Food Safety

HACCP for Small Bakeries: A Practical Guide

By Robert Roessler, Food Scientist · Published 14 November 2026

Bread and cakes are not usually seen as dangerous foods, but a bakery still handles raw flour, eggs, nuts, allergens and, often, fillings that spoil. HACCP is the method that turns these risks into a short, written routine. This guide explains it step by step for a small bakery and says where the rules in the United States and the United Kingdom differ. Every statement about rules names its source.

1. What HACCP is

HACCP stands for Hazard Analysis and Critical Control Points. The U.S. Food and Drug Administration describes it as a systematic approach to identifying, evaluating and controlling food safety hazards, built on seven principles (FDA). The idea is prevention: you look at your own process, find the steps where a hazard could reach the customer, and control those steps and prove that you did.

Hazards fall into three groups: biological (bacteria, mould), chemical (cleaning agents, allergens) and physical (metal, glass, wood). A bakery will usually have all three.

2. Which rules apply to you

United States

Two systems exist side by side, and they are easy to mix up. Classic HACCP plans are mandatory for some product categories, such as seafood and juice, and the FDA recommends the same principles for retail and food service on a voluntary basis (FDA Food Code, Annex 5). Bakeries that manufacture food are covered by the Food Safety Modernization Act (FSMA) rule on preventive controls for human food. It requires a written food safety plan with a hazard analysis and risk-based preventive controls (FDA). The plan must be prepared, or its preparation overseen, by a qualified individual who has the training or experience, and it must be reassessed at least every three years or sooner if problems occur (New York State Department of Agriculture and Markets).

Small businesses may qualify for modified requirements as a "qualified facility", which is tied to annual sales; one industry fact sheet names a limit of 1 million dollars in annual sales of human food (Almond Board of California). Such a facility is exempt from the hazard analysis and risk-based preventive controls requirements (National Sustainable Agriculture Coalition), but it still has to identify and control the hazards of its food, and it files an attestation with the FDA (Minnesota Department of Agriculture). The exact sales limit is adjusted for inflation, so check the current value with the FDA. A retail bakery is normally supervised by the state or local health department, so ask them what they expect in writing.

United Kingdom

Every food business must have a documented food safety management system based on HACCP principles (Hartlepool Borough Council). For small caterers and retailers, the Food Standards Agency offers the Safer Food, Better Business pack. Manufacturers usually need a fuller HACCP plan instead (Cherwell District Council). The FSA also provides a free online tool, MyHACCP, which produces the documents for you (Food Standards Agency). Your local food safety team can tell you which type your business needs (GOV.UK).

3. Start with the basics before you look for critical control points

A HACCP plan sits on top of good manufacturing practice and other prerequisite programs. The FDA's preventive controls rule treats these as part of the food safety system (New York State Department of Agriculture and Markets). In a bakery this means, at a minimum:

• Cleaning and sanitation with a written schedule and a record that it was done.
• Personal hygiene and handwashing rules for everyone who handles food.
• Pest control and tidy storage of flour, seeds and nuts.
• Supplier approval: know who delivers your ingredients and what they say about foreign material and allergens.
• Allergen management: separate storage, labelled containers and a cleaning routine between products. Undeclared allergens are reported as the most common reason for recalls in the bakery (Food Safety Magazine).
• Traceability: be able to say which ingredient lots went into which batch.

4. The seven principles in a bakery

The seven principles are the same everywhere (FDA). Here is what each one means in practice.

1. Conduct a hazard analysis. Write down your process from receiving to dispatch and list the hazards at each step. Note which ones are likely and serious enough to need control.
2. Determine the critical control points (CCPs). A CCP is a step where control is essential. Keep the list short. A trade magazine article on bakery HACCP points out that mixing times and oven temperatures matter for quality but usually do not count as CCPs, because they do not directly affect health, and that too many CCPs make a plan hard to use (Institute of Food Technologists). Other sources use the final internal temperature after baking as an example CCP for some products (BAKERpedia). Which is right for you depends on your hazard analysis, so decide it product by product.
3. Set critical limits. A limit is a measurable value, such as a temperature or a time. Take it from your regulator's guidance or the FDA Food Code, and do not invent it.
4. Monitor. Say who measures what, how, and how often.
5. Corrective actions. Decide in advance what happens when a limit is missed: what happens to the product, and how you fix the cause.
6. Verification. Check that the system works: calibrate thermometers, review records, and test whether the controls really do their job.
7. Records and documentation. Keep the plan, the monitoring records and the corrective action records where you can show them.

5. Typical hazards in a bakery

The table lists hazards that bakery sources commonly name. Your own analysis may add or drop items.

6. Worked example: a cream-filled pastry

This example shows how the steps fit together. It is simplified and does not replace your own analysis.

• Hazard: bacteria growing in the cream filling while it waits at room temperature.
• Control point: cooling and cold storage of the filled product.
• Critical limit: the temperature and time that your health department or the FDA Food Code gives for such foods. Write the value into your plan from that source.
• Monitoring: the person on shift measures the product temperature with a calibrated thermometer at set times and writes the result on a log sheet.
• Corrective action: if the limit is missed, the product is held, assessed according to your written rule, and discarded if it cannot be shown to be safe. The cause, such as an overloaded cooler, is fixed.
• Verification: the manager checks the log every week and tests the thermometer on a schedule.

7. Keep it alive

A plan in a drawer does not protect anyone. Update it when you add a product, change a recipe or scale up production (BAKERpedia). In the United States, a plan under the preventive controls rule must be reassessed at least every three years (New York State Department of Agriculture and Markets). Train every employee on the parts that concern them, and keep the records short enough that people actually fill them in.

8. A short checklist to start

1. Ask your local health department or food safety team which system applies to you.
2. Draw the process flow of your most risky product first, usually one with a filling.
3. List the hazards for each step and decide which need a control.
4. Write the limits, monitoring and corrective actions on one page per CCP.
5. Set up simple log sheets and train your team.
6. Review after the first month and then at fixed intervals.

Summary

HACCP is a way of thinking before it is a document: find where your products can become unsafe, control those steps, and keep proof. Start with good hygiene and allergen routines, keep the list of critical control points short, take critical limits from your authority, and review the plan whenever your products change.

Sources

• U.S. Food and Drug Administration: HACCP Principles & Application Guidelines
• U.S. Food and Drug Administration: HACCP guidelines (seven principles)
• FDA Food Code, Annex 5 (archived copy)
• FDA: FSMA Final Rule for Preventive Controls for Human Food
• New York State Department of Agriculture and Markets: Preventive Controls for Human Food Rule (presentation)
• Almond Board of California: Facility compliance fact sheet
• National Sustainable Agriculture Coalition: Is my operation a qualified facility?
• Minnesota Department of Agriculture: Qualified Facility Guidance
• UK Food Standards Agency: HACCP
• GOV.UK: Creating a food safety management system
• Hartlepool Borough Council: Food safety management systems
• Cherwell District Council: Food safety management system
• Institute of Food Technologists: Implementing HACCP plans in bakeries
• BAKERpedia: Why your bakery needs a HACCP plan
• BAKERpedia: HACCP plan for bakeries (white paper)
• Food Safety Magazine: Handling food safety risks in a retail bakery
• FoodReady: Bakery HACCP plan guidance

Information current as of 14 November 2026. This guide is general information and does not replace advice from your local health department, your food safety authority or a qualified food safety professional.