FDA issued the 2026 Food Code on 17 September 2026, replacing the 2022 edition and its Supplement as the model code for restaurants and retail food stores. It is not law until a state or local authority adopts it, so your inspector enforces the edition your jurisdiction adopted.
This guide is for food safety managers in US restaurants and retail food stores, and for GCC operators who compare the FDA model with Dubai's code.
Which Food Code edition does your inspector enforce?
FDA states that the Food Code is neither federal law nor federal regulation, and does not preempt state law. About 75 state and territorial agencies and more than 3,000 local departments inspect retail food. Each enforces the code its jurisdiction adopted, often with amendments.
FDA's latest adoption report counts the editions in force on 31 December 2024. Only 7 states had adopted the 2022 edition: Colorado, Connecticut, Illinois, Mississippi, Ohio, Pennsylvania and Utah. Together they held 16.06% of the US population. Adding the 2017 and 2013 editions takes the total to 36 states and 64.64% of the population.
Several large states sit further back. FDA's report lists Texas on the 2017 edition with Supplement and California on the 2005 edition. New York's retail agency is on 2001, and its restaurant agency had adopted no edition. Hawaii and Virginia moved to 2022 in early 2025, after the report's cut-off.
Twelve states split oversight between agencies, so a supermarket and a restaurant in one state can work to different editions. In Florida, the retail agency is on 2017 and the two restaurant agencies are on 2017 and 2013. And 38 of the 62 adopting state agencies keep at least one provision less stringent than their adopted edition. FDA notes that the adoption list is self-reported.
What changed in the 2026 Food Code?
The 2026 edition folds in the Supplement to the 2022 Food Code and the 2025 Conference for Food Protection recommendations. FDA's summary of changes lists every amended section.
The biggest change is paperwork. New section 8-201.15 requires a written Food Safety Management System (FSMS): written procedures, training plans and monitoring records fitted to your operation. It must run during all hours of operation and be available to the regulator on request.
The duty starts four years after your regulatory authority adopts the 2026 Code, not in 2026, and minimal-risk establishments can be exempted. Plan review does not wait: under the 2026 Code, it asks for evidence that an FSMS is developed or being developed (8-201.12(E)).
New section 2-501.11 requires a written employee illness policy covering reportable symptoms, the six reportable diagnoses, and exclusion, restriction and reinstatement. The vomit and diarrhoea clean-up procedure moved from 2-501.11 to new section 2-502.11, so check the cross-references in your procedures.
Food defense is now a defined term. The person in charge must know how to prevent intentional adulteration (2-102.11(C)(18)), and employees must be aware of food defense and report suspicious activity (2-103.11(R)).
A new cooling method allows food at a depth of no more than 2 inches (3-501.15(A)(7)). With regulatory approval, food can also cool uncovered at that depth in a unit at 5 °C (41 °F) or below, with continuous electronic monitoring of time and air temperature (3-501.15(C)). Double gloving can be approved (3-304.15(B)).
Arm and hand jewellery is prohibited during food preparation, except a plain band and medical devices (2-303.11). A new Part 4-10 covers disinfection. Date marking (3-501.17) did not change.
Which core rules does every operator need to know?
A person in charge must be present during all hours of operation (2-101.11). Under 2-102.12, that person must be a certified food protection manager, unless the regulator deems the establishment minimal risk. The 2022 and 2026 wording is the same.
Cooked time/temperature control for safety (TCS) food must cool from 57 °C (135 °F) to 21 °C (70 °F) within 2 hours, and to 5 °C (41 °F) within 6 hours in total (3-501.14). Hold hot food at 57 °C or above and cold food at 5 °C or below (3-501.16). Refrigerated ready-to-eat TCS food held more than 24 hours needs a date mark, 7 days at most, with the day of preparation as Day 1 (3-501.17).
These are FDA's model values. Your adopted code sets the numbers your inspector uses.
The nine major food allergens are milk, egg, fish, crustacean shellfish, tree nuts, wheat, peanuts, soybeans and sesame. Sesame was added under the FASTER Act, effective 1 January 2023. Since the 2022 edition, 3-602.12(C) has required written notification of major food allergens in unpackaged food. A code adopted from an older edition may not include that duty.
What will the inspector ask to see?
Each inspection item carries a risk designation. Priority items, such as cooking and cooling, directly control hazards. Priority foundation (Pf) items, such as training and written procedures, support them. Core items cover general sanitation.
Under the 2026 model, be ready to show these:
- Which agency inspects you, and which edition and amendments it adopted.
- A person in charge on site, with a manager certificate from a program listed by a CFP-recognized accrediting agency (2-102.20).
- Employee illness reporting and exclusion decisions (2-201.11 to 2-201.13) and, under the 2026 model, the written illness policy (2-501.11).
- A written vomit and diarrhoea clean-up procedure (2-502.11).
- Cooking, cooling, holding and reheating checks.
- A date marking system the regulator can understand (3-501.17).
- Written allergen notification, and allergy-awareness training (2-103.11(O)).
- If you hold food on time instead of temperature, written procedures kept on site (3-501.19).
FDA's own studies show where operators fail. In 438 retail store delis observed from 2019 to 2022, 84.0% were out of compliance on holding or time and temperature, 61.9% on handwashing and 35.8% on date marking. Each figure means at least one observed instance per deli, not the share of time a practice failed.
Well-developed food safety management systems go with better results. In 2017 and 2018, fast-food restaurants averaged 4.5 out-of-compliance items with no food safety management system and 1.5 with a well-developed one. Full-service restaurants averaged 5.3 against 2.2. Our guides to HACCP for restaurant chains and to food establishment inspection bodies cover multi-site control and the inspector's side.
How does the FDA model compare with Dubai's Food Code?
Dubai Municipality's Food Code (2013) names codes issued in the United States, among others, as key references. It does not name the FDA Food Code.
Both codes centre on a person in charge. Dubai requires every establishment to run a risk-based food safety programme built on HACCP. The FDA model requires a HACCP plan only where law requires one, for variance processes and for reduced oxygen packaging (8-201.13). The numbers also differ.
| Control | FDA Food Code 2026 (US model) | Dubai Municipality Food Code 2013 |
|---|---|---|
| Hot holding | 57 °C (135 °F) or above (3-501.16) | At least 60 °C (§3.2.10) |
| Cooling cooked food | 57 °C to 21 °C in 2 hours, to 5 °C within 6 hours in total (3-501.14) | 60 °C to 20 °C in 2 hours, then to 5 °C within 4 more hours, 6 hours in total (§3.2.11) |
| Date marking trigger | Ready-to-eat TCS food held more than 24 hours, 7 days maximum (3-501.17) | Ready-to-eat high-risk food in food service held more than 6 hours (§8.1(h)) |
| Allergen list | Nine, including wheat and sesame (1-201.10) | Nine, including sesame and gluten-containing cereals (§3.4.3(b)) |
| Allergens in unpackaged food | Written notification (3-602.12(C)) | Displayed, or given on request (§3.4.3(d)) |
Cold holding is 5 °C under both. Dubai's Food Code 2.0 exists only as a July 2023 final draft, so the 2013 code is in force. If you run a US-brand restaurant in Dubai, name the authority next to every limit in your procedures. Our guide to international restaurant chains covers keeping one system across markets.
How AGS can help
Each kit holds editable Word files and one Excel workbook. Both are built on the 2022 Food Code and note the 2026 edition. Check sections against your code.
- U.S. Restaurant Food Safety Management System (FDA Food Code): 243 documents, including a Food Code applicability assessment and a Time as a Public Health Control Program.
- U.S. Retail & Supermarket Food Safety Management System (FDA Food Code): 254 documents, including a Regulatory Compliance Matrix and 25 illustrative department hazard models.
Frequently asked questions
When will my state adopt the 2026 Food Code?
No adoption is reported yet, because FDA's data runs to the end of 2024. Four state agencies and three territories use automatic short-form adoption, which picks up each new edition without new rulemaking. FDA has not confirmed how that applies to 2026.
When do we need a variance or a HACCP plan?
You need a variance before smoking food to preserve it, curing food, using additives to make food non-TCS, or sprouting seeds, among other processes (3-502.11). Each needs a HACCP plan submitted for approval first (8-201.13). Reduced oxygen packaging without a variance still needs a HACCP plan (3-502.12).
How long do we have to correct a violation?
Priority and Pf items are corrected at the inspection, though the regulator may allow up to 72 hours or 10 calendar days respectively (8-405.11). Core items get an agreed date, no later than 90 calendar days (8-406.11).
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the U.S. Food and Drug Administration, any state or local regulatory authority, or Dubai Municipality. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
