Yes: every bar or restaurant that handles food has to apply a HACCP system (APPCC in Spanish), but adapted to its size. HACCP stands for "Hazard Analysis and Critical Control Points": it is a method for spotting what can go wrong with food (it gets contaminated, the cold chain breaks...) and putting in writing how you prevent it. A small venue does not need a treatise: clear procedures and simple records showing that you follow them are enough.
What the rules require exactly
The basis is Regulation (EC) 852/2004, which applies to every food business, from a neighbourhood bar to a factory. These are the pieces that matter to a restaurant:
| What it requires | Where it is |
|---|---|
| Put in place, implement and maintain permanent procedures based on HACCP principles | Regulation (EC) 852/2004, art. 5.1 |
| Follow seven principles: identify hazards, determine critical control points, set critical limits, monitor them, define corrective actions, verify that the system works and keep documents and records | Art. 5.2, letters a to g |
| Documents and records, "commensurate with the nature and size of the business" | Art. 5.2.g |
| Provide the authority with evidence that you comply, keep the documents up to date and keep the records for an appropriate period | Art. 5.4 |
| Training: supervise and train food handlers in hygiene according to their work | Annex II, chapter XII, paragraph 1 |
| Adequate procedures to control pests | Annex II, chapter IX, paragraph 4 |
| Do not interrupt the cold chain, except for limited periods for handling needs | Annex II, chapter IX, paragraph 5 |
| Know who supplies you and whom you supply (traceability) and be able to inform the authority if asked | Regulation (EC) 178/2002, art. 18.2 and 18.3 |
Note the point in art. 5.2.g: the rule itself recognises that the volume of paperwork has to be proportionate to the business.
"Small" does not mean "no plan"
Recital 15 of Regulation (EC) 852/2004 accepts that in some businesses it is not possible to identify critical control points, and that in those cases good hygiene practices can replace monitoring. It also says that critical limits do not always require a figure to be set and that documentation must be flexible so as not to burden very small businesses.
That does not mean you can have nothing. It means your plan can be short, with your real dishes and your real kitchen, and the records can be simple.
In 2022 the European Commission published Notice 2022/C 355/01 on food safety management systems with flexibility, which replaces the 2016 one. It is an interpretation guide: Commission notices are not legally binding. AESAN, Spain's state food safety agency, also has a page dedicated to flexibility in applying the hygiene regulations.
The typical records of a small restaurant
We need to be clear here: no rule sets a sheet template or a mandatory frequency for these records. What is usually asked for in an inspection is proof that you do what you say you do (art. 5.4.a). These are the ones that almost always come up:
| Record | What it is for | What in the rules supports it |
|---|---|---|
| Temperatures of cold rooms and fridges | Showing that the cold chain is not broken | Regulation (EC) 852/2004, Annex II, ch. IX; Real Decreto 1086/2020, art. 30 |
| Cleaning and disinfection | Checking that what was planned is done | Art. 5.1 and 5.2.g of Regulation (EC) 852/2004 |
| Suppliers and traceability | Knowing where each product comes from and whom it is served to | Regulation (EC) 178/2002, art. 18.2 and 18.3 |
| Staff training | Showing that whoever handles food knows how | Annex II, ch. XII, paragraph 1 |
| Pest control | Contract with a company or your own checks | Annex II, ch. IX, paragraph 4 |
| Frying oil | Controlling when it has to be changed: the content of polar compounds must be below 25% | Orden of 26-1-1989, art. 6.3 (art. 3 of the Orden expressly includes bars) |
On frequency, no rule sets a general recording frequency. If you want to know what the inspection expects in your area, check with the health authority of your autonomous community. A good starting point is to record as regularly as the plan itself decides and always keep to it: a half-done record with gaps looks worse than a simple, complete one.
The temperatures set by the rules
The most specific ones are in art. 30 of Real Decreto 1086/2020, as worded by Real Decreto 1021/2022, for prepared-meal establishments:
| Situation | Temperature | Paragraph of art. 30 |
|---|---|---|
| Refrigerated prepared food with a shelf life of more than 24 hours | 4 °C or less | 3.a |
| Refrigerated prepared food with a shelf life of less than 24 hours | 8 °C or less | 3.b |
| Frozen prepared food | -18 °C or less | 4 |
| Food kept hot | 63 °C or more | 2 |
| Rapid cooling of hot food | From 60 °C to 10 °C in less than 2 hours | 6 |
| Reheating | 74 °C for at least 15 seconds at the centre of the food, within one hour of taking it out of the fridge | 7 |
The same article lets the operator set other storage temperatures if they show the authority, on a scientific basis, that safety is guaranteed (paragraph 5). What works for your kitchen is what you have written in your plan and can justify.
Retained samples (comidas testigo: keeping a sample of what was served for seven days, at least 100 g, at 4 °C or less or at -18 °C or less) are required of those who serve care homes, day centres, school canteens and other group catering, communal canteens, means of transport, events when that is their main activity, and orders for groups or events of more than 40 people (art. 30, paragraphs 8 to 10). It is not usual in a small restaurant, but if you accept an order for more than 40 people, it does affect you.
If you come across old templates that cite Real Decreto 3484/2000 on prepared meals, bear in mind that it has been repealed since Real Decreto 1021/2022.
What penalties the law provides for
The Ley 17/2011 classes as a food safety infringement, among others, non-compliance on self-monitoring (art. 50.1.d), and sets these bands in art. 52:
| Classification | Band (Ley 17/2011, art. 52) | Examples on self-monitoring |
|---|---|---|
| Minor | Up to €5,000 | Deficiencies in the records (art. 51.1) |
| Serious | From €5,001 to €20,000 | Absence of self-monitoring; absence of required records or lack of essential traceability data (art. 51.2) |
| Very serious | From €20,001 to €600,000 | Lack of the controls or precautions required when it entails a serious risk to public health (art. 51.3) |
Those are the limits set by the law, not the fine a bar would get. Control falls to the competent bodies of the autonomous communities (and of Ceuta and Melilla), to local authorities in their areas and to the central State administration for coordination and external health (Ley 17/2011, art. 3.2.a). If you are unsure how it applies in your area, ask the health authority of your autonomous community.
Where to start
- Write your list of real hazards: which dishes (with their allergens), which fridges, which handling operations.
- Decide what you are going to record (temperatures, cleaning, suppliers, training, pests, oil) and how regularly, and stick to it.
- Write down what you do if something fails (for example, a fridge above its temperature) and leave a record that you did it.
- Keep the records and have the documents to hand for when the inspection comes.
For step 2 you don't have to start from scratch: here you prepare the month's sheets to print and fill in by hand, with the temperatures of each cold room, cleaning, goods received and fryer oil. For now the tool is in Spanish.
If you prefer to manage this in an app, Weko is a management tool for hospitality, and we compare it with Yurest and Qamarero, which also handle HACCP. With it or without it, what is decisive is that the records reflect what really happens in your kitchen every day.
This guide is for information only and is not legal advice.
Verifactu in bars and restaurants: when it becomes mandatory and what to do
Verifactu and TicketBAI: how they differ and which one applies to your bar or restaurant
Do you have to list the 14 allergens on the menu of a bar or restaurant in Spain?