Regulations

HACCP for bakeries and production kitchens: hazards, CCPs and records

A bakery isn't a restaurant: the working temperatures, the processes and the hazards are different, so your HACCP plan should be too. This guide covers the control points specific to bread and savoury baking, what you need to record and how to do it without the paperwork eating into production time.

Updated 15 October 2026 · 8 min read

Freshly baked loaves in an artisan bakery

Why a bakery's HACCP isn't a restaurant's

A HACCP plan, called APPCC in Spain, follows the same framework for every food business: analyse the hazards at each stage, identify the critical control points (CCPs) and record that you control them. What changes from business to business are the hazards and the CCPs themselves. In a restaurant the main risk is service temperature and allergen cross-contact. In a bakery the most relevant hazards come up in proving, baking and, above all, storing raw materials in bulk.

Most HACCP plans in the trade are generic: a consultancy writes them, the owner keeps them in a folder and nobody touches them until the inspection. The result is a plan that doesn't reflect the real kitchen, records filled in the day before the visit, and an inspector who notices. If you're new to the Spanish system, start with APPCC explained in English.

Hazards specific to bakeries

Biological hazards

  • Contamination of bulk flour: flour kept in damp conditions or in open sacks for too long can grow mould or be contaminated by rodents. Storage conditions and stock rotation are key.
  • Uncontrolled proving: dough that proves for longer than it should or at the wrong temperature can develop unwanted compounds. Time and temperature control in the prover is the most common CCP in a bakery.
  • Allergen cross-contact: if you make products with and without nuts, gluten or milk in the same space, separating lines or cleaning thoroughly between batches is required, and it has to be recorded.
  • Eggs and dairy in pastries and savoury bakes: these need temperature control at goods-in, in storage and in the finished product when it isn't baked hot enough.

Chemical hazards

  • Cleaning product residues: cleaning and disinfection products must be stored away from raw materials and rinsed off food contact surfaces.
  • Additives and improvers over the limit: bread additives must stay within the authorised doses. Ingredient specification sheets make this easier to control.
  • Pesticides in raw materials: for bulk flour or fruit for fillings, supplier approval is the first barrier.

Physical hazards

  • Foreign bodies: bits of eggshell, packaging, utensil shavings or machine screws are the most common. Equipment checks and sieves where flour is tipped in reduce the risk.
  • Broken glass or ceramics: if you use moulds or bowls made of them, a breakage procedure and an inventory of utensils let you act when a piece goes missing.

Critical control points in a bakery

A CCP is a step where you can apply a measure that removes or reduces a hazard to an acceptable level, and where, if it fails, the product can be unsafe. In bakeries these are the most common.

StepHazardIndicative critical limitWhat to record
BakingBiological (pathogens surviving)Oven ≥ 200 °C for the baking time set in the recipe; crumb ≥ 95 °C for large piecesOven temperature and baking time per batch
Proving in a retarderBiological (uncontrolled proving)Retarder between 4 °C and 8 °C for cold proving; maximum time per recipe for proving at room temperatureRetarder temperature at start and end; proving time
Cooling after bakingBiological (recontamination, condensation)Product in a clean area; no contact with unsanitised surfaces; cooled below 30 °C before baggingProduct temperature when bagged
Receiving chilled raw materials (eggs, dairy, fillings)Biological and chemicalArrival temperature ≤ 4 °C; batch label and use-by date presentTemperature on arrival, batch and supplier
Storing bulk flourBiological and physicalRelative humidity below 70%; no pests; sacks closed or bins coveredRegular check of store conditions
Typical bakery CCPs with indicative critical limits

Note

The limits in this table are indicative and need to be adapted to your own processes and products. Your HACCP plan must contain the values validated for your bakery, not someone else's. If in doubt, a food safety consultant can help you validate them.

Prerequisites to have in place first

Before you get to the CCPs, HACCP requires the prerequisite plans to be covered. They're the basic hygiene the whole system rests on.

  • Cleaning and disinfection plan: what gets cleaned, with what product, at what dilution and how often. Including machinery (mixers, ovens, sheeters) and work surfaces.
  • Temperature control: calibrated probes in provers and fridges, with a daily record.
  • Pest control: a current contract with an authorised pest control company, with records of visits and incidents.
  • Food handler training: what training each person has and when it's refreshed. See food handler training in Spain.
  • Traceability of raw materials: delivery notes with the supplier's batch number. Without them you can't trace a product if there's a recall.
  • Supplier control: an approved supplier record with their details, what they supply and, where relevant, allergen information.

The records you need day to day

  1. 1Goods-in record: date, supplier, product, batch, arrival temperature (where relevant) and the result of the visual check.
  2. 2Fridge and prover temperatures: at least once a day, with the time it was taken.
  3. 3Baking temperatures: oven temperature and baking time per batch, especially for large or filled pieces.
  4. 4Cleaning record: what was cleaned, when, with what and by whom.
  5. 5Incidents and corrective actions: if a fridge goes over its limit, what was done with the product and what was fixed.
  6. 6Production record (optional but highly recommended): what was made, with which ingredient batches and how many units. It links traceability with HACCP and with production cost.

The most common mistake

Filling in a whole week of records on Friday afternoon. An inspector can ask to see them on the spot, and if a week's worth of readings are all in the same handwriting and the same pen, the plan loses all credibility. Digital records with a timestamp avoid the problem: each reading is dated the moment it's taken.

Run your bakery's HACCP from your phone: signed records, alerts for missed checks and batch traceability linked to your recipe costings.

Try gramo free

Frequently asked questions

Does a small artisan bakery need a HACCP plan?
Yes. Regulation (EC) 852/2004 applies to every food business, whatever its size. Small or low-risk businesses can use simplified systems based on the sector's good hygiene practice guides, but having no self-control system at all isn't an option at an inspection.
How many CCPs should a bakery HACCP plan have?
There's no minimum or maximum: HACCP identifies the CCPs that really exist in your process. In a standard bakery the most common are baking and temperature control during proving. Adding CCPs where there's no real hazard just complicates the system.
What's the difference between a CCP and a prerequisite?
A prerequisite controls background hazards that affect the whole process, like cleaning or staff training. A CCP is a specific step where, if control fails, the hazard can't be removed later. Baking is a CCP because if the temperature isn't reached you can't go back. Cleaning the mixer is a prerequisite, not a CCP.
Is HACCP the same as APPCC?
Yes. APPCC (Análisis de Peligros y Puntos de Control Crítico) is the Spanish name for HACCP. Your inspector and your consultant will call it APPCC.
In gramo

Digital HACCP

Food safety records without paper or folders.

Digital HACCP

Every gram counts

gramo works out your recipe costs and food cost with real data, and keeps your traceability and HACCP without paper. Start free, no card.

Start free

Keep reading