Food Safety Certification for Restaurants in Dubai: HACCP, the Dubai Food Code, and ISO 22000
Most restaurants in Dubai are sold ISO 22000 when what they need is HACCP certification against the Dubai Food Code. Here is the difference, and how to tell which applies to you.
Restaurant operators in Dubai are routinely quoted for ISO 22000 when the certification that actually applies to them is a different one.
The distinction that matters
HACCP certification against the Dubai Food Code is the scheme built for food establishments operating in Dubai. It assesses your food safety system against the technical requirements Dubai Municipality applies locally — the Food Code — using HACCP principles.
EIAC accredits certification bodies specifically for this scheme. That is a separate accreditation from generic management system certification, and it exists because the Dubai Food Code is a local technical regulation, not an international standard.
ISO 22000 is an international food safety management system standard, designed for the whole food supply chain — processors, manufacturers, packaging producers, transporters. It is the right standard when you are supplying other businesses who ask for it, exporting, or operating a central production kitchen feeding multiple outlets.
For a single restaurant serving customers in Dubai, ISO 22000 is usually more system than the operation requires, and it is not what the local regulator’s framework is built around.
| HACCP to Dubai Food Code | ISO 22000 | |
|---|---|---|
| Built for | Food establishments in Dubai | The international food supply chain |
| Basis | Dubai Food Code technical requirements | International management system standard |
| Typical holder | Restaurants, cafés, catering, kitchens | Manufacturers, processors, suppliers |
| Recognised by | Dubai Municipality framework | Clients and buyers internationally |
| Accreditation | EIAC, for this specific scheme | EIAC or other IAF-recognised body |
Some businesses need both — a restaurant group running a central production unit that supplies its own outlets and third parties is a common case.
itmad is accredited by EIAC for HACCP certification as per the Dubai Food Code, and separately for ISO 22000. If you are not sure which applies, describe your operation and we will tell you — including if the answer is that you do not need certification at all yet.
What a HACCP system actually requires
Certification assesses whether you operate a functioning food safety system, not whether you have a folder.
Prerequisite programmes — the foundation, and where most findings occur:
- Cleaning and sanitation schedules, with records
- Pest control, with a contracted provider and monitoring records
- Personal hygiene, including staff health screening and reporting of illness
- Supplier approval — you are responsible for what enters your kitchen
- Waste management
- Water safety
- Maintenance and equipment condition
- Allergen management and separation
The HACCP plan itself:
- Hazard analysis across every process step — receiving, storage, preparation, cooking, cooling, holding, reheating, service
- Critical control points identified, with justification
- Critical limits set for each CCP — temperatures and times, specifically
- Monitoring procedures, with records
- Corrective actions when a limit is breached
- Verification that the system works
- Documentation and record keeping
Temperature control is where restaurants most often fail. Cold holding, hot holding, cooking core temperatures, cooling rates, reheating. Each needs a defined limit, a monitoring routine, a record, and a documented action when the limit is missed. A fridge log with identical readings every day tells an auditor the log is being filled in, not the fridge being checked.
Staff training
Food handler training and competence is a requirement, not an optional extra, and it is checked. Records should show who was trained, in what, when, and when refresher training is due.
Beyond the minimum, the practical issue is that a HACCP system is operated by kitchen staff, not by managers. If the person cooling stock at the end of service does not know the cooling requirement or where to record it, the system does not work regardless of what the plan says.
We provide food safety training alongside certification — as separate services, for reasons explained below.
The certification process
- Gap assessment — where your current practice sits against requirements
- Build the system — prerequisite programmes, hazard analysis, HACCP plan, monitoring and records
- Train the team — the people operating it, not just the manager
- Run it — records need history. A system implemented last week has nothing to audit
- Internal check — verify it works before someone external does
- Certification audit — document review and on-site assessment across the operation
- Certification decision, then surveillance audits to maintain it
The step most often compressed is step 5, and it is the one that determines the audit outcome.
One thing to check when choosing a certification body
An accredited certification body cannot provide consultancy on the system it certifies. Impartiality rules prohibit it.
If a provider offers to build your HACCP system and then certify it, either they are not accredited or they are operating outside their accreditation — and the certificate will not stand up when it is examined.
Ask any provider two questions: which accreditation do you hold for this specific scheme, and can I see it. Then verify it in the EIAC directory rather than taking the logo at face value. That applies to us as much as anyone — our listing is here.
Common questions
Do I need ISO 22000 or HACCP? For a restaurant operating in Dubai, HACCP against the Dubai Food Code is normally the applicable scheme. ISO 22000 becomes relevant if you supply other businesses, export, or operate production facilities. Describe your operation to a certification body before buying either.
Is certification mandatory for restaurants in Dubai? Food establishments in Dubai operate under Dubai Municipality’s food safety requirements. What form of documented food safety system you must hold depends on your category of establishment and activities — confirm with the Municipality or an accredited certification body rather than assuming.
How long does it take? The audit is short. Building a system with enough operating history to audit is the real timeline — typically weeks to a few months depending on where you start.
We already passed a Municipality inspection. Is that the same? No. An inspection assesses conditions on the day. Certification assesses whether you operate a documented, functioning food safety system over time. They are different exercises.
What happens at surveillance? Periodic audits to confirm the system is still operating. Certification is a cycle, not a one-off.
Request a food safety certification proposal — tell us your operation type and number of outlets. See also HACCP certification and ISO 22000 certification.
Related: ISO 22000 certification cost in the UAE · How to get halal certification in the UAE
This article is provided for information only and does not constitute professional or compliance advice. ITMAD accepts no liability for any action taken in reliance on it.