Food Safety for Bakeries: a Complete Guide

A bakery's biggest food-safety risks are not the bread — they are the cream and custard fillings, the allergens baked into almost everything (gluten, egg, nuts, milk), and slow cooling of large, dense bakes. Cream- and custard-filled products are potentially hazardous and must generally be kept at 5°C or below. Get allergen declarations, temperature control and cooling right, and confirm your specific licensing and Food Safety Supervisor obligations with your local council and state food regulator. Key takeaways: Cream, custard, cheesecake and fresh-cream products are potentially hazardous foods — they should generally be kept at 5°C or below (or 60°C or above) and given a defined use-by date, unlike plain bread and most dry biscuits.. Almost every bakery product declares multiple allergens; under Plain English Allergen Labelling (mandatory since 25 February 2024) you must name the specific cereal containing gluten (e.g. wheat), tree nuts by name, egg and milk clearly, and control cross-contact from shared flour, benches and equipment.. Large, dense bakes (family pies, quiches, mud cakes, fruit loaves) cool slowly through the danger zone — a widely used approach is two-stage cooling: 60°C to 21°C within 2 hours, then 21°C to 5°C within a further 4 hours.. Food you make and package on site to sell from the same premises is generally exempt from a full label, but you must still be able to declare allergens; food packaged for wholesale or other retailers usually needs a complete label.. Most bakeries handling unpackaged potentially hazardous food will generally need to notify or be licensed, appoint a Food Safety Supervisor and meet Standard 3.2.2A food safety management tools — confirm the details with your council and state food regulator.. Bakery labelling by how the food is sold: How the food is sold, Labelling requirement. Made and packaged on site, sold direct to the customer — Generally exempt from a full label, but allergens must still be declarable. Displayed unpackaged — Allergen information must be available to the customer at the point of sale. Packaged for other businesses, markets or online delivery — Generally needs a full label: name, ingredients, allergen statement, date marking, lot ID, net weight and supplier details. Why bakeries are a special case for food safety On the surface a bakery looks low-risk: baking at high temperatures destroys the pathogens people worry about most. The problem is what happens after the oven. A crusty sourdough is relatively safe, but the moment you add fresh cream, crème pâtissière (custard), cheesecake filling, ganache made with cream, or a savoury quiche or meat pie filling, you are handling potentially hazardous food that supports bacterial growth and needs strict temperature control. Bakeries also run enormous allergen loads — wheat flour is everywhere, and egg, milk, nuts, soy and sesame appear across the range — so cross-contact is a constant, distinctive risk. Add the reality that large, dense products cool slowly, and that most of what a bakery sells is unpackaged or packaged on site, and you have a sector with its own specific obligations rather than generic kitchen rules. Baking is a reliable kill step, but post-bake handling (filling, decorating, slicing) reintroduces risk. Cream, custard, cheesecake and cooked savoury fillings are potentially hazardous foods needing 5°C or below. Flour dust and shared equipment make allergen cross-contact a defining hazard. Large bakes cool slowly, and most products are sold unpackaged or packaged on site. Allergen labelling: gluten, nuts, egg and cross-contact Allergen management is arguably the single most important food-safety duty in a bakery because your products contain so many declared allergens and your customers actively ask about them. Under Standard 1.2.3 of the Food Standards Code and the Plain English Allergen Labelling (PEAL) requirements — mandatory since 25 February 2024 — allergens must be declared clearly and in specified plain-English terms. For bakeries this means naming the specific cereal containing gluten — usually 'wheat' rather than a vague 'gluten' — and declaring tree nuts by their specific name (for example almond, hazelnut, walnut), plus egg, milk, soy, sesame and any others present. Where a product carries a label, PEAL requires each allergen to appear in bold in the ingredient list and in a separate summary statement beginning with the word 'Contains'. Just as important is cross-contact: shared flour bins, mixers, benches, piping bags, cooling racks and slicers can transfer traces of nuts or gluten to a product that does not list them. Precautionary allergen labelling (for example 'may contain traces of tree nuts') should reflect a genuine, assessed risk — the VITAL program from the Allergen Bureau is the industry tool for making that call — and is never a substitute for good separation and cleaning. Name the specific cereal containing gluten (e.g. wheat) and each tree nut by name, not generic terms. Declare egg, milk, soy, sesame and other allergens present clearly and consistently. On labelled food, show allergens in bold in the ingredient list and in a 'Contains' summary statement. Control cross-contact from shared flour, mixers, benches, piping bags, racks and slicers. Use precautionary statements ('may contain…') only after a genuine risk assessment, not as a default. Keep an up-to-date allergen matrix so staff can answer customer questions accurately. Cream and custard fillings: potentially hazardous foods Fresh cream, crème pâtissière and custard, cheesecake, mousse, trifle, and cream-cheese frostings are potentially hazardous foods (PHF). They are moist, nutrient-rich and low in acid, so bacteria such as Staphylococcus aureus, Salmonella and Listeria can grow if they are left in the temperature danger zone (broadly between 5°C and 60°C). This is the risk that most clearly separates a bakery's finished-goods handling from a bread-only operation. Cream and custard products should be kept at 5°C or below in cold storage and refrigerated display, and any that are held hot (for example hot pies or savoury custards on display) should stay at 60°C or above. Prepare custards and creams in small batches, chill them quickly, and do not leave bowls of cream or custard sitting out on the bench during a busy morning. Because these products are perishable, they should carry a use-by date rather than a best-before date, and stock should be rotated so the oldest is sold first. Raw or lightly cooked egg used in some fillings, mousses and glazes is a specific Salmonella risk — using pasteurised egg product is a common control. Keep cream, custard, cheesecake and mousse products at 5°C or below; hot savoury fillings at 60°C or above. Make custards and creams in small batches and chill them rapidly after cooking. Never leave cream or custard standing in the danger zone during service. Apply a use-by date to cream- and custard-filled products and rotate stock. Consider pasteurised egg for uncooked or lightly cooked fillings, mousses and glazes to control Salmonella. Cooling large bakes safely Large, dense bakes are a classic bakery hazard because they hold heat and cool slowly, spending a long time in the danger zone where any surviving or reintroduced bacteria and spores (notably Clostridium perfringens and Bacillus cereus) can grow and, in some cases, produce toxins. Family-sized meat pies and quiches, deep lasagne slices, dense mud cakes, boiled fruit cakes, and large loaves left to cool in a warm bakery are the products to watch. A widely used, defensible approach in Australia is the two-stage cooling method described in the FSANZ guidance to Standard 3.2.2: cool cooked food from 60°C down to 21°C within two hours, and then from 21°C to 5°C within a further four hours. If you cool over a longer period you need to be able to show your alternative method is safe. To hit those times, do not stack hot trays or leave big items cooling in a hot section of the bakery. Portion or decant into shallower containers, use a blast chiller if you have one, and avoid covering food tightly while it is still steaming, which traps heat. Verify with a clean, calibrated probe thermometer rather than assuming a product 'feels cool' — the centre of a dense cake or pie stays warm long after the surface has cooled. Apply two-stage cooling: 60°C to 21°C within 2 hours, then 21°C to 5°C within a further 4 hours. Any longer cooling method must be demonstrably safe. Portion large bakes into shallower containers to speed cooling. Use a blast chiller where available; do not overcrowd fridges with hot product. Do not seal food tightly while steaming — it traps heat and slows cooling. Check the centre of dense items with a calibrated probe, not by touch. Packaged-on-site labels and what the law requires Bakeries package food in several ways, and the labelling rules differ. Food that you make and package on the premises and sell directly to the customer from that same premises is generally exempt from carrying a full label under the Food Standards Code — a loaf bagged at the counter, or a cake boxed for a customer, usually does not need a complete ingredient panel. However, you must still be able to declare allergen information on request, either verbally or in writing, and where food is displayed unpackaged, allergen declarations must be available to the customer (for example on a card, sign, menu or folder at the point of sale). The picture changes when you package food for sale somewhere else — supplying a café, a supermarket, a market stall run by others, or selling online for delivery. That food generally needs a full label including the name of the food, ingredient list, allergen summary statement, use-by or best-before date, storage conditions, lot identification, net weight, and supplier name and address. Country of origin labelling requirements may also apply to many packaged foods. Because the boundaries around 'packaged in the presence of the purchaser' and wholesale supply can be nuanced, confirm exactly what applies to your products with your local council or state food regulator. Made-and-packaged-on-site for direct sale: generally exempt from a full label, but allergens must still be declarable. Unpackaged displayed food: allergen information must be available to the customer at the point of sale. Food packaged for other businesses, markets or online delivery: generally needs a full label and date marking. Full labels typically need name, ingredients, allergen statement, date mark, storage, lot ID, net weight and supplier details. Check country-of-origin labelling and the exact wholesale boundary with your council or regulator. Licensing, Food Safety Supervisors and food safety programs Whether a bakery needs a licence, a notification, or a Food Safety Supervisor (FSS) depends on what it handles and where it operates. Generally, a bakery that prepares and sells unpackaged potentially hazardous food — which includes cream cakes, custard slices, quiches and hot pies — is treated as a higher-risk food business, and most jurisdictions require it to notify or be licensed with the local council or state authority, appoint a trained FSS, and ensure food handlers have the required skills and knowledge. Standard 3.2.2A introduced food safety management tools for food service and closely related retail businesses, classifying them as Category 1 or Category 2. A bakery handling unpackaged, ready-to-eat potentially hazardous food is typically Category 1 and generally needs all three tools: a certified Food Safety Supervisor, food handler training, and the ability to substantiate key controls (for example through temperature and cooling records). Some states and sectors also require a documented food safety program. A bakery that sells only bread and shelf-stable baked goods with no potentially hazardous fillings may face lighter requirements. Because how these obligations are adopted and enforced varies by state and territory and by council, do not assume — confirm your specific licensing, FSS and food safety program requirements with your local council and state or territory food regulator before you trade. Handling unpackaged PHF (cream, custard, pies, quiche) generally puts a bakery in the higher-risk (Category 1) group. Most such bakeries generally need to notify or be licensed and appoint a trained Food Safety Supervisor. Standard 3.2.2A Category 1 businesses generally need FSS, food handler training and substantiation of controls. Bread-only, shelf-stable operations may face lighter requirements. Requirements vary by jurisdiction — confirm licensing, FSS and program rules with your council and state regulator. Cleaning, pest control and the bakery environment Flour and sugar make a bakery uniquely attractive to pests and uniquely prone to build-up in hard-to-reach places. Flour dust settles on beams, behind mixers and inside equipment, where it can support insect activity such as weevils and flour moths if not controlled. Store flour and dry ingredients in sealed, labelled, food-grade containers off the floor, rotate stock, and inspect deliveries for signs of infestation. Cleaning and sanitising is a two-step process: clean to remove flour paste, grease and food residue, then sanitise food-contact surfaces such as benches, mixing bowls, beaters and slicers. Give particular attention to equipment that touches cream, custard and cooked fillings, and to any shared equipment that is your main allergen cross-contact route — a mixer or slicer used for a nut product then a nut-free one must be thoroughly cleaned between uses. Keep proving areas, cool rooms and display cabinets clean and well maintained, control condensation, and maintain a pest management program appropriate to the premises. Store flour and dry goods in sealed, labelled, food-grade containers off the floor and rotate stock. Inspect deliveries and dry-storage areas for weevils, moths and other pest signs. Clean first to remove flour paste and grease, then sanitise food-contact surfaces. Thoroughly clean shared mixers, beaters and slicers between allergen-containing and allergen-free products. Maintain cool rooms, proving areas and display cabinets, and run a suitable pest management program. Worked examples: Cooling a large family pie: A bakery bakes large family meat pies. Rather than leaving them to cool overnight in the warm bakery, staff portion them and apply two-stage cooling, from 60°C to 21°C within 2 hours and 21°C to 5°C within a further 4 hours, checking the centre with a calibrated probe rather than judging by touch. Selling slices to a nearby cafe: A bakery starts supplying its slices to a nearby cafe. Because the food is now packaged for sale at another business, it needs a full label with name, ingredient list, allergen 'Contains' statement, use-by date, storage, lot ID, net weight and supplier details, unlike the same slice sold over its own counter. Checklist: Potentially hazardous products (cream, custard, cheesecake, quiche, pies) identified and separated from low-risk lines. Cream and custard products held at 5°C or below; hot savoury items at 60°C or above. Custards and creams made in small batches and chilled rapidly, not left in the danger zone. Use-by dates applied to cream- and custard-filled products, with stock rotation. Allergen matrix complete, naming the specific cereal containing gluten and each tree nut, and kept current. Allergen information available to customers for unpackaged and on-site-packaged food. Cross-contact controlled: shared mixers, beaters, benches and slicers cleaned between allergen and allergen-free work. Two-stage cooling applied to large bakes and verified with a calibrated probe. Correct labels applied to food supplied to other businesses, markets or online delivery. Flour and dry goods stored sealed and off the floor, with a pest management program in place. Licensing/notification, Food Safe