EU regulation · Food safety
Sightadel guides you through the preliminary steps and the seven principles of HACCP – with industry templates drawn from many years of consulting practice, drafting help and real consultants when a hazard analysis gets tricky.
Only at Sightadel
Among the GRC platforms we compared on 10 October 2026, only Sightadel lists HACCP as a framework. You run your HACCP plan, ISO 9001 and, if needed, ISO 27001 in one system with the same evidence.
Basis: public information on the vendors’ websites as of 10 October 2026.
What it is about
HACCP stands for Hazard Analysis and Critical Control Points. It is a method by which a business identifies the hazards to food safety in its processes and controls them at the decisive points – biological, chemical, physical and allergens. It works preventively: errors should not arise in the first place, rather than being sorted out at the end.
In the EU, a procedure based on the HACCP principles is mandatory for food business operators after primary production. This is laid down in Article 5 of Regulation (EC) No 852/2004. Since 2021, the regulation has also required a food safety culture and allergen management. How extensive the plan must be depends on the type and size of the business. Small businesses may use a simplified approach.
At its core are seven principles: analyse hazards, determine critical control points, establish critical limits, monitor, provide for corrective actions, verify the system and document everything. Before them come the preliminary steps – HACCP team, product description, intended use, flow diagram and its on-site confirmation. Beneath them lie the prerequisite programmes such as cleaning, pest control and personal hygiene. A plan rarely fails because of the analysis, but because it is no longer adapted once it has been drawn up.
The recipe has changed, a line has been added, the plan is ancient history. Sightadel guides you through the preliminary steps and the seven principles and shows where you need to catch up.
Temperature logs on paper, cleaning schedules in Excel, training in people's heads. When the inspection comes, everyone searches. In Sightadel, every piece of evidence sits with the requirement it proves, with an expiry date.
A retail customer requires IFS, BRCGS or FSSC 22000. All of them build on HACCP. If you maintain your plan properly, you have already evidenced the basis for the audit.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
A competent HACCP team, product description and intended use, and a flow diagram of all process steps, confirmed on site.
In SightadelGuiding questions lead you through the preliminary steps. The industry template suggests typical process steps; you confirm or adapt them and upload the flow diagram.
Cleaning and disinfection, pest control, personal hygiene, water, maintenance and supplier selection are defined and evidenced.
In SightadelEach programme as a recurring cycle with an owner and evidence. Suppliers are assessed in the Vendors module.
For every process step, possible hazards are identified, assessed and assigned control measures.
In SightadelGuided analysis, step by step. The template names typical hazards in your industry; you make the assessment – Sightadel marks these points.
The points at which a hazard must be controlled are determined and given measurable critical limits.
In SightadelCCP register with critical limit, justification and link to the hazard. Anyone wanting to understand why a step is not a CCP will find the justification.
For each critical control point, it is defined what is monitored, how often and by whom.
In SightadelMonitoring plans as cycles with an owner. The records from your measuring systems or logs are filed as evidence.
For every deviation from the critical limit, it is defined in advance what happens to the product and the process.
In SightadelDeviations are recorded as issues and turned into action plans with a deadline. The activity log shows who decided what and when.
It is checked regularly whether the plan is effective, and it is reviewed whenever the product or process changes.
In SightadelVerification as a scheduled date with a checklist. Reminders before the review is due.
Plan, decisions and records are complete, up to date and available for inspection.
In SightadelEverything in the evidence archive with version, approval and expiry date. For an inspection, the current status is compiled in a few clicks.
Management promotes a food safety culture that is actually lived. Allergens are controlled in storage, production and labelling.
In SightadelTraining as recurring cycles with evidence. Allergens are asked about separately in the hazard analysis.
Process
One to three months for a small to medium-sized business, if someone really drives it. Several sites or many product groups take longer.
Appoint the HACCP team, describe products and intended use, draw up the flow diagram and check it on site.
Record cleaning, pest control, personal hygiene, maintenance and suppliers. Upload and assign existing plans.
Check and assess every process step for hazards. Only then can critical control points be determined sensibly.
Define critical control points, justify critical limits, describe monitoring and corrective actions.
Train staff, start keeping records in daily operations, handle the first deviations.
Check whether the plan works in practice. After that, as an annual cycle and whenever the product or process changes.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
A purchased plan rarely fits your own processes and is exposed at the first question. Use templates as a starting point, but check every step against your business.
Shortcuts, intermediate storage and rework are often missing from the diagram. Walk through the process on site and confirm the diagram with a date.
If every step becomes a CCP, monitoring loses its focus. Assign hazards controlled by basic hygiene to the prerequisite programmes and give your reasons.
A critical limit without a technical source cannot be defended. Record what it is based on, such as legislation, a guide, manufacturer specifications or validation.
If a product is held back when a limit is exceeded but nothing is written down, the evidence is missing. Record every deviation with the decision, what happened to the product and the cause.
New recipe, new equipment, new supplier – and the plan stays the same. Define which changes trigger a review, and also plan an annual verification.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Supplier evaluation, training records, document control and corrective actions are maintained once and count towards both systems.
GDPRStaff training and health records are personal data. Access and retention must also comply with data protection law.
ISO 27001Where monitoring is digital – temperature sensors, recipes, control systems – access rules and backups from the ISMS help keep the records reliable.
Audit and evidence
HACCP itself is not a certifiable standard. Whether your plan holds up is checked by the official food control authorities during their on-site inspections, unannounced and on the basis of your records. Retail customers also often require an audit to IFS, BRCGS or FSSC 22000 by a certification body – all of which presuppose a working HACCP plan.
Sightadel does not certify and does not replace an inspection. It ensures that the current status with all evidence is ready at any time. External auditors get their own access and can never delete anything. For audits to retail standards, you choose a body from our independent partner network or one of your choice, with no commission to us or the partners.
To the independent auditor networkThe obligation to have a HACCP-based procedure is set out in Article 5 of Regulation (EC) No 852/2004 on the hygiene of foodstuffs. The general hygiene requirements for premises, equipment, staff, water and waste are in its Annex II. The amendment by Regulation (EU) 2021/382 added two topics there: allergen management, for example for equipment, transport and storage, and food safety culture as a chapter of its own. In Germany, the Food Hygiene Ordinance (LMHV) and the Food and Feed Code (LFGB) supplement the EU requirements.
The regulation does not demand an off-the-shelf plan. Scope and form depend on the type and size of the business. The European Commission has explained in a notice how this flexibility is to be understood: small businesses with simple processes can rely largely on good hygiene practice, use sector guides and keep documentation brief. Anyone who heats, cools, fills or produces for vulnerable groups needs a more detailed analysis.
Technically, authorities and businesses follow the General Principles of Food Hygiene of the Codex Alimentarius, revised in 2020. They distinguish more clearly between good hygiene practice as the basis and the HACCP principles for the points that need special attention. For many sectors there are also national guides to good hygiene practice that can serve as a starting point. Sightadel does not replace these guides, but takes you through the points in a structured way and records decisions and evidence.
The Sightadel licence for HACCP is charged monthly per edition, with discounts for multiple frameworks and advance payment. You can find all prices and a calculator on our pricing page. You can try it free for 14 days without payment details.
The real effort lies in the business. Drawing up a plan needs people who really know the processes: production or kitchen, quality, purchasing, engineering. In a small business, that is often two or three people over a few weeks, with the focus on the flow diagram and hazard analysis. After that, there is ongoing effort for measurements, records, cleaning evidence, training and the annual verification.
External costs may arise for laboratory analyses, pest control, maintenance of measuring equipment and, where applicable, an audit to a retail standard. These are invoiced by the respective providers themselves. If a hazard analysis gets tricky, for example with new products or processes, you can book expert consulting as a package in the app.
Food control authorities at district and city level carry out risk-based inspections. How often a business is visited depends on the type of food, the processes and the results of previous inspections. Inspections are usually unannounced. Premises, hygiene, temperatures and processes are checked on site, and documents are requested: hazard analysis, critical control points with critical limits, monitoring records, corrective actions, cleaning and pest control records, training records and statutory hygiene instructions.
Missing or incomplete own checks can lead to orders, follow-up inspections, fines and, in serious cases, closure. Under the Food and Feed Code (LFGB), the authorities can also publish certain breaches. If unsafe food is placed on the market, withdrawal or recall and criminal law questions come into play.
Conversely, a properly maintained plan is your best evidence of due diligence. If you can show that critical limits were monitored, deviations detected and corrections made, you are in a much better position after an incident. The legal assessment of an individual case is a matter for your legal adviser; Sightadel does not provide legal advice.
In practice, it helps to keep the documents ready so that they can be found during an unannounced inspection even without the person responsible. In Sightadel, the current status is compiled in a few clicks, also for the deputy.
The hazard analysis is the heart of the plan and at the same time its most common weak point. It starts with a complete flow diagram from goods receipt to dispatch, including rework, intermediate storage and cleaning steps. The diagram is checked on site, because the shortcuts that are taken in everyday work are often exactly what is missing on paper.
For each step, possible hazards are recorded: biological ones such as microbial growth or survival of pathogens, chemical ones such as cleaning agent residues, physical ones such as glass, metal or plastic, and allergens through cross-contact. Each hazard is assessed by likelihood and severity. Only from this does it follow which hazards must be controlled at this step.
Then comes the decision as to whether a step is a critical control point or whether the hazard is sufficiently controlled by the prerequisite programmes. Many businesses use a decision tree for this. What matters is that the justification is recorded, even if the answer is “not a CCP”. This is exactly what inspectors and auditors ask about.
In Sightadel, the analysis is guided step by step. The template suggests typical hazards in your industry; you make the assessment and decision. Every justification remains traceable with date and editor.
Since the 2021 amendment, the management of a food business must establish, maintain and be able to demonstrate an appropriate food safety culture. This means that safety is not just written in documents but takes priority in everyday work. It includes clear responsibilities, sufficient resources, regular training, open communication about problems and a management that leads by example. Scope and form depend on the type and size of the business.
Culture cannot be evidenced with a single document. Proven approaches include training records, minutes of team meetings, a procedure through which staff can report problems without repercussions, analysed deviations, and objectives that management sets and reviews. Some businesses also carry out short surveys.
Allergen management is about cross-contact in storage, production and transport, and about correct labelling. Typical measures are separate storage locations, cleaning steps between products, production sequences and label checks when recipes change. In Sightadel, allergens are asked about separately in the hazard analysis, and training runs as recurring cycles with evidence.
A HACCP plan is only as good as its last review. The regulation requires it to be reviewed and adapted whenever there is a change to the product, process or any production step. New recipes, a new supplier, a new piece of equipment or changed opening hours can be enough. Regardless of this, an annual verification is advisable.
Verification includes reviewing monitoring records, analysing deviations and complaints, laboratory testing of products or surfaces, calibrating measuring equipment and internal walk-throughs. The result is documented, and changes are incorporated into the plan.
In everyday operations, many businesses fail less because of the plan than because of the records. Logs are kept with gaps, thermometers are not checked, training is forgotten. In Sightadel, monitoring, cleaning, calibration, training and verification are set up as cycles with an owner and a due date. If a piece of evidence expires, it appears on the dashboard before the inspector asks for it. Sightadel is not a measuring system; you file your records from sensors or logs as evidence.
If you are also audited to IFS, BRCGS or FSSC 22000, you use the same evidence. External auditors get their own access in Sightadel, see plan, decisions and records in one place and can comment, but never delete.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
HACCP stands for Hazard Analysis and Critical Control Points. It is a method by which a business identifies the hazards to food safety in its processes and controls them at the decisive points – biological, chemical, physical and allergens.
Yes, for food business operators in the EU after primary production. The obligation arises from Article 5 of Regulation (EC) No 852/2004. Scope and form depend on the type and size of the business. Small businesses may take a simplified approach, but it cannot be dropped altogether.
None is provided for by law. Private marks exist, but they replace neither official food controls nor a retail standard. In practice, IFS, BRCGS or FSSC 22000 are in demand, all of which presuppose HACCP.
HACCP is a method for controlling hazards. ISO 22000 builds a complete management system on it, with leadership, internal audit and management review, and is certifiable. If you have a sound HACCP plan, you already have the technical core.
Yes, to an extent that suits the business. Hazard analysis, critical control points with critical limits, monitoring, corrections and verification must be traceable for the inspection. A folder full of forms that nobody fills in does not help.
Then the corrective action defined in advance applies: hold the product, assess it, correct the process, clarify the cause. What matters is that this is recorded. In Sightadel, the deviation becomes an issue with an owner and a deadline.
No. Sightadel is not a measuring system. You file your records from sensors, logs or scales as evidence. Sightadel ensures that they are complete, assigned and renewed on time.
The licence is charged per framework and edition; you can find all prices and a calculator on our pricing page. You can try it free for 14 days without payment details, and your work is kept when you move to a paid plan.
No. Sightadel helps you build the system and keep the evidence. For specific questions of food law, your food control authority or a qualified consultant is the right place to go.
Yes, snack bars, cafés and restaurants must also have a procedure based on the HACCP principles. However, the regulation allows a simplified approach: if your processes are simple, you rely largely on good hygiene practice and sector guides and keep documentation brief. Critical points such as cooling, heating and hot holding still need monitoring and records.
The EU regulation does not set a uniform period. Retention depends on the type of food and its shelf life, on the requirements of the competent authority and, where applicable, on retail standards. Keep records at least long enough to be able to prove what happened beyond the shelf life of the products. If in doubt, ask your food control authority.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
