Moving your food-safety management plan to digital: a practical guide

Every food business operator already has a food-safety management plan — in France, a plan de maîtrise sanitaire (PMS). The question is not creating one, but knowing what it must prove, and in what form, on the day an inspection arrives unannounced. This guide does not replace HACCP support; it describes what separates a plan that holds up under inspection from a binder you leaf through hoping everything is there.

The framework, in three figures

Before the detail, the three references that determine what you must be able to produce, and for how long.

• The text: Regulation (EC) No 852/2004 on the hygiene of foodstuffs. It applies to every food business operator — primary production, processing, distribution. There is no size threshold below which you fall outside it.
• What the plan contains: good hygiene practices (GHP), procedures based on the seven HACCP principles, and traceability and non-conformity handling procedures. Four blocks, not one.
• The retention period: information on own-checks and analysis results must be kept for three years after the check was carried out. That figure, more than any other, decides what form your plan must take — three years of paper records is a physical volume to store, protect and retrieve.

One point often misunderstood: establishments engaged in direct supply to the final consumer are not subject to the sanitary approval requirement. That in no way exempts them from the food-safety plan or from Regulation 852/2004 — approval and the plan are two different things, and conflating them makes operators wrongly believe they are out of scope.

What an inspection actually asks for

An inspector does not read a food-safety plan from first page to last. They check, in order, that three things are immediately available:

1. The last few days' records (temperatures, goods-in checks) — not the general principles, the real figures from the last 72 hours.
2. Evidence of a corrective action when a record falls outside thresholds — a deviation with no documented follow-up weighs more heavily than an isolated deviation properly handled.
3. Consistency between the written plan and observed practice — a plan describing a procedure never applied on the floor is a warning sign to an inspector, more than a missing plan.

The seven principles, reduced to five questions

The HACCP method has seven principles, and Regulation 852/2004 is what fixes them — a compliant plan rests on those, not on a shortened version. The five questions below do not replace them: they let you check quickly that an existing plan covers the ground, before going back to the reference principle by principle.

• What are the hazards? Biological, chemical, physical — identified for each process step, not generically.
• Where do they play out? The critical control points (goods-in, cooking, cooling, storage) where a hazard, if uncontrolled, reaches the consumer.
• Which thresholds? A temperature, a delay, a pH — the limit separating a controlled operation from a deviation.
• How do you verify? The frequency and method of recording — who, when, with which instrument.
• What do you do with a deviation? The corrective action planned in advance, not improvised on the day it happens.

What you digitise without changing everything

Going digital does not mean replacing the existing HACCP plan — it remains the reference. Three categories of record gain most from being digitised first, because they are the ones an inspection asks for in priority and the ones where paper loses reliability fastest:

• Temperature records: a paper logbook filled in at the end of the day "from memory" is worth nothing against a record timestamped at the moment of measurement. A sensor or a mobile entry at the point of the check is enough — no need for an expensive connected probe to start.
• Corrective actions: the part most often missing from a paper plan. A deviation noted without what followed (product withdrawn? relabelled? destroyed?) is an incomplete file in an inspector's eyes.
• Staff records: HACCP training completed, medical checks, authorisations — documents scattered across several binders that ought to be searchable in one query.

What can stay as it is: the HACCP plan itself (the hazard analysis document rarely changes), formalised cleaning procedures, supplier technical sheets already archived reliably.

Structuring records so they hold up under inspection

A digital record is only useful if it answers three questions without manual searching:

• Who took this measurement, and when — a real timestamp, not a date entered afterwards.
• Whether the measurement is within thresholds — a deviation must be immediately visible, not buried in a list of figures.
• If there was a deviation: which action followed, and who signed it off.

A shared spreadsheet can suffice at this level, provided the timestamp cannot be altered after the fact — which is precisely what an ordinary spreadsheet does not guarantee, and what an experienced inspector knows to check.

Common mistakes

• Records filled in as a block, after the fact. A run of temperatures all identical, entered at the same time for a whole week, is spotted immediately — and discredits the entire file, not only the suspect records.
• Photocopies as the sole evidence. A photocopy proves neither the real date of the record nor the absence of later modification.
• Untracked non-conformities. A product rejected at goods-in with no written record of the reason or the decision (returned? destroyed?) leaves a gap an inspector notices.
• An HACCP plan never updated after a change of process, supplier or premises — the document no longer matches the actual activity.

Starting checklist

1. Check that the plan covers all four blocks: good hygiene practices, procedures based on the seven HACCP principles, traceability, non-conformity handling.
2. List the critical points already identified in the existing HACCP plan.
3. Choose a first scope to digitise — temperature and corrective actions, in priority.
4. Define who records, at what frequency, with which instrument.
5. Formalise the corrective-action procedure before the first deviation, not after.
6. Check that archiving holds for three years — that is the retention period for own-checks and analysis results, and it is what makes paper expensive.
7. Check that the history stays consultable and cannot be altered after the fact.
8. Run a mock inspection: produce the last 72 hours of records in under five minutes.

Sources

• Regulation 852/2004 — food hygiene, DGCCRF — scope and principles.
• Food hygiene regulation, French Ministry of Agriculture — composition of the plan, approval and direct supply.
• Plan de maîtrise sanitaire, DRAAF — detailed content and record retention.

Verified 17 August 2026. This guide replaces neither HACCP support nor your sector's good hygiene practice guide.