HACCP as a Legal Obligation 2026: Who Must Have It, What It Means in Practice

Yes, HACCP is mandatory. Not "recommended", not "nice to have" - mandatory by law. It applies to every entity that produces, processes or serves food in Poland. Restaurant, bar, cafe, bakery, catering, food truck - no exceptions. This obligation flows from EU law (Regulation (EC) No 852/2004) and the Polish Food Safety Act. In this article I explain exactly who it covers, what specifically you must implement, and what happens if you have no HACCP system in 2026.

Key points

• HACCP is mandatory for every entity active in the food market in Poland, regardless of venue size.
• Legal basis is Regulation (EC) No 852/2004 of the European Parliament and the Polish Food Safety Act of 25 August 2006.
• HACCP implementation means not only having documents, but actually applying the system in daily kitchen work.
• Penalties for missing HACCP include fines up to 500 PLN on the spot, administrative penalties up to tens of thousands of PLN, and in extreme cases, closing the venue.
• The only exception covers primary production (e.g. selling farm produce without processing), but even then GHP applies.

Who must have HACCP: full list of entities

Regulation (EC) No 852/2004 defines this very broadly: HACCP obligation covers all food business operators running any stage of food production, processing or distribution. In practice this means:

• restaurants and bars (regardless of size),
• cafes, patisseries and bakeries,
• catering companies and food delivery operators,
• food trucks and mobile foodservice,
• school, hospital and workplace canteens,
• hotels with foodservice,
• stores with culinary departments (ready meals, salads),
• food production plants,
• food wholesalers and warehouses.

It does not matter whether you have one point of sale or a chain. It does not matter whether you employ 2 or 50 people. The obligation is the same. What differs is the scale of the system - a small venue can (and should) have a simpler system than a large factory. That is an important distinction, because many owners think "simple" means "not needed". No - it means "matched to scale".

Legal basis: what the regulations actually say

HACCP obligation in Poland rests on two pillars:

1. EU law: Regulation (EC) No 852/2004

This is the regulation of the European Parliament and Council of 29 April 2004 on the hygiene of foodstuffs. Article 5 says directly: food business operators must establish, implement and maintain a permanent procedure based on HACCP principles. The regulation has direct application in every EU member state, so Poland does not need to "implement" it separately - it is already in force.

Regulation 852/2004 requires applying the seven HACCP principles, aligned with the Codex Alimentarius:

1. Hazard identification and risk analysis.
2. Setting Critical Control Points (CCP).
3. Establishing critical limits for each CCP.
4. Developing CCP monitoring procedures.
5. Defining corrective actions.
6. Establishing verification procedures.
7. Keeping documentation and records.

2. Polish law: the Food Safety Act

The act of 25 August 2006 (with later amendments) places on food business operators the obligation to implement an HACCP system. Article 59 specifies that these operators are required to develop, implement and apply procedures based on HACCP principles. The act also gives sanitary inspectors specific tools to enforce this obligation, from fines to closure decisions.

Note that regulations do not require HACCP certification by an external company. A certificate (e.g. ISO 22000) is voluntary. But the system implementation itself - hazard analysis, setting CCPs, keeping records - is mandatory.

What "HACCP implementation" actually means

This is the question many venue owners ask themselves. "I have documents in a folder - does that mean I have HACCP?". The answer is: not necessarily. The sanitary inspector does not just check whether you have paper. They check whether the system works in practice.

HACCP implementation covers several things together:

Documentation - you must have the system described. This covers the venue description, hazard analysis, defined CCPs, monitoring procedures, corrective actions, and verification procedures. It does not have to be 200 pages. For a small venue, a dozen-plus pages is enough, if they are specific and reflect what you actually do.

GHP/GMP procedures - HACCP does not work in a vacuum. It must stand on the foundation of Good Hygiene Practice (GHP) and Good Manufacturing Practice (GMP). Without procedures for cleaning, disinfection, personal hygiene and goods receipt, your HACCP is incomplete.

Records - kept up to date. Fridge temperatures, goods receipt, cleaning and disinfection. The inspector does not want to see empty rows or entries filled in the day before inspection (it shows).

Trained team - every employee must know what they do and why. HACCP training is mandatory and should be documented. It does not have to be a formal academy - a short internal session with a participation record is enough.

Verification - the system must be regularly checked and updated. Changed the menu? Added delivery? Changed the supplier? All of these require a review and possible documentation update.

At GastroReady, based on experience with over 500 venues, we see a repeating pattern: owners who treat HACCP as a living system (not a one-off purchase) have significantly fewer problems during inspections.

Exceptions: who HACCP does not cover

There is exactly one exception in the regulations: primary production. Under Regulation 852/2004, primary production is activity at the primary stage, such as:

• crop farming,
• animal husbandry,
• picking mushrooms, forest fruit,
• hunting and fishing.

If a farmer sells apples straight from the orchard, they do not need HACCP. But note - even primary production is subject to GHP requirements. Hygiene obligations apply to everyone.

However, if the same farmer starts making jam from those apples and selling it, that is already food processing and HACCP becomes mandatory.

For foodservice, this exception is practically irrelevant. If you serve food to customers in any form, HACCP applies. There is no "too small a venue", "too small a turnover" or "too simple a menu". The regulations do not provide such exemptions.

Penalties for missing HACCP: what can happen in 2026

The consequences of missing an HACCP system have several levels. The sanitary inspector has broad powers and picks the tool to match the scale of the problem:

Caution - for minor irregularities, especially when the inspector sees the system exists but needs correction. The lightest form, but it is recorded in the protocol.

On-the-spot fine - up to 500 PLN per single breach, issued on site. The inspector may issue several fines at once for different irregularities. Missing HACCP documentation, missing temperature records, missing staff training - each is a separate fine.

Administrative penalty - imposed by an administrative decision. Amounts can reach several, and with repeated breaches, tens of thousands of PLN. The decision goes into your venue's case file, meaning the inspector sees a history of breaches at the next inspection.

Order to remedy irregularities - the inspector sets a deadline by which you must implement the system or fix breaches. If you miss the deadline, penalties grow.

Activity suspension or venue closure - in case of serious public health risk, the inspector may order immediate closure. This is not a theoretical threat - it is a real power that inspectors use.

It is also worth remembering indirect costs: lost reputation, negative reviews, stress around a follow-up inspection, time and money for an "implementation yesterday".

Common HACCP implementation mistakes to avoid

HACCP obligation is clear, but how to deliver it is sometimes a problem. Here are the most common mistakes we see at foodservice owners, and which inspectors catch.

"From the internet" documentation without adaptation

Downloading a ready HACCP template and dropping it into a folder is one of the most common and worst mistakes. The inspector compares the documentation with what they see in the kitchen. If your document describes three cold rooms and you have one, or lists processes you do not run (e.g. smoking, vacuum packing), that is a clear signal the documentation is not yours. Such a system does not protect you at inspection and does not protect your guests.

HACCP without GHP

An HACCP system does not work in a vacuum. It needs a foundation of GHP (Good Hygiene Practice) and GMP (Good Manufacturing Practice) procedures. Many owners focus on hazard analysis and CCPs, skipping the basics: cleaning procedures, personnel hygiene, goods receipt, pest control. The inspector checks both. Without GHP, your HACCP is like a house without foundations.

Records kept "for show"

Temperature records, cleaning, goods receipt - these must be living documents. Filling them in bulk the day before an inspection is visible: uniform handwriting, identical times, no natural variation. The inspector knows what a properly kept register looks like and can tell fiction from fact. Better to have occasional gaps with explanation than a perfect but fake register.

No update after changes

Changed the menu? Added a new supplier? Started delivering food? Each of these requires an HACCP documentation review. A document describing a menu from two years ago is not current and the inspector will notice. The HACCP system must evolve with your venue.

How an HACCP inspection looks in practice

Many owners fear inspections because they do not know what to expect. In reality, the sanitary inspector checks HACCP in a fairly predictable way.

Documentation on the desk

The inspector starts by reviewing documentation: HACCP plan, hazard analysis, defined CCPs, GHP/GMP procedures. Checks whether documents are dated, signed, and matched to venue specifics. It does not have to be a thick folder. It has to be logical, complete and current.

Records: spot check

Next the inspector reviews records from recent weeks. Looks at temperatures, entry frequency, response to deviations. If a record entry says "fridge temperature 8 degrees Celsius" with a note "products moved to fridge no. 2, service called", that is proof the system works. If it says 8 degrees and nothing more, the inspector will ask: what did you do?

Questions to staff

The inspector often talks to employees. Asks the cook: "what do you do when the fridge temperature is too high?". Asks the waiter: "does this dish contain gluten?". Staff answers are a test of whether training was real, not just logged.

Kitchen walk

At the end (or the start), the inspector walks through the kitchen. Checks zone separation, equipment condition, cleanliness, chemical storage, product labelling. Compares what they see with what is in the documentation. Consistency between paper and reality is the key.

Frequently asked questions

Does a small foodservice venue also need HACCP?

Yes, no exceptions. Regulation 852/2004 and the Polish Food Safety Act apply to every entity producing or serving food, regardless of size. A small venue has the right (and should) implement a simplified version of HACCP matched to its scale, but the obligation itself is identical to that of a large restaurant.

Do I need an HACCP certificate?

An HACCP certificate (e.g. as part of ISO 22000 or from certifying firms) is not required by law. What the law requires is actual implementation and use of a system based on HACCP principles. A certificate may be a marketing asset or a partner requirement (e.g. retail chain), but from the sanitary inspector's perspective what matters is whether the system works, not whether you have a diploma on the wall.

Can I implement HACCP myself, or must I hire an external firm?

Regulations do not require using an external firm. You can implement the system yourself, provided you know HACCP principles and can apply them to your venue. In practice, many venues use ready documentation templates adapted to their conditions. GastroReady packages (from 299 PLN) were designed exactly for self-implementation: they contain complete documentation, records and step-by-step instructions. Over 500 venues have implemented the system this way.

How often must HACCP documentation be updated?

There is no strict deadline in the regulations. The rule is simple: you update when something changes in your process. New menu, new supplier, kitchen equipment change, adding delivery, location change - all of these require a review. Good practice is also an annual system review, even if nothing has changed, to make sure documentation still matches reality.

Does HACCP apply to a food truck?

Yes. A food truck is treated as a mobile foodservice unit and falls under the same regulations as a stationary restaurant. You must have an implemented HACCP system, GHP/GMP procedures and kept records. The only difference is scale: the system for a food truck is simpler because you have fewer processes and a smaller back-of-house. But the obligation is identical.

Does a school or workplace canteen fall under the same regulations?

Yes. School, hospital and workplace canteens fall under the same rules as restaurants. For school and hospital canteens, inspections are sometimes more frequent due to a sensitive consumer group (children, the sick). The HACCP system in a canteen must account for mass catering specifics: large batches, meal transport, sample storage for 72 hours.

Summary: what you should do

HACCP obligation in foodservice is not a matter of interpretation - it is clear and applies to you if you serve food. Do not wait for an inspection to find out. Implementation does not have to be expensive or complicated, especially in a small venue. But it requires a conscious approach: understanding your processes, identifying risks, and consistently keeping records.

If you do not know where to start, or want certainty that your documentation is complete and compliant, check the GastroReady documentation packages. They start from 299 PLN and contain everything a small or medium venue needs: hazard analysis, GHP/GMP procedures, records, instructions and training - ready to deploy immediately.