
Every company that produces, processes or places food on the market in the European Union is required to implement the HACCP system. this is not a voluntary certification or an industry standard – it is a legal requirement, stemming directly from the EU Regulation on the hygiene of foodstuffs. Although HACCP has been in use in the food industry for decades, it still raises questions about what exactly it is, what it covers and how it relates to other food safety management systems.
HACCP (Hazard Analysis and Critical Control Points) is a preventive food safety management system developed in the 1960s by NASA and Pillsbury for the space programme – the aim was to ensure food safety for astronauts. In the decades that followed, the system came to be used in the food industry and became the basis for food regulations worldwide.
In the European Union, the obligation for all food business operators to apply HACCP principles stems from Regulation (EC) No 852/2004 of the European Parliament and of the Council of 29 April 2004 on the hygiene of foodstuffs. This Regulation is directly applicable in all Member States and does not require transposition into national law. In Poland, compliance with HACCP requirements is monitored by the Sanitary Inspection Authority (Sanepid) in establishments producing and processing food intended for human consumption, and by the Veterinary Inspection Authority in establishments dealing with products of animal origin.
The HACCP requirements are based on the seven principles of the Codex Alimentarius – a set of international food standards developed by the FAO/WHO Codex Alimentarius Commission. It is the principles of the Codex Alimentarius that serve as the benchmark for all food safety management systems – HACCP, ISO 22000, FSSC 22000, BRC and IFS.

The HACCP system is based on seven principles, which must be implemented in a specific order. They form a logical sequence of steps leading from the identification of hazards to a documented system for monitoring product safety.
Principle 1 – Hazard analysis. The HACCP team identifies all biological, chemical and physical hazards that may occur at every stage of the production process – from the receipt of raw materials to the release of the finished product. For each hazard, the likelihood of its occurrence and the severity of the potential health effects are assessed.
Principle 2 – Identification of Critical Control Points (CCPs). Based on the hazard analysis, the points in the process are identified where the application of a control measure is essential to eliminate the hazard or reduce it to an acceptable level. A classic example of a CCP is heat treatment to eliminate bacterial pathogens.
Principle 3 – Establishment of critical limits. For each CCP, measurable limits are set; exceeding these limits signifies a loss of control over the hazard. Examples include the minimum pasteurisation temperature or the maximum duration of a product’s exposure to room temperature.
Principle 4 – Establishing a monitoring system. For each CCP, procedures are defined for the regular monitoring of critical parameters – who takes the measurements, how often, using what method, and how the results are documented.
Principle 5 – Establishing corrective actions. Actions to be taken in the event of a critical limit being exceeded are defined – what to do with the product and how to regain control of the process.
Principle 6 – Development of verification procedures. The HACCP system must be regularly verified – through internal audits, microbiological testing of products and system reviews – to confirm its effectiveness.
Principle 7 – Documentation and record-keeping. All elements of the HACCP system must be documented. Records of CCP monitoring, test results, corrective actions and verification results must be retained and made available to regulatory authorities.
The relationship between HACCP and other food safety management systems is a source of frequent misunderstandings that are worth clarifying.
HACCP and ISO 22000. The ISO 22000:2018 standard fully integrates the HACCP principles in accordance with the Codex Alimentarius as one of its key elements. A company certified to ISO 22000 has an HACCP system in place – and one that is more comprehensive than required by Regulation 852/2004 alone, as it is supplemented by the standard’s systemic requirements. ISO 22000 does not replace the legal obligation to implement HACCP – it is an extension and documentation of it.
HACCP versus BRC and IFS. Both standards require an implemented and functioning HACCP system compliant with the Codex Alimentarius as a condition for certification. A BRC or IFS certificate is proof that a company has not only HACCP in place, but an entire integrated food safety and quality management system.
Does an HACCP certificate replace an ISO 22000 certificate? No – and vice versa. An HACCP certificate confirms compliance with the requirements of the HACCP system, whilst an ISO 22000 certificate confirms compliance with the requirements of the standard, of which HACCP forms a part. For companies that do not require GFSI certification, an HACCP certificate may be sufficient proof of competence. For companies operating within a retail chain, a standard recognised by the GFSI is usually required.