Chocolate Food Safety for Small Makers: HACCP and Hazards
On this page
A small chocolate maker handles food safety the same way a factory does: with a plan based on HACCP, scaled to the size of the workshop. In cocoa the main hazard is Salmonella, and the roast is usually the step that controls it. Contaminants such as cadmium and ochratoxin A are dealt with earlier, through the beans you buy and how well you winnow. Where each of these steps sits in the whole chain is in the bean-to-bar process, and registration, equipment and costs for a new business are in how to start a chocolate factory.
HACCP, scaled to a workshop
HACCP is a tool to assess hazards and set up controls focused on the significant ones, rather than relying mainly on testing the finished product. The Codex text, CXC 1-1969 in its 2022 revision, sets out seven principles:
- Conduct a hazard analysis and identify control measures.
- Determine the critical control points (CCPs).
- Establish validated critical limits.
- Monitor control of the CCPs.
- Set corrective actions for when monitoring shows a deviation.
- Validate the plan, then verify that it works.
- Keep documentation and records.
Not every hazard needs a critical control point. Codex says good hygiene practices can be enough to control some hazards, with CCPs added where they aren’t. It encourages flexible approaches for small businesses, for example recording monitoring results only when there’s a deviation. All seven principles should still be considered, though, and the food business operator stays responsible for the system.
What the law asks in the EU and the US
In the EU this is law. Article 5 of Regulation (EC) No 852/2004 requires food business operators to put in place and maintain a permanent procedure based on HACCP principles. Its recitals accept that some businesses can’t identify critical control points, that good hygiene practice can sometimes replace monitoring them, and that record-keeping should be flexible for very small businesses.
The US framework is the FDA’s preventive controls rule for human food, written under the Food Safety Modernization Act and set out in 21 CFR Part 117. It’s built on hazard analysis and risk-based preventive controls rather than HACCP by name, and a very small business can qualify for modified requirements instead of the full plan. The good manufacturing practice rules aren’t among the parts it exempts.
Keeping raw beans away from finished product
Raw cocoa beans carry an intrinsic risk of microbial contamination, and the industry’s quality guide, Cocoa Beans: Chocolate and Cocoa Industry Quality Requirements, calls for an effective hygiene barrier between incoming raw materials and finished goods. Its sample protocol for breaking and winnowing asks for precautions against cross-contamination between raw and roasted beans as part of an active HACCP program. In a small room, that means separate containers, separate tools and a route that never brings roasted nibs back past raw sacks.
The shell needs the same attention. The guide calls it often the most contaminated part of the bean: for microbes including molds, for polycyclic aromatic hydrocarbons (PAH), for ochratoxin A and for some pesticide residues. Good winnowing is a safety step as much as a yield one, and the legal shell limits are covered in the cracking and winnowing section of the bean-to-bar guide. Checking and sorting beans on arrival is in cocoa bean quality checks.
Salmonella and the roast
Salmonella is recognized as the major pathogen of concern in cocoa and cocoa products. The industry’s CocoaVal validation guideline (2024) notes there is no legal requirement for a specific log reduction in cocoa processing, and that a minimum 5-log reduction (a 100,000-fold drop) is currently considered adequate for beans, nibs and liquor.
Chocolate gives little margin. Outbreak investigations indicate that few colony-forming units are needed to cause illness, as Nascimento and colleagues (2012) note. One outbreak linked to German chocolate led to an estimated excess of 439 S. Oranienburg notifications in Germany between October 2001 and March 2002, according to Werber and colleagues (2005).
Published kill data for whole beans
The most useful data for small roasters come from a Penn State study of whole beans in a laboratory convection oven, published by Yan and colleagues in 2021. More than a 5-log reduction was reached after 10 minutes at 150 °C. At 100 to 140 °C, the longest roasts tested topped out between 2.80 and 4.98 log.
Read those numbers with their limits. The study used one strain and inoculated beans, and three of its authors worked for a bean-to-bar maker. The authors present the data as a guide for validating roasts in-house with nonpathogenic surrogates such as Enterococcus faecium, rather than as a substitute for that validation.
Nibs and conching
Two cautions follow from the same body of work. Nibs are harder to kill than whole beans. In the Nascimento study, Salmonella in nibs had D-values (the time for a tenfold reduction) 1.8, 2.2 and 1.5 times higher than in whole beans at 110, 120 and 130 °C; only at 140 °C was there no significant difference. Kill data published for whole beans can’t simply be carried over to a nib roast.
Conching is a weak kill step. In milk chocolate conched at 50 to 70 °C, the same study found D-values from 50.99 to 216.87 minutes in the first 180 minutes, growing longer after that. A melanger, where friction warmed the mass to about 40 °C in a 2019 study by Hinneh and colleagues, shouldn’t be counted on to reduce Salmonella.
Validating your own roast
The CocoaVal guideline’s preferred approach uses surrogate microorganisms and at least 3 runs to account for process variability. It was written by specialists from large cocoa processors, and we found no version adapted to small makers.
Your critical limit for the roast is the time, temperature and load you have validated on your own roaster, not a number from a paper. That’s why the roast log matters: set temperature and, if you can measure it, bean temperature, time and when you started counting, and batch weight. Those are the inputs a validation is written against, and the roasting section of the bean-to-bar guide covers how to build the profile.
Contaminants with EU limits
EU law sets maximum levels for cadmium in chocolate and for ochratoxin A in cocoa powder, in Annex I of Regulation (EU) 2023/915:
| Contaminant | Product | Maximum level |
|---|---|---|
| Cadmium | Milk chocolate with less than 30% total dry cocoa solids | 0.10 mg/kg |
| Cadmium | Chocolate with less than 50% total dry cocoa solids; milk chocolate with 30% or more | 0.30 mg/kg |
| Cadmium | Chocolate with 50% or more total dry cocoa solids | 0.80 mg/kg |
| Cadmium | Cocoa powder sold to the final consumer, or in sweetened cocoa powder and drinking chocolate | 0.60 mg/kg |
| Ochratoxin A | Cocoa powder | 3.0 µg/kg |
The table follows the regulation as first published, not the consolidated version, so check the current consolidated text before relying on it.
Cadmium is largely a sourcing question. The industry guide says the problem relates to beans from certain regions of some producing countries, particularly in Latin America and the Caribbean. If you make a high-percentage bar from one origin, the beans’ cadmium level largely determines whether the bar complies, so a supplier analysis is a reasonable thing to request before you buy.
For ochratoxin A, the only cocoa line in the text read for this page is cocoa powder; there is no separate limit for chocolate bars in it. The guide calls ochratoxin A the most important mycotoxin in cocoa and says most of it sits on the outside of the bean, one more reason winnowing matters. The same regulation also limits PAH in cocoa beans and derived products.
Sources
The industry quality guide cited here is Cocoa Beans: Chocolate and Cocoa Industry Quality Requirements. Its sample protocol on cross-contamination between raw and roasted beans is on the breaking and winnowing page.