What is the due diligence defence in food safety law?
General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.
The due diligence defence under UK food law only works if you can prove it. Here is what evidence a food business actually needs to hold.
What actually counts as a due diligence defence if an environmental health officer or a court asks a food business to prove it. In UK law, a due diligence defence means showing, with contemporaneous evidence, that the business took all reasonable precautions and exercised all due diligence to prevent the problem, not simply stating that staff are careful and standards are high. It is one of the most misunderstood protections in food law, partly because businesses assume good intentions and a clean kitchen are enough, and partly because the evidence that actually supports the defence is often scattered across paper sheets, memory and goodwill rather than held anywhere a manager could produce it quickly if asked.
What the due diligence defence covers
The Food Safety Act 1990 creates a range of offences relating to food that is unsafe, mislabelled or produced in unhygienic conditions. It also gives businesses a way to defend themselves: if something goes wrong despite a proper system being in place and followed, the business may avoid conviction by proving it exercised due diligence. This is not a technicality lawyers use after the fact. It is a legal test that turns on whether a working food safety system existed and was followed on the day in question, not whether one exists in theory. A business cannot simply point to a policy folder written three years ago and left untouched since; the defence depends on showing the system was live and being used at the relevant time, which is exactly why the underlying records matter more than the policy document itself.
The four things a due diligence defence must actually show
A due diligence defence generally needs to demonstrate four things together. First, that a documented system was in place covering the relevant risk, whether that is temperature control, allergen handling, cleaning or pest control. Second, that staff were trained to carry it out and understood why it mattered, not just that a training session happened once at induction. Third, that checks were actually completed, not just scheduled, with a name and a time attached to each one so the record cannot be dismissed as a blank template filled in later. Fourth, that when something was found wrong, a corrective action was recorded and followed through, whether that meant discarding stock, adjusting a fridge, or retraining a member of staff. Missing any one of these weakens the defence considerably, because a court or an environmental health officer is looking for a system that worked in practice, not a policy document sitting in a drawer waiting to be produced only when trouble arrives.
Why paper struggles to carry the weight of a defence
Paper checklists and log books are still common in kitchens, and they are not worthless. The problem is what happens when a business needs to produce two years of cleaning records, or prove a specific fridge was checked at a specific time on a specific date. Sheets go missing, get filled in at the end of a shift rather than at the time, or get completed retrospectively when an inspection is announced. None of this is necessarily dishonest, but it is exactly the kind of gap that a prosecutor or a claimant's solicitor will probe, and once one sheet looks backfilled, every other sheet in the file becomes suspect by association. A record that cannot be shown to be contemporaneous is weaker evidence than one that is time-stamped and cannot be backdated. Digital checklists address this directly, because every entry carries a time and a name at the point it is made, and a manager cannot quietly go back and add a missing row the night before an inspection.
Building the record trail behind a defence
A credible due diligence file usually draws on several strands that, together, tell a consistent story rather than a single decisive document. Temperature records for fridges, freezers and cooking show the cold chain and cooking temperatures were controlled, and the core temperature thresholds differ slightly depending on where in the UK the business operates.
| Process | England, Wales and Northern Ireland | Scotland |
|---|---|---|
| Cooking food thoroughly | 75 degrees Celsius core | 75 degrees Celsius core |
| Reheating food | 75 degrees Celsius core | 82 degrees Celsius core |
Cleaning schedules show surfaces and equipment were sanitised on a set frequency, with sign-off rather than a blank tick box left for the sake of appearances. Allergen checks and matrices show which dishes contain which of the fourteen listed allergens, and training records show staff knew how to answer a customer's question correctly rather than guessing under pressure. Pest control reports show any evidence of activity was acted on quickly rather than left until the next scheduled visit. None of these on its own proves due diligence, but a consistent, dated pattern across all of them is difficult for a prosecutor to argue against, and the Safer food, better business pack sets out the baseline most small and medium food businesses are expected to work from when building this trail.
Supplier checks and traceability as part of the defence
Due diligence does not stop at the kitchen door. If a supplier delivers contaminated or mislabelled ingredients, a business can still be liable unless it can show it took reasonable steps to check that supplier in the first place and can trace what it received through the supply chain. That means keeping supplier approval records, delivery checks against temperature and condition on arrival, and invoices or delivery notes that let a batch of food be traced back if a problem is reported by a customer or another business further down the chain. A business that cannot say where an ingredient came from, or when it arrived, has a much weaker position than one that can produce that trail on request within minutes rather than days, which is why supplier approval and traceability sits alongside internal checks as a core part of the defence, not a separate concern that only matters if something is recalled.
HACCP monitoring: the plan is not the proof
Many businesses hold a HACCP-based food safety management system, built around identifying critical control points and monitoring them, as required under the HACCP guidance for food businesses. Having the plan document is the starting point, not the finish line. What a due diligence defence actually rests on is evidence that each control point was monitored as scheduled, that limits were checked at the frequency the plan sets out, and that when a limit was breached, a corrective action was recorded and carried out, whether that was rejecting a delivery, re-cooking a dish, or discarding stock that had spent too long in the danger zone. A HACCP plan an EHO will respect is one where the monitoring records match the plan on paper, week after week, not one that only exists as a binder produced for the inspection itself and never referred to in between. Getting the underlying checks recorded properly through food safety software makes this consistency far easier to maintain than relying on staff memory or paper sign-off sheets that can be filled in after the fact once someone remembers.
How long records need to be kept
There is no single statutory retention period that covers every type of food safety record, which is one reason businesses often default to the periods they already know, such as the six years required for VAT records or the retention expected for PAYE records. In practice, most food businesses keep temperature logs, cleaning records, training certificates and supplier checks for at least two years, and longer if there is an ongoing complaint, claim or investigation that could still result in a prosecution some time after the event in question. Deleting or discarding records early, even by accident during a routine tidy-up of old paperwork, removes exactly the evidence a due diligence defence depends on, so a searchable, dated archive that cannot be quietly amended or thinned out is worth more to a business than a filing cabinet that eventually gets cleared out to make room.
Where Zynthio fits
Zynthio's food safety module records checks, corrective actions and supplier and training evidence with a time stamp and a name attached to each entry, giving a food business a dated, exportable record trail if it ever needs to demonstrate due diligence to an environmental health officer or a court.
Frequently asked questions
What is the due diligence defence in food safety law?
It is a legal defence under the Food Safety Act 1990. If a business is prosecuted for a food safety offence, it can avoid conviction by proving it took all reasonable precautions and exercised all due diligence to prevent the problem. The burden is on the business to show this, with evidence, not simply to assert it.
What records prove due diligence?
Contemporaneous, dated records made at the time work was done: temperature logs, cleaning schedules, allergen checks, supplier approval documents, pest control reports, training certificates, and evidence that corrective action was taken when something was found wrong. A single missing check is less damaging than a pattern with no evidence at all.
Do handwritten paper records count as due diligence evidence?
They can, but they are harder to rely on. Paper can be lost, filled in late, or written up after the event, which a prosecutor or environmental health officer may challenge. Records that are time-stamped and cannot be backdated are generally stronger evidence of a working system.
How long should food safety records be kept?
There is no single fixed period set out for all food safety records, so many businesses align retention with other statutory periods they already keep, such as VAT and PAYE records, and hold food safety logs for at least two years as a working minimum, longer if a claim or investigation is live.
Does having a HACCP plan count as due diligence?
A HACCP-based plan is part of the picture but not the whole defence. What matters is evidence that the plan was actually followed: monitoring records at each control point, corrective actions logged when limits were breached, and verification that the system worked in practice, not just that a plan document exists.