A hotel HACCP system applies the seven principles of the Codex General Principles of Food Hygiene (CXC 1-1969, revised in 2020 and 2022) to every food operation on the property under one plan. Each kitchen, buffet, banqueting suite and room service route gets its own flow diagram, critical control points and records, checked against your regulator's limits.
This guide is for executive chefs, F&B directors and hygiene managers who need one system that works across all outlets, with Dubai Municipality's requirements as the worked example.
What does HACCP require of a hotel?
The Codex text has two parts. The first covers good hygiene practices: cleaning, pest control, personal hygiene, water, maintenance and supplier control. The second sets out the HACCP system, its seven principles and the twelve steps used to apply them. Our Codex HACCP guide walks through both parts in detail.
The seven principles are the same for every food business. You analyse hazards, decide the critical control points (CCPs), set validated critical limits and monitor them. You then define corrective actions, validate and verify the plan, and keep the documents and records that prove all of it.
What makes a hotel different is the number of operations under one roof. A single property may run fine dining, a high-volume banqueting kitchen, an all-day buffet, a pastry section, a pool bar, in-room dining and a staff canteen. Each has different foods, holding times and service styles. The HACCP team, usually the executive chef, the hygiene manager, the chief engineer, purchasing and the outlet chefs, has to cover all of them.
Which hotel operations need their own flow diagram?
Codex asks for a flow diagram of each process, confirmed on site. In a hotel the shortcut is to draw one diagram for "the kitchen". It rarely holds up, because the buffet, banqueting and room service routes add steps that an à la carte line does not have.
In AGS's practical view, most properties need separate diagrams for these flows:
- À la carte: receive, store, prepare, cook, serve within minutes.
- Buffet: cook or prepare, hold hot or cold, display, replenish, discard at a set time.
- Banqueting: cook in bulk, cool, store, reheat, hold, transport to the function room, serve.
- Room service: cook, plate, cover, carry through corridors and lifts, serve in the room, collect.
- Cold kitchen and pastry: prepare raw or ready-to-eat items with no later kill step.
- Staff canteen: often cook-chill or batch cooking with long hot holding.
Walk each diagram during a real service, including a peak banquet. Steps that only appear under pressure, such as food staged in a corridor before a function, are the ones that cause failures.
Which steps usually become critical control points?
The hazard analysis decides your CCPs, not a template. In many hotel kitchens the hazard analysis ends up naming cooking, cooling, reheating and hot holding as CCPs, because those are the steps where a temperature failure cannot be corrected later.
Critical limits must come from your regulator or from a validated source. The table uses the Dubai Municipality Food Code as the example, and other authorities set different figures. UK government guidance, for example, tells businesses to keep hot food at or above 63 °C, where Dubai's code sets 60 °C. Use the limits of the authority that licenses your property.
| Step | Limit in the Dubai Municipality Food Code | Typical monitoring record |
|---|---|---|
| Cooking raw food of animal origin | Core temperature at least 75 °C, or an equivalent time and temperature (section 3.2.8) | Cooking temperature log with probe readings |
| Hot holding | At least 60 °C. Holding at or above 60 °C for no more than 4 hours is recommended for quality (section 3.2.10) | Hot holding log, checked at set intervals |
| Cooling after cooking | From 60 °C to 20 °C or less within 2 hours, then to 5 °C or less within a further 4 hours. Use within 72 hours (section 3.2.11) | Cooling log with start, 2-hour and end readings |
| Reheating for hot holding | Internal temperature above 75 °C, within 1 hour, and once only (sections 3.2.13 and 3.2.14) | Reheating log |
| Food held without temperature control | Hot food for immediate consumption no more than 2 hours between 5 °C and 60 °C. Cold food no more than 4 hours, including preparation (section 3.3) | Time labels and discard record |
The code describes 5 °C to 60 °C as the temperature danger zone. Monitoring records are AGS's practical suggestion, not wording from the code.
What changes for buffets, banqueting and room service?
These three are where hotel systems most often break, because food leaves the kitchen and the chef loses sight of it.
Buffets. Where hot holding equipment keeps food at 60 °C or above, the food stays under temperature control. If you use time as the control instead, the Dubai code limits hot food to 2 hours and cold food to 4 hours, then the food is discarded. It also requires such food to be labelled with the time it must be thrown away.
Give one person per buffet the job of checking and recording temperatures and discard times.
Banqueting. Bulk cooking for a function usually means cooling and reheating, which adds two CCPs. Large joints and deep containers of rice cool slowly. The code suggests smaller portions, shallow containers and space for cold air to circulate. Plan cooling capacity before you accept a large booking.
Room service. The risk is time and temperature between the kitchen and the guest. Set a maximum delivery time, use covered and insulated equipment, and record spot temperatures at the door for high-risk dishes. Our HACCP guide for catering operations covers transported food in more depth.
Allergens cut across every outlet. The Dubai code lists nine groups that must be declared on the menu or label, including crustaceans, peanuts, tree nuts, sesame, fish, egg, milk, soy and cereals containing gluten. Outlets that offer allergen-free food must have a competent person on every shift to deal with allergic guests.
What will a Dubai Municipality inspector or auditor expect?
The Dubai Municipality food establishment pages publish the Food Code and its supporting requirements. Section 3 of the Food Code sets out how food safety must be managed. For a hotel, the main points are these.
- A Person in Charge (PIC) certified in food safety. Where high-risk, ready-to-eat or raw food is prepared, a certified PIC must be present on every shift. The certificate is valid for five years.
- A documented food safety programme, approved by Dubai Municipality, kept at the establishment.
- A review of the programme at least once a year, and again after any significant change, justified complaint or incident.
- An audit of the programme by a third-party auditor approved by Dubai Municipality, unless a waiver applies. Audit reports from the last four years must be kept for inspection.
For a hotel with several outlets, the practical test is consistency. An auditor who finds complete logs in the main kitchen and gaps at the pool bar will treat the system as only partly implemented. Other emirates and countries have their own codes, so confirm which authority licenses your property and which version of its code applies.
For other sectors, our HACCP management systems collection lists the sector kits side by side.
How AGS can help
The HACCP Hotels Management System contains 68 editable Microsoft Word documents. It includes a hotel food safety manual, a hotel HACCP plan and study, and 19 procedures, among them buffet and banqueting, room service and allergen management. Its 29 forms include cooking, cooling, hot holding and reheating logs and a room service delivery temperature record. There are also 8 checklists, 5 guidance documents and 3 training documents.
Frequently asked questions
Does each outlet need its own HACCP plan?
Not necessarily. Many hotels keep one HACCP plan for the property with a separate flow diagram and hazard analysis for each operation. What matters is that every outlet's steps are covered and monitored.
Is HACCP certification mandatory for hotels?
That depends on your regulator. In Dubai, the Food Code requires a documented food safety programme and a third-party audit of it. Certification to a standard is a separate step, carried out by a certification body after its own audit.
Who should be on a hotel HACCP team?
Usually the executive chef, the hygiene manager, the chief engineer, the purchasing lead and the chefs who run each outlet. The team needs people who know the equipment and the suppliers as well as the food.
Does buying documentation make a hotel compliant?
No. Documents are a starting point. Compliance depends on how the system runs every day and on what inspectors and auditors find.
This guide is independent. AGS and the referenced kit are not affiliated with, endorsed by or approved by Dubai Municipality, the Codex Alimentarius Commission or any certification body, and they do not guarantee any inspection or audit outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
