Restaurant food regulations in the US are not governed by one single federal rulebook. Instead, restaurants operate within a layered system: federal agencies provide model guidance, states adopt or adapt those rules, and local health departments enforce them through inspections, permits, and corrective actions.
A restaurant group operating across multiple states may need to meet different requirements at every location, even for the same basic processes. This guide breaks down how food safety regulation works in the US, which rules apply to restaurants, and what operators need to manage in practice.
For a broader view of how food safety fits alongside other compliance obligations, see Restaurant Compliance Requirements in the US.
Key Takeaways
- There is no single national food safety law for restaurants. Regulation works through a combination of federal guidance, state adoption, and local enforcement.
- The FDA Food Code is a model code, not a law. States and local jurisdictions decide whether and how to adopt it.
- Requirements can vary between states and even between cities within the same state.
- Core daily obligations cover temperature control, hygiene, cleaning, cross-contamination prevention, approved sourcing, and recordkeeping.
- Higher-risk processes such as smoking, curing, sous vide, or fermentation may require a HACCP plan and a variance from the local health authority.
- Food safety and allergen management are not separate disciplines. Allergens are hazards that need to be tracked and controlled within the same food safety system.
- Multi-state operators face additional complexity because the same process may be regulated differently at each location.
What food safety regulations do restaurants have to follow?
The regulatory framework for US restaurants combines federal guidance, state law, and local enforcement. The specific rules depend on where the restaurant operates.
Are restaurant food safety rules federal, state, or local?
At the federal level, the FDA publishes the Food Code, a set of model recommendations covering temperature control, handwashing, allergen management, employee health, and more. It was most recently updated in 2022.
The Food Code is not a law. It is a reference document that states can choose to adopt. Some adopt it fully, some adopt an earlier version, and some modify sections to reflect local priorities. State governments set the regulations that restaurants must actually follow.
Local health departments handle day-to-day enforcement: inspections, permits, complaints, and corrective actions.
Why do food safety rules vary by state and city?
States have the authority to regulate food safety within their borders, and they exercise it differently. Some track closely with the latest FDA Food Code. Others operate under older versions. Some have added requirements beyond what the FDA recommends, particularly around allergen disclosure and training certification.
Local health departments add another layer through additional permit requirements, inspection frequencies, or rules for specific operation types.
For single-site operators, this is manageable. For multi-state groups, compliance has to be understood location by location.
What is the FDA Food Code and why does it matter?
The FDA Food Code is the closest thing the US has to a national food safety standard for restaurants. Understanding what it covers helps operators see the logic behind the rules they follow, regardless of jurisdiction.
What does the FDA Food Code cover?
The Food Code addresses:
- Food handling and preparation, including temperature requirements from delivery through to holding and reheating
- Employee health and hygiene, including handwashing, glove use, and illness exclusion protocols
- Equipment and facility standards
- Pest control
- Allergen awareness
- Specialized processes that typically require a HACCP plan
- A person in charge at each operation who can demonstrate food safety knowledge
What does this mean for daily restaurant operations?
The Food Code translates into the routines running in the background of every shift:
- temperature logs,
- handwashing stations that are stocked and used,
- cleaning schedules that distinguish between general cleaning and sanitizing,
- receiving procedures that check deliveries before anything enters storage.
For most operators, compliance is not about reading the Food Code. It is about whether the restaurant’s systems deliver what the Food Code expects, consistently, every shift.
What core food safety controls do restaurants manage every day?
Daily food safety execution covers temperature control, hygiene, cleaning, cross-contamination prevention, and approved sourcing. These are the controls that health inspectors assess and that protect guests in practice.
Time and temperature control
| Food type | Minimum internal temperature |
| Poultry | 165°F (74°C) |
| Ground meats | 155°F (68°C) |
| Whole cuts, fish, eggs cooked to order | 145°F (63°C) |
| Cold holding | 41°F (5°C) or below |
| Hot holding | 135°F (57°C) or above |
Cooling is one of the highest-risk stages. Cooked food must move from 135°F to 70°F within two hours, and to 41°F within a further four. Temperature control depends on monitoring in real time, not assumptions filled in from memory.
Handwashing, hygiene, and illness controls
Handwashing is the most frequently cited requirement in food safety regulation and one of the most frequently failed during inspections. Employees showing symptoms of vomiting, diarrhea, jaundice, or sore throat with fever must be excluded or restricted from working with food.
Cleaning removes visible residue. Sanitizing reduces bacteria to safe levels. Food contact surfaces need both steps between uses. Cross-contamination is prevented through color-coded boards, raw and ready-to-eat separation, and thorough cleaning between tasks. Cross-contact is a separate allergen-specific risk that cooking does not fix.
See Cross-Contact vs Cross-Contamination: What Restaurants Need to Know for more information on how handwashing affects food safety.
Approved sourcing, receiving, and storage
All food must come from approved, inspected sources. Receiving procedures should verify delivery temperatures, packaging integrity, and expiration dates. Storage follows FIFO rotation, with raw proteins below ready-to-eat items, food off the floor, and all containers labeled.
What do health inspectors look for in restaurants?
Health inspections verify that daily controls are working in practice, not just documented on paper. Inspectors focus on:
- Food temperature control (storage, cooking, holding, cooling)
- Employee handwashing and hygiene
- Cross-contamination prevention
- Cleaning and sanitizing practices
- Storage and labeling
- Pest activity
- Facility condition
- Staff behavior and knowledge
How inspections and violations work
Critical violations present immediate health risk and require corrective action on the spot. These include unsafe temperatures, symptomatic employees working with food, and evidence of contamination. Non-critical violations come with a timeframe for correction. Inspection frequency varies by jurisdiction. The most useful way to think about inspections is as a check on daily systems, not an event to prepare for.
What training and certification requirements are common?
Training requirements vary by jurisdiction, but most restaurants need food handler training, manager-level certification, and ongoing internal refreshers.
Food handler training
Most states require food handlers to complete a training course within 30 to 60 days of starting work. Certification is typically valid for two to three years. Most jurisdictions also require at least one Certified Food Protection Manager (CFPM) on site during operating hours, obtained through accredited exams such as ServSafe and usually valid for five years.
Ongoing staff training in practice
Formal certification meets the minimum. It does not build a team that handles food safely under pressure. Short, focused refreshers at pre-shift meetings are more effective than relying on onboarding alone. Training should be documented, regular, and responsive to what is actually going wrong.
Allergen-specific training should sit within this same structure: the nine major allergens, common derivatives, cross-contact prevention, and allergen order handling all need regular reinforcement.
For more information on staff training and requirements, take a look at Preventing Allergen Cross-Contamination in Restaurants and Training Your Team for ADDE Act (SB 68) Readiness.
When are additional controls like HACCP required?
Most restaurant operations are covered by standard food safety controls. HACCP plans are typically only required for specialized processes that create higher food safety risks.
What HACCP means in foodservice
HACCP (Hazard Analysis and Critical Control Points) is a structured system for identifying food safety hazards and controlling them during production. In foodservice, it commonly applies to processes such as smoking and curing, fermentation, sprouting, sous vide and reduced-oxygen packaging, using additives for preservation, and custom methods like dry-aging.
These processes often require a variance from the local health authority along with written procedures, monitoring, and recordkeeping.
For most operators, HACCP only applies to a limited part of the menu, if at all. The important step is recognizing when a specialized process requires additional oversight and working with the local authority before implementation.
What records do restaurants need for food safety compliance?
Records provide evidence that food safety controls are being followed. Without documentation, verbal assurance carries far less weight than a log showing what was done, when, and by whom.
Common records and why they matter
| Record type | Purpose |
| Temperature logs | Demonstrate cooking, holding, cooling, and storage compliance |
| Cleaning and sanitizing schedules | Confirm food contact surfaces are maintained |
| Receiving logs | Verify deliveries met temperature and quality standards |
| Employee training records | Show food handler and CFPM certification, refresher completion |
| Illness reporting logs | Document exclusion and return-to-work decisions |
| Vendor records and specifications | Confirm approved sourcing and ingredient accuracy |
| Corrective action documentation | Capture responses to incidents and violations |
Records should be completed in real time and stored accessibly. For multi-location operators, centralizing recordkeeping makes it easier to identify gaps before an inspector does.
Where food safety compliance breaks down in practice
Most food safety failures are not caused by operators who do not know the rules. They are caused by conditions that make the rules harder to follow consistently.
Staff turnover creates periods of weaker knowledge. Menu changes and seasonal rotations can introduce risks the existing controls were not designed for.
Vendor substitutions can change the food safety and allergen profile of multiple dishes without anyone in the kitchen knowing. Manual systems fail when operations grow beyond what paper-based records can handle reliably.
See Hidden Allergens and Derivatives Restaurants Must Track on Menus for a breakdown of where vendor-related risks appear.
How does food safety fit into wider restaurant compliance?
Food safety regulation is one part of a broader set of obligations. The same processes that drive food safety, including accurate ingredient data, trained staff, and reliable vendor management, also drive allergen compliance, menu labeling, and disclosure requirements.
Relationship to menu labeling and allergen compliance
Federal menu labeling rules require certain chains to provide calorie information. The underlying data infrastructure, accurate recipes built from accurate vendor specifications, is the same infrastructure needed for allergen disclosure.
See Menu Labeling Laws for Restaurants.
Allergen management is a food safety discipline. The nine major allergens, defined by FALCPA and the FASTER Act, are hazards that need the same systematic controls as any other food safety risk. In California, SB 68 requires chain restaurants subject to federal menu labeling requirements to provide written allergen disclosure for the nine major allergens beginning July 1, 2026.
The most effective approach is to treat allergen management as part of the food safety system, not an add-on. See How to List Allergens on a Menu.
Frequently Asked Questions
What food safety regulations do restaurants have to follow?
A combination of federal guidance, state law, and local health department requirements. The specific rules depend on where the restaurant operates.
Is the FDA Food Code law?
No. It is a model code that states can adopt and adapt as the basis for their own regulations.
Do restaurant food safety rules vary by state?
Yes. States adopt different versions and amendments. Local jurisdictions can add further requirements. Compliance must be managed location by location.
Do all restaurants need a HACCP plan?
Not for standard operations. HACCP plans are required for higher-risk processes such as smoking, curing, sous vide, fermentation, or sprouting.
What do health inspectors check most often?
Temperature control, employee hygiene, cross-contamination prevention, cleaning and sanitizing, storage and labeling, pest activity, and facility condition. Critical violations require immediate corrective action.
What records should restaurants keep?
Temperature logs, cleaning schedules, receiving logs, training records, illness logs, vendor documentation, and corrective action records. Records should be completed in real time and stored accessibly.
Related Resources
- Restaurant Compliance Requirements in the US
- Restaurant Allergen Compliance Guide
- Cross-Contact vs Cross-Contamination: What Restaurants Need to Know
- Preventing Allergen Cross-Contamination in Restaurants
- Menu Labeling Laws for Restaurants: What US Operators Need to Know
- The Ultimate Restaurant Compliance Checklist (US)
- Training Your Team for ADDE Act (SB 68) Readiness
- How to Comply With Food Regulations