🍞 Food Safety, Hygiene and Regulation

Before you can control a hazard you have to know which hazards are real in your bakery. Some things bakers worry about are not the danger, and some things they never think about are.

Start with the biggest misunderstanding. Baking does not sterilise your product. It kills most things, but the core of a loaf only reaches 90 to 97 degrees Celsius and cannot exceed 100 degrees, because the crumb is wet and water boils at 100 degrees. Some organisms survive that easily. So a bakery has two separate hazard problems: what survives the oven, and what lands on the product after the oven.

What survives the oven is rope. Rope is spoilage by spore-forming Bacillus bacteria, chiefly Bacillus subtilis and Bacillus mesentericus, with B. licheniformis, B. megaterium and B. cereus as secondary causes. The spores arrive in the flour itself. They withstand up to 130 degrees Celsius, while your loaf core only reaches 90 to 97 degrees, so they pass through the bake untouched and then germinate in the cooling loaf and digest the crumb enzymatically.

You recognise rope by smell before you see it: a sweetish, fruity or rotten smell from the crumb, detectable at 12 to 24 hours in one source and after several days of storage in another. Then the crumb discolours, turns sticky, and draws thread-like strands resembling spider webbing when you tear the loaf apart.

Rope is a hot-climate disease and it is markedly more frequent in summer and hot seasons, which makes it a first-order risk for much of Africa. The conditions that favour it are precisely the conditions inside a normal loaf: crumb moisture of 35 to 42 percent, crumb water activity of 0.90 to 0.95, and an optimal germination pH of around 6.0, with germination still possible down to about pH 5.4 under heavy contamination and warm storage.

The control is chemistry, not cleaning alone, and that makes rope unusual. Formulate to pH 5.4 or below, or below 4.6 through fermentation. Sourdough and acidifying agents containing acetic acid are effective, as are acetic acid salts such as sodium diacetate and calcium acetate. A published acidity regulator dose for hot months is 0.2 to 0.3 percent on total flour, and propionic acid or monocalcium phosphate at 0.1 to 0.5 percent. Cool the loaves rapidly and do not stack them during cooling. Disinfect slicing equipment with a 2 percent vinegar solution. And eliminate contaminated leftover bread from the production cycle, because returned ropey bread reseeds the whole bakery.

What lands after the oven is mould. Baking destroys vegetative mould, so every mould spore on a loaf arrived after the oven. The listed causes are unsanitary equipment, contaminated packaging and wrappers, mouldy racks and tools, and dust exposure. Controls follow directly: cool on clean racks in clean air, keep wrappers covered and clean, clean slicers daily, and remove and destroy mouldy product immediately rather than letting it sit in the production area.

Now the physics of why bread spoils at all. Water activity, not total moisture, governs microbial spoilage. Fresh pan bread sits at 0.93. Batter cakes at 0.81. Soda crackers at 0.30. Compare those against the growth thresholds: most bacteria are inhibited below 0.91, with some found as low as 0.75; yeasts and moulds grow down to 0.60; nothing grows below 0.60; and a safety threshold of 0.85 or less is cited for shelf-stable foods that depend on water activity.

Read those two lists together and the conclusion is uncomfortable. Fresh bread at 0.93 sits above the mould threshold and well inside the bacterial range. Bread is not microbiologically stable. Its safety comes from being eaten quickly, and its keeping quality from preservatives, packaging and hygiene, not from its water activity.

That is a commercial insight, not just a technical one. Cakes at 0.81 and biscuits at 0.30 are progressively safer, which is exactly why biscuits are the natural product for a bakery without a cold chain or reliable daily distribution. A baker in a rural area with a three-times-a-week transport route should think very hard before building a business on fresh bread when biscuits carry a fraction of the risk over the same route.

Water activity values for buns, scones, pastry and cream or custard fillings were not available for this course and this course will not guess at them. Filled products are the highest-risk line a small bakery can run, and if you intend to sell them you need those figures measured or you need refrigeration and same-day sale.

Two more hazards to name. Chemical hazards include mycotoxins carried in the raw grain, covered in Lesson 4, and any cleaning chemical stored near food. Physical hazards include metal from worn equipment, glass, wood splinters from pallets and packaging, and jewellery or hair from staff. Neither is exotic. Both are found by walking your own bakery with a notebook and asking, at each step, what could get into this product here.

Hygiene rules feel like nagging until you understand that each one blocks a specific route by which something gets into food. Learn the route and the rule stops being arbitrary.

Start with hands, because hands are the main vehicle. The Codex general principles of food hygiene require adequate means of washing and drying hands, including soap, preferably liquid, and wash basins. Those basins must be supplied with hot and cold water. And here is the requirement most small bakeries fail: the hand-wash basin must not be used for any other purpose. Not for washing food. Not for washing utensils. Not for rinsing a mop. If your only sink does all three jobs, you do not have a hand-wash basin, you have a sink, and every hand wash is contaminating itself.

That is a fixable problem and it is cheap. A dedicated basin, plumbed or even a clean gravity tank with a tap, sited where staff enter the production area, with liquid soap and a means of drying hands beside it. Codex also requires cleaning facilities to have an adequate supply of hot and cold water, so the hand basin and the wash-up point are two separate requirements, not one.

When must hands be washed? The Codex text sets the principle rather than a schedule, requiring an appropriate degree of personal hygiene so that personnel are not a source of contamination. The practical points that follow safely from that text are these. Wash on entering the production area. Wash after every toilet visit. Wash after handling raw egg or waste. Wash after touching your face, hair or telephone. And wash between allergen-different tasks, which is Lesson 3. Then dry your hands, because a wet hand recontaminates itself from whatever it next touches.

Now the premises. Food-contact surfaces must be smooth, non-absorbent, and inert to the food, to detergents and to disinfectants. Read that as a purchasing rule. A cracked plastic board absorbs. A bare wooden table absorbs. A rusting steel table is no longer inert. If a surface cannot be cleaned back to visibly clean, it is not a food-contact surface and it must be replaced or covered, however long it has been in the bakery.

Facilities require adequate maintenance and cleaning, and this is where a small bakery quietly slips. A broken tile, a gap under a door, a leaking pipe: each one is a harbourage or a contamination route, and each one is cheap now and expensive after an inspection.

Waste containers must be specifically identifiable, suitably constructed, and made of impervious material. Identifiable means someone who has never worked in your bakery can tell at a glance that it is a waste bin and not an ingredient container. Impervious means it does not soak up what is in it. A sack on the floor meets none of this.

Storage must protect food from contamination, and that explicitly includes allergen cross-contact. Where products or tasks must be kept apart, Codex offers two routes: physical separation using walls and partitions, or separation in time, with suitable cleaning and disinfection between uses. For a one-room bakery, the second route is the only workable one, and Lesson 3 shows exactly how to run it.

Now the part where this course must stop and send you elsewhere. Codex requires that food handlers not be a source of contamination. It does not tell you which illnesses require a person to be excluded from food handling, for how long, or whether a medical certificate or food handler's permit is compulsory. Those rules are national and they were not available for this course. Do not invent them and do not copy a foreign rule. In several African jurisdictions a food handler's medical certificate is a licensing condition, meaning you cannot legally trade without it, so this is not a theoretical question. Go to your local environmental health office and ask three things in writing: which symptoms and conditions require a handler to be excluded, for how long, and whether a medical certificate is required for each person and how often it must be renewed.

Work a practical example. A baker in Mwanza, Tanzania, has four staff and one sink at the back used for hands, mixing bowls, mops and washing vegetables for lunch.

1. He buys a second basin and mounts it at the entrance to the production room, with liquid soap and a roll of paper for drying.
2. He labels the old sink for equipment washing only and the new one for hands only, in the language his staff read.
3. He replaces two cracked plastic boards and covers the wooden bench with a sheet of stainless or hard laminate, because neither cracked plastic nor bare wood is non-absorbent.
4. He buys two lidded impervious bins, marks them clearly as waste, and stops using flour sacks for rubbish.
5. He writes to the environmental health office and asks the three staff-health questions above.

None of that requires capital of any size. All of it is what an inspector looks for first.

A bakery is an allergen-dense environment by its nature. Wheat, egg, milk, soy in shortening and lecithin, nuts and sesame are all routine ingredients here. That means allergen control is not an optional extra for a bakery; it is the core of your food safety system.

The Codex declared allergens, meaning the foods that must always be declared, are these eight.

1. Cereals containing gluten, which is wheat, rye, barley, oats, spelt, or their hybridised strains.
2. Crustacea and products of these.
3. Eggs and egg products.
4. Fish and fish products.
5. Peanuts, soybeans and products of these.
6. Milk and milk products, including lactose.
7. Tree nuts and nut products.
8. Sulphite in concentrations of 10 milligrams per kilogram or more.

Now read the warning that goes with that list, because it is the most important sentence in this lesson. Sesame is not in the Codex list of prepackaged food labelling requirements read for this course, although the Codex allergen code of practice does name it among example allergens. Many jurisdictions, including the EU, the USA, the UK, Canada and Australia and New Zealand, do mandate sesame declaration, and several add mustard, celery and lupin. For a bakery in a sesame-using region, and much of Africa is one, that gap matters enormously. Treat the Codex eight as the floor and then obtain your own country's list. Never present the Codex eight as complete.

The controls come from the Codex code of practice on food allergen management, and they are practical.

Production scheduling. Process foods without allergens before foods with allergens. Add allergenic ingredients as late in the process as possible. Run products with identical allergen profiles consecutively. This is the whole allergen strategy for a one-room bakery, because physical separation with walls is impossible there and Codex explicitly allows separation in time with suitable cleaning and disinfection between uses as the alternative.

Cleaning validation. Confirm by visual inspection that equipment is visibly clean. Use analytical testing where feasible. Evaluate push-through material. Use rinse or swab testing for clean-in-place systems. Most small bakeries can only do the first of those, so do it properly: someone other than the person who cleaned should look, and should sign.

Rework. Store rework in sturdy containers with secure covers in designated, clearly marked areas, and have a policy that rework goes back into the same product wherever feasible. A tub of unmarked scrap dough that gets tipped into whatever is mixing next is exactly how an undeclared allergen reaches a customer.

Labelling. Verify that the correct label is applied, and have procedures to segregate and re-label or destroy incorrectly labelled product. Storage must protect food from contamination including allergen cross-contact.

On precautionary labelling, meaning the phrase that a product may contain something, this course must be careful. The Codex allergen code focuses on preventing undeclared allergens rather than on may-contain statements, and whether precautionary labelling is permitted at all, and in what exact wording, is a national decision that was not available for this course. What can be said with confidence is this: may contain is not a substitute for control. A bakery that can eliminate cross-contact by scheduling and cleaning should do that rather than label around the problem. A may-contain sticker on every product tells your customer nothing and protects you less than you think.

Work a real schedule. A baker in Ibadan, Nigeria, makes five products in one room with one mixer, one bench and one oven: plain bread with wheat only; a milk bread with milk powder; a sesame-topped bun; a peanut biscuit; and an egg-glazed roll.

1. List allergens per product. Plain bread: wheat. Milk bread: wheat, milk. Sesame bun: wheat, sesame. Egg roll: wheat, egg. Peanut biscuit: wheat, peanut.
2. Order from fewest allergens to most, so plain bread runs first.
3. Group identical profiles together, so all milk products run consecutively before moving on.
4. Put the peanut biscuit last in the day, because peanut is the allergen with the most severe reactions and the hardest cleaning burden.
5. Between each allergen change, clean the mixer bowl, hook, bench, scrapers and any dusting containers, and have a second person confirm visibly clean and sign a line in the cleaning record.
6. Add sesame and peanut as late in the process as possible, meaning topping and inclusion at the bench rather than in the mixer, so less equipment is exposed.
7. Label every product with its full allergen list in the words your national list requires.

That schedule costs nothing but the order in which he works. It is the single highest-value control in this module, and it is the one an inspector will ask about first if you sell anything containing nuts.

Flour, sugar and fat attract rodents, birds and stored-product insects. That is not a sign of a dirty bakery; it is a consequence of what you keep in the building. What separates a controlled bakery from an infested one is design and routine, not luck.

Codex gives two principles here and they are both about design rather than poison. First, site selection: avoid areas prone to pest infestation. Second, the premises must be designed to ensure effective protection against pest access and harbourage. Access means the ways in. Harbourage means the places to live once inside. Both must be closed.

The detailed programme, meaning how often to inspect, where to place bait stations, and which rodenticides are permitted, was not available for this course, and it should not be. Pesticide approvals are strictly national and a rodenticide legal in one country is prohibited in the next. Ask your environmental health office which products are approved for use in food premises, and ask whether pest control must be done by a licensed contractor. Meanwhile, never use agricultural pesticides in a food area. That rule has no exceptions and it is the way small bakeries poison people.

What you can do without waiting for anyone.

1. Proof the building. Fill holes in walls and floors. Fit brush strips or seals under doors. Screen windows and vents. Rodents pass through a gap you would not put a pencil in.
2. Store raw materials off the floor and away from walls. Pallets or racks with a clear gap all round, so you can see, sweep and inspect behind every stack. A sack against a wall is a rodent's corridor and you will never see the droppings.
3. Rotate stock. First in, first out, with the delivery date written on every sack in marker as it arrives. Old stock at the back is where infestation starts.
4. Remove waste and spillage daily. Spilled flour and sugar feed everything you are trying to exclude.
5. Maintain a monitoring record. Walk the store weekly, look for droppings, gnawing, webbing and live insects, and write down what you saw and the date, including when you saw nothing. That record is evidence for an inspector and a trend line for you.

Now storage as a quality matter, because the same practices protect the flour itself. Codex sets a maximum moisture for wheat flour of 15.5 percent by mass. Typical flour as milled runs 14 to 15 percent, and storage problems begin above 16 percent. That narrow gap is why a damp store ruins flour: the flour picks up moisture from humid air, crosses 16 percent, and then cakes, moulds and attracts insects. Store on a dry floor, in a ventilated room, off the ground, away from any wall that gets wet in the rains.

Fat has its own storage failure, which is rancidity from heat, light and air, so keep it covered, cool and dark and rotate it faster than you rotate flour. Sugar cakes with humidity. Yeast has its own rules covered elsewhere in this course, but note that fresh yeast is perishable and belongs at 4 degrees Celsius while dry yeasts sit at room temperature.

Mycotoxins are the hazard that storage either prevents or creates, and this is where you must go to your own authority. Codex sets a maximum of 5 micrograms per kilogram of ochratoxin A in raw wheat, barley and rye. Codex also requires flour to be free from heavy metals in hazardous amounts, to comply with pesticide and mycotoxin limits, and to be free from micro-organisms in hazardous amounts and free from parasites. But the maximum levels for deoxynivalenol, fumonisin and aflatoxin in cereals and flour were not available for this course. That is a serious gap for an African bakery, because maize-containing and groundnut-containing bakery products carry genuine aflatoxin risk, and aflatoxin is a chronic poison, not a spoilage nuisance. Write to your national food safety authority and ask for the current national maximum levels for aflatoxin, deoxynivalenol and fumonisin in cereals and flour, and ask which laboratory tests for them.

Work an example. A baker in Tamale, Ghana, buys groundnut paste for a filled biscuit and stores it beside the oven wall because it is the only space left.

1. Groundnuts carry aflatoxin risk, so the supplier question comes first: can they provide test results, and if not, can he buy from someone who can?
2. The oven wall is the hottest, most humid spot in the building, which accelerates both rancidity in the paste and mould growth. He moves it to the coolest dry shelf.
3. He marks every container with its delivery date and uses the oldest first.
4. He starts a weekly store inspection record, one line per week.
5. He writes to the national food safety authority for the aflatoxin limit and the name of a testing laboratory.

All five steps are free except the last, and the last is a stamp.

Water is an ingredient. In a lean bread formula it is 60 to 75 percent of the flour weight, which makes it the second largest thing in the loaf, and unlike flour it usually arrives with no paperwork at all.

Codex requires that the suitability of water be assessed where it may pose a hazard, and treats water as a contamination route to be controlled. What Codex does not do is give you a number, and the potability standard, conventionally expressed as an organism count per 100 millilitres, was not available for this course. Do not accept a number from a foreign country as a substitute. What you can be taught safely is this.

1. Water that touches food, or that ingredients are made with, must be of drinking-water quality as defined by your national authority.
2. If your supply is a borehole, well, tanker or rainwater tank rather than a verified municipal main, it must be tested, and the test repeated on a schedule set by the regulator. That frequency is jurisdictional and was not available for this course.
3. Water used for cooling, for ice and for washing equipment is food-contact water and must meet the same standard. Bakers routinely forget the ice, and ice made from untested water goes straight into the dough.

So the questions to take to your environmental health office are: what is the drinking-water standard here, who tests, what does a test cost, and how often must I repeat it for my type of supply. Get the answers in writing and keep the certificates in your safety file.

Now cleaning. Codex requires adequate, suitably designated cleaning facilities with sufficient hot and cold water, separate from the hand-wash basin covered in Lesson 2. Food-contact surfaces must be smooth, non-absorbent and inert to the food, to detergents and to disinfectants, which means the surface must survive the cleaning chemical as well as the food.

There is no Codex minimum cleaning frequency table, and that is deliberate rather than an omission: frequency is risk-based, set by the operator, and then checked by the regulator. So you write it. Your cleaning schedule has five columns.

1. What is cleaned. Be specific: mixer bowl, mixer hook, bench top, scrapers, dough trough, slicer, cooling racks, floor, bins, door handles, extraction, oven.
2. How often. Build it around end of every production run; after every allergen changeover; daily for floors, bins and hand-contact points; and a scheduled deep clean for extraction, ovens, mixer bowls and dough troughs.
3. With what. Name the actual product.
4. By whom. A named person or role, not everyone, because everyone means nobody.
5. Checked by whom. Someone other than the person who cleaned.

On the chemicals themselves, this course gives you no concentrations and no contact times, because sanitiser concentrations and contact times are product-specific and were not available for this course. Follow the label on the sanitiser you actually buy, and check that the product is approved for food-contact use in your country. That approval is a national matter and it is worth asking about before you buy a drum of something cheap.

One specific cleaning instruction is sourced and it matters in a hot climate: disinfect slicing equipment regularly with a 2 percent vinegar solution against rope. Slicers spread rope through an entire day's production in minutes.

Now records, which is where most small bakeries lose an argument they should have won. Codex names training and traceability as prerequisite programmes and requires that personnel be competent and that management ensure appropriate training and supervision. The full traceability and recall requirements were not available for this course, but the minimum for a small bakery follows directly from the principle and it is achievable with a notebook.

Record which flour lot, meaning miller, batch number and delivery date, went into which production date. Then record which production date went to which customer or outlet. Without those two links a recall is impossible, and impossible means that if one lot of flour turns out to be contaminated you must recall everything or nothing, and both answers destroy a small business.

Work it. A baker in Blantyre, Malawi, receives a call: a customer is ill and names her bread.

1. With no records, she can prove nothing, cannot say which flour was used, cannot tell which other outlets got that batch, and has no defence and no way to limit the recall.
2. With records, she opens her book, finds that the date named used flour lot 4471 delivered on the ninth, sees that lot 4471 also went into the bakes of two other days, and identifies the three outlets that received them.
3. She can pull exactly those products, telephone exactly those outlets, and give the environmental health officer a clear written history within an hour.
4. She keeps her licence and most of her stock.

The difference between those two bakers is a notebook and ten minutes a day. Keep the water certificates, the cleaning schedule with its signatures, the flour lot record, the delivery record and the staff training record in one folder, and keep that folder where you can hand it to an inspector without hunting for it.

You cannot copy another country's licensing. What you can copy is the list of questions, and a baker who can answer these six for their own town has done this lesson correctly.

1. Who inspects food premises here?
2. What certificate must the premises hold?
3. Do food handlers need a medical certificate?
4. Is a trading licence separate from that certificate?
5. Who certifies gas installations and fire compliance?
6. What must a label carry?

To show you the shape of the answers, here is one country's published set, from a commercial guide for South Africa dated June 2026. Read it as an example of the categories of permission a bakery needs, not as your own rule, and note that every figure differs by country and often by municipality. That guide lists a Certificate of Acceptability issued by the local municipality environmental health department at an indicative R0 to R500; food safety training at R500 to R2,000 per person; a municipal trading licence from the licensing department at R300 to R2,000 a year; a fire compliance certificate from the local fire authority at R500 to R2,500; and a gas installation certificate from a registered gas installer at R1,000 to R3,000.

Notice the structure rather than the numbers. There is a premises certificate. There is a person or training requirement. There is a trading licence, separate from the food certificate. And there are two safety certifications, gas and fire, issued by different bodies again. In most jurisdictions you will find some version of all five, issued by three or four different offices, and the commonest reason a bakery gets shut is that it obtained one of them and assumed it covered the rest.

Now labelling and date marking. Under Codex, a date of minimum durability must be declared, showing when the product remains fully marketable and retains its stated qualities, in day and month format if durability is under three months, otherwise month and year. Special storage conditions must be declared if the validity of the date depends on them. And Codex exempts fresh bakery items from date marking, alongside fresh produce, wines, high-alcohol drinks, vinegar, salt, solid sugars and chewing gum.

Do not build a business on that exemption. Many countries do not grant it, or grant it only for unwrapped product sold on the day of baking. Wrapped, dated, shelf-stable bread almost always requires a date mark. Never teach or treat the exemption as a right; ask question six above and get the answer in writing.

Preservatives are the third area where a foreign number can get you prosecuted. Calcium propionate is the industry-standard bread mould inhibitor because it inhibits mould and ropy bacteria while having little effect on yeast and not interfering with fermentation, which is why it and not sorbate or benzoate is the bread preservative. Typical bakery usage is 0.1 to 0.3 percent on flour weight, with higher levels described as not uncommon, and a straight-dough system is published at 0.25 percent at 65 percent water absorption and 0.40 percent at 67 percent hydration. It works best at pH below 5.5, and it contains 21 grams of calcium per 100 grams.

That pH figure is the practical trap. A well-fermented dough at around pH 4.5 is in range, but a fast, lightly fermented dough may not be, and then the preservative underperforms and the baker blames the supplier when the real cause is the process.

Those usage figures are technical, not legal. The legal maximum you may use, and whether you must declare it on the label, is set by your national food authority. The Codex maximum levels for propionates in bakery wares were not available for this course, and neither were any African national limits. The only maxima retrieved were European figures, published as 3,000 milligrams per kilogram for pre-packaged sliced bread and rye bread, 2,000 for energy-reduced and partially-baked bread, and 1,000 for general pre-packaged bread. Those are European numbers, they are not global, and the source citing them appears to contain a typographical error in the regulation number, so treat them as unverified. Use them only to see that limits exist and differ by product category. Find your own number before you sell.

How to deal with the regulator, practically.

1. Go before they come. Walk into the environmental health office, say you are opening or already running a bakery, and ask for the requirements. An owner who arrives voluntarily is treated differently from one who is found.
2. Ask for everything in writing, and write down the name and date of whoever answered you. Verbal permissions evaporate.
3. Keep one folder containing your premises certificate, trading licence, gas and fire certificates, staff medical certificates if required, water test results, cleaning schedule with signatures, flour lot and production records, allergen list per product, and training records. Hand it over on arrival rather than hunting for pieces of it while an inspector waits.
4. Fix what they tell you and write back to confirm you have fixed it, with a date. That letter is your evidence.
5. Do not argue about the rule. Ask which regulation it comes from, get the reference, and read it.

One last honest statement about this whole module. No African national food safety code, bakery code of practice or bread standard was available for the reference behind this course. Everything you have been taught in this module is Codex-derived, and Codex is a model code, not law, until a country adopts it. That is not a weakness if you use it correctly: Codex tells you what a good system looks like, and your national authority tells you what is required. Build the Codex system, then take it to your regulator and ask what else they need. A baker who says they will check with their national authority is a better baker than one who confidently quotes a foreign country's rule.