Tempo di lettura: 10 minuti
HACCP training and food safety culture: what Regulation (EU) 2021/382 requires
HACCP training can no longer be proven with a signature sheet alone: since March 2021, EU law has required food businesses to maintain a food safety culture and provide evidence of it, and both IFS standards and the Codex Alimentarius ask companies to check that training actually works.
HACCP training is a legal obligation for every food business in the European Union: Regulation (EC) 852/2004 requires food handlers to be trained in hygiene and those who maintain the system to be trained in HACCP principles.¹ In Spain, that responsibility has sat directly with the company since 2010, when the food handler card was abolished.³
What has changed in recent years isn't the obligation, but the proof. A record with names, a date and a signature shows that a session took place; it doesn't show that the operator on the packing line knows what to do when the metal detector rejects a batch. In this article we cover what the rules require today, what training each role needs, and a five-step framework to keep HACCP training up to date and be able to prove it.
The food and drink industry employs 598,500 people in Spain, and 95.9% of its 27,312 companies have fewer than 50 employees.⁷ All of them, whatever their size, are subject to the same regulatory framework:
| Regulation | What it requires on training | Who it applies to | How it's proven |
|---|---|---|---|
| Regulation (EC) 852/2004, Annex II, Chapter XII | Supervision and instruction or training of food handlers in hygiene, in line with their work; training in HACCP principles for those who maintain the system | Every food business operator | To official control authorities |
| Regulation (EU) 2021/382 | A food safety culture backed by evidence; management must ensure staff are adequately trained and supervised | Every operator, proportionate to its size | Evidence of culture: commitment, communication, verification |
| Spanish Royal Decree 109/2010 | Abolishes the food handler card and shifts responsibility for training to the company | Food businesses in Spain | During official control visits |
| Codex Alimentarius CXC 1-1969 | Periodically assess training effectiveness, review it and keep records | International HACCP reference | Records and verification |
| IFS Food v8, section 3.3 | Documented programmes with effectiveness evaluation, appropriate language and training before starting work | IFS-certified companies | Certification audit |
The piece that has changed the picture most is Regulation (EU) 2021/382, which is why it gets its own section.
Regulation (EU) 2021/382 added a new chapter, XI bis, to Annex II of 852/2004, applicable since 24 March 2021. Its opening line changes the nature of the obligation: food business operators must establish and maintain an appropriate food safety culture, and provide evidence of it.²
The text sets out what that culture must include:
The regulation also defines what management commitment includes. Among other points, management must verify that controls are carried out on time and efficiently and that documentation is up to date, ensure that staff are adequately trained and supervised, and encourage continuous improvement of the food safety management system.²
Finally, implementation must take into account the nature and size of the food business. A 12-person bakery doesn't need the same rollout as a 600-person plant, but both have to be able to show evidence.
| Chapter XI bis requirement | What it means for training | Evidence the company can show |
|---|---|---|
| Hazard awareness among all workers | Each role knows the hazards and controls that affect it, not a general syllabus | Role-by-control matrix and verification results per person |
| Communication of deviations | Operators can recognize a deviation and know who to tell | Records of deviations reported from the line, not just by quality |
| Adequate training and supervision | Initial training before work and on-the-job supervision | Training record with date, content and practical check |
| Up-to-date documentation | Training changes when the HACCP plan changes | Date of each training piece's last review compared with the plan's |
| Continuous improvement | Deviations and audits feed back into training | Training actions opened after incidents or non-conformities |
None of these pieces of evidence is a signature sheet. That's the practical difference between complying with the 2004 regulation and complying with the 2021 one.
The regulation doesn't set hours or syllabuses: it requires training in line with each person's work activity.¹ That means every company has to decide what each role needs to know. A practical way to organize it:
| Role | What they need to be able to do | When to train | How to verify it |
|---|---|---|---|
| Line food handler | Personal hygiene, prerequisites, the CCP controls for their station and what to do when there's a deviation | Before starting and every time their CCP changes | On-the-job observation and questions about specific cases |
| Shift lead | CCP monitoring, records, corrective actions and when to stop the line | On taking the role and with every plan review | Record reviews and deviation simulations |
| HACCP team | The Codex's 7 principles and 12 steps, hazard analysis, validation and verification | Full initial training and periodic updates | Review of the HACCP plan itself and its verifications |
| Cleaning and maintenance | Cleaning and disinfection plans, foreign body control, work in production areas | Before entering production areas | Cleaning verification and equipment release checks |
| Temporary and external staff | Basic hygiene rules and the controls for their specific task |
The last row is the one that fails most often in practice. The IFS standard explicitly requires temporary and seasonal staff, and staff from external companies, to be trained before they start work.⁸ In a company with seasonal peaks, that means training dozens of people in a few days, often in several languages.
The usual HACCP training model in many companies is one annual session, a PowerPoint and a signature sheet. It meets the letter of the 2004 rules, but falls short of what today's reference texts ask for:
None of the three is satisfied by knowing that someone attended. All of them ask whether the person can apply the control. We call that difference Competence Verification: measuring whether the operator can carry out the critical task, not whether they completed the course. We go deeper in our guide to assessing real competence after training.
A signature sheet proves training happened; a food safety culture is proven when any operator can explain and apply the critical control at their station.
This framework starts from the company's own HACCP plan, not a generic syllabus. That way, every training piece is tied to a specific hazard, control and role.
Review the flow diagram and the plan's HACCP control chart, and assign every CCP and prerequisite to the role that controls it. The result is a role-by-control matrix: the packer needs to master the metal detector and allergen label checks; the cooking operator, temperature records and the corrective action.
A 60-page HACCP plan can't be taught in one session. It's taught in 3 to 5 minute pieces, one per control, showing the right action, the record and the response to a deviation. Converting written procedures into short visual modules, which platforms like Vidext automate from the source document, narrows training down to what each person actually has to do.
Initial training has to be available on day one, in the person's language, without depending on a trainer being on that shift. For a workforce with several nationalities, that means having every piece translated with the plant's technical terminology, not just generic subtitles.
After each piece, ask questions about specific cases ("the log shows 3 °C above the limit, what do you do?") and, for CCPs, have the shift lead run a practical check at the station. The resulting record no longer says "attended", but "showed they can apply control X on date Y".
The Codex anticipates that re-training may be part of the corrective actions for some deviations.⁴ Every HACCP plan review (a new supplier, a recipe change, new equipment) should trigger an update of the affected pieces and their reassignment to the roles that need them.
An example: the HACCP team at a ready-meals plant decides to cut the maximum blast-chilling time on one line from 120 to 90 minutes. With classroom training, the change reaches the three shifts whenever there's a slot for a session, sometimes weeks later. With modular pieces, the blast chiller module is updated, reassigned to the 14 operators on that line, and within 48 hours the record shows who has verified the new limit and who hasn't.
Spain's Food Safety Law 17/2011 classifies failing to meet food handler training requirements as a minor infringement, with fines of up to 5,000 euros.⁵ Seen that way, the risk looks small. It isn't, for two reasons:
The bigger cost, in any case, isn't the fine: it's the recalled batch, the retail customer that suspends orders, or the failed IFS audit. Training is the part of the system that's cheapest to fix before something happens.
If you want to see this approach applied to a specific risk, we've covered it for allergen and cross-contamination training.
HACCP training has gone from a card-based formality to a direct responsibility of the company, and from there to a culture requirement backed by evidence. EU law, the Codex and private standards share the same thread: delivering training isn't enough; you have to check it works and keep it current when the plan changes.
The companies that get it right aren't the ones that log the most training hours, but the ones that have turned every critical control into a piece that updates with the plan and gets verified at the station. You can see how it's set up in a demo, but the real test is simpler: ask any operator what they do if their CCP deviates. If the answer comes straight away, the culture exists.
Yes. Regulation (EC) 852/2004 requires every food business operator to train food handlers in hygiene in line with their work, and to train those who develop and maintain the system in HACCP principles. It applies directly in Spain.
No. Royal Decree 109/2010 repealed Royal Decree 202/2000, which regulated the card. Since then, the company is responsible for training its food handlers and must prove it during official control visits. It's worth checking with your regional health authority whether any additional sector-specific requirement applies.
It's the requirement Regulation (EU) 2021/382 added to 852/2004: commitment from management and all employees to producing safe food, awareness of hazards among all workers, open communication about deviations, and sufficient resources. The company must provide evidence of it, proportionate to its size.
The regulations don't set a frequency. The Codex recommends reviewing and updating programmes when needed and assessing their effectiveness periodically. In practice, it makes sense to update training every time the HACCP plan is reviewed and to reinforce it after a deviation.
According to the Codex Alimentarius: hazard analysis and control measures, determining critical control points, validated critical limits, a system to monitor CCPs, corrective actions, validation of the plan and verification procedures, and documentation and records.
Section 3.3 of IFS Food v8 requires documented programmes covering content, frequency, languages and a qualified trainer; training before starting work (including temporary and external staff); signed records; and a procedure to prove training effectiveness.
Law 17/2011 classifies it as a minor infringement, with fines of up to 5,000 euros. If the training failure leads to an absent or deficient self-control system, the infringement can be serious (5,001 to 20,000 euros) or very serious (20,001 to 600,000 euros), depending on the risk to health.
Yes. The regulations require training suited to the work, not a specific format. What matters during an inspection or audit is being able to show what was trained, to whom, when and with what result. A digital format makes that record easier to keep.
¹ Regulation (EC) No 852/2004 on the hygiene of foodstuffs - EUR-Lex ² Commission Regulation (EU) 2021/382 - Official Journal of the European Union ³ Real Decreto 109/2010 - BOE ⁴ General Principles of Food Hygiene CXC 1-1969 (2022 edition) - Codex Alimentarius FAO/WHO ⁵ Ley 17/2011, de 5 de julio, de seguridad alimentaria y nutrición - BOE ⁶ Programa 1: Inspección de establecimientos alimentarios 2024 - AESAN ⁷ Informe anual de la industria alimentaria española 2025 - Spanish Ministry of Agriculture, Fisheries and Food ⁸ IFS Progress Food v3 - IFS Food v8 checklists comparison - IFS
| Before starting work |
| Practical check on day one |
Programma di promozione dell'assunzione a tempo indeterminato di giovani qualificati, nell'ambito del Sistema Nazionale di Garanzia Giovani. Vidext ha ricevuto una sovvenzione di 25.401€, concessa da LABORA (Servizio Valenciano per l'Impiego e la Formazione), per l'assunzione a tempo indeterminato nel 2024 di giovani qualificati iscritti al Sistema Nazionale di Garanzia Giovani, azione suscettibile di cofinanziamento da parte del Fondo Sociale Europeo Plus (FSE+) 2021-2027 o di qualsiasi altro fondo dell'Unione Europea. Expediente ECOGJU/2024/550/46. La presente pubblicazione è effettuata in adempimento degli obblighi di trasparenza stabiliti dalla Legge 19/2013, del 9 dicembre.
