Every food business operator in Great Britain must have a food hygiene risk assessment. This requirement comes from Article 5 of Regulation (EC) 852/2004 on the hygiene of foodstuffs, enforced in England through the Food Hygiene (England) Regulations 2006, and underpinned by the Food Safety Act 1990. If you prepare, handle, store or sell food — whether from a restaurant, café, catering business, food truck, market stall, care home kitchen or home-based bakery — this applies to you.
Many food business operators only discover they need a food hygiene risk assessment when a council environmental health officer visits and asks to see it. This guide explains what the law requires, what the assessment must contain, and how to put one in place before that visit happens.
What the Food Hygiene Regulations Require
The primary legislation is the Food Safety Act 1990, which makes it an offence to render food injurious to health, to sell food not of the nature, substance or quality demanded, or to falsely describe or present food. The Act gives ministers the power to make regulations — which they have done through the Food Hygiene (England) Regulations 2006 and equivalent regulations in Scotland, Wales and Northern Ireland.
These regulations implement European Union Regulation (EC) 852/2004 into UK law. Although the UK has left the EU, Regulation (EC) 852/2004 was retained in domestic law under the European Union (Withdrawal) Act 2018 and remains in force. Article 5 of that regulation requires every food business operator to put in place, implement and maintain a permanent procedure based on the Hazard Analysis and Critical Control Point (HACCP) principles.
For most small food businesses, this does not mean a full formal HACCP plan as used in large food manufacturing. The Food Standards Agency (FSA) recognises that HACCP can be applied flexibly. What you must have is a documented food safety management system based on the identification of hazards and the controls you have in place to manage them. That system starts with a food hygiene risk assessment.
The assessment must identify all food safety hazards at every stage of your food operation — from receiving raw materials and storing ingredients, through preparation, cooking, cooling, reheating, to serving and display. For each hazard you must record the control measures you have in place and how you monitor them. This is not optional: Article 5(1) states that food business operators shall put in place, implement and maintain such procedures.
Who the Regulations Apply To
The Food Hygiene Regulations apply to all food business operators. A food business operator is defined under Article 3 of Regulation (EC) 178/2002 as any person responsible for ensuring that the requirements of food law are met within the food business under their control. In practice this means:
- Restaurants, cafés, pubs, hotels and other catering businesses
- Takeaways, fast food outlets, sandwich bars, fish and chip shops
- Mobile catering businesses, food trucks, ice cream vans
- Market stalls, farmers markets, temporary food events
- Care homes, hospitals, schools, workplace canteens
- Bakeries, butchers, fishmongers and other food retail
- Food manufacturing and processing businesses
- Home-based food businesses, including cottage food producers
- Self-employed caterers and private chefs
If you handle food as part of a charitable activity, community kitchen, church hall or village fête, the regulations apply to you. If you operate a bed and breakfast, holiday let or Airbnb and provide food to guests, the regulations apply to you. The only significant exclusion is primary production (growing crops, raising livestock for your own use), which is covered by separate legislation. Once food enters the commercial supply chain, the Food Hygiene Regulations apply regardless of business size or frequency of trading.
Key Duties at a Glance
Under the Food Hygiene Regulations and Regulation (EC) 852/2004, food business operators must:
- Put in place, implement and maintain procedures based on HACCP principles (Article 5 of Regulation (EC) 852/2004) — this means identifying hazards, determining critical control points, establishing critical limits, implementing monitoring procedures, establishing corrective actions and maintaining documentation
- Ensure that food handlers receive appropriate supervision, instruction and training in food hygiene (Article 4 and Chapter XII of Annex II to Regulation (EC) 852/2004)
- Register the food business with the local authority at least 28 days before opening (Regulation 6 of the Food Hygiene (England) Regulations 2006) — failure to register is an offence
- Comply with the general hygiene requirements in Annex II of Regulation (EC) 852/2004, covering premises layout, ventilation, lighting, drainage, water supply, waste disposal, personal hygiene, food handling and temperature control
- Keep food at safe temperatures: chilled food at or below 8°C (with certain tolerances), frozen food at or below −18°C, and hot food at or above 63°C where being held for service (Regulation 4 of the Food Hygiene (England) Regulations 2006)
- Maintain records of your food safety management system, including temperature logs, cleaning schedules, supplier information, staff training records and the risk assessment itself
- Review and update the risk assessment and food safety procedures whenever there is any significant change to the food operation, including new menu items, new equipment, change of premises, or following a food safety incident
- Cooperate with environmental health officers from the local authority during inspections and provide access to all relevant documents (Section 32 of the Food Safety Act 1990)
Penalties for Non-Compliance
The Food Safety and Hygiene (England) Regulations 2013 make it an offence to fail to comply with the requirements of Regulation (EC) 852/2004, including the requirement to have HACCP-based procedures in place. Local authority environmental health officers enforce the regulations. On inspection, if an officer finds that you do not have a suitable food hygiene risk assessment or food safety management system, they can take a range of enforcement actions.
An improvement notice under Section 10 of the Food Safety Act 1990 requires you to take specific steps within a set time — typically producing a written food safety management system within 14 or 28 days. Failure to comply with an improvement notice is a criminal offence. A hygiene emergency prohibition notice under Section 12 can close your business immediately if there is an imminent risk to public health. The prohibition remains in force until a magistrates court lifts it, which requires you to demonstrate that the risk has been removed.
Prosecution can result in an unlimited fine in the Crown Court and up to 2 years imprisonment for the most serious offences. Summary conviction in a magistrates court can result in a fine of up to £5,000 per offence and up to 6 months imprisonment. The Sentencing Council's Health and Safety Offences guideline (which applies to food safety offences) sets out sentencing levels based on culpability and harm. A medium-sized catering business with high culpability and Category 1 harm (actual illness or significant risk of serious harm) could face a fine starting at £170,000.
Food Standards Agency data shows that lack of documented food safety management procedures is one of the most frequently identified issues during local authority inspections. In 2022/23, there were over 1.1 million food hygiene interventions carried out by local authorities in the UK, and approximately 8,900 prosecutions and formal cautions for food law offences. Your Food Hygiene Rating (the 0-5 score displayed on your premises and published online) is directly affected by your food safety management system: businesses with no documented procedures cannot score above a 1.
How This Relates to Risk Assessments
The food hygiene risk assessment is the foundation of your food safety management system. It is distinct from (but related to) the general health and safety risk assessment required under the Management of Health and Safety at Work Regulations 1999. Your general health and safety risk assessment covers risks to employees and others affected by your work — slips, trips, manual handling, use of equipment, violence. Your food hygiene risk assessment covers risks to consumers from contaminated or unsafe food.
Both are legal requirements. As a food business operator employing staff, you need both. Even if you are self-employed with no employees, you still need the food hygiene risk assessment because the Food Hygiene Regulations apply to all food business operators regardless of whether they employ anyone.
The food hygiene risk assessment must be written down. Article 5(2)(g) of Regulation (EC) 852/2004 requires food business operators to establish documents and records appropriate to the nature and size of the business to demonstrate the effective application of the HACCP-based procedures. A mental assessment is not sufficient. An environmental health officer on inspection will ask to see your documented system. If you cannot produce it, you are in breach of the regulations.
Your risk assessment should identify hazards in a logical sequence through your operation. For a café, that might mean: receiving deliveries (checking supplier food safety, checking temperature and condition of delivered food, checking use-by dates); storage (keeping raw and ready-to-eat foods separate, maintaining fridge and freezer temperatures); preparation (preventing cross-contamination between raw and cooked, handwashing, allergen control); cooking (achieving adequate core temperatures); cooling (cooling cooked food rapidly if not served immediately); reheating (achieving 75°C throughout); and service (hot holding above 63°C, preventing contamination during display). For each hazard, record the control and how you monitor it.
The FSA provides free food safety management packs — Safer Food, Better Business (for caterers and retailers), CookSafe (Scotland), and similar systems in Wales and Northern Ireland. These packs provide templates that combine the risk assessment and HACCP requirements into one system. Many small businesses use them. Alternatively, Anyrisks generates food hygiene risk assessments tailored to your specific operation in under 2 minutes, covering all stages from delivery to service and including allergen management.
Food Hygiene Risk Assessment and Street Food Vendors
Street food vendors, mobile caterers and market traders often assume that because they operate from a small unit or trade only occasionally, the Food Hygiene Regulations do not fully apply. This is wrong. A burger van, crepe stall or hog roast operating at weekend markets has exactly the same legal duty to have a documented food safety management system as a high street restaurant.
Environmental health officers regularly inspect street food events, farmers markets and temporary food stalls. If you cannot produce a food hygiene risk assessment and evidence of temperature monitoring, cleaning schedules and supplier checks, you risk an improvement notice or immediate closure. The fact that you trade from a gazebo rather than a permanent building does not change your legal obligations under Regulation (EC) 852/2004.
For mobile caterers, your risk assessment must address the specific challenges of your operation: limited water supply (how you maintain handwashing facilities and cleaning standards); temperature control in vehicles (how you keep chilled and frozen ingredients at safe temperatures during transport and service); preventing cross-contamination in a confined space; and safe food storage when moving between sites. Your local authority will expect to see that you have thought through these issues and documented your controls before granting event approval or issuing a satisfactory food hygiene rating.
Food Hygiene Training Requirements
Article 4 of Regulation (EC) 852/2004 and Chapter XII of Annex II require food business operators to ensure that food handlers are supervised and instructed or trained in food hygiene matters commensurate with their work activity. There is no mandatory food hygiene certificate in UK law — but you must be able to demonstrate that everyone handling food in your business has received appropriate instruction or training.
For most businesses, this means Level 2 Food Safety and Hygiene training for all food handlers, and Level 3 for supervisors and managers. These qualifications are widely available from awarding bodies including the Chartered Institute of Environmental Health (CIEH), the Royal Society for Public Health (RSPH), and Highfield. Online courses typically cost £15-£30 and can be completed in a few hours. Certificates are valid for three years, though best practice is to refresh training annually.
Environmental health officers will ask to see training records during an inspection. If you cannot demonstrate that staff have been trained (or at minimum have received documented on-the-job instruction covering the key food safety hazards), this will affect your Food Hygiene Rating and may result in enforcement action. The training requirement applies equally to family members, volunteers and casual staff.
Food Allergen Information Requirements
Since December 2014, food businesses have been required under the EU Food Information for Consumers Regulation (Regulation (EU) 1169/2011) — retained in UK law as the Food Information Regulations 2014 — to provide allergen information for non-prepacked food. This applies to all food sold loose, made to order, or served in a catering environment.
You must provide clear information on the presence of any of the 14 major allergens: celery, cereals containing gluten (wheat, rye, barley, oats), crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame seeds, soybeans and sulphur dioxide (preservative used in dried fruit, wine, soft drinks). This information can be provided in writing (on a menu, chalkboard or information pack) or orally (by a trained member of staff who can direct customers to written information).
Since October 2021, full written ingredient and allergen labelling is required for prepacked for direct sale (PPDS) food under Natasha's Law. PPDS food is food that is packaged on the same premises where it is sold — sandwiches wrapped in your café, cakes boxed in your bakery. Every PPDS item must have a label showing the product name, a full ingredient list with allergenic ingredients emphasised (bold, italic or colour), and the name and address of the business. Failure to comply is an offence under the Food Information Regulations 2014.
Your food hygiene risk assessment must address allergen control. This means preventing cross-contamination during storage and preparation (separating allergenic ingredients, using separate utensils and boards, cleaning surfaces between tasks), training all staff in allergen awareness, and maintaining records of ingredients and recipes so you can answer customer questions accurately. An environmental health officer will check your allergen procedures as part of the inspection.
Related Regulations and Guidance
The Food Hygiene Regulations work alongside several other pieces of food legislation. The Food Safety Act 1990 is the overarching statute, creating offences and enforcement powers. The Food Information Regulations 2014 cover labelling and allergen information. The Food Safety and Hygiene (England) Regulations 2013 consolidate earlier regulations and specify certain requirements including temperature control.
Specific products have additional regulations: the Meat Products (England) Regulations 2014 for butchers and meat processors; the Egg Products Regulations 1993 for businesses using liquid egg; the Dairy Products Hygiene Regulations 1995; and the Fishery Products (Official Controls) Regulations 2009. Businesses that export food or import food from outside the UK face further requirements under retained EU legislation and new UK border controls.
The Food Standards Agency publishes detailed guidance on all aspects of food hygiene law at food.gov.uk. The FSA's Safer Food, Better Business pack remains the most widely used food safety management system for small catering and retail businesses in England. Local authority environmental health departments also provide advice and support — most offer a free initial visit to new food businesses to help them understand their obligations before formal inspection.
If you also have responsibilities under the Health and Safety at Work etc. Act 1974 (because you employ staff or engage contractors), you need a general health and safety risk assessment covering workplace hazards. The duty to assess risks applies to every employer and self-employed person whose work affects others. Risk assessment legal requirements are set out in Regulation 3 of the Management of Health and Safety at Work Regulations 1999.
