A catering HACCP system applies the seven Codex HACCP principles to food cooked in one place and eaten in another, so transport, holding and on-site service become CCP candidates. Codex CXC 39-1993 covers mass catering, and Dubai's Food Code 2013 sets limits such as at least 60 °C for hot food in holding and transport.
This guide is for event caterers, contract caterers running units on client sites, and central kitchens that supply schools, hospitals, camps or offices.
What makes HACCP for catering different from a restaurant kitchen?
The seven principles come from the Codex General Principles of Food Hygiene (CXC 1-1969, revised in 2020 and 2022) and are the same for every food business. You analyse hazards, decide the critical control points (CCPs), set critical limits, monitor them, act on failures, verify the plan and keep records. What changes in catering is the process.
A restaurant usually cooks and serves within minutes. A caterer often cooks hours ahead, then cools, stores, reheats, transports and holds the food before anyone eats it. Each of those extra steps is a point where bacteria can grow if time or temperature slips.
In AGS's practical view, most catering businesses run some mix of four flows, and each needs its own flow diagram confirmed on site.
- Cook and serve on site: a contract unit in a client's building with its own kitchen.
- Cook, hold hot and transport: a central kitchen sending hot meals to a satellite servery or an event.
- Cook, chill, transport and regenerate: food chilled in bulk and reheated at the point of service.
- Cook and freeze: meals frozen centrally and reheated days later.
The hazard analysis has to follow the food out of the kitchen. A plan that stops at the pass leaves the riskiest steps uncontrolled.
What does Codex CXC 39-1993 add for mass catering?
CXC 39-1993 is the Codex Code of Hygienic Practice for Precooked and Cooked Foods in Mass Catering. The Codex Alimentarius Commission adopted it at its 20th Session in 1993. It is still on the Codex list of codes of practice.
Its scope is food prepared for large groups with limited choice: children in schools, older people in care homes or on meals-on-wheels, hospital patients, and people in prisons and similar institutions. That is close to what contract caterers do every day.
The code applies HACCP to these operations and names the critical points. It covers chilling after cooking, chilled and frozen storage, transport, reheating and service. It also asks for each container to be labelled with the production date, food type, establishment and lot number, so a recall is possible.
Two cautions apply. The code is an advisory text, and the Commission leaves it to each government to decide how to use it. It is also older than the 2020 revision of the general Codex hygiene principles. Use it for sector detail, and take your binding limits from the authority that licenses you.
Which steps become CCPs, and whose limits apply?
Your own hazard analysis decides your CCPs. In most catering plans it names cooking, cooling, reheating and hot holding, plus transport where hot or chilled food leaves the kitchen. These are the steps where a failure cannot be put right later.
The table compares the Dubai Municipality Food Code 2013 with Codex CXC 39-1993. They do not always agree. The records column is AGS's practical suggestion, not wording from either text.
| Step | Dubai Municipality Food Code 2013 | Codex CXC 39-1993 | Typical record |
|---|---|---|---|
| Cooking | Core at least 75 °C for raw food of animal origin, or an equivalent (section 3.2.8) | Time and temperature enough to destroy non-sporing pathogens (7.5.1) | Cooking probe log |
| Cooling | 60 °C to 20 °C within 2 hours, then to 5 °C within a further 4 hours (3.2.11) | Centre from 60 °C to 10 °C in under 2 hours, then stored at 4 °C (7.7.2) | Cooling log with start and end readings |
| Chilled storage | 5 °C or below, and cooled food used within 72 hours (3.2.11) | 4 °C or below, and no more than five days including the day of cooking and the day of eating (7.7.4) | Fridge log and date labels |
| Hot holding and transport | At least 60 °C when holding (3.2.10) and in transport (3.6.2) | Vehicles keep heated food at 60 °C or more (7.9.3), and food reaches the consumer at 60 °C or more (7.10.2) | Dispatch and arrival temperature record |
| Reheating | Above 75 °C within 1 hour, and once only (3.2.13 and 3.2.14) | At least 75 °C at the centre within 1 hour of leaving refrigeration (7.10.1) | Reheating log |
| Food out of temperature control | Exceptional use only. Hot food no more than 2 hours, cold food no more than 4 hours, then discarded. Businesses that routinely hold food must use temperature control (3.3) | No equivalent time rule | Time labels and discard record |
The Dubai code treats 5 °C to 60 °C as the danger zone. Where two texts differ, follow your licensing authority. Some caterers simply apply the stricter figure everywhere, an approach our guide to catering rules where the stricter value wins explains.
How do you control food in transport and at the client's site?
Transport is the step generic kitchen plans miss. The Dubai Municipality Food Code sets several rules that apply directly to caterers.
- Food must travel in vehicles approved by the Food Control Department, used only for the foods named in the approval (section 3.6.1).
- Vehicles and containers must keep high-risk food at 5 °C or below, 60 °C or above, or frozen at -18 °C, and carry calibrated monitoring devices (3.6.1 and 3.6.2).
- Caterers supplying cruise ships, desert events and other external events need prior approval from the Department (2.23).
- When food goes to a third party such as an event organiser, the supplier must give the person in charge of the event its handling requirements in writing (2.23).
In practice, record the temperature at dispatch and again on arrival, and set a maximum travel time for each route. At the venue, someone must own hot holding and the discard time for every dish. Our guide to HACCP for hotels covers buffets and banqueting in more depth.
What changes for a contractor running units on client sites?
A contract caterer runs the same system in many kitchens it does not own. The client owns the building and often the equipment. The caterer still answers to the regulator for the food.
Three things deserve their own procedure. First, mobilisation: before a new unit opens, walk the site, confirm each flow diagram, and agree who maintains the fridges, hot cupboards and dishwashers. Second, consistency: one daily unit record and one set of CCP logs across all sites, so a weak unit shows up in review. Third, client reporting: agree what the client receives, such as audit results, complaints and incidents.
In Dubai, each establishment needs a certified Person in Charge on every shift where high-risk, ready-to-eat or raw food is prepared (section 3.1.1). It also needs a documented food safety programme approved by the Municipality and reviewed at least yearly (3.1.3). Unless a waiver applies, the programme is audited by a third party and the reports are kept for four years (3.1.3.2). Caterers that distribute pre-packaged high-risk food must validate its shelf life and get approval (8.2).
Remote and workforce sites add their own hazards. Our guide to HACCP for labour camps covers bulk catering for large workforces.
What records will an inspector ask for?
Annex A of the Dubai code lists the documents every food establishment should keep, where relevant to its activity. For a caterer the most important are these:
- Time and temperature records for receiving and storing high-risk food, cooking, hot and cold holding, and any use of time as a control.
- Calibration records for thermometers and other devices that affect food safety.
- Copies of food transport vehicle permits.
- Certificates for the Person in Charge and food safety training.
- Sick food handler reports, complaint records, the pest control contract and a recall form.
Expect these records to be checked at every unit, not only at the central kitchen.
How AGS can help
AGS has two kits for catering operations, both editable Microsoft Word documents:
- HACCP Catering Management System: 142 documents, including 34 procedures (cooking, cooling and reheating, hot and cold holding, allergens), 45 forms and 23 training documents.
- HACCP Food Service Contractors Management System: 68 documents, including a HACCP plan and study, procedures for food transport and satellite meals and for contract mobilisation, and a food transport temperature record.
Frequently asked questions
Is CXC 39-1993 still current?
It remains on the Codex list of codes of practice. It is an advisory text, so your licensing authority's limits come first.
Do event caterers need a separate HACCP plan for each event?
Usually not. Most keep one plan with flow diagrams for each type of service, then check each venue against it before the event.
Who is responsible for food safety at a client's site?
The caterer runs the food operation and its records. The contract should say who maintains the client's equipment and building.
Does buying documentation make a caterer compliant?
No. Documents are a starting point. Compliance depends on how the system runs every day and on what inspectors and auditors find.
AGS provides independent documentation toolkits. Dubai Municipality, the Codex Alimentarius Commission, FAO and WHO are named for identification only. AGS is not affiliated with, endorsed by or approved by any of them, and no kit guarantees an inspection or audit outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
