer: if you're shipping to the EU, your HACCP system must align with EU Regulation 852/2004. Many international buyers won't even consider a supplier without a functioning HACCP plan. So really, the question isn't whether you need it. It's whether you can afford to operate without it.

The HACCP system rests on seven principles defined by the Codex Alimentarius. They aren't abstract ideas. Each one translates into specific actions your food safety team must take.

Principle 1: Conduct a Hazard Analysis. Identify every biological, chemical, and physical hazard that could affect your product at each stage of production. A bakery might focus on allergen cross-contact and metal fragments. A dairy processor will worry about pathogenic bacteria and antibiotic residues. Your hazards depend on your product and process.

Principle 2: Determine Critical Control Points (CCPs). These are the steps where you can apply a control measure to prevent or reduce a hazard to an acceptable level. Pasteurization temperature in a milk plant is a classic CCP. Not every step qualifies. Use a decision tree to separate CCPs from ordinary control points.

Principle 3: Establish Critical Limits. For each CCP, define measurable boundaries. "Hot enough" isn't a critical limit. "Minimum 72 degrees C for 15 seconds" is. Critical limits need to come from science, regulatory standards, or validated studies.

Principle 4: Set Up Monitoring Procedures. You can't control what you don't measure. Monitoring means scheduled observations, measurements, or tests at each CCP to confirm critical limits are met. Assign responsibility: who monitors, how often, with what equipment.

Principle 5: Define Corrective Actions. When monitoring shows a critical limit has been breached, what happens? Corrective actions must be predefined, not improvised on the spot. They cover both the immediate response (isolate the affected product) and root cause elimination.

Principle 6: Establish Verification Procedures. Verification confirms that the HACCP system is working as intended. This includes calibrating monitoring equipment, reviewing records, running internal audits, and sometimes testing finished products.

Principle 7: Keep Records and Documentation. Every hazard analysis, CCP determination, critical limit, monitoring result, corrective action, and verification activity must be documented. Records are your proof to regulators, auditors, and customers that the system works.

These seven principles form a closed loop. Skip one, and you've got a gap. Follow all seven consistently, and you have a defensible, science-based food safety system.

Here's a mistake we see constantly: companies jump straight into HACCP without building the foundation first. HACCP doesn't operate in a vacuum. It sits on top of prerequisite programs (PRPs), the baseline conditions and activities needed for a safe production environment.

PRPs cover facility design, cleaning and sanitation, pest control, personal hygiene, water quality, waste management, supplier control, and staff training. These aren't HACCP-specific; they're general good practices that any food operation should have. If your facility has pest problems or your cleaning schedule exists only on paper, launching a HACCP plan won't fix those underlying issues.

GMP (Good Manufacturing Practices) is the most recognized framework for PRPs in food production. GMP creates the environment where HACCP can function. Without clean equipment, trained staff, and controlled storage conditions, your critical control points lose their meaning. A detailed overview of common mistakes and practical controls is available in the guide to hygiene in food production.

The Codex Alimentarius is explicit on this: HACCP should be applied within a framework of PRPs. ISO 22000 takes it further by integrating PRPs, operational PRPs, and the HACCP plan into a single food safety management system. Planning to eventually pursue FSSC 22000 certification? The prerequisite programs become even more detailed, governed by the ISO 22002 series.

Before writing your first HACCP plan, conduct a gap assessment of your PRPs. A diagnostic audit is built for exactly this: evaluate the real state of your foundational programs so you know what to fix before layering HACCP on top.

The Codex Alimentarius outlines 12 steps for HACCP implementation. The first five are preparatory; the remaining seven map directly to the HACCP principles.

Step 1. Assemble the HACCP Team. You need people who understand your product, processes, and potential hazards. This usually means quality, production, and maintenance staff, sometimes logistics too. Small companies might rely on 2-3 people plus an external consultant.

Step 2. Describe the Product. Document everything about your product: composition, processing methods, packaging, shelf life, storage conditions, intended use, target consumers. Don't skip vulnerable groups. Infant food and products for immunocompromised people require stricter hazard analysis.

Step 3. Identify Intended Use. Who eats this product and how? Is it consumed raw or cooked? Could it be used by high-risk groups? These answers shape your hazard analysis.

Step 4. Construct a Flow Diagram. Map every step from raw material receipt to final dispatch. Include storage, rework loops, waste streams, and any outsourced processes. The flow diagram is the backbone of your HACCP plan.

Step 5. On-Site Verification of the Flow Diagram. Walk the production floor with your flow diagram in hand. Does it match reality? Miss a step here and you'll miss a hazard later.

Steps 6-12 correspond to the 7 HACCP principles described above: hazard analysis, CCP identification, critical limits, monitoring, corrective actions, verification, and documentation.

The whole process, from team assembly to a validated HACCP plan, typically takes 2-4 months for a mid-sized food business. Rush it and you'll create a paper system that won't survive its first audit. Drag it out and you'll lose team momentum. Weekly team sessions with steady progress tend to work best.

This question comes up in almost every consulting engagement, and the confusion makes sense. HACCP is a methodology, a set of seven principles for controlling food safety hazards. ISO 22000 is a management system standard that incorporates HACCP but goes further.

What does ISO 22000 add? Structure. Management commitment, resource planning, internal communication, emergency preparedness, continual improvement cycles. It also introduces a formal distinction between CCPs and operational PRPs (oPRPs), which are control measures that matter but don't rise to the level of a critical control point.

For many Ukrainian companies, HACCP implementation is the starting point. It satisfies the legal requirement and addresses the most pressing food safety risks. ISO 22000 becomes relevant when you want a certified management system, particularly for export markets or when international buyers require it.

If your clients demand GFSI-recognized certification, you'll need FSSC 22000, which layers additional requirements on top of ISO 22000. The progression looks like this: HACCP principles at the core, ISO 22000 wrapping them in a management system, FSSC 22000 adding scheme-specific requirements on top.

After years of consulting food businesses across Ukraine, we see the same problems repeating. Here are the mistakes that turn a potentially useful system into expensive paperwork.

Copying someone else's HACCP plan. Every product, facility, and process is different. A borrowed plan from a competitor or a downloaded template might look complete on paper, but it won't reflect your actual hazards. Auditors spot this within minutes.

Too many CCPs. Some teams designate 15-20 critical control points out of caution. The result? An unmanageable monitoring burden, record fatigue, and eventually nobody monitoring properly. A typical food production line has 1-4 genuine CCPs. Got more than 5? Revisit your hazard analysis.

Ignoring prerequisite programs. Without solid PRPs, your HACCP plan ends up compensating for problems that should've been solved at a more basic level. Pest control failures, poor personal hygiene, unreliable cleaning: these belong in your PRP framework, not your CCP list.

No real corrective actions. When a critical limit is breached, the response can't be "we'll be more careful next time." Corrective actions must address the affected product (segregate, evaluate, dispose) and the root cause. Why did the deviation happen, and how do you prevent it from happening again?

Management treats HACCP as a quality department project. HACCP requires cross-functional involvement and buy-in from leadership. If the director signs the policy but never reviews HACCP performance data, the system stagnates. Budget, staffing, and equipment decisions that affect food safety need leadership involvement, not just the food safety team's attention. Remember too that HACCP and labeling go hand in hand: the AMCU fine for misleading food labeling case illustrates how regulators assess systemic compliance gaps in a producer's operations.

This is where HACCP tends to become bureaucratic. But it doesn't have to be. You need enough records to prove the system works. That's it.

At minimum, your HACCP documentation should include: hazard analysis worksheets (listing all identified hazards and the rationale for each decision), the HACCP plan itself (CCPs, critical limits, monitoring procedures, corrective actions), the flow diagram with on-site verification records, monitoring logs for each CCP, corrective action reports, verification records (calibration logs, internal audit reports, product testing results), and meeting minutes from HACCP team reviews.

The format matters less than what's in the records. A spreadsheet-based system works fine for a small bakery. A mid-sized processor might use dedicated food safety software. What counts is that records are accurate, timely, signed by the responsible person, and retrievable when needed.

One practical tip: keep monitoring records close to the CCP, physically or digitally. If your operator has to walk to an office to fill in a form after each measurement, compliance will drop. Make recording easy and it'll get done.

There's no universal price tag for HACCP implementation. Here are realistic ranges for Ukrainian businesses in 2026.

For a small food business (bakery, small dairy, HoReCa chain with 1-3 locations), the process typically takes 1-3 months with external consulting support. Costs generally run between 30,000 and 80,000 UAH for consultant-guided implementation, including team training and documentation development.

Mid-sized manufacturers (meat processing, confectionery, beverages) usually need 3-5 months. The investment runs higher, 80,000-200,000 UAH, reflecting greater process complexity, more CCPs, and more staff to train.

Large enterprises with multiple production lines and export ambitions can expect 4-8 months and budgets starting at 200,000 UAH, especially when HACCP implementation is paired with preparation for ISO 22000 or FSSC 22000 certification.

These figures include consulting fees, internal labor (your team's time), and basic monitoring equipment like thermometers, metal detectors, and pH meters. They don't include facility upgrades, which may be needed if your PRPs have gaps.

Where does the ROI come from? Fewer product recalls, lower waste, access to new markets, and avoided penalties from regulatory inspections. Most clients we work with see the system pay for itself within the first year.

HACCP works when you treat it as a practical tool for preventing food safety problems. The seven principles give you a proven framework. The implementation steps give you a roadmap. And Ukrainian law leaves no ambiguity: if you handle food, you need HACCP-based procedures.

The companies that get the most out of HACCP are the ones that invest in doing it right from the start. They build solid prerequisite programs. They train their teams to understand not just what to do, but why. They keep their plans current. And when they're ready to move toward ISO 22000, FSSC 22000, or new export markets, they don't have to start from scratch.

If your HACCP system needs building, rebuilding, or a reality check, start with an honest look at where you stand. A diagnostic audit takes the guesswork out and gives you a clear action plan.