HACCP by Business Type

HACCP Plan for a Bakery: Allergens, Baking & Display Controls

HACCP for Bakeries: From Mixing to Display Cabinet

Bakeries present a distinctive combination of food safety hazards. Wheat flour - one of the 14 declarable allergens - is the primary ingredient in almost everything you produce, making allergen cross-contact with "free-from" products a constant challenge. Cream-filled and custard-based products support rapid bacterial growth if temperature-controlled incorrectly. Display cabinets must maintain appropriate temperatures for products with very different requirements sitting side by side. And the baking process itself, while generally effective at destroying pathogens, must be validated to ensure that the centre of dense products reaches a safe temperature. Your HACCP plan must address all of these bakery-specific hazards alongside the standard requirements of EC Regulation 852/2004.

Key takeaways

Flour dust makes allergen cross-contact a constant risk - be honest about what you can guarantee as "gluten-free."

Validate baking temperatures by probing the core of dense products, not just relying on oven settings and time.

Cream and custard-filled products must be cooled to below 8C within 90 minutes and refrigerated immediately after assembly.

Display cabinets holding chilled products must operate below 8C and be monitored at least twice daily.

PPDS labelling under Natasha's Law applies to wrapped bakery products even if made on the same premises.

Allergen Controls in a Flour-Based Environment

Flour dust is airborne and settles on every surface in a bakery. This makes allergen contamination of gluten-free products extremely difficult to prevent unless you have dedicated equipment, dedicated preparation areas, or scheduled production with thorough cleaning between runs. Your HACCP plan must be honest about what you can and cannot guarantee. If you produce both wheat-based and gluten-free products in the same bakery, you must either: demonstrate validated cleaning procedures that remove gluten to below 20 parts per million (the threshold for "gluten-free" labelling under UK law), use dedicated equipment and a physically separated area for gluten-free production, or declare "may contain wheat/gluten" on your products and not claim them as gluten-free. Beyond gluten, bakeries commonly use multiple allergens: milk, eggs, soya (in margarines and release agents), sesame (increasingly common in bread), and tree nuts in cakes, pastries, and decorations. Your allergen matrix must cover every product, and your production schedule should be organised to minimise cross-contact - for example, producing nut-free products before nut-containing ones, with cleaning between runs.

Baking Temperature Validation and Cooling Controls

The baking process is generally sufficient to destroy vegetative pathogens, but this should not be assumed - it must be validated. Dense products like fruit cakes, large loaves, and filled pastries may not reach 75C at the centre even when the exterior appears fully baked. Validate your baking process by probing the core temperature of representative products from each category during commissioning and periodically thereafter (at minimum quarterly or when recipes or oven settings change). Record the results. Cooling after baking is a critical control. Products containing dairy-based fillings (custard, fresh cream, cream cheese) must be cooled to below 8C within 90 minutes and then refrigerated. Ambient-stable products (bread, unfilled pastries, biscuits) can be cooled at room temperature but must be protected from contamination during cooling - cover with clean cloths or use dedicated cooling racks in a clean area away from raw ingredient handling. Cream and custard preparation are specific CCPs: custard must be cooked to at least 75C to ensure egg safety, then cooled rapidly. Cream must be stored below 8C at all times. Products filled with cream or custard after baking must be refrigerated immediately after assembly.

Display Cabinet Management and Shelf Life

Bakery display cabinets often hold products with very different temperature requirements. Cream cakes and custard tarts must be below 8C. Bread and ambient pastries do not require temperature control but must be protected from contamination. Displaying chilled and ambient products in the same cabinet is acceptable only if the entire cabinet operates at the temperature required by the most sensitive product (i.e. below 8C). Your HACCP plan should specify: which products require chilled display, the monitoring frequency for display cabinet temperatures (at minimum at opening and midday), and the action to take if the temperature exceeds 8C (remove chilled products immediately, investigate the cause, and only return products when the cabinet is back below temperature). Shelf life determination is a critical element of bakery HACCP. Products containing fresh cream have a short shelf life (typically 24-48 hours at 2-5C). Bread and unfilled pastries may last 2-3 days at ambient. Your HACCP plan must document the shelf life for each product category, supported by evidence (supplier guidance, industry standards, or your own microbial testing for novel products). Label products with production dates and enforce shelf-life limits rigorously.

HACCP by Business Type

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

PPDS Labelling and Retail Bakery Requirements

If you sell products prepacked for direct sale (PPDS) - wrapped sandwiches, boxed cakes, bagged pastries packed before the customer selects them - Natasha's Law requires full ingredient lists with the 14 allergens emphasised. This applies even if you made the product on the same premises. Your HACCP plan should include the labelling process as a control point: who creates labels, how recipes are translated into ingredient lists, how accuracy is verified (particularly when recipe changes occur), and the corrective action if a labelling error is discovered. For wholesale bakeries supplying other businesses, you must provide allergen information with every delivery. This is typically done through product specification sheets listing all ingredients with allergens identified. Keep these specifications current and issue updates to all customers when recipes change. Your HACCP records should include evidence that customers have been notified of allergen changes. The Food Information Regulations 2014 require that allergen information is accurate, up-to-date, and available at the point of sale - whether that is your own bakery counter or a cafe 20 miles away that buys your cakes.

What to do next

Validate your baking process for dense products

Probe the core temperature of your densest products (fruit cakes, large loaves, deep-filled pies) during baking. Record the results and repeat quarterly or when recipes change. Ensure all products reach at least 75C core.

Organise your production schedule to minimise allergen cross-contact

Schedule gluten-free and nut-free production runs first each day, before wheat-based and nut-containing products. Clean and sanitise all equipment between allergen changeovers and document the cleaning.

Common mistakes to avoid

Mistake

Claiming products are "gluten-free" without validated cleaning procedures

Instead

Unless you can demonstrate that gluten residues are below 20ppm after cleaning (validated by testing), do not label products as gluten-free. Use "may contain" declarations and be transparent with customers.

Mistake

No shelf-life documentation for cream-filled products

Instead

Every product containing fresh cream, custard, or other high-risk fillings must have a documented shelf life. Label with production date and discard time. Cream cakes are typically 24-48 hours at 2-5C.

Frequently asked questions

Do I need a separate HACCP plan for my bakery if I also have a cafe counter?

No, but your HACCP plan must cover both operations. The bakery production side has different CCPs (baking validation, cooling, allergen production scheduling) from the cafe service side (display temperatures, PPDS labelling, customer allergen communication). Include both in a single plan.

How do I handle "may contain" declarations for bakery products?

Precautionary allergen labelling ("may contain") should only be used after a thorough risk assessment shows that cross-contact is a real risk despite your controls. It is not a substitute for good allergen management. The FSA discourages overuse of "may contain" as it restricts food choices for people with allergies unnecessarily.

What temperature should I bake bread to?

Standard bread is typically baked at oven temperatures of 200-230C, and the internal temperature of a finished loaf usually reaches 90-100C - well above the 75C pathogen destruction point. However, enriched breads (brioche, panettone) with high fat and sugar content should be validated by probing, as these ingredients affect heat transfer.

HACCP by Business Type