Legal requirements for HACCP
Article 5 of Regulation (EC) 852/2004 sets out the legal requirements for the implementation of production processes based on the seven HACCP principles. Each point of Paragraph 2 of Article 5 refers to the corresponding HACCP principle.
Article 5
Hazard analysis and critical control points
- Food business operators shall put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles.
The HACCP principles referred to in paragraph 1 consist of the following:
a) identifying any hazards that must be prevented, eliminated or reduced to acceptable levels;
b) identifying the critical control points at the step or steps at which control is essential to prevent or eliminate a hazard or to reduce it to acceptable levels;
c) establishing critical limits at critical control points which separate acceptability from unacceptability for the prevention, elimination or reduction of identified hazards;
d) establishing and implementing effective monitoring procedures at critical control points;
e) establishing corrective actions when monitoring indicates that a critical control point is not under control;
f) establishing procedures, which shall be carried out regularly, to verify that the measures outlined in subparagraphs (a) to (e) are working effectively;
and
g) establishing documents and records commensurate with the nature and size of the food business to demonstrate the effective application of the measures outlined in subparagraphs (a) to (f).
When any modification is made in the product, process, or any step, food business operators shall review the procedure and make the necessary changes to it.
The below section takes each of these legal provisions in turn and explains how it applies to cell-cultivated products.
1) Food business operators shall put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles.
What this means for cell-cultivated product producers
Food business operators producing cell-cultivated products are producing a foodstuff. As such, the legislation outlined in the table above applies, and a HACCP plan must be in place to control food safety hazards and ensure safe food production. The plan must be built upon the seven principles mentioned above.
Good practice
Decide the HACCP team members. Ideally, this would be a group of people with knowledge of all aspects of the product, production process and food safety among them. For example, knowledge on:
- HACCP principles
- cell sourcing, isolation and proliferation
- harvesting and forming the end product
- storage and distribution
- staff requirements
- financials
Define the scope of the HACCP plan:
- Start and end points of the operation
- Types of hazards (as explained in the next section below)
- Product description – describe the product, its nature and shelf life
- Intended use of the product – describe the expected uses
- Consumers and target groups, including ‘at risk’ groups
- Packaging, storage and distribution – describe how its packaged and the conditions of storage and distribution
- Processing and safety information – provide information such as types of processing (e.g. heating, freezing, drying, smoking), shelf life, instructions for use
Provide a flow diagram of the production process.
This must include:
- All steps of the production process from start to finish
- All inputs, such as culture media, growth factors, packaging
- All outputs, such as waste and by-products
Document the application of all seven HACCP principles.
The HACCP folder must include:
- A list of the HACCP team members
- The scope of the plan
- The flow diagram
- The hazard analysis identifying all hazards in the production
- Control measures for those hazards
- Monitoring procedure and corrective actions
- Validation and verification procedures and records
- Records of review
2) The HACCP principles referred to in paragraph 1 consist of the following:
a) First principle - hazard analysis
Identifying any hazards that must be prevented, eliminated or reduced to acceptable levels (first principle – hazard analysis)
What this means for cell-cultivated product producers
Identify and list all physical, biological, chemical, toxicological and allergenic hazards that may be reasonably expected to occur at each step of the production process. Assess the risk of the hazards, taking into account their likelihood and severity. Record all conclusions reached and the reasoning behind them.
Good practice
The hazards associated with cell-cultivated products production may diverge from the hazards of traditional POAO production. For example, microbial contamination associated with the gastrointestinal tract and faecal contamination will not be considered in the same manner, due to the absence of the processing of live animals.
The main hazards in cell-cultivated products production concern cell line identity (and consistency), hazards introduced during production process (microbiological contamination, growth media and residual components in the final product), and allergens.
Consideration should be given towards the possibility of:
- Introduction of contamination
- Multiplication or survival of pathogens
- The production or persistence of:
- Toxins
- Other undesirable products of microbial metabolism
- Chemicals
- Physical contaminants
- Allergens
- The significance of the hazards
When developing a HACCP plan for cell-cultivated products production, consideration must be given to all of the hazards that may occur at each step of the production process. For cell-cultivated product production, it is anticipated that this will require particular consideration of:
- Introduction of microbial contamination
- Introduction of novel cell lines or cell line divergence
- The production or accumulation of
- Compounds of toxicological importance
- Physical contaminants
- Allergens
- Anti-nutritional factors
Company/industry experience, audit reports, monitoring records, customer complaints may be taken into account at this step.
Explain what control measures are in place. More than one may be needed depending on the hazard; alternatively, one control measure may control multiple hazards.
b) Second principle – critical control points
Identifying the critical control points at the step or steps at which control is essential to prevent or eliminate a hazard or to reduce it to acceptable levels (second principle – critical control points)
What this means for cell-cultivated product producers
Identify and list all the points that are critical to food safety (critical control points) in the production process. Document the reasoning and conclusions behind the selection process, so that information is available for verification, validation and review.
Good practice
It is for the food business operator to decide what the critical control points are.
Decide if control of each significant hazard identified is essential to prevent or eliminate a hazard or reduce it to acceptable levels, and / or meet legal requirements. Each critical control point will need at least one critical limit that will show the hazard is being controlled, as well as monitoring and corrective action procedures to ensure that potentially unsafe food is not placed on the market.
There are various ways of determining critical control points, such as a decision tree.
c) Third principle - critical limits
Establishing critical limits at critical control points which separate acceptability from unacceptability for the prevention, elimination or reduction of identified hazards (third principle – critical limits)
What this means for cell-cultivated product producers
Decide what the critical limit of each critical control point is. The limits must be capable of being monitored. These must be documented appropriately in the HACCP plan.
Good practice
Critical limits are what separate acceptability from unacceptability. They must be at least as strict as the legal requirement that applies for that step of the operation; if one exists.
Limits must be capable of being monitored, measured or observed, so it is clear to staff when the operation is under control or is moving out of control.
Critical limits can be based on legislative requirements or other evidence, such as guides to good manufacturing practice, scientific literature, research or academic studies.
d) Fourth principle - monitoring procedures
Establishing and implementing effective monitoring procedures at critical control points (fourth principle – monitoring procedures)
What this means for cell-cultivated product producers
Set out what the monitoring procedures for each critical control point and document them in the HACCP plan. Explain how the monitoring procedures are completed and who the responsible staff member is for monitoring. Always ensure that a record of all checks is kept.
You must establish:
- How the monitoring of critical limits is carried out
- The frequency of the monitoring checks
- The responsible person
- What is recorded and where
- Who is responsible for checking that the monitoring has been properly carried out and where this is recorded.
Good practice
Monitoring may be as simple or complex as the step requires. It may be just a visual check, or done through the use of specific measuring instruments.
If monitoring is automated, it should be done continuously, with regular checks on the equipment to ensure accuracy.
For non-automated monitoring, it is better to choose a frequency of checks commensurate to your operation.
e) Fifth principle - corrective actions
Establishing corrective actions when monitoring indicates that a critical control point is not under control (fifth principle – corrective actions);
What this means for cell-cultivated product producers
For each critical control point, you must specify the actions which must be taken, when a critical control point found to be outside of the critical limits during the monitoring checks, to bring it back under control. This must be documented in the HACCP plan.
Good practice
You must establish:
- What the corrective action is and how it works on three stages (past, present and future):
- To restore control (past)
- Deal with affected products (present)
- Investigate the root cause to prevent repetition (future)
- Who is responsible for carrying out each corrective action
- What information is recorded, where and by whom
- Who is responsible for checking that the corrective action has been carried out properly and where this is recorded.
If corrective actions have to be taken repeatedly, it means there is a fundamental error with the food safety management system. This should trigger a further investigation to determine probable causes.
f) - Sixth principle - verification and validation
Establishing procedures, which shall be carried out regularly, to verify that the measures outlined in subparagraphs (a) to (e) are working effectively (sixth principle – verification and validation);
What this means
You must validate and verify your HACCP plan and keep records of both.
Good practice
You must establish:
- What the validation and verification checks are and when they are carried out
- Who is responsible for carrying them out
- What is recorded and where
- Who is responsible for checking that validation and verification have been properly carried out and where this is recorded
Validation occurs after creation of the HACCP plan and before implementation for the first time. Its purpose is to ensure the accuracy of the plan and that it is working in practice as it does in theory. This must be repeated every time the HACCP plan is changed. You should check the scope, technical data, flow diagram, hazard analysis, and the effectiveness of control measures in eliminating food safety hazards or controlling them to an acceptable level, and that control point identification, critical / legal limits, monitoring and corrective action plans are appropriate and effective.
To confirm that the operation is safe it may be enough for the FBO to apply relevant legal limits or refer to industry guides to manufacturing or to scientific publications. Where the procedure or product is unusual, it may be necessary to get specialist scientific advice.
Verification occurs after implementation. Its purpose is to ensure that the plan continues to work as intended. Verification checks must be carried out often enough to maintain confidence in the HACCP-based procedures. The frequency of verification will depend on factors such as the nature of the food safety hazards, throughput, monitoring frequency, end-use, the competence of staff, and the number of times critical / legal limits have been breached. Microbiological test results or customer complaints may also trigger verification checks. However, it is advised that as a minimum, verification must occur at least once a year, if there have been no serious issues.
Verification can be both internal and external.
Internal verification checks may include checks that were carried out during validation, as well as more including:
- The documentation, scope, flow, hazard analysis, control measures, critical control points, monitoring procedures, corrective actions
- Hygiene procedures and records, such as cleaning, maintenance and training
- Validation and verification records
- Calibration records for instruments used for monitoring
- Microbiological result and trends
- Customer complaints
- Third party audit reports
Examples of external verification are audits by customers, the competent authorities or third parties, such as assurance bodies.
It may be the case that some checks serve the purpose of both validation and verification. For example, testing for specific microbiological markers.
g) Seventh principle - records
Establishing documents and records commensurate with the nature and size of the food business to demonstrate the effective application of the measures outlined in subparagraphs (a) to (f) (seventh principle – records)
Also relevant to the seventh principle (records) is article 5(4) of Regulation (EC) 852/2004:
4. Food business operators shall:
(a) provide the competent authority with evidence of their compliance with paragraph 1 in the manner that the competent authority requires, taking account of the nature and size of the food business;
(b) ensure that any documents describing the procedures developed in accordance with this Article are up to date at all times;
(c) retain any other documents and records for an appropriate period.
What this means
You must be documenting the entire HACCP-based food safety management system, including the checks and actions. All documents must be signed off by a responsible company official.
Good practice
Example of a food safety management system folder:
- HACCP: Includes the plan(s) and all documentation based on the HACCP principles
- Policy documents: Includes all the prerequisites and Standards Operating Procedures (SOPs) and policies, such as training, instructions and good hygiene policies.
- Records: Includes monitoring results, corrective actions, validation and verification checks, HACCP reviews, microbiological test results, calibration records, customer complaints and audit reports.
Documents and records can be either physical or digital. To ensure all documents and forms which are being used are up to date, an appropriate version control system must be in place.
Regardless of format, all must be kept for a sufficient time to allow for verification of the HACCP plan and for audit purposes.
Paragraph 2, Article 5, Regulation (EC) 852/2004
When any modification is made in the product, process, or any step, food business operators shall review the HACCP procedure and make the necessary changes to it.
What this means
You must review your HACCP every time any change is made or at least once a year where no changes have been made. As per the above requirements, the review must be documented.
Good practice
If there are changes to the HACCP-based system, including any changes to the product, process, or any step, it is necessary to review the HACCP plan to make sure that it is still valid and food safety procedures remain effective. The review may indicate that aspects of the HACCP plan need to be changed, such as the scope, flow diagram, technical data, hazard analysis, control measures, control points, critical limits, monitoring procedure, corrective actions and records.
The HACCP team must be made aware of changes that trigger a review so they can consider how they affect food safety and the HACCP plan. All staff should be made aware of how the changes affect them and be retrained if necessary.
Examples of changes that trigger a review:
- Changes to the source materials used
- Changes to the final product (either its specifications, or intended use)
- Changes to the production process
- Change of the equipment used
- New information regarding a hazard or information about a new hazard
- Changes in relevant legislation
Further obligations – Adequate training
Regulation (EC) 852/2004, Annex II, Chapter XII, point 2
Food Business Operators are to ensure that those responsible for the development and maintenance of the procedure referred to in Article 5(1) of this Regulation or for the operation of relevant guides have received adequate training in the application of the HACCP principles;
What this means
At least one person in the HACCP team must have received adequate training in the application of HACCP principles, to Level 4. Records of this training and qualifications must be kept on file.
Good practice
Apart from the people responsible for developing the HACCP plan, staff responsible for monitoring checks and corrective actions must be trained to better understand the importance of their work in maintaining the HACCP-based procedures.
© Crown copyright 2025
This publication (not including logos) is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
For more information and to view this licence:
- visit the National Archives website
- email psi@nationalarchives.gov.uk
- write to: Information Policy Team, The National Archives, Kew, London, TW9 4DU
For enquiries about this publication, contact Food Standards Scotland or the Food Standards Agency.
Follow us on Twitter: @FSScot, @foodgov
Find us on Facebook: facebook.com/FoodStandardsScotland, facebook.com/FoodStandardsAgency,