Compliance guide

HACCP for craft food & drink producers: a practical EU guide

Almost every EU food business beyond primary production, from a two-person brewery to a farmhouse cheesemaker, has to run food-safety procedures based on HACCP. This guide explains what the law actually asks for, the seven principles behind it, and how the rules flex to fit a small or micro operation, so you can build a plan that is genuinely workable rather than a binder you never open.

Guidance only, not legal advice · Reviewed 2026 against Regulation (EC) No 852/2004, Commission Notice 2016/C 278/01 and Codex Alimentarius CXC 1-1969.

What EU law actually requires

Under Article 5 of Regulation (EC) No 852/2004 on the hygiene of foodstuffs, food business operators must put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. This obligation applies at all stages of production, processing and distribution except at the level of primary production, so it covers craft breweries, distilleries, bakeries, dairies, fermenters, preserve makers and similar small producers.

HACCP stands for Hazard Analysis and Critical Control Points. The EU requirement is built directly on the international Codex Alimentarius standard, the General Principles of Food Hygiene (CXC 1-1969) and its HACCP annex, which is why the same seven principles appear in food law worldwide. The goal is prevention: you design controls into your process rather than relying on testing the finished product.

The regulation also expects you to review and update your procedures whenever you change a product, a recipe, an ingredient, a process step or your premises, so HACCP is a living system, not a one-off document.

The seven HACCP principles

Article 5(2) of 852/2004 sets out the seven principles, taken from Codex. For a craft producer they translate into a straightforward sequence:

Conduct a hazard analysis: identify the biological, chemical (including allergen) and physical hazards that could occur at each step of your process and decide which are significant.
Determine the critical control points (CCPs): the steps where control is essential to prevent, eliminate or reduce a significant hazard to an acceptable level, for example a pasteurisation or cook step.
Establish critical limits at each CCP: the measurable boundary between safe and unsafe, such as a minimum temperature and time, a target pH, or a water activity value.
Establish monitoring: decide how, how often and by whom each CCP is checked so you catch a loss of control quickly.
Establish corrective actions: define in advance what you do when a critical limit is not met, including what happens to the affected product.
Establish verification: confirm the system is working, through calibration, record review, testing or periodic reassessment.
Establish documentation and record-keeping: keep records appropriate to the nature and size of your business that show the system is running as intended.

Prerequisite programmes come first

HACCP does not sit on its own. It rests on prerequisite programmes, the good hygiene and good manufacturing practices required by the general hygiene rules in Annexes I and II of 852/2004 (Annex II being the relevant one for processing after primary production). These are the basic conditions and activities that keep the whole environment safe, and Commission Notice 2016/C 278/01 stresses that solid prerequisites make the HACCP plan itself simpler, because many general hazards are already controlled.

Typical prerequisites for a craft producer:

Cleaning and disinfection schedules for equipment and surfaces.
Pest control and building maintenance.
Personal hygiene, staff health and food-handler training.
Water quality, waste management and drainage.
Supplier approval and incoming goods checks.
Temperature control of storage and the cold chain.
Allergen management and preventing cross-contamination.
Traceability: knowing one step back and one step forward for every batch.

For many small operations, strong prerequisites plus a short HACCP plan targeting a handful of genuine CCPs is the whole system.

Flexibility and proportionality for small producers

The law is deliberately scalable. Recital 15 of 852/2004 states that the HACCP requirements should provide sufficient flexibility to be applicable in all situations, including small businesses, and recognises that in certain food businesses it is not possible to identify critical control points, and that in some cases good hygienic practices can replace the monitoring of CCPs.

Commission Notice 2016/C 278/01 is the official guidance on how that flexibility works in practice. It confirms that HACCP-based procedures should be applied with flexibility appropriate to the nature and size of the operation, that documentation should be proportionate and can be kept light for small businesses, and that generic, sector-specific guides to good practice can be used instead of building everything from scratch.

What proportionality means for you:

You do not need a large HACCP team; a small business can carry out the analysis with outside advice or an approved guide.
Documentation should be simple, real and kept up to date, not padded to look impressive.
Where good hygiene practices already control a hazard, you may not need a formal CCP with continuous monitoring.
National and sector guides to good practice, encouraged by 852/2004, can be adopted on a voluntary basis to save effort.

Flexibility does not mean opting out. All seven principles still have to be considered, and your competent authority can ask to see that your procedures are appropriate to your process.

Building and running your plan

A workable HACCP system for a craft producer follows a clear order and then keeps turning over as you make batches.

Describe your products and processes: draw a simple flow diagram from goods-in to dispatch, and confirm it on the floor.
Put prerequisite programmes in place and document them.
Work through the seven principles for each product or product group, keeping CCPs to the genuine few.
Write monitoring, critical limits and corrective actions into everyday batch records so the checks happen where the work happens.
Train everyone who handles food on the parts of the plan that affect them.
Verify and review: calibrate instruments, review records, and reassess whenever a product, recipe or process changes.

Documentation and records

Principle seven is about proof. Records should show that CCP checks were done, that limits were met, and that corrective actions were taken when they were not. They also underpin traceability, which lets you act quickly and narrowly if there is ever a problem with a batch or an ingredient.

Records worth keeping:

CCP monitoring logs (temperatures, times, pH, and similar readings).
Corrective action records tied to the affected batches.
Cleaning, calibration and verification logs.
Supplier and incoming ingredient checks.
Batch and lot traceability, one step back and one step forward.
Training records for food handlers.

The records must be appropriate to your size: enough to demonstrate control, no more. Storing them digitally makes them easier to complete honestly, retrieve on demand and keep for the required period.

How fermt helps

fermt is an EU-hosted ERP and traceability system built for small and micro craft producers, so your HACCP records live alongside the batch and production data you already capture. Instead of a separate binder that drifts out of date, monitoring checks, critical limits and corrective actions attach to the actual batches moving through your process, which is exactly the proportionate, record-keeping approach that 852/2004 and Notice 2016/C 278/01 expect.

Because every ingredient, batch and finished lot is linked, forward and backward traceability is there when an authority, a customer or a recall situation asks for it, without a scramble through paper.

Capture CCP monitoring, critical limits and corrective actions directly on each production batch.
One-step-back, one-step-forward traceability from ingredient lot to finished product.
Batch and production records retained digitally and searchable for audits and inspections.
EU-hosted data, keeping your compliance and GDPR footprint inside the EU.

Start free trial Compliance in fermt

Frequently asked questions

Does a small or micro food business really need HACCP?

Yes. Article 5 of Regulation (EC) No 852/2004 requires all food business operators, other than at the level of primary production, to run procedures based on the HACCP principles, regardless of size. What changes with size is proportionality, not whether the obligation applies: a micro producer can keep documentation light and lean on approved guides, but still has to consider all seven principles.

Do I need HACCP software, or is paper enough?

The law does not mandate software; it requires appropriate, up-to-date records. Paper is legally acceptable, but software makes monitoring easier to complete honestly, keeps records retrievable for inspections, and links checks to specific batches for traceability. For a busy small producer that usually means fewer gaps and less admin than a paper binder.

What is the difference between prerequisite programmes and CCPs?

Prerequisite programmes are the baseline good hygiene and manufacturing practices, such as cleaning, pest control and personal hygiene, that keep the whole environment safe. CCPs are the specific steps where control is critical to a particular hazard, such as a cook or pasteurisation step. Strong prerequisites reduce how many CCPs you need, and in some businesses good hygiene practices can replace CCP monitoring.

What does small-business flexibility actually allow?

Recital 15 of 852/2004 and Commission Notice 2016/C 278/01 allow the HACCP approach to be scaled to the nature and size of your operation: proportionate documentation, use of generic sector guides, and recognition that some businesses cannot identify formal CCPs. It does not let you skip the principles or ignore hazards; your procedures still have to be appropriate and demonstrable.

Which official sources should I rely on?

The primary sources are Regulation (EC) No 852/2004 on EUR-Lex, Commission Notice 2016/C 278/01 on the implementation of food safety management systems covering prerequisite programmes and HACCP-based procedures, and the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), which the seven principles come from. Your national competent authority, such as the FSA in the UK context or your member state equivalent, publishes practical guides built on these.

How often should I review my HACCP plan?

Review it whenever you change a product, recipe, ingredient, process step, equipment or premises, and periodically as part of verification even when nothing changes. HACCP is a living system under 852/2004, so a plan that no longer matches what you do on the floor is not compliant, however good it looked when first written.