HACCP

What is HACCP?

HACCP (Hazard Analysis and Critical Control Points) is a preventive food safety method in which a business analyses the biological, chemical and physical hazards in its production process, identifies the steps where those hazards must be controlled (the critical control points, or CCPs) and sets critical limits, monitoring, corrective actions and records for each of them. Rather than testing finished products after the fact, HACCP builds safety into the process itself. In the European Union, a system based on HACCP principles is a legal requirement for almost every food business beyond primary production.

HACCP = controlling hazards where they arise, not at the final inspection.

🧠 Where does HACCP come from?

HACCP originated in the US space programme. From 1959 onwards, Pillsbury developed food for astronauts together with NASA and the US Army laboratories in Natick. End-product testing was impractical: gaining confidence would have meant destroying almost the entire output in tests. The developers therefore chose to control the process itself. In 1971 Pillsbury presented the approach at the first National Conference on Food Protection.

HACCP then spread through legislation:

🧪 Which hazards does HACCP control?

HACCP distinguishes three types of hazard. Since the European amendment of 2021, allergens receive extra attention as a chemical hazard.

A hazard only belongs in the HACCP plan if it is reasonably likely to occur and severe enough to matter. That judgement resembles a risk assessment or an FMEA: likelihood times severity.

🧱 What are the 7 principles of HACCP?

The Codex Alimentarius describes HACCP in twelve steps. The first five are preparatory: assemble a multidisciplinary team, describe the product, identify its intended use, draw a process flow diagram and confirm that diagram on the shop floor. The seven principles follow:

1. Conduct a hazard analysis - identify for each process step which hazards may occur and which control measures exist.
2. Determine the critical control points (CCPs) - the steps where control is essential to prevent or eliminate a hazard or reduce it to an acceptable level. A decision tree helps, but does not replace expert knowledge.
3. Establish critical limits - measurable boundaries such as temperature, time, pH or metal detector sensitivity.
4. Establish monitoring - continuously with sensors or at a fixed frequency, with a clearly assigned owner.
5. Establish corrective actions - what happens to product and process when a critical limit is exceeded.
6. Validate and verify - demonstrate that the critical limits work and check periodically that the system still does what it should.
7. Document and keep records - the plan, measurements, deviations and verifications, so that an auditor or regulator can trace everything.

🏭 What does HACCP look like in a dairy plant?

An example for pasteurised milk in bottles. The EU hygiene rules specify at least 72 °C for 15 seconds for high-temperature short-time pasteurisation, or an equivalent combination such as 63 °C for 30 minutes. Immediately after pasteurisation the milk must test negative for alkaline phosphatase, a common check that the heat treatment was sufficient.

Note that a metal detector cannot see glass. Glass requires optical or X-ray inspection.

🔧 How does OT support HACCP monitoring?

A modern HACCP system runs largely on OT. Where an operator once wrote down a temperature on paper every hour, automation now monitors the CCPs continuously:

• Measure and control - a PLC controls the pasteuriser and switches the flow diversion valve as soon as the temperature drops below the critical limit.
• Visualise and alarm - SCADA shows the status of each CCP; with sound alarm management the operator only sees alerts that genuinely require action.
• Record - a historian stores the measurement series per batch as evidence for principle 7.
• Batch and release - MES and ISA-88 batch control link process data to the batch number; LIMS adds lab results for release.
• Hold and recall - after a CCP deviation the WMS or ERP puts the batch on hold, and tracking and tracing determines which customers are affected.
• Inspection quality - vision systems check bottles, labels and allergen information.

Three points need attention. First, measurement chains must be calibrated regularly (calibration), otherwise a critical limit is meaningless. Second, records must be trustworthy: the principles of data integrity (ALCOA+) apply here too, and for exports to the US, 21 CFR Part 11 and FDA expectations may come into play. Third, the control system is a target: medium-sized and large food producers and processors fall under NIS2 and its national implementations, such as the Dutch Cyberbeveiligingswet, because a manipulated pasteurisation temperature is directly a food safety incident.

🔄 How does HACCP relate to GMP, ISO 22000 and BRCGS?

HACCP does not stand alone. It rests on basic conditions and is embedded in management systems:

HACCP is about food safety, not about machine or process safety for workers. In pharmaceuticals HACCP is used as a risk tool, but there it is not a legal obligation.

🇪🇺 How do you implement HACCP in the EU and the Netherlands?

• Legal basis - Article 5 of Regulation (EC) 852/2004 requires every food business beyond primary production to operate permanent procedures based on the HACCP principles.
• Guides to good hygiene practice - many sectors work with a government-approved guide (in the Netherlands a hygiënecode), for example for catering or bakeries. Small businesses can use these to meet the HACCP obligation more easily.
• Supervision - in the Netherlands, the Netherlands Food and Consumer Product Safety Authority (NVWA) checks whether businesses apply their HACCP system and can take enforcement action.
• Culture and allergens - since 2021, businesses must also demonstrate a food safety culture and manage allergens, including on shared equipment.
• After a deviation - investigate the cause with a root cause analysis and update the HACCP plan. A plan that has not changed for years is usually no longer current.

❓ Frequently asked questions

Is HACCP mandatory?

HACCP is mandatory in the European Union for all food businesses beyond primary production, under Article 5 of Regulation (EC) 852/2004. Small businesses may use an approved guide to good hygiene practice to comply. A HACCP certificate is not required; applying the principles is.

What is a CCP in HACCP?

A CCP (Critical Control Point) is a process step where control is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. A step is usually only a CCP if no later step will still remove the hazard. Pasteurisation and metal detection are well-known examples.

What is the difference between a CCP and a prerequisite programme?

A CCP has a measurable critical limit and is monitored per batch or continuously. A prerequisite programme, such as cleaning or pest control, provides a hygienic baseline for the whole site. HACCP builds on that baseline, which keeps the number of CCPs limited.

How often should a HACCP plan be reviewed?

A HACCP plan must be reviewed whenever the product, process, raw material or equipment changes, and periodically as well, usually at least once a year. A complaint, recall or deviation should also trigger a review. Verification under principle 6 shows whether the plan is still valid.

Can HACCP be run fully digitally?

HACCP can largely be run digitally with sensors, PLCs, SCADA, a historian and MES that monitor and record the CCPs. The digital records must, however, be reliable, complete and protected against silent changes. Calibration, verification and human judgement on deviations remain necessary.

What is the difference between HACCP and ISO 22000?

HACCP is a method with seven principles for controlling food safety hazards in a process. ISO 22000 is a certifiable management system standard that combines HACCP with policy, prerequisite programmes, internal audits and continual improvement. ISO 22000 therefore includes HACCP but goes further.

📌 In summary

HACCP is the legally required, preventive method by which food businesses analyse hazards and control them at critical control points using critical limits, monitoring, corrective actions and records. Modern automation with PLC, SCADA, historian and MES makes that monitoring continuous and demonstrable, provided the measurement chains are calibrated, the data is trustworthy and the systems are properly secured.