Australia New Zealand Food Standards Code – Standard 3.2.2A – Food Safety Management Tools

Category one business (s 3.2.2A‑6): a caterer or a food service that processes unpackaged potentially hazardous food into a food that is both potentially hazardous and ready‑to‑eat. The key is processing: the business itself performs activities such as chopping, cooking, drying, fermenting, heating, thawing, washing (or a combination) that transform raw or semi‑processed ingredients into a finished ready‑to‑eat product. A restaurant cooking raw chicken into a cooked chicken dish is a classic category one business.

Category two business (s 3.2.2A‑7): a business that offers for retail sale food that is potentially hazardous and ready‑to‑eat, where that food was received unpackaged by the business (or was unpackaged after receipt) and was not made or processed by the business other than slicing, weighing, repacking, reheating or hot‑holding. A supermarket delicatessen that receives a whole cooked ham (potentially hazardous and ready‑to‑eat), unwraps it, slices it and sells it by weight is a category two business. The business is not doing primary cooking or manufacturing.

Prescribed activity (s 3.2.2A‑5): the handling by the food business of any unpackaged potentially hazardous food that either (a) is used in preparation of ready‑to‑eat food to be served to a consumer, or (b) is ready‑to‑eat food intended for retail sale by that business. This definition links the obligations to the specific moment when unpackaged, temperature‑sensitive food enters the handling chain.

Potentially hazardous food: food that must be kept at certain temperatures to minimise growth of pathogenic microorganisms or prevent toxin formation. This is a well‑established concept in the Code, covering most protein‑rich, moist foods.

Ready‑to‑eat food: food ordinarily consumed in the state in which it is sold, excluding nuts in shell, whole raw fruits, and vegetables intended for hulling, peeling or washing by the consumer.

Food safety supervisor: a person holding a food safety supervisor certificate issued within the preceding five years, and having the authority and ability to manage and give direction on safe food handling. The certificate must come from a registered training organisation or an organisation recognised by the relevant authority under the application Act.

Food safety training course: training covering safe handling, food contamination, cleaning and sanitising, and personal hygiene.

Fund raising event: an event raising funds solely for a community or charitable cause, not for personal financial gain. This is the only exclusion in the standard.

Food service (s 3.2.2A‑4): a food business which processes and serves ready‑to‑eat food direct to a consumer, whether consumed on premises or elsewhere. “Serve” includes portioning from bulk, presenting in a bain‑marie for self‑service, or delivering plated food.

The distinction between category one and category two matters because category one businesses must comply with sections 10 (training), 11 (supervisor), and 12 (records), while category two businesses are only required to comply with sections 10 and 11 , no mandatory record‑keeping. The standard therefore imposes a lighter burden on businesses that only slice, weigh, repack, reheat or hot‑hold, versus those that do full processing.

The standard directly affects any food business in Australia that falls within the definitions of category one or category two. That includes a broad swathe of commercial and institutional food operations: restaurants, cafés, takeaway shops, hotel kitchens, school canteens, hospital food services, aged‑care kitchens, catering companies, mobile food vendors, butcher shops that sell ready‑to‑eat products, supermarket delis, bakeries that handle potentially hazardous fillings, and convenience stores that serve hot food from bain‑maries. The inclusion of “caterer” in the definition of category one (s 3.2.2A‑6(a)) catches not just commercial caterers but institutions such as schools and hospitals which handle food for immediate consumption, regardless of whether they charge for it. The definition of “food business” in Standard 3.1.1 already includes charitable or community activities, so a church soup kitchen running regularly could be a category one business if it processes unpackaged potentially hazardous food.

Excluded are: (a) fund‑raising events (narrowly defined , sole community or charitable cause, no personal financial gain), (b) businesses that never handle unpackaged potentially hazardous food, such as a cafe that sells only pre‑packaged, shelf‑stable snacks, (c) primary food production (excluded from the food business definition in the Code), (d) businesses that handle only whole raw fruits, nuts in shell, or vegetables intended for consumer hulling/peeling/washing (which are not “ready‑to‑eat”), and (e) businesses that only transport food (not “handling” if only transport, but note the broad handling definition). Businesses that sell only ready‑to‑eat food that was received fully packaged and not opened on site are also exempt from the standard, because they are not engaging in a “prescribed activity”.

The compliance burden falls particularly heavily on small and micro businesses that may lack dedicated training budgets, existing supervisory structures, and record‑keeping systems. A single‑operator food truck that cooks raw meat into burgers is a category one business; the operator must have completed a food safety training course, hold a current food safety supervisor certificate, be reasonably available to supervise themselves (a curious self‑supervision scenario), and maintain records of temperature control, processing times, cleaning, etc. for three months. The record‑keeping requirement (s 12) can be excused if the business can “demonstrate to the reasonable satisfaction of an authorised officer” compliance, but that is a discretionary assessment and the burden of proof lies on the business at the time of inspection. This creates uncertainty and an incentive to keep records anyway, defeating the intended concession.

Businesses that operate in multiple jurisdictions face the complexity that enforcement, interpretation, and the recognition of training organisations and certificates may vary between states and territories, since the Code is applied through separate Food Acts. The standard does not harmonise those differences.

Duty to ensure food handler training (s 3.2.2A‑10): The food business must ensure that every food handler who engages in a prescribed activity has, before engaging in that activity, either completed a food safety training course (covering safe handling, contamination, cleaning/sanitising, personal hygiene) or possesses skills and knowledge of food safety and hygiene matters commensurate with that specific activity. This is not a “one size fits all” qualification mandate; there is an alternative pathway of demonstrated equivalent competence. However, the wording is vague , what constitutes “commensurate” is left to the judgement of the business and ultimately an authorised officer. No minimum hours or specific course is mandated, which allows flexibility but also invites dispute.

Duty to appoint a food safety supervisor (s 3.2.2A‑11): Before engaging in a prescribed activity, the business must appoint a food safety supervisor and ensure that person is reasonably available to advise and supervise each food handler engaged in that activity. The supervisor must hold a current food safety supervisor certificate (issued within the preceding five years) from a registered training organisation or an organisation recognised by the relevant authority. The certificate must be issued by a body recognised under the relevant state/territory application Act, meaning a certificate from one jurisdiction may not be accepted in another if the recognising authorities differ. The requirement that the supervisor be “reasonably available” introduces a fact‑dependent standard: a supervisor who is simultaneously managing multiple kitchen sites or who is not contactable during operating hours may not satisfy the test. The business bears the risk of an adverse finding.

Record‑keeping duty for category one businesses (s 3.2.2A‑12): The business must make a record that substantiates any matter that the prescribed provisions (listed in subsection (4)) require in relation to the prescribed activity. Those provisions are: Standard 3.2.2 clauses 5(3) (handling potentially hazardous food), 6(2)(a) (temperature control facilities), 7(1)(b)(ii) (processing of potentially hazardous food), 7(2) and (3) (cooling and hot‑holding), 7(4) (reheating), 8(5)(a) (food storage), 10(b) (record of temperature checks for potentially hazardous food), and clause 20 (recall system). The record must be kept for three months. The duty is triggered only if the business engages in a prescribed activity; if the activity ceases, so does the record‑keeping obligation for that activity.

Right to avoid record‑keeping: Subsection (3) provides that the record‑keeping duty does not apply if the business can demonstrate to the reasonable satisfaction of an authorised officer that it has complied with each of the prescribed provisions. This is a test that can only be met on request (typically during an inspection). It is not a blanket exemption; it puts the burden on the business to prove compliance on the spot. Practically, most businesses will keep records anyway, because the risk of failing the demonstration is high.

Rights regarding certification: The business may choose any registered training organisation or any organisation recognised by the relevant authority as a provider of food safety supervisor certification. The standard does not restrict the choice of provider, so price competition may soften cost impact.

No duty for fund‑raising events: The standard does not apply to handling of food at a fund‑raising event (s 3.2.2A‑3(2)). The definition of such events is narrow, but the exclusion is total , no training, no supervisor, no records required.

Standard 3.2.2A itself does not prescribe pecuniary penalties or custodial sentences. Enforcement is through the application Acts of each Australian state and territory, which incorporate the Food Standards Code into local law (typically Food Acts). Contravention of a provision of the Code becomes a breach of the relevant application Act. Penalties vary by jurisdiction but commonly include fines (often up to several hundred thousand dollars for corporations), improvement notices, prohibition orders, and in serious cases, prosecution leading to criminal conviction.

The standard creates several points of vulnerability:

• Failure to ensure training before a food handler commences a prescribed activity (s 10). Each person‑instance could be a separate breach.
• Failure to appoint a food safety supervisor before engaging in a prescribed activity (s 11(a)).
• Failure to ensure the supervisor is reasonably available (s 11(b)). This is a continuing obligation.
• Failure to make or keep records for a category one business (s 12). The records must be kept for three months; destruction or loss earlier risks a breach.
• Failure to substantiate compliance on request, if the business attempts to rely on the s 12(3) exception but cannot satisfy the authorised officer.

The “reasonable satisfaction” test in s 12(3) gives authorised officers significant discretion. A business that cannot produce records and cannot otherwise demonstrate compliance (e.g., through witness testimony, process documentation, or digital logs) will be treated as having contravened the record‑keeping duty. The burden is on the business, not the officer.

There is no right of internal review or appeal within the standard itself; businesses would need to rely on general administrative law remedies or statutory review mechanisms under the relevant application Act.

The three‑month retention period for records is relatively short, but it applies to each record individually. A business that processes food daily will accumulate hundreds of records; a failure to keep any one of them for the full three months could theoretically be an offence. Practically, enforcement is likely to be risk‑based and focused on systemic failures rather than isolated omissions, but that is at the discretion of the regulator.

Standard 3.2.2A sits within Chapter 3 of the Australia New Zealand Food Standards Code (Food Safety Standards). It operates alongside, not instead of, Standard 3.2.2 (Food Safety Practices and General Requirements) and Standard 3.2.1 (Food Safety Programs). Standard 3.2.2 contains the base‑level food safety requirements (temperature control, cleaning, maintenance, etc.) that apply to all food businesses. Standard 3.2.2A adds additional management tools only for category one and category two businesses. Businesses that are required to implement a food safety program under Standard 3.2.1 (typically those with a history of public health risk, such as hospitals and some large caterers) must continue to do so; Standard 3.2.2A does not exempt them. The interaction may create overlap: a category one business that already keeps records under its food safety program may find that those records satisfy the s 12 requirement, but it must still ensure the records cover each prescribed provision specifically.

The prescribed provisions listed in s 12(4) are drawn from Standard 3.2.2. For example, paragraph 7(1)(b)(ii) of Standard 3.2.2 requires that potentially hazardous food be processed in a way that minimises contamination and microbial growth. Standard 3.2.2A does not alter that requirement; it only obliges the business to make a record substantiating compliance with it. Similarly, clause 20 of Standard 3.2.2 requires a food recall system; the new standard requires a record that the system exists and is in place.

The standard applies in Australia only (note 2 in the standard). New Zealand businesses are not subject to it, even though the Code is jointly developed. This may complicate compliance for trans‑Tasman food operations that handle unpackaged potentially hazardous food on both sides of the Tasman.

State and territory food laws may impose additional licensing and registration requirements that intersect with this standard. For example, a food business licence may require evidence of a food safety supervisor as a condition of registration; the standard now mandates that regardless of licensing conditions. There is no provision for exemption or modification by state regulators; the standard is binding as written.

Private contracts (e.g., supply agreements, franchise agreements) may impose stricter requirements. The standard sets a floor, not a ceiling.

The Family Law Act, workplace health and safety laws, and industrial awards may also indirectly affect how the duty to supervise and train is implemented (e.g., rostering, minimum staffing). The standard does not address those interactions.

Standard 3.2.2A as provided is the original variation made under Proposal P1053 - Food Safety Management Tools. It bears the date 1 December 2022 and was gazetted in the Commonwealth of Australia Gazette No. FSC 8 in December 2022. The commencement clause (s 3.2.2A‑1, note) states it commences 12 months after gazettal, making the effective date approximately December 2023.

The source document does not contain any subsequent amendments. It is possible that FSANZ has issued minor corrections or editorial amendments since the initial publication, but those are not reflected in the provided text. The standard was the result of a consultation process (Proposal P1053) that considered industry submissions, cost‑benefit analysis, and public health data. The final instrument differed from earlier drafts in some respects, but the source text does not include a regulatory impact statement or explanatory memorandum.

Practitioners should verify the current version on the Federal Register of Legislation or the FSANZ website, because the Code is subject to periodic variations.

The source document does not refer to any litigation. Given that the standard only commenced in late 2023, there has been limited time for enforcement actions or judicial interpretation. No reported cases are cited. It is unlikely that significant appellate litigation has yet occurred specific to this standard. Any challenges would most likely arise in state tribunals (such as the NSW Civil and Administrative Tribunal, or its equivalents) or via judicial review in state Supreme Courts if a business challenges an enforcement decision. The key interpretive questions that may eventually be litigated include: what constitutes “reasonably available” (s 11), when does a business “process” food (affecting category one vs category two classification), and what satisfies the “demonstrate to the reasonable satisfaction” test (s 12(3)). The “skills and knowledge commensurate” test in s 10(b) is also open to challenge.

For now, the litigation history is essentially nil, but that will change as enforcement ramps up.

1. The “prescribed activity” net is wide: If a business handles any unpackaged potentially hazardous food that is used to prepare ready‑to‑eat food, or that is ready‑to‑eat for retail sale, it is caught. A café that opens a pack of sliced cheese for a sandwich is handling unpackaged potentially hazardous food. The act of opening the packaging changes the food from “packaged” to “unpackaged” (s 3.2.2A‑7(i) uses “received unpackaged or was unpackaged by the food business after receipt”). That single action can trigger the standard if the food is potentially hazardous and ready‑to‑eat.

2. The three‑month record retention trap: Records must be kept for three months after being made. If a business switches to a new record‑keeping system or discards old records after two months, it is in breach even if no inspection has occurred. The clock starts from the date of each record, not from the end of the activity.

3. “Reasonably available” is vague: A single supervisor for multiple sites or shifts may not satisfy the requirement if they cannot be contacted quickly. There is no safe harbour for having a supervisor on call by phone; the wording “advise and supervise” implies on‑site or at least real‑time direction capability.

4. Certificate expiry: The food safety supervisor certificate must have been issued within the preceding five years. A certificate issued five years and one day ago is invalid. Renewal requires a new certification, which may involve additional training or assessment, not just a re‑issue.

5. No small business exemption: The standard applies to every food business meeting the definitions, regardless of size, revenue, or number of employees. A one‑person food truck is a category one business with the same duties as a large restaurant chain.

6. Self‑supervision problem: A solo operator who is the only food handler and also the only person with a food safety supervisor certificate must supervise themselves. The standard does not address whether “supervision” implies a separate person or simply the vesting of authority. An authorised officer may take the view that a single person cannot simultaneously handle food and supervise themselves.

7. Training vs skills/knowledge: The path of “skills and knowledge commensurate” (s 10(b)) is risky. The business must be able to prove commensurate skills and knowledge if challenged, and the standard does not define what evidence suffices. In practice, a formal training certificate is much safer.

8. Fund‑raising exclusion is narrow: Only events “solely for a community or charitable cause and not for personal financial gain” are excluded. A school sausage sizzle run by parents to raise money for the school is likely excluded, but if the operator takes a profit, it is not.

9. Category two businesses can still be caught by record‑keeping via other standards: Even though s 12 does not apply, businesses may be required to keep records under Standard 3.2.2, for example temperature logs (clause 10) or recall records (clause 20). Standard 3.2.2A adds no new record‑keeping for category two, but existing record‑keeping duties from the underlying standard still apply.

10. Interstate inconsistency: The “relevant authority” that recognises training organisations may differ between states. A supervisor certificate recognised in Victoria may not be accepted in NSW if the NSW authority has not recognised that particular provider. The standard does not mandate mutual recognition.

Step 1 - Classify your business. Carefully review the definitions of category one and category two. As a rule of thumb: if you cook, bake, fry, or otherwise transform raw or semi‑processed potentially hazardous food into ready‑to‑eat food, you are category one. If you buy ready‑to‑eat potentially hazardous food that is already cooked or prepared, and you only slice, weigh, repack, reheat, or hot‑hold it before selling, you are category two. If in doubt, err on the side of category one because the record‑keeping is the only additional element.

Step 2 - Identify prescribed activities. Map every step in your operation where a food handler handles unpackaged potentially hazardous food that is used to prepare ready‑to‑eat food (e.g., raw chicken being cooked) or that is itself ready‑to‑eat for retail sale (e.g., unpacking a wheel of brie to slice). Include all staffing, including casuals and volunteers.

Step 3 - Training. Either provide each food handler who will engage in a prescribed activity with a food safety training course covering the four topics in the definition (safe handling, contamination, cleaning/sanitising, personal hygiene) or, if relying on skills and knowledge, document that employee’s experience, prior training, and demonstrated competence. Keep a copy of course certificates or a written record of the skills assessment.

Step 4 - Food safety supervisor. Appoint a person who holds a food safety supervisor certificate issued within the last five years by a registered training organisation or an organisation recognised by the relevant authority in your jurisdiction. Ensure the person has the authority and ability to manage and give direction on safe food handling. That means they should be in a position to enforce hygiene practices, stop unsafe work, and give instructions. Ensure they are “reasonably available” , on site during all food handling hours, or contactable and able to attend promptly if needed. If the business operates multiple sites or shifts, consider appointing multiple supervisors.

Step 5 - Record‑keeping (category one only). Implement a system to substantiate compliance with each of the nine prescribed provisions of Standard 3.2.2 listed in s 12(4). At a minimum, keep logs of:

• Temperature of potentially hazardous food (cooling, cooking, holding, reheating) - covering cl 5(3), 7(2)-(4), and 10(b).
• Maintenance and calibration of temperature control equipment - covering cl 6(2)(a).
• Storage and handling procedures - covering cl 8(5)(a) and possibly 7(1)(b)(ii).
• Recall system documentation - covering cl 20. Records must be made at the time the activity occurs, or as soon as practicable, and retained for three months. Digital records are acceptable.

Step 6 - Decide whether to rely on the s 12(3) exemption. This exemption allows you to avoid making records if you can demonstrate compliance on the spot to an authorised officer. It is risky for all but the most meticulous, low‑risk, and well‑staffed operations. Generally, keeping records is the safer course.

Step 7 - Audit and update. Regularly review that food safety supervisor certificates are current (within five years). When a new food handler is hired, ensure they complete training or are assessed before they handle unpackaged potentially hazardous food. When recipes or processes change, verify that the prescribed provisions remain covered.

Step 8 - Engage with the relevant authority. Contact your local enforcement agency (e.g., local council environmental health officer, state food authority) to confirm recognition of training organisations and supervisor certification providers. Seek their guidance on interpretation of “reasonably available” and “commensurate skills and knowledge” if your operations are non‑standard.

Step 9 - Document compliance. Even if you rely on the exemption, maintain a brief summary of your compliance approach, including who your supervisor is, what training has been provided, and how you manage prescribed provisions. This will assist in any inspection where you need to demonstrate compliance.

Step 10 - Avoid the fund‑raising trap. If you run a community event, ensure it qualifies under the narrow definition (solely charitable/community, no personal financial gain). If profit is involved, treat it as a regular category one or two business.