HACCP Checklist for UAE Restaurants — Inspector's Guide

A HACCP-based Food Safety Management System is mandatory for every food establishment in the UAE — Dubai Food Code 2.0 §3.1.3 and ADAFSA Regulation 6/2010 Article 100 both spell it out. This checklist walks through what a Dubai Municipality or ADAFSA inspector will actually look at: a certified Person in Charge on every shift, the seven Codex HACCP principles documented and live, temperature critical limits hit and recorded, supplier and training records on file, and inspections logged in DMChecked rather than on paper.

If you run a kitchen in Dubai, Abu Dhabi, or anywhere else in the UAE, HACCP is not a nice-to-have. It is the operating contract between you and the regulator. The good news: the rules are written down clearly. The bad news: most restaurants discover them on inspection day. This guide pulls every clause that matters into one practical checklist, mapped to the actual sections of Dubai's Food Code 2.0, the ADAFSA Code of Practice, and Federal Law No. 10 of 2015 on Food Safety.

The legal stack: where HACCP is written for the UAE

Three documents do almost all the work. Read them once and you will know more about UAE HACCP than most of the consultants selling courses.

• Federal Law No. 10 of 2015 on Food Safety (UAE). Article 9 obliges the operator to ensure food safety, apply UAE-approved food-safety systems, and notify authorities of any risk. The federal law is the umbrella; the emirate-level codes implement it.
• Dubai — Food Code 2.0 (12 July 2023, Final Draft). §3.1.3(a) is unambiguous: "All food establishments in Dubai should implement and maintain a Food Safety Management System (FSMS) based on Codex principles of Hazard Analysis and Critical Control Point (HACCP)."
• Abu Dhabi — ADAFSA Regulation 6/2010 + Code of Practice No. 29/2019. Article 100: "The food business operator shall develop, implement and maintain a food safety management system based on the Hazard Analysis and Critical Control Point (HACCP) principles." Article 5 mandates the Essential Food Safety Training (EFST) for every food handler in the emirate.

Sharjah, Ajman, RAK, Fujairah and UAQ run parallel municipal regimes aligned to the federal law and Codex. The detail varies; the HACCP requirement does not. For the rest of this guide we anchor on Dubai's Food Code 2.0 because it is the most prescriptive — if you pass a Dubai inspection, the others tend to follow.

For the wider context on Dubai food-safety obligations beyond HACCP, see our pillar guide on Dubai Municipality food safety requirements.

Person in Charge: the role no inspection forgives

Before the inspector looks at a single thermometer, they look for a Person in Charge. Food Code 2.0 §3.1.1 says a food establishment must employ at least one full-time, on-site PIC certified in food safety. High-risk operations must have an active PIC during every work shift. Establishments serving high-care groups — hospitals, schools, nurseries, daycare, food for the elderly — must have a certified PIC across the whole production-to-service chain.

Two procedural details that catch people out:

• If the PIC leaves, you have 30 days to designate a successor, and the successor must enrol in the training and be certified within 45 days (§3.1.1.e).
• The PIC must register in the Dubai Municipality digital food-safety system — that is now DMChecked — and credentials cannot be shared (§3.1.1.f).

The PIC's standing duties (§3.1.2) include written policies, supervision, employee training before they start, and active use of DM digital tools to record and manage pest reports, employee illness exclusions, food-delivery incidents, vehicle issues, equipment problems, and process deviations.

The seven HACCP principles, applied to a UAE kitchen

Food Code 2.0 §3.1.3.1 mandates the Codex Alimentarius seven HACCP principles. Stripped of textbook language, here they are with the sub-clause that codifies each one:

The HACCP plan must be developed and managed by a competent multi-disciplinary food-safety team led by someone with in-depth Codex HACCP knowledge (§3.1.3.1.e). Day-to-day responsibility stays with the establishment even if you bring in external consultants to write the plan. And the whole plan must be reviewed at least annually, and on any material change — new supplier, new ingredient, new equipment, new menu item, new packaging, a recall, or new science on a hazard (§3.1.3.1.r).

Temperature critical limits a Dubai inspector will measure

If you remember nothing else from Food Code 2.0, remember the danger zone. §3.4.1 spells it out: "Most pathogenic bacteria grow and multiply rapidly at temperatures between 5 °C and 60 °C." Your CCPs are designed to keep food out of that band, or move it through fast.

The full set of temperature critical limits an inspector will probe at the thickest part of the food, with a calibrated thermometer:

Two operational notes: thermometers must be calibrated and the calibration evidence must be on file (§2.7.4). ADAFSA's Code of Practice 29/2019 goes further — operators in Abu Dhabi must hold temperature, maintenance and calibration records for three years.

The records an inspector will ask for

Food Code 2.0 §3.1.3.1.q calls for "documentation and record-keeping … sufficient to enable the site to verify that the HACCP and food safety controls … are in place and maintained." In practice, an inspection-day pull request looks like this:

• HACCP plan + flow diagrams for each product or product family, with hazard analysis, CCPs, critical limits, monitoring, corrective actions, verification, and the most recent annual review (§3.1.3.1.r).
• PIC certificate and successor plan if applicable.
• Food-handler training records — every employee trained before they start work; refresher every 2 years (§6.4.b). EFST certificates in Abu Dhabi.
• Temperature monitoring logs — chillers, freezers, hot holding, cooking probe, cooling, reheating. Date, time, reading, signature, corrective action when out of limit.
• Calibration records for every thermometer and measuring device.
• Cleaning & disinfection programme with frequencies, chemicals (with safety data sheets), responsible staff, sign-offs (§4.2).
• Pest control records — contractor visits, monitoring traps, eradication actions (§4.4.6).
• Supplier records — name, address, contact, batch codes, delivery dates, traceability one-step-back, retained for at least the shelf life of the product.
• Allergen matrix per dish, with segregation procedures (§3.6).
• Customer complaint and corrective action log (§8.11).
• Recall plan (§8.10) — even if you have never used it.

Most kitchens that fail an audit do not fail on the cooking. They fail on the paperwork that proves the cooking was right.

DMChecked: paper logs no longer count

On 12 November 2025 Dubai Municipality launched DMChecked, replacing FoodWatch Connect. Existing FoodWatch users were auto-migrated. Every DM-licensed restaurant, café, catering unit, central kitchen, food factory, delivery vehicle and PIC must operate inside DMChecked.

What flows through it, per Food Code 2.0 §3.1.2.e:

• Pest infestation reports and pest contractor work.
• Employee illness reports and exclusion-from-work decisions.
• Food-delivery incidents.
• Transportation vehicle issues.
• Equipment-related issues.
• Process-related issues.

Inspections, follow-ups, and corrective-action tracking happen on the same platform. The clause stays the same regardless of platform name: the PIC "shall use digital tools to record food safety observations and initiate and manage the subsequent actions intended for correction and prevention." A PDF on a shared drive is not a digital tool in the sense of §3.1.2.e. DMChecked is.

Pre-inspection checklist (printable)

Run this 30 minutes before opening, the day you expect (or fear) an inspector.

Where UAE HACCP inspections most often fail

From the patterns in Food Code 2.0 enforcement language and ADAFSA's published violation summaries — ADAFSA recorded over 103,000 inspection visits and 3,391 violations in 2023 alone — these are the recurring fail points:

1. PIC absent or uncertified. Especially during evening shifts or on Fridays.
2. Two-stage cooling logged as one number. Inspectors want to see 60 → 20 in 2 h and 19 → 5 in the next 4 h, not just an end-of-shift fridge reading.
3. Chillers running > 5 °C. The display reads 4 °C; the food in the back of the unit is 7 °C. Display vs. food temperature is a known §3.4.2 failure mode.
4. No calibration evidence for probe thermometers.
5. Supplier records missing batch codes — fine when nothing is wrong, fatal during a recall.
6. Allergen statements absent on non-packaged food (§3.6.4).
7. HACCP plan written once, never reviewed. §3.1.3.1.r requires annual review and review on change. A 2023 plan in a 2026 kitchen is non-compliant.
8. Pest contractor visits not in DMChecked. Paper invoices in a binder do not satisfy §3.1.2.e.

A working HACCP system answers each of those before the inspector asks. The discipline is the same in Dubai, Abu Dhabi, Sharjah and the northern emirates — the document references change, the underlying Codex principles do not.

For chefs ramping up the operational side, the recipe management workflow is where the per-dish allergen list and ingredient-level traceability ultimately live, and the inventory module ties every recipe write-off back to a supplier batch.