HACCP done right: what food safety inspectors actually check — in every market

The inspection you cannot prepare for at the last minute

Food safety inspectors do not send appointment letters. They arrive — in restaurants, hotel kitchens, care-home production facilities, and catering operations — and they ask to see the HACCP documentation immediately. Not next week. Now.

What follows is one of two scenarios. In the first, the kitchen manager opens a tablet or a notebook and navigates to a structured dashboard: temperature logs for the past 30 days, signed-off SOPs, corrective action records, allergen matrices updated with the latest supplier data. The inspector spends 20 minutes reviewing clear evidence. The kitchen passes.

In the second scenario, the manager opens a ring binder, a shared Excel file, and a handwritten temperature notebook. Some entries are missing. One log covers only three of the five critical control points. The SOP binder has not been updated since 2023. The inspection becomes an extended conversation about gaps — and the outcome is now uncertain.

The difference between the two scenarios is not the kitchen’s food safety record. It is whether the evidence exists and is accessible.

This scenario plays out identically in Zürich, Munich, Vienna, Paris, London, Amsterdam, Brussels, and Dubai. The names of the authorities differ. The documentation requirements are functionally the same.

What the law requires — across every major market

The shared foundation is Regulation (EC) No 852/2004 (EU/EEA) and its Codex Alimentarius equivalent (CH, UK post-Brexit, UAE, Singapore). Every professional food operator must:

• Conduct a hazard analysis and identify critical control points (CCPs)
• Establish critical limits for each CCP
• Implement a monitoring system for each CCP
• Define corrective actions when monitoring shows a CCP is not under control
• Keep records demonstrating the above — and make them available to the competent authority on request

The last bullet is where most operators struggle. The analysis was done. The limits were set. The monitoring happened. But the records are incomplete, disorganised, or not linked to the specific control points they are supposed to document.

Here is how each major market’s authority interprets and enforces that requirement:

Switzerland — BLV / cantonal offices The HACCP-based self-control duty is anchored in Art. 78–79 of the Lebensmittel- und Gebrauchsgegenständeverordnung (LGV, SR 817.02), issued under the Lebensmittelgesetz (LMG); the detailed hygiene requirements sit in the Hygieneverordnung EDI (HyV, SR 817.024.1). Cantonal food inspectors (Lebensmittelinspektoren) operate unannounced under the OSAV enforcement framework. Gaps in monitoring records → formal notice (Verfügung) → mandatory re-inspection → in serious cases, temporary operating prohibition.

Germany — BVL + Länder Veterinärämter The written HACCP self-monitoring (Eigenkontrolle) and record-keeping duty applies directly via Article 5 of Regulation (EC) No 852/2004; §4 of the Lebensmittelhygiene-Verordnung (LMHV) adds that easily perishable foods may only be handled by staff with documented hygiene training. Personal liability rests on the Betriebsinhaber — meaning the operator, not just the kitchen manager, is legally accountable for documentation failures. The Allgemeine Verwaltungsvorschrift Rahmen-Überwachung (AVV RÜb) sets the risk-based inspection frequency. Non-compliance findings are recorded by the competent Länder food control authorities — the BVL only compiles aggregated national control statistics; public disclosure of significant individual violations is handled by the Länder themselves under §40 Abs. 1a LFGB.

Austria — AGES / Lebensmittelaufsicht Under the Lebensmittelsicherheits- und Verbraucherschutzgesetz (LMSVG), inspections are carried out by the Lebensmittelaufsicht of the nine Bundesländer under the responsibility of the provincial governors; AGES analyses the samples taken and provides risk assessment, but has no supervisory authority over the Länder inspectorates. Austria has no counterpart to the German LMHV; Regulation (EC) No 852/2004 applies directly, supplemented by the LMSVG and its implementing ordinances. Administrative fines carry fixed statutory ceilings under §90 LMSVG (generally up to EUR 20,000, doubled for repeat offences) rather than scaling with turnover; a documented HACCP gap in a multi-outlet operation can trigger simultaneous inspections of all sites.

France — DGCCRF / DDPP Regulation CE 852/2004 applies directly. In healthcare and collective catering (restauration collective), traceability and allergen obligations flow from EU law and the arrêté of 21 December 2009 on hygiene rules for restauration collective; the GEMRCN guide is a separate, non-binding nutritional recommendation for public catering procurement. DDPP (Direction Départementale de la Protection des Populations) inspectors use a risk-tiered system; a finding of “HACCP plan inexistant ou insuffisant” triggers a mise en demeure, and persistent non-compliance results in administrative closure (fermeture administrative). France publishes inspection outcomes in the Alim’confiance database — visible to consumers and procurement managers.

United Kingdom — FSA / Environmental Health Officers Post-Brexit, Great Britain retains the requirements of Regulation 852/2004 via the Food Safety and Hygiene (England) Regulations 2013 and equivalents. Environmental Health Officers (EHOs) conduct unannounced inspections and score operators on the Food Hygiene Rating Scheme (FHRS), which is publicly displayed on the FSA website and — mandatory in Wales and Northern Ireland, voluntary in England — on the premises; Scotland runs the separate Food Hygiene Information Scheme (FHIS) instead. A rating below 3 triggers media attention and, for institutional food service contractors, contract review. Where ratings fall short, inadequate HACCP procedures are among the most common findings — with documentation gaps leading the list.

Netherlands — NVWA The Warenwetbesluit hygiëne van levensmiddelen implements 852/2004. NVWA (Nederlandse Voedsel- en Warenautoriteit) publishes enforcement actions on its website — a naming-and-shaming approach that gives compliance a direct reputational dimension. In NVWA enforcement practice, insufficient HACCP monitoring records are a recurring finding among inspected food service businesses.

Belgium — AFSCA/FAVV Regulation (EC) No 852/2004, together with the Arrêté royal of 14 November 2003 on autocontrôle, mandates HACCP-based self-checking for all food-chain operators; the Arrêté royal of 13 July 2014 only adds complementary national hygiene rules. AFSCA awards a single, voluntary green smiley to businesses whose certified self-checking system has been validated — valid for three years, with a reduced annual contribution and lower inspection frequency. There are no yellow or red smileys, but AFSCA publishes inspection results online (Foodweb), so compliance gaps remain publicly visible — and, for institutional catering contracts, can prompt a formal compliance review.

UAE — Dubai Food Safety Department (DFSD) / ADAFSA The Dubai Municipality Food Code mandates a documented HACCP-based food safety system for food establishments, and international hotels are in practice expected to maintain ISO 22000 or equivalent certification, typically verified through third-party audits. A-class inspection results are publicly posted by DFSD. Non-compliant hotels face licence suspension — a severe commercial consequence in a market where food safety ratings directly influence tourism-sector licensing.

United States — FDA Food Code / state and local health departments There is no federal restaurant inspector in the US. Inspections are carried out by state, county, and city health departments under their adopted version of the FDA Food Code — a model code, not federal law; the current edition is the 2022 Food Code, as supplemented in 2024, and which edition applies varies by state. Inspectors expect a Person in Charge present at all times who can demonstrate food safety knowledge — generally a Certified Food Protection Manager — and they verify the Food Code’s core controls: cold holding at or below 41°F (5°C), hot holding at or above 135°F (57°C), and date marking of ready-to-eat refrigerated foods. The underlying expectation is HACCP-based active managerial control; a formal written HACCP plan is legally required only for specialized processes such as reduced-oxygen packaging or curing, or where a variance is needed. Outcomes can be very public: New York City has required a letter grade posted at the entrance since 2010, Los Angeles County since 1998. Establishments holding foods on the FDA’s Food Traceability List additionally face the FSMA 204 traceability rule — keeping Key Data Elements including traceability lot codes — with a compliance date of July 20, 2028.

The five things inspectors look at most closely

Across all markets, documentation gaps that most frequently lead to findings cluster in five areas:

1. Temperature monitoring completeness. Are all refrigeration units, blast chillers, and hot-holding equipment logged? No missing dates, no unexplained gaps. A single week of missing entries in a 90-day log is enough to raise questions in every jurisdiction.

2. Corrective action records. When a temperature deviation was found, what happened? An undocumented correction is, from a compliance standpoint in every market, a correction that did not happen. The FSA in the UK, the BVL in Germany, and the DFSD in Dubai all look for the same thing: the corrective action linked to the original deviation, with a named employee and a timestamp.

3. Allergen information chain. Is there a documented path from ingredient supplier to recipe to guest communication? Since Natasha’s Law (UK, October 2021), this chain must be demonstrable for prepacked-for-direct-sale items. In Germany and Switzerland, the same chain must be demonstrable behind every oral allergen answer given by service staff; in France, oral communication alone is not enough — allergen information for non-prepacked food must be provided in writing under décret n° 2015-447.

4. SOP currency and staff sign-off. Are standard operating procedures up to date? Have staff signed off on current versions? Across every market, an SOP that predates the last major allergen regulation update — the UK PPDS rules, Germany’s LMIV implementation, or France’s LIV equivalents — is a gap, not evidence of compliance.

5. Receiving inspection records. Goods receipt is a critical control point. Temperature readings at receipt, lot numbers, and supplier specifications should be systematically captured. In Germany, receipt temperature documentation follows from the operator’s own HACCP obligations under Article 5 of Regulation (EC) No 852/2004 — the AVV RÜb only governs how the authorities plan and perform official controls.

Where paper systems fail the compliance test

A paper-based HACCP system can be fully compliant — but it requires discipline that is difficult to maintain in a real kitchen environment. The failure modes are identical across markets:

Retrospective entries. Temperature logs get filled in at end of shift rather than at the monitoring moment. The data exists, but the integrity of real-time monitoring — what every framework requires — is undermined.

Incomplete coverage. Manual systems tend to cover the units the person doing the log happens to pass. A blast chiller in an annex, or a reach-in in the pastry section, may be systematically under-monitored.

Version drift. An allergen SOP updated in response to a supplier change or regulatory update does not automatically reach all staff. The updated version lives in the manager’s email. The version in the binder is 18 months old.

No linkage between control points and records. Temperature logs exist. The HACCP plan identifies the correct storage temperature for fresh fish as that of melting ice — in practice 0–2°C. But the log does not specify which CCP it corresponds to, and the inspector — in any jurisdiction — has to reconstruct the link manually.

What a digital HACCP system changes

A purpose-built compliance system restructures the evidence problem at its root:

Monitoring is embedded in daily workflows. Staff log temperatures, receiving checks, and cleaning sign-offs as they work — on a tablet, at the relevant station, at the relevant moment. The log entry is timestamped to the minute. Retrospective data entry is either impossible or flagged.

Non-conformities trigger automatic corrective action flows. When a temperature reading exceeds the critical limit, the system opens a corrective action record. Every step is attributed, timestamped, and linked to the original monitoring entry. This satisfies the corrective action documentation requirement across all markets simultaneously.

SOPs are versioned and linked to staff sign-off. When an allergen procedure changes, the system notifies every assigned staff member. Re-signature is required before their next shift. The inspector can see, for any given date, exactly who had signed which version of which procedure — satisfying the staff training and instruction requirement of Regulation (EC) No 852/2004 (Annex II, Chapter XII) while evidencing the allergen-information duties under EU 1169/2011, UK PPDS, Germany’s LMIDV, and Switzerland’s LIV at the same time.

The inspector dossier exports in minutes. All current SOPs with version history, all monitoring logs for a requested period, all corrective action records, staff training sign-off status. What used to take hours to assemble takes minutes — and the same underlying data satisfies the documentation request from a Swiss cantonal inspector, a French DDPP agent, a UK EHO, and a Dubai DFSD auditor.

The commercial argument

The cost of an unfavourable inspection is not just the administrative follow-up. Across every market, the risks compound:

• Public records (UK FHRS, France Alim’confiance, Netherlands NVWA publications, Belgium’s AFSCA Foodweb) mean compliance gaps are visible to consumers, procurement managers, and institutional contract holders.
• Group hotel brands conduct internal audits against standards that exceed local law. A regional VP who sees incomplete HACCP documentation will not wait for the local inspector to act.
• Civil liability in allergen incidents is not capped by any jurisdiction covered above. A guest hospitalised by an undisclosed allergen creates exposure under Swiss OR Art. 55, German BGB §823, French Code civil Art. 1242, and UK tort law simultaneously if the hotel has operations in multiple markets.

For a care home serving 850 meals a day, a hotel with 300 covers, or a catering operation under institutional contract, a clean compliance record is not a regulatory formality. In every market above, it is a commercial prerequisite.

---

Want to see what a digital HACCP dossier looks like — one that works for inspectors in any of these markets? Book a 15-minute call: Schedule here.