Cold Chain Compliance in the UK: HACCP, SFBB, and the Complete Regulatory Map

The UK regulatory landscape: which laws apply, and to whom

Cold chain compliance in the UK is not governed by a single piece of legislation. It is the product of overlapping legal frameworks, each operating at a different level of the food supply chain. Regulation (EC) No 852/2004 on the Hygiene of Foodstuffs remains operative in UK law following the Food Safety and Hygiene (England) Regulations 2013 and equivalent legislation in Scotland, Wales, and Northern Ireland. Despite Brexit, the substantive requirements from retained EU food hygiene law continue to apply. For cold chain purposes, the critical obligation from this framework is that food businesses must implement, maintain, and review food safety management procedures based on HACCP principles.

The Food Safety and Hygiene (England) Regulations 2013 — commonly called the 2013 Regulations — are the domestic statutory instrument that gives teeth to the temperature control requirements. Regulation 30 establishes the core chill-holding requirement: chilled foods that are likely to support the growth of pathogenic microorganisms or the formation of toxins must be held at 8°C or below. Regulation 31 covers hot holding: food being kept hot must be maintained above 63°C. These are legally mandated temperature thresholds, enforced by EHOs under the Food Standards Act 1999.

The Quick Frozen Foodstuffs Regulations 1990 (as amended) govern frozen food specifically, requiring that quick-frozen food must be maintained at -18°C or below during storage and transport. This is a separate legal instrument from the general hygiene regulations, and it applies throughout the supply chain — not just at point of sale. The short-term excursion tolerance to -15°C applies only during transport and retail display, not during storage.

Beyond statute, two industry frameworks carry quasi-legal commercial weight. BRCGS Food Safety certification is required by major UK retailers including Tesco, Sainsbury's, and Marks & Spencer as a condition of supply. The Cold Chain Federation / BRCGS Joint Technical Guidance on Temperature-Controlled Food Storage and Distribution (2021) is cited by EHOs, insurers, and buyers' technical teams as the benchmark for what 'good' looks like.

Temperature requirements: what is legally mandated

The core UK temperature requirements by food category: chilled ready-to-eat foods must be stored and transported at 8°C or below (5°C recommended, and commonly required by buyer codes of practice). Raw meat and poultry: 8°C or below legally, 3°C recommended. Fish and shellfish: 8°C or below legally, 0–2°C recommended. Dairy: 8°C or below. Quick-frozen foods: -18°C or below for storage and transport, with a limited short-term excursion tolerance to -15°C during transport only. Hot-held foods: 63°C or above.

The legal maximum for chilled storage is 8°C, but best practice guidance from the Chilled Food Association and the Cold Chain Federation consistently recommends maintaining chilled foods at 5°C or below. Many BRCGS and retailer codes of practice set 5°C as their operational maximum. For compliance purposes, you must meet the legal 8°C threshold; for audit purposes and to create meaningful safety margin, you should operate to 5°C.

Cook-chill foods after cooking must cool to 8°C within 1.5–4 hours (per the Chilled Food Association Industry Guide to Good Hygiene Practice) before being stored at 8°C or below. Continuous monitoring during the cooling phase is the most reliable way to demonstrate compliance with this requirement — manual checks at intervals cannot capture a cooling curve.

HACCP applied to cold chain: CCPs, critical limits, and monitoring procedures

HACCP — Hazard Analysis and Critical Control Points — is the systematic, science-based approach to identifying and controlling food safety hazards. Under UK food law, any food business handling open food is required to have a documented HACCP-based food safety management system. For cold chain operations, this is not optional. It is a legal requirement.

The five universally relevant cold chain CCPs are: Receiving (incoming chilled at ≤8°C, frozen at ≤-18°C, with documented monitoring, defined corrective action on out-of-spec deliveries, and verification records); Cold Storage (the monitoring requirement is that temperature is controlled and evidenced — not just checked, with systematic gap-free records); Processing and Handling (time-temperature exposure during open-food handling must be tracked); Distribution and Transport (pre-loading temperature verification, journey logs, defined corrective actions for excursions, and vehicle calibration evidence); and Display and Point of Sale (chilled at ≤8°C or hot at ≥63°C throughout display).

Best practice is to set an operational action limit inside the critical limit to allow corrective action before a legal breach occurs. For example: set an alert at 6°C for chilled storage, with the legal critical limit at 8°C. This gives the team time to investigate and correct before the CCP is breached — and the alert-to-action record is itself evidence of a functioning HACCP system.

Where SFBB fits for smaller operators

Safer Food Better Business (SFBB) is the FSA's pre-built food safety management system, designed for small catering businesses — primarily restaurants, cafes, takeaways, and small retailers — that do not have the resources to develop a bespoke HACCP system. SFBB is not a replacement for HACCP. It is a documented, pre-validated HACCP-based system that the FSA has developed on behalf of small operators.

For cold chain purposes, SFBB includes opening and closing temperature checks for refrigerators and freezers, delivery checks with temperature verification, safe methods for chilled storage and hot holding, and diary pages for recording checks and corrective actions. The SFBB system is adequate for small food businesses with limited cold chain exposure — a café that receives two deliveries a week, stores food in two refrigerators, and serves it the same day. It is not adequate for a food manufacturer, a distribution centre, or any operation with multiple vehicles, extended journey times, or high-volume chilled or frozen storage.

The key distinction EHOs draw is between operators who are using SFBB because it is genuinely appropriate for their scale and complexity, and operators who are using SFBB because it is easier than developing a proper HACCP system for a more complex operation. The former is compliant. The latter is not — and an experienced EHO will identify it quickly.

The monitoring frequency problem: why manual checks create evidence gaps

Here is the structural problem that most food businesses share: twice-daily manual temperature checks capture less than 1% of the day's temperature profile. A refrigerator checked at 8:00am and 4:00pm generates two data points in a 24-hour period — 0.14% coverage. In between those two checks, the compressor could fail, the door could be propped open, a hot batch of product could be loaded, or the ambient temperature could spike. None of these events would appear in the temperature record.

This is not a theoretical concern. EHOs are trained to look for the gap between what the temperature log shows and what the temperature history of the product actually was. When a food safety incident occurs — a consumer complaint, a reported illness, a product recall — the first question from enforcement authorities is: 'What does your temperature evidence show?' If the answer is twice-daily manual checks, the evidence window is insufficient to demonstrate that control was maintained between checks.

Manual temperature checks are also subject to the observation effect: temperatures recorded when someone is paying attention to them are systematically different from temperatures at other times. A refrigerator checked after the door has been closed and undisturbed for two hours will show a different temperature than one that has had thirty door openings in the hour before the check. The manual record captures the former and is silent on the latter.

What continuous monitoring actually looks like vs twice-daily logs

For compliance purposes, continuous monitoring means a system that records temperature at a frequency sufficient to demonstrate that the critical limit was not breached between data points. A continuous monitoring system must: record at defined intervals (typically every 5–15 minutes for storage, every 5 minutes for transport); generate tamper-evident records automatically rather than by manual entry; trigger real-time alerts when temperatures approach or breach critical limits; retain records for the required period in storage that cannot be edited or deleted; and use calibrated sensors with traceable calibration records.

A twice-daily manual check system produces a spreadsheet or paper log with two rows per sensor per day. A continuous electronic monitoring system produces a time-series record with hundreds of data points per sensor per day, automatically timestamped, with associated alerts and corrective action logs. When an EHO visits, the difference in evidential quality is immediately apparent. A paper log with two entries per day can be reviewed in seconds. A continuous electronic record requires examination — and this is precisely its value. It demonstrates that monitoring was happening whether or not someone was present, and that excursions were identified and addressed.

BRCGS requires a minimum of 12 months for temperature record retention; the Cold Chain Federation recommends two years for distribution records. Electronic records stored in a system where they cannot be edited or deleted satisfy both requirements by design.

Building a compliant cold chain evidence trail

Compliance is not just about controlling temperatures. It is about being able to demonstrate, to any competent authority, that temperatures were controlled at every stage, over any period, with a documented response to every deviation. This is what the evidence trail requirement means in practice.

The five components of a compliant evidence trail are: continuous timestamped temperature records from calibrated sensors at every CCP; calibration records documenting that every monitoring device has been calibrated against a traceable standard at the frequency specified in the HACCP plan; corrective action records for every temperature excursion documenting the nature and duration, the cause, the immediate action, the product disposition decision, and the preventive action; verification records confirming the monitoring system is functioning correctly (including trend review and internal audit); and audit-ready reports — the ability to produce a complete temperature history for any product at any point in the cold chain, from receipt to dispatch or sale, at short notice.

Of the five components, corrective action records are the most frequently inadequate. It is common to find businesses with reasonable temperature records but minimal corrective action documentation — creating a paradox where the temperature data shows excursions but the corrective action record is empty. This is worse than having no monitoring: it is evidence that the business knew problems were occurring and did not respond to them. A corrective action record for a routine excursion needs to record what happened, what was done, and who was responsible. For a significant excursion, it needs to document the product disposition decision, the maintenance action, and any notification required.