I run a CFIA-licensed mushroom production facility in Brantford, Ontario. Mushroom isn't a Big 9 allergen. Talking to friends who run bakeries, I realized they're carrying six of the nine major allergens on a normal Tuesday — wheat, eggs, milk, tree nuts, peanuts, and sesame. Their food-safety problem is harder than mine. That's why HACCPlan has a bakery-specific build, even though I'm not the one who's going to use it day-to-day.
01The math
Why a bakery needs different software than a restaurant or meat plant.
Most food-safety software was written for one of two reference customers: the multi-unit restaurant chain, or the $50M-revenue meat plant. A bakery is neither. The hazards are different. The records are different. The inspector who walks in is reading from a different chapter.
9,100
U.S. retail bakeries and bakery-cafes plus 9,200 wholesalers (IBISWorld 2025). 65% employ fewer than 10 people.
6 of 9
Big 9 allergens routinely present in a bakery: wheat, eggs, milk, tree nuts, peanuts, sesame. Only fish, crustacean shellfish, and soybeans are typically absent.
101
Undeclared-allergen recalls in 2024 — 34% of all FDA food recalls. Wheat and milk lead the list.
The other thing that makes a bakery unusual: flour is now a known pathogen carrier. Until the 2016 General Mills E. coli O121 outbreak and the 2023 Gold Medal Salmonella outbreak, most operators treated flour as a low-risk ingredient. It isn't. It carries field-borne pathogens that survive grinding and bagging. The bake step has become the bakery industry's primary kill step — not just a cooking step.
02The hazards
The bakery hazard analysis HACCPlan helps you build.
A real bakery HACCP plan has to cover three categories of hazards, each with bakery-specific examples.
Biological
Flour + RTE
Salmonella in flour (Gold Medal 2023, 14 illnesses, 13 states). E. coli O121 in flour (General Mills 2016, 63 illnesses, 24 states). Listeria in ready-to-eat (RTE) pastries (Dec 2024 — ~45,000 units recalled across 60 product types).
Chemical + Physical
Allergens + metal
Undeclared allergens (the #1 cause of recall in any category — 34% of all food recalls in 2024). Sanitizer residue from cleaning. Mycotoxins from improperly stored grain. Foreign material: metal from broken equipment, glass from broken light bulbs, stones from poorly-cleaned grain.
03The CCPs
The Critical Control Points a bakery actually has.
Most bakeries have three Critical Control Points (CCPs). Some have more depending on product mix. Cottage and retail bakeries can usually run with two.
- 01
The bake step (as a kill step)
Time and temperature combination that achieves a validated pathogen reduction. For Salmonella in flour, this is typically a 6+ log reduction at internal temperatures ≥160°F sustained for product-specific times. The bake step is validated per product (a brownie validation doesn't cover a baguette).
- 02
Allergen control
The scheduling, cleaning, and labeling that prevents allergen cross-contact in a shared facility. Includes the recipe-to-allergen mapping, the production schedule run order (allergen-free first, allergens last, full cleaning between), and the ELISA swab verification on cleaned equipment.
- 03
Metal detection (wholesale only)
Retail standards are 2.0 mm ferrous / 2.5 mm non-ferrous / 3.0 mm stainless steel. Required by most GFSI schemes for wholesale operations. Optional for retail and cottage, but recommended where any motorized equipment is in the line.
04What HACCPlan does
What's inside HACCPlan for bakeries.
The bakery build of HACCPlan addresses the specific records and tools a small-to-mid bakery needs. None of it is generic restaurant software with a "bakery" label stuck on.
- 01
Recipe-to-allergen mapping
Add a recipe, the system maps each ingredient to the Big 9 allergens (plus mustard and sulphites for Canadian operations). Generates the allergen statement for the label automatically.
- 02
Allergen-aware production scheduler
Drag your day's products onto a schedule. The scheduler enforces the correct run order (allergen-free first, allergens last) and flags conflicts. Cleaning steps required between allergen runs appear as blocking tasks.
- 03
Batch and metal-detection logs
Every batch tracked from raw material lot codes through bake and packaging, with metal-detection rejection records if applicable.
- 04
Cleaning and ELISA validation logs
The sanitation records that prove cross-contact prevention works. ELISA swab results entered against the cleaned equipment, with corrective action triggers when results come back positive.
- 05
Supplier verification
For flour mills, sugar suppliers, dairy, nut suppliers. Certificate-of-analysis review tracked against each lot received. Critical for buyer audits that ask "show me your supplier program."
- 06
Recall plan with mock-recall drills
The plan stays current. The mock recall runs through your actual records to find which batches went where, in the four-hour window FDA expects. Cottage operators often skip this; the cost when something goes wrong is catastrophic.
- 07
Buyer Vendor Compliance Packet export
Whole Foods, Kroger, Sprouts, and others increasingly require a Vendor Packet — HACCP plan, allergen program, recall plan, supplier list, plus letters of guarantee. HACCPlan exports the whole packet in the format each buyer expects.
- 08
Cottage label generator (for cottage operators)
Generates the legally-required label for cottage-law states (Texas SB 541 set the cap at $150K in Sept 2025; California Class A at $75K; Florida and Georgia uncapped). Includes the "made in a cottage kitchen" disclosure language each state requires.
05Three operators
Three operator stories.
The bakery operators we hear from sit on one of three rungs. Each has a different first-priority pain. (Quotes below are composites synthesized from multiple conversations, labeled as such — never a fabricated single source.)
“
Texas just raised the cottage cap to $150,000. I'm at $80K and projecting to break the limit by next September. I need to know what changes when I cross that line, not what the rules are after I cross it.
”Composite — cottage scaling up to retail
“
We got the Vendor Compliance Packet from Whole Foods asking for HACCP plus SQF Fundamentals in 90 days. I have the bakery. I do not have a written HACCP plan, an allergen program, or a supplier list. Where do I start?
”Composite — retail going wholesale
“
I'm the QA-of-one at a 35-employee wholesale bakery. We have SQF Edition 9 certification due for re-audit in eight months. My current binder system is held together by colored tape. I need everything in one place — including the ELISA results and the supplier COAs.
”Composite — wholesale at GFSI
HACCPlan addresses all three rungs from the same codebase. The cottage operator runs on the free tier (one HACCP plan, three doc types, the cottage label generator). The retail-going-wholesale operator runs on Pro ($149/mo) for the full document set plus multi-LLM audit. The GFSI operator runs on Pro plus the Inspector Mode add-on.
06Recent recalls
Why this matters — the recent cases.
A bakery doesn't have to invent the recall risk. Recent cases are explicit about what goes wrong and what it costs.
Recent bakery and bakery-ingredient recalls
Gold Medal flour (April 2023): 14 illnesses across 13 states, 3 hospitalized, Salmonella Infantis. Triggered industry-wide reassessment of flour-as-RTE-ingredient risk.
Listeria pastry recall (December 2024): ~45,000 units across 60 product types from a single mid-size wholesale bakery. The root cause was a contaminated piece of equipment that hadn't been part of the validated cleaning program.
General Mills flour (June 2016): 63 illnesses across 24 states, 17 hospitalized, including 1 case of hemolytic uremic syndrome. E. coli O121. Established flour as a pathogen carrier in regulatory thinking.
The pattern: 94% of low-water-activity food recalls between 2007 and 2012 were Salmonella. The bake-as-kill-step strategy is what you have to validate, not assume.
07Canadian operators
For Canadian operators.
If you operate under the Safe Food for Canadians Regulations (SFCR), the bakery build of HACCPlan covers the Canadian-specific differences:
- 01
Bilingual label generation
Every label generated in both English and French. Required by Canadian Food Inspection Agency (CFIA) for all consumer-facing packaging.
- 02
Canadian priority allergen list
Includes mustard and added sulphites at >10 ppm in addition to the US Big 9. Gluten sources include wheat, rye, barley, oats, and triticale.
- 03
SFCR Preventive Control Plan structure
The HACCP plan is formatted as a §86-compliant PCP with the additional Canadian sections (traceability, recall, complaints) baked in.
- 04
2-year record retention under §87
Matches the CFIA requirement. Records archived but retrievable for the full retention window.
From my own facility
My CFIA inspector at the Brantford facility audits against the PCP every six months — pulls a random month of records, walks the production area with the PCP in hand, and asks "show me the entry that matches what I'm looking at." The system has to make that retrieval fast or you spend the inspection digging through binders. That's the bar for the Canadian build.
08Pricing + starter
What it costs and how to start.
Cottage bakery operators usually run on the Free tier — one HACCP plan, three doc types, the cottage label generator, basic temperature and cleaning logs. No payment required.
Retail and small wholesale bakeries usually need Starter ($49/mo) for three plans and the mock recall drill, or Pro ($149/mo) for unlimited plans, multi-LLM audit, allergen scheduler, and Vendor Compliance Packet export.
Larger wholesale operations on GFSI schemes run on Pro plus the Inspector Mode add-on for in-facility audit preparation.
The free Bakery Starter Kit includes:
- 01
A bake-validation worksheet
For documenting product-specific bake time/temperature combinations that achieve a 6+ log Salmonella reduction. References FSIS Appendix A and current academic validation literature.
- 02
A recipe-to-allergen mapping spreadsheet
Editable. Pre-loaded with the Big 9 + Canadian additions.
- 03
A cleaning and sanitation log formatted for bakery zones
Separate zones for mixing, proofing, baking, cooling, packaging.
- 04
A cottage-label-language quick reference
The exact "made in a cottage kitchen" disclosure language each state requires.
- 05
A Vendor Compliance Packet checklist
The documents each major buyer (Whole Foods, Kroger, Sprouts, Costco) asks for, in their expected format.
Most bakeries run on the free kit for 30-60 days before deciding whether the paid tiers fit their operation.
Footnotes
1.21 CFR Part 117 (Preventive Controls for Human Food) — ecfr.gov
2.FDA — Food Allergies (Big 9) — fda.gov
3.FDA Outbreak Investigation — Salmonella in Flour (April 2023) — fda.gov
4.CDC — 2016 Multistate Outbreak of E. coli O121 Linked to Flour — cdc.gov
5.CFIA Preventive Control Plans — Regulatory Requirements — inspection.canada.ca
Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-03· 12 min read· Wikidata Q139112497