EU Food Hygiene Regulations Explained (852/2004 and the Hygiene Package)

EU food hygiene regulations are built around Regulation (EC) No 852/2004, which requires food businesses to apply good hygiene practices, register establishments and maintain HACCP-based procedures. Regulation (EC) No 178/2002 adds general food-safety, traceability and withdrawal duties, while Regulation (EC) No 853/2004 sets extra rules for food of animal origin.

EU food hygiene law creates a common framework for businesses that produce, process, store, distribute or sell food. It applies across the food chain, from primary production to restaurants, retailers, caterers, manufacturers, warehouses and online food businesses.

The rules are designed around a central principle: the food business operator has primary responsibility for the safety of food under its control. Authorities inspect and enforce, but they do not operate a business’s food-safety system on its behalf.

For most businesses, compliance means more than keeping a kitchen visibly clean. It requires suitable premises, hygienic processes, temperature control, contamination prevention, trained and supervised staff, documented procedures, traceability and evidence that controls work in practice.

In summary, food businesses should:

1. Identify which EU and national food rules apply.

2. Register each establishment and obtain approval where required.

3. implement and maintain procedures based on Hazard Analysis and Critical Control Points principles.

4. Meet the hygiene requirements relevant to premises, equipment, food, water, waste, pests and personnel.

5. Maintain traceability and an effective withdrawal or recall process.

6. Cooperate with inspections and keep evidence of compliance.

7. Check Member State and local requirements in addition to EU legislation.

Professional limitation: This article provides general compliance guidance, not legal advice. National legislation, sector-specific rules and competent-authority requirements may add obligations.

What is the EU Hygiene Package?

Key takeaway: The Hygiene Package is a group of complementary EU laws covering general hygiene, animal-origin foods and official controls.

The term EU Hygiene Package describes the harmonised legal framework introduced for food hygiene across the European Union. Its central business-facing regulations are Regulation (EC) No 852/2004 and Regulation (EC) No 853/2004. Regulation (EU) 2017/625 now provides the main framework for official controls carried out by competent authorities.

The framework has applied since 2006 and covers the production, processing, distribution and placing on the market of food. Private domestic preparation and food produced solely for private consumption generally fall outside these EU business rules.

Regulation (EC) No 853/2004 supplements rather than replaces Regulation 852/2004. A meat-processing or dairy establishment may therefore need to comply with both the general hygiene rules and the additional animal-origin requirements.

What does Regulation 852/2004 require?

Key takeaway: Regulation 852/2004 requires food businesses to control hygiene systematically and to provide evidence that their arrangements are effective.

Regulation (EC) No 852/2004 is the core EU food hygiene regulation. It places primary responsibility for food safety on the food business operator and requires food to be protected throughout production, processing and distribution.

Its requirements are risk-based. The controls needed in a large ready-meal factory will differ from those needed in a small shop selling sealed, shelf-stable products. However, the business must still identify its relevant hazards and meet the legal outcomes.

Premises and equipment

Food premises must be designed, maintained and operated so that they can be cleaned, contamination can be controlled and hygienic working practices are possible. Requirements may cover:

• the layout and condition of rooms;

• food-contact surfaces;

• handwashing and sanitary facilities;

• ventilation, drainage and lighting;

• storage of waste and cleaning chemicals;

• potable water;

• pest prevention;

• cleaning and disinfection; and

• maintenance of equipment.

A premises checklist is not enough by itself. Businesses should be able to show who is responsible for each control, how frequently it is performed, what standard is expected and what happens when a failure is found.

Food handling and contamination control

Food must be protected against contamination that could make it unsafe or unfit for consumption. This includes contamination from raw ingredients, equipment, water, pests, waste, chemicals and food handlers.

The practical controls may include separating raw and ready-to-eat activities, maintaining an appropriate storage order, controlling temperatures, checking deliveries, protecting exposed food and using validated cleaning methods.

For a wider explanation of these system-level controls, see the complete guide to food hygiene and safety.

Personal hygiene and training

People working in food-handling areas must maintain a high degree of personal cleanliness and wear suitable, clean and, where necessary, protective clothing. People with illnesses or symptoms that may contaminate food must report them and must not handle food where contamination is possible.

Annex II, Chapter XII also requires food handlers to be supervised and instructed or trained in food hygiene matters appropriate to their work. People responsible for developing or maintaining HACCP-based procedures need adequate training in the application of HACCP principles.

Training should therefore match responsibility. A delivery driver, kitchen assistant, production supervisor and HACCP team leader do not necessarily need identical content, but each must be competent for the food-safety tasks assigned to them.

Do all food businesses need HACCP in the EU?

Key takeaway: Most food businesses operating after primary production need permanent procedures based on HACCP principles, but the complexity should reflect the business and its risks.

Article 5 of Regulation 852/2004 requires relevant food business operators to put in place, implement and maintain permanent procedures based on the principles of Hazard Analysis and Critical Control Points, commonly known as HACCP.

The seven principles require a business to:

1. Identify hazards that must be prevented, eliminated or reduced.

2. Identify critical control points where control is essential.

3. Establish critical limits separating acceptable from unacceptable conditions.

4. Establish monitoring procedures.

5. Establish corrective actions.

6. Verify that the controls work effectively.

7. Maintain documents and records appropriate to the nature and size of the business.

The law requires procedures based on HACCP principles. It does not mean every small business must create the same volume of documentation as a complex manufacturer. EU rules allow proportionate implementation, and suitable national or sector guides may help businesses apply the principles in a practical way.

However, “flexible” does not mean optional. A business using simplified procedures must still understand its hazards, control them consistently and demonstrate compliance when requested by the competent authority.

A practical example

A small café may identify chilled storage, cooking, cooling and allergen communication as its key controls. Its system might use concise opening checks, temperature records, recipe information and corrective-action instructions.

A central production kitchen handling cook-chill meals would usually need a more detailed system covering supplier approval, validated cooking and cooling limits, environmental hygiene, shelf-life controls, traceability, verification and trend review.

The difference is the scale and complexity of the system—not the underlying responsibility to control hazards.

Do food premises need registration or approval?

Key takeaway: Every food business must notify the competent authority for registration, while approval applies only to establishments covered by specific rules.

Under Article 6 of Regulation 852/2004, food business operators must notify the appropriate competent authority of every establishment under their control that carries out food production, processing or distribution. They must also provide updated information about significant changes and closures.

Registration enables the authority to know what food activities are taking place and where. The exact application process, notice period and responsible authority are determined nationally or locally.

Approval is a separate requirement. It generally applies where Regulation 853/2004 or national legislation requires an establishment to be approved, particularly for specified activities involving food of animal origin. Approval normally involves an on-site visit by the competent authority before the establishment may operate under the approval requirement.

A restaurant is not automatically subject to establishment approval merely because it handles meat, dairy or fish. The activity, supply arrangements, exemptions and national interpretation must be checked with the relevant competent authority.

What does the General Food Law require?

Key takeaway: Regulation 178/2002 establishes the wider duties to keep unsafe food off the market, verify compliance, maintain traceability and act when problems arise.

Regulation (EC) No 178/2002 is known as the General Food Law Regulation. It establishes the overarching principles of EU food law, created the European Food Safety Authority and assigns core responsibilities to food business operators and public authorities.

Four provisions are especially important to operational compliance:

Food must not be unsafe

Article 14 prohibits food from being placed on the market if it is unsafe. Food is considered unsafe when it is injurious to health or unfit for human consumption.

A product may therefore require action even where no customer illness has been reported. Businesses must assess available information, including the hazard, likely exposure, affected consumers and whether the product has left their control.

Businesses must verify compliance

Article 17 makes operators responsible for ensuring that food under their control satisfies relevant food-law requirements and for verifying that those requirements are met.

This is why records matter. A business should not rely solely on statements that staff “normally” follow the procedure. It needs proportionate evidence such as monitoring records, supplier information, corrective actions, verification checks and training records.

Traceability must be maintained

Article 18 requires traceability through the food chain. Businesses must be able to identify their immediate suppliers and, except when supplying final consumers, the businesses to which products have been supplied.

This is often summarised as one step back, one step forward. Businesses should retain information in a form that can be supplied to the competent authority without avoidable delay.

For a detailed record checklist and recall workflow, see food traceability and recalls.

Unsafe food may need withdrawal or recall

Article 19 requires operators to initiate procedures to withdraw food when they have reason to believe it is unsafe and it has left their immediate control. Where necessary, consumers must be informed effectively, and products already supplied to consumers may need to be recalled. The competent authority must also be notified and operators must cooperate with further risk-management action.

What changed under Regulation 2021/382?

Key takeaway: Regulation 2021/382 made food safety culture, stronger allergen controls and safe food-redistribution checks part of the binding hygiene framework.

Commission Regulation (EU) 2021/382 amended the annexes to Regulation 852/2004 in three important areas: food allergen management, food redistribution and food safety culture. These are legal hygiene requirements, not merely optional recommendations.

Food allergen management

Equipment, containers and vehicles used for food containing a regulated allergen must not be used for food that is not intended to contain that allergen unless they have been cleaned and checked appropriately.

Businesses should translate this requirement into clear controls for scheduling, separation, cleaning validation or verification, recipe management, rework, storage and changeovers. Allergen controls must also align with the food-information requirements applicable to the product and market.

Food redistribution

Before redistributing food, operators must assess whether it remains suitable and safe. Relevant factors can include date marking, storage conditions, cold-chain history, packaging integrity, traceability and any handling that may have affected safety.

Redistribution does not reduce the operator’s responsibility. Donated or redistributed food remains subject to food-safety and hygiene law.

Food safety culture

Food business operators must establish, maintain and provide evidence of an appropriate food safety culture. The requirement includes management commitment, clear roles, open communication, staff awareness, adequate resources, training and supervision, and keeping controls up to date.

The scale of the arrangements may reflect the nature and size of the business. Nevertheless, a policy statement without supporting behaviour, decisions and evidence is unlikely to demonstrate an effective culture.

For further implementation guidance, see what food safety culture means and how to build it.

How are EU food hygiene regulations enforced?

Key takeaway: Competent authorities use risk-based official controls to verify whether businesses comply with food law and whether their systems work in practice.

Regulation (EU) 2017/625 provides the principal EU framework for official controls across the agri-food chain. Member State authorities use inspections, document reviews, interviews, sampling and other control activities to assess compliance. The framework supports a risk-based approach, meaning the nature and frequency of controls can reflect the business’s risks and compliance history.

An inspection may examine:

• the condition and layout of the premises;

• cleaning, maintenance and pest-control arrangements;

• personal hygiene and staff competence;

• cross-contamination and allergen controls;

• temperature monitoring;

• HACCP-based procedures;

• traceability and recall arrangements;

• supplier and delivery controls;

• labels and product information;

• corrective actions and verification records; and

• whether actual working practices match written procedures.

The regulation establishes a common control framework, but enforcement measures and penalties are provided through applicable EU and national law. Businesses should therefore check the procedures used by the competent authority in the Member State and locality where they operate.

How do the rules vary between EU Member States?

Key takeaway: EU regulations create common outcomes, but registration processes, enforcement structures, training arrangements and some detailed requirements vary nationally.

Regulations 178/2002, 852/2004, 853/2004 and 2017/625 establish a harmonised foundation across the EU. Member States nevertheless retain important implementation and enforcement responsibilities. They designate competent authorities, organise inspections, establish national procedures and may adopt certain supplementary or adapted measures where EU law permits.

Country variations: Training certificates, registration forms, approval procedures, inspection arrangements, enforcement measures, national hygiene guides and certain retail or sector-specific rules can differ between Member States. Businesses should confirm requirements with the competent authority for each establishment.

For example, Regulation 852/2004 requires appropriate food-hygiene supervision, instruction or training, but it does not establish one universal EU certificate that every food handler must hold. A Member State may have national rules, sector expectations or recognised training arrangements that affect how competence is demonstrated.

Similarly, EU law often establishes a required safety outcome rather than one universal operational number for every product and process. A business may need to use national guidance, microbiological criteria, sector legislation, scientific evidence and its HACCP assessment to set validated limits.

What should a food business do to comply?

Key takeaway: Compliance should be managed as an evidence-based operating system rather than a collection of disconnected documents.

Use the following implementation sequence:

1. Define the business activities. Record the foods, processes, customer groups, distribution methods and establishments under your control.

2. Identify applicable legislation. Check general hygiene rules, animal-origin requirements, microbiological criteria, food-information rules and national provisions.

3. Complete registration or approval. Confirm the process with the competent authority before starting or materially changing activities.

4. Establish prerequisite hygiene controls. Cover premises, equipment, cleaning, pests, waste, water, suppliers, temperature, storage, personal hygiene and allergens.

5. Implement HACCP-based procedures. Identify hazards, establish controls, set limits where needed and define monitoring and corrective actions.

6. Train and supervise staff by role. Verify competence through observation, questioning and record review rather than attendance certificates alone.

7. Maintain traceability and recall readiness. Test whether supplier, batch and customer information can be retrieved quickly.

8. Verify the system. Review records, investigate repeated failures, inspect actual practices and update controls after changes.

9. Prepare for official controls. Keep key evidence organised and ensure managers can explain how risks are controlled.

10. Review national requirements. Monitor competent-authority guidance and legal changes in every Member State where the business operates.

Understand your legal duties
Build practical knowledge of hygiene controls, HACCP-based procedures, contamination prevention and operational responsibilities through the Food Hygiene and Safety course. Training supports competence, but each business remains responsible for applying the law to its own activities and national requirements.