HACCP is not something you buy: it is the written method your kitchen uses to show it controls its hazards

The short answer

Regulation (EC) 852/2004 requires every food business operator to put in place, implement and maintain procedures based on HACCP, hazard analysis and critical control points (APPCC in Spanish). It applies to the neighbourhood bar, the restaurant with an open kitchen, the kitchen of a hotel or a school and the cake shop with its own workshop. There is no minimum floor area, headcount or number of covers.

It is not a seal someone sells you or a diploma to hang on the wall. It is the written way your kitchen identifies what can go wrong —the cold room stuck at nine degrees, the undercooked chicken, the nut sauce that goes over the same board as the nut-free dish—, decides where to watch for it and keeps a record that it does. Since 2022, restaurants and food retailers in Spain may apply it in a simplified way, but always with a named person in charge.

What the rule says

Article 5(2) lists the seven principles. They are given here as worded after the Spanish-language corrigendum of 2 March 2023, which changed «puntos de control crítico» to «puntos críticos de control» (critical control points):

• Identify the hazards that must be prevented, eliminated or reduced to acceptable levels.
• Identify the critical control points: the stages where control is essential, such as cooking a stew or cooling it down.
• Set critical limits that separate acceptable from unacceptable at each of those points.
• Monitor those points with effective procedures.
• Correct when monitoring shows that a point is no longer under control.
• Verify regularly that all of the above works.
• Document: draw up documents and records "en función de la naturaleza y el tamaño de la empresa alimentaria" (commensurate with the nature and size of the food business).

Whenever a product, a process or any of its stages changes, the procedure is reviewed (Art. 5(2), last paragraph). And the operator must provide the authority with evidence of compliance "en la manera en que ésta lo solicite" (in the manner it requests), keep the documents describing the procedures up to date and retain other records for an appropriate period (Art. 5(4)).

Who it binds and from what threshold

Article 5(3) applies HACCP to anyone involved at any stage after primary production. Spain's Royal Decree 1021/2022 spells out the most common case, the «establecimiento de comercio al por menor» (retail food establishment), which expressly includes restaurants and hospitality and supply to a group of diners such as a school, a company or a care home (Art. 2(2)). Those establishments are also entered in the food health register of their autonomous community after a notification or responsible declaration (Royal Decree 191/2011, Art. 2(2)). Where food is served to such a group on its own premises, the notification is made by the holder of those premises.

Flexibility is not an exemption

The regulation allows for rules that make HACCP easier for certain operators, "en particular estableciendo el uso de los procedimientos que fijen las guías" (in particular by providing for the use of procedures set out in guides) (Art. 5(5)). Its recitals explain why:

The same recital adds that the requirement to retain documents must be flexible "para evitar cargas excesivas para empresas muy pequeñas" (to avoid undue burdens for very small businesses), and recital 16 sets the limit: flexibility must not compromise food hygiene objectives. In Spain, Article 20 of RD 1021/2022 allows HACCP to be applied in a simplified way following Commission Notice 2020/C 199/01, requires "una persona responsable de su aplicación" (a person responsible for applying it) and makes clear that guides to good hygiene practice are voluntary.

What annex II requires, chapter by chapter

HACCP rests on the general hygiene requirements of annex II, which bind every operator after primary production (Art. 4(2)). These are the chapters that matter most on premises with a kitchen:

Pests. The obligation sits in two places in annex II: the layout of the premises must allow "en particular el control de las plagas" (in particular pest control) (chapter I, point 2(c)), and the operator must apply "procedimientos adecuados de lucha contra las plagas" (adequate procedures to control pests) (chapter IX, point 4). The rule does not require you to hire a company or set a number of visits a year. If biocides authorised for use by specialised professional staff are applied, they are applied by staff qualified under Royal Decree 830/2010, and a company treating third parties' premises registers beforehand in the biocide services register (ROESB) of its autonomous community (Order SCO/3269/2006, Art. 3). More in pest control.

Allergens. Since Regulation (EU) 2021/382, chapter IX requires that equipment, containers or transport used with a substance causing allergies or intolerances are not used for food that does not contain it unless they have been cleaned and checked, at least, for the absence of any visible residue. How diners are informed and how special menus work is covered in the guide to allergens in the dining hall.

What paperwork is kept

Two kinds of paperwork, under Article 5(4): the documents describing your procedures, which must be "actualizados permanentemente" (kept up to date at all times), and the records showing that you apply them. In an ordinary kitchen that usually means the written plan plus temperature sheets for cold rooms and cooking, goods-in checks, cleaning, pest control visits and staff training. Goods-in records are also the basis of food traceability: knowing which supplier each batch came from.

The regulation does not set a retention period in months or years. It says "durante un período adecuado" (for an appropriate period) and leaves it to implementing rules to specify it (Art. 5(5)); none of the Spanish rules cited on this page sets that period. Nor does it require a format: the record can be a sheet on the cold room door or a file, as long as it can be shown when the inspector asks.

What the rule does not say

What depends on the autonomous community

The EU regulation and the Spanish royal decrees are the same throughout Spain, but official controls are carried out by the competent authority of your autonomous community or your local council, regularly and according to risk (RD 1021/2022, Art. 21), and the food health register where the premises are entered is regional too. Chapter XII also requires compliance with national law on training programmes for certain sectors: if your region asks something specific of food handlers, it will be in its official gazette.

What this means for each type of business is on the pages for restaurants, hotels and schools. The kitchen's water supply also has its own Legionella checks.