HACCP Plan in Morocco: Law 28-07, ONSSA and Codex, a Complete Guide

Is a HACCP plan mandatory in Morocco?

Yes for establishments under sanitary approval, and in a lighter form for the others. Law 28-07 sets out the principle of own checks; its implementing Decree 2-10-473 specifies that these checks rest on HACCP principles and makes them mandatory for activities under approval. Both are enforced by ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires), Morocco’s national food safety authority.

Law 28-07 on the safety of food products, promulgated by the Dahir of 11 February 2010, contains three articles that shape every Moroccan HACCP plan. Article 5 requires food establishments and businesses to hold a sanitary authorisation or approval before they start operating. Article 7 provides for the suspension, then the withdrawal, of that authorisation or approval if the conditions under which it was granted are no longer met. Article 9 makes the operator responsible for the safety of what it places on the market or exports: it must set up, apply and maintain an own-check programme, or follow an approved guide to good sanitary practice, and record its procedures in documents kept for at least 5 years.

Decree 2-10-473 of 6 September 2011 links this obligation to the HACCP method. Its Article 41 states that the own-check programme of Article 9 must be based on the principles of hazard analysis and critical control points, in line with Moroccan standard NM 08.0.002 (HACCP), the standard that replaces it, or any equivalent system that achieves the same objectives. Its Article 34 imposes it on food establishments under sanitary approval, on top of the hygiene conditions of Articles 32 and 33.

Approval or authorisation: two levels of requirement for the plan

Article 4 of the decree places under sanitary approval the activities on the annexed list (for example fishery products, dairy products, meat products, central kitchens, juices and nectars, or heat-treated canned vegetables), and under sanitary authorisation all the others. How the two regimes fit into a food safety project, and where to file, is summarised on our food safety consulting page; here, what matters is their effect on the plan.

That effect can be read in the files ONSSA publishes. The approval file asks for a manual describing the own-check programme, drawn up in line with Articles 32, 33 and 41 of the decree: that is your HACCP system. The authorisation file asks for a procedures manual based on the guides to good sanitary practice for the activity; where no guide exists, that manual applies Articles 32 and 33, sets out measures to identify and reduce risks and establishes a traceability system. Guides to good practice are drawn up by trade organisations, referring where appropriate to the Codex codes of practice, then approved by ministerial order (Article 43).

For an authorised site that targets an industrial customer or export markets, the question does not stay open for long: the buyer and every certification standard will ask for a full HACCP plan.

What does ONSSA expect of the HACCP plan, in the file and during visits?

A plan that describes the real site, then a site that stays in line with that plan. The HACCP plan comes in at two moments: it is filed as a manual with the approval application, together with the detailed production flow diagrams of the technical sheet, then the inspectorate checks that it is applied and kept up to date.

The ONSSA approval and authorisation page (in French) cites Law 28-07, Decree 2-10-473 and Orders 2768-12 and 244-13. Approval is granted when the facilities, the equipment and the operating documentation meet the requirements (Article 12 of the decree); the establishment then receives regular sanitary inspection visits, which check that these conditions are still met (Article 16). The texts ONSSA cites and the two parts of the application file are summarised on our HACCP plan and ONSSA approval page.

The stakes are real. A non-conformity found during a visit can lead to suspension of the approval, with no more than six months to come back into compliance, then to its withdrawal (Article 17); a non-conformity that endangers life or health leads to immediate withdrawal (Article 18). Since Order 2010-25 of 5 August 2025, published in the Official Bulletin (Bulletin officiel) of 15 January 2026, ONSSA may delegate these regular visits to approved bodies.

In our diagnostics, the gap we find most often is an own-check manual filed years ago that no longer describes the current lines, products or organisation. Yet the approval was granted on the basis of that file.

How do the 7 principles and 12 steps of the Codex apply?

The method remains that of the Codex Alimentarius: five preliminary steps, then seven steps that apply the seven principles. The Moroccan decree does not rewrite it; it adds obligations on training, laboratories, record keeping and traceability.

The reference text is the General Principles of Food Hygiene, CXC 1-1969: adopted in 1969, it was revised in 1997, 2003, 2020 and 2022, the substantive revision being that of 2020. It is organised in two chapters: good hygiene practices (GHPs), then the HACCP system and its application. The FAO good hygiene practices and HACCP toolbox explains how to apply it in twelve steps and points out that a food business should only implement HACCP once it has established solid prerequisite programmes.

Four definitions from the official text (FAO/WHO 2023 edition) change the way a plan is read:

• significant hazard: a hazard identified by a hazard analysis as reasonably likely to occur at an unacceptable level in the absence of control, and for which control is essential given the intended use of the food;
• critical control point (CCP): a step at which a control measure or control measures, essential to control a significant hazard, is/are applied in a HACCP system;
• critical limit: a criterion, observable or measurable, relating to a control measure at a CCP which separates acceptability from unacceptability of the food;
• validation of control measures: obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome.

Between ordinary GHPs and CCPs, the Codex recognises that certain activities or critical steps may require greater attention. ISO 22000 and FSSC 22000 use the term operational prerequisite programmes (OPRPs) for a similar level. Our HACCP plan page details the seven principles, the twelve steps and this correspondence with ISO 22000, so we do not repeat it here.

The full practice, step by step and with table templates, is set out in our article on how to build a HACCP plan step by step.

Which good hygiene practices must come before the plan?

Those that Decree 2-10-473 imposes on every establishment, before CCPs even come up. A HACCP plan laid over uncontrolled premises, water or staff ends up classifying basic hygiene as CCPs.

The decree covers them at length. Articles 32 and 33 deal with premises, food contact equipment, waste and water: drinking water within the meaning of Moroccan standard NM 03.7.001, clean water allowed for whole fishery products and external washing, ice made from drinking water, steam free of hazardous substances and, for hermetically sealed containers that are heat-treated, cooling water that must not be a source of contamination. Article 46 covers storage, pest control and the cold chain. Articles 60 to 65 cover staff: cleanliness, work clothing, competence, training, exclusion of sick people and medical surveillance paid for by the operator. Articles 66 and 67 regulate cleaning and disinfection products.

The GFSI-recognised standards follow the same logic. BRCGS Food Safety Issue 9 requires documented prerequisite programmes, included within the development and reviews of the HACCP plan (2.2.1), and validation of the adequacy of the programmes that control a specific hazard (2.7.4). Cross-cutting programmes, such as allergens, traceability, pest control and environmental monitoring, are covered on our food safety programmes page.

How does the same plan satisfy BRCGS, IFS and FSSC 22000?

By staying faithful to the Codex and building in the strictest verification requirements from the start. The three standards recognised by the GFSI (Global Food Safety Initiative) build their HACCP chapter on the Codex steps; what sets them apart are frequencies, the status of the requirement and the points the auditor looks at first.

Three practical consequences follow. First, the hazard analysis must cite the regulations of the country of sale as well as Morocco’s: IFS says so in as many words, and the European or British buyer will check. Second, the review frequency follows the strictest standard: a documented annual review, plus a review before any change of raw material, recipe, equipment or process, as BRCGS lists them (2.12.3). Third, corrective action must cover all product made while control was lost (BRCGS 2.11.1) and identify the root cause (IFS 2.3.10.1).

For FSSC 22000, audits against version 6 remain possible until 30 April 2027, then upgrade audits to Version 7 run from 1 May 2027 to 30 April 2028. The mapping between the Codex steps and the clauses of ISO 22000:2018 is set out on our ISO 22000 certification page. What changes for the HACCP plan in 2026 and 2027 is summarised in our article on HACCP requirements for 2026-2027.

A “HACCP” certificate issued by a body on the basis of the Codex may reassure a local customer. It replaces neither ONSSA approval, which is a legal obligation, nor a GFSI-recognised standard, which is a commercial requirement.

Where do you start when the site already has a HACCP plan?

With a cross-reading of the sanitary file, the plan and the line. An existing plan is often worth more than a blank page, provided it is compared with the site as it runs today.

• The approval or authorisation number covers every current activity, product and building.
  
• The own-check manual filed with ONSSA still describes the lines, flow diagrams and products in production.
  
• The recommendations of the latest visit reports are closed, with evidence, and the visit register is kept.
  
• The good hygiene practices of Articles 32, 33 and 46 of the decree are written, applied and recorded.
  
• The HACCP team is appointed and multidisciplinary, and its training is documented (Article 63).
  
• Each flow diagram has been confirmed on the line since the last change, for every shift.
  
• Each CCP has a validated critical limit, monitoring recorded at the time of the check and a signed verification.
  
• The laboratories that carry out verification testing are identified and recognised (Article 42).
  
• The records of the last 5 years can be found in a few minutes.
  
• A traceability and withdrawal test has been carried out and documented (Article 75).
  
• The plan has been reviewed within the last 12 months and before each significant change.
  

If several boxes remain empty, start with the sanitary file: it is what allows you to operate. The time and resources for this upgrade are detailed in our article on HACCP plan cost, and a full example is given in our sardine cannery case study. A HACCP plan works all the better when the site’s culture supports it: see our food safety culture guide.