Food Safety Management System for Restaurants: What the 2026 Food Code Requires
Quick answer: a food safety management system is a restaurant's own written set of procedures, training plans, and monitoring records for preventing foodborne illness. Under the 2026 FDA Food Code, every food establishment needs one within four years of its state or local health department adopting the 2026 code (§8-201.15). It has to be kept up to date, used during all hours of operation, and shown to the inspector on request. Places the health department considers minimal risk can be exempted.
In practice it means writing down how your kitchen handles the checks a person in charge already oversees, such as cooking, cooling, holding, receiving, sanitizing, and employee health, training staff on them, and keeping the logs that show they happen. Here's what the code says and how to build one.
What the Food Code Means by a Food Safety Management System
The 2026 Food Code defines it in two parts (§1-201.10). It is "a specific set of actions taken by the employee to prevent the occurrence of foodborne illness risk factors based on the type of operation, type of food preparation, and food prepared," and it "includes written procedures, training plans, and monitoring records to control specific operational steps" that contribute to foodborne illness.
Because it's based on what each kitchen actually does, no two systems look the same. A coffee shop's is short; a full-service restaurant that cooks, cools, and reheats food needs more. FDA first added the requirement in its December 2024 Supplement to the 2022 Food Code, and the 2026 edition makes it part of the code.
When Is It Required?
Section 8-201.15 says that within four years of the health department adopting the code, a written food safety management system shall be:
- developed and maintained to ensure compliance with the person in charge's duties in §2-103.11;
- implemented in the food establishment during all hours of operation; and
- made available to the health department on request.
The health department can exempt establishments it considers minimal risk, based on the type of operation and how much food preparation it does (§8-201.15(B)). Plan review changes too: when a restaurant is built, converted, or remodeled, the plans it submits to the health department now have to include evidence that a food safety management system is developed or being developed (§8-201.12(E)).
The four-year clock only starts when your state or local health department adopts the 2026 code (or the 2024 Supplement to the 2022 code), which most haven't yet. See which Food Code edition your state uses.
Why FDA Added It
The Food Code's Annex 3 points to FDA's Retail Food Risk Factor Study: restaurants with well-developed, documented systems, meaning complete, consistent, and mostly written, had significantly fewer food safety practices out of compliance. The study found these systems were the strongest predictor of out-of-compliance items in both fast-food and full-service restaurants, and that keeping the documentation up was vital to their success.
The Three Parts
Annex 3 explains each part of the definition:
- Written procedures: the steps management adopts for doing a task safely, written so employees can use them as a reference. They can be standard operating procedures, recipe cards with process instructions, wall charts, wallet cards, or an employee health policy. The goal is to describe who, what, where, when, and how each activity is done.
- Training plans: how employees learn those procedures, by computer-based training, on-the-job training, demonstrations, wall charts, or other methods, and how often. Training should be documented.
- Monitoring records: routine observations and measurements that show the procedures are followed, such as logs, charts, checklists, or automated temperature systems, also stating who, what, where, when, and how. The goal is a system that can be verified.
The section that will list the required contents of a food safety management system (§8-201.16) is still marked "reserved," so the code doesn't yet prescribe a format. Build yours around the person in charge's duties below.
What It Has to Cover
The system has to ensure compliance with §2-103.11, the list of things the person in charge makes sure of to maintain "active managerial control" of foodborne illness risk factors. Here are the duties most restaurants write procedures for, with the record that shows each one happens:
| Duty | Your written procedure covers | Monitoring record |
|---|---|---|
| Employee health (P) | What employees report, exclusion and restriction, return to work | Signed reporting agreements, illness log (see our employee illness policy guide) |
| Handwashing (D) | When and how staff wash hands, and how managers check | Manager observation checklist |
| Receiving (E, F) | Approved sources, delivery temperatures, after-hours deliveries | Food receiving log |
| Cooking (G) | Final cooking temperatures, checked with calibrated thermometers | Cooking temperatures; thermometer calibration log |
| Cooling (H) | Cooling methods and the 2-hour and 6-hour limits | Food cooling log |
| Hot and cold holding (I) | Holding temperatures and how often they're checked | Holding log, fridge and freezer log |
| Thawing (J) | Approved thawing methods | Temperature checks during thawing |
| Sanitizing (L) | Sanitizer concentration, temperature, and contact time | Sanitizer log |
| No bare-hand contact (N) | Utensils and gloves for ready-to-eat food | Manager observation checklist |
| Consumer advisory (K) | Menu advisory, if you serve raw or undercooked animal foods | Menu review |
| Training (O) | Food safety training for each job, including food allergy awareness | Training records |
| Written plans (Q) | Keeping required written procedures current, such as the vomit clean-up procedure | Review dates |
| Food defense (R) | Watching for tampering and reporting suspicious activity | Training records |
The rest of §2-103.11 covers keeping unnecessary people out of the kitchen, making sure visitors such as delivery and maintenance workers follow the code, not operating out of a living space, and reminding self-service customers to take clean plates.
Is It the Same as a HACCP Plan?
No. A HACCP plan is a formal plan the health department has to approve before you start certain specialized processes, such as reduced oxygen packaging or processes that need a variance, like curing or smoking food to preserve it (§8-201.13). Most restaurants never need one. A food safety management system is broader and simpler: it covers the everyday risk factors in every kitchen. It borrows the HACCP idea of setting limits and monitoring them, but doesn't require a formal hazard analysis. If you do need a HACCP plan, it becomes one of the written procedures in your system.
How to Build One
- Check your timeline. Find out which Food Code edition your health department enforces and whether it plans to adopt 2026. Your deadline is four years after adoption.
- Map your operation. List what your kitchen actually does, from receiving to serving, and match it to the duties above. Leave out what doesn't apply, such as a consumer advisory if nothing is served raw or undercooked.
- Write a short procedure for each step: who does it, what they do, where, when, and how, and what to do when a limit is missed. Our free food safety plan template lays this out on one page, with a filled-in sample.
- Set up the monitoring records. Logs for cooling, holding, receiving, sanitizer, and thermometer calibration cover most kitchens; our free log templates are a ready-made start.
- Train staff and write it down. Note who was trained on what, and when.
- Keep it where the person in charge can reach it during every shift, show it to the inspector on request, and review it when your menu, equipment, or rules change.
- Check that it works. Walk the kitchen the way an inspector would, with our health inspection checklist, and fix the procedure behind anything that fails.
The Food Code itself points to free model procedures: the Institute of Child Nutrition's HACCP-based standard operating procedures and log templates, written for school kitchens, which FDA says can serve as a template for any food establishment.
Want it done for you? Our Food Safety Plan Kit is a ready-made food safety management system: 24 editable written procedures built on the 2026 Food Code, training records, monitoring logs, a self-inspection checklist, an employee illness policy, and a vomit clean-up procedure.
Done-for-you templates
Food Safety Plan Kit
- Written food safety procedures for every risk factor, ready to customize
- Employee illness policy and clean-up procedure for the 2026 Food Code
- Training records, a self-inspection checklist, and 8 editable logs
Frequently Asked Questions
What is a food safety management system?
Under the 2026 FDA Food Code, it's a specific set of actions a food establishment takes to prevent foodborne illness risk factors, including written procedures, training plans, and monitoring records for the steps in its operation that could contribute to foodborne illness.
Is a food safety management system required?
Under the 2026 Food Code, yes, within four years of your state or local health department adopting the 2026 edition (§8-201.15). FDA first added it in its December 2024 Supplement to the 2022 Food Code, so adopting that supplement starts the same clock. It isn't in the 2017 edition or the original 2022 edition. Health departments can exempt establishments they consider minimal risk.
Is a food safety management system the same as a HACCP plan?
No. A HACCP plan is a formal, health department-approved plan needed only for certain specialized processes, such as reduced oxygen packaging or processes that need a variance. A food safety management system is the everyday written system every covered establishment needs.
What records does a food safety management system need?
Monitoring records that show your procedures are followed. The code doesn't yet list specific ones (§8-201.16 is reserved), but cooling, hot and cold holding, refrigeration, receiving, sanitizer, and thermometer calibration logs, plus training and employee illness records, cover the main risk factors.
Who has to keep the food safety management system?
The food establishment. It must be implemented during all hours of operation, so the person in charge on every shift should know where it is and be able to show it to an inspector.
Bottom Line
A food safety management system is your kitchen's food safety routine, written down: short procedures for the risky steps, training on them, and the logs that prove they happen. You have four years after your health department adopts the 2026 code, but the logs and the illness policy are worth starting now.
Sources
- U.S. Food and Drug Administration, Food Code 2026 (§1-201.10, §2-103.11, §8-201.12, §8-201.13, §8-201.15, §8-201.16; Annex 2, supporting document AA; Annex 3, §1-201.10 and Chapter 8) — fda.gov.
- U.S. Food and Drug Administration, Supplement to the 2022 Food Code (December 2024) — fda.gov.
- U.S. Food and Drug Administration, Managing Food Safety: A Regulator's Manual for Applying HACCP Principles to Risk-based Retail and Food Service Inspections and Evaluating Voluntary Food Safety Management Systems — fda.gov.
- Institute of Child Nutrition, Food Safety Resources (HACCP-based standard operating procedures and logs) — theicn.org.
Ready to check yourself?
Our free 30-question practice test grades you instantly and links every miss back to the guide that explains it.