Bakery business operations: permits and inspections

What to take away

How state and county rules shape bakery permits

The FDA Food Code is a model, not a statute. It has no independent force over your bakery. Congress never gave the FDA authority to inspect a neighborhood retail bakery the way it inspects a canning plant.

Instead, the agency publishes the model text and state, local, and tribal regulators choose to adopt it, usually with edits, on their own timetable. That adoption pattern is spelled out on the FDA Food Code page.

This is why the same doughnut shop faces different rules in Portland, Oregon and Houston, Texas. Adoption is a patchwork. Some states adopt each new edition within a year. Others stay on an older edition for a decade.

Who actually holds the pen

State legislatures or state health agencies adopt the Food Code, then county or city health departments write the local ordinance that governs your permit, your fee, and your inspection frequency.

In California, that means county environmental health divisions. In New York, it runs through county health departments and, in New York City, the Department of Health and Mental Hygiene. Illinois uses certified local health departments. Florida splits retail food between the Department of Agriculture and Consumer Services and the Department of Business and Professional Regulation.

Texas delegates most retail food permitting to city and county health departments under state rules. Washington and Massachusetts run state-level retail food programs with local partners. Oregon uses county health departments under the Oregon Health Authority.

The practical result: your inspector works for a county, not for the FDA. Read the local ordinance, not just the federal model.

Food Code editions and local adoption

The Food Code 2022 is the edition most states are moving toward. It carries forward the risk-factor framework that inspectors use to score your operation.

For a bakery, the notable threads are allergen labeling, cleaning and sanitizing frequency, and the requirement that a person in charge be present during operating hours. That person must be able to answer questions about food safety, not just open the door.

Some states adopted the 2022 text quickly. Others were still operating under the 2017 or 2013 edition when the 2022 book came out. Confirm which edition your county enforces before you build out a kitchen.

Food-safety practices that matter to a dough business

Dough is a low-risk food compared with raw chicken, but it is not exempt. Flour is a raw agricultural commodity, and the Food Code treats it accordingly.

Bare-hand contact and glove rules

Bakeries get cited on bare-hand contact more than almost anything else. If your product is ready to eat, hands must be covered or utensils used. Shaping bread dough that will be baked is generally treated differently from handling a finished cream-filled pastry.

The distinction matters because it drives your glove budget, your hand sink count, and your training. A single hand sink in the wrong place can cost you points on every inspection.

Cold holding, date marking, and time as a control

Custard, cream, mousse, and egg wash are time and temperature control foods. They need cold holding at or below the temperature your county sets, usually 41 F, and date marking once opened or prepared.

If you use time rather than temperature, you need a written procedure and a way to track it. Inspectors ask for the log, not the intention.

Allergens and labeling

The Food Code requires that unpackaged food be labeled or otherwise identified when a customer asks. For packaged product, the major allergens must be declared.

A bakery running eight doughs on one bench has a real cross-contact problem. Walnut, sesame, milk, egg, and wheat are the usual offenders. Sesame was added to the major allergen list in recent federal law, and states have followed.

Employee health and the person in charge

The Food Code requires food employees to report certain symptoms and diagnoses to the person in charge. The person in charge then restricts or excludes them.

For a small bakery, this is a staffing problem as much as a legal one. A vomiting incident on a Saturday morning means someone goes home and someone else covers the bench.

Cleaning, sanitizing, and the dish machine

Sanitizer concentration is measured, not eyeballed. Quat at the wrong dilution is a common finding. So is a dish machine that runs out of sanitizer mid-shift with no test strips on hand.

Your bakery compliance checklist should include a daily sanitizer check at open and at mid-shift.

What a bakery permit application asks for in practice

A retail food establishment permit is the core license for a bakery selling to the public. Fees vary widely by county, from under a hundred dollars to several hundred, and are usually based on risk category and square footage.

Plan for the permit to be one of several. Your bakery licensing requirements will also include a business license, a seller's permit for sales tax, and often a fire or occupancy sign-off.

The standard application packet

Most county packets ask for a core set of documents: your menu, floor plan, equipment list, water source, sewage method, and certified food protection manager information. Missing one typically delays the review by weeks.

Some counties also want a grease interceptor spec, a hood suppression certificate, or a sample label. Ask the plan reviewer before you submit, not after.

Plan review comes before construction

In most jurisdictions you cannot pass a permit inspection until the plan review is approved. Build first and you may be tearing out a wall to add a hand sink.

Submit the plan while the space is still drawings. Corrections are cheap on paper.

What the fee and category mean

Higher-risk categories pay more and get inspected more often. A bakery that does no cooking, no cooling, and no raw protein handling usually lands in a lower category than a bakery with a hot sandwich line.

Adding a meat-filled empanada or a hot deli case can move you up a category. That changes your fee and your inspection frequency.

Your bakery license requirements therefore depend on the menu you submit, so decide the full menu before you file.

Common rejection triggers

What inspectors check on site, station by station

A state health department bakery inspection is a walkthrough with a scoring form. The inspector follows the flow of food from receiving to service.

Expect the visit to take one to two hours for a small bakery. Longer if you have a hot line, a deli case, or a wholesale operation attached.

Receiving and dry storage

Receiving is where the inspector looks for damaged packaging, pest evidence, and temperature logs for any refrigerated delivery. Dry storage gets checked for off-floor shelving, labeled bins, and no chemicals above food.

Flour bags on the floor are a classic finding. So are unlabeled secondary containers.

Prep and the dough bench

At the bench, the inspector watches hand washing, glove use, and whether raw ingredients are stored below ready-to-eat items. Wooden benches and wooden utensils get scrutiny because they are hard to clean.

Your bakery inventory practice shows up here: open bags, unlabeled bins, and ingredients without dates all read as poor control.

Cold holding and refrigeration

Every cooler and freezer gets a temperature. The inspector compares the reading against your log. A cooler at 45 F with no corrective action note is a violation.

Thermometers must be present, accurate, and calibrated. Bring a calibration ice bath to the inspection so you can prove it.

Baking, cooling, and hot holding

Baking kills pathogens, but cooling does the opposite if you do it slowly. If you bake and then cool custards or meat fillings, the inspector wants to see your cooling method and timing.

Hot holding units need a temperature check and a record. A heat lamp over a tray is not a hot holding unit.

Service, display, and self-service

Self-service pastry cases need sneeze guards and tongs. Tongs must be stored so the handles do not touch food. Labels must be legible.

If you sell packaged items, the inspector reads the label. Allergen declaration, net weight, and your business name and address are the usual checks.

Warewashing, hand sinks, and restrooms

Warewashing is a three-step check: wash, rinse, sanitize, with the sanitizer at the right concentration. Hand sinks must have soap, paper towels, and warm water, and must not be blocked by a stack of sheet pans.

Restrooms must be clean, stocked, and accessible to employees without crossing the food prep area where the ordinance requires it.

Pest control, chemicals, and maintenance

The inspector looks for droppings, gnaw marks, and live insects. Chemicals must be stored below and away from food, in original or labeled containers.

Floors, walls, and ceilings must be cleanable. A cracked tile is minor. Standing water under a cooler is not.

The report and your correction window

Most jurisdictions give you a set number of days to correct priority violations, often 48 hours to 10 days, and longer for lesser findings. You usually have to show proof, either by photo or by a re-inspection.

Ask the inspector to write the specific code section on the report. That is what you fix, not the general complaint.

Where FDA, USDA FSIS, and state jurisdiction split for bakery products

Jurisdiction follows the product, not the building. The same bakery can be under county health for its retail counter and under a federal agency for a wholesale line.

Retail counter: state and county

Selling directly to consumers, whether at the counter or at a farmers market, keeps you under the state or county retail food program. The Food Code is the underlying text.

This is the simplest lane. One permit, one inspector, one set of rules.

Wholesale dough: FDA and FSMA

Once you manufacture dough and sell it to other businesses across state lines, you are likely a food facility under the FDA, not a retail food establishment. That brings FSMA into play.

The FSMA final rule for preventive controls for human food requires a written food safety plan built on a hazard analysis, plus preventive controls, monitoring, corrective actions, verification, and a recall plan.

Some small wholesale bakeries qualify for modified requirements or an exemption based on size and sales, but the exemption has conditions. Do not assume it applies to you without checking your numbers.

Meat-containing bakery products: USDA FSIS

Add a meat filling and the product can move to USDA jurisdiction. Empanadas, meat pies, sausage rolls, and some kolaches are the usual examples.

The FSIS inspection program covers establishments that produce meat and poultry products for commerce. If your meat pie crosses state lines, expect FSIS to be the agency at the door, not the county.

FSIS publishes compliance guidance for specific product categories. The FSIS guidelines library is where you find the relevant compliance guide before you design the process.

The split in one table

When you sit in two lanes at once

Many bakeries do. A retail counter plus a wholesale line plus a seasonal meat pie means three rulebooks in one building.

Keep the records separate. A county inspector does not want to review your FSMA hazard analysis, and an FSIS inspector does not score your retail sneeze guards.

Keeping a bakery inspection-ready between visits

Inspection readiness is a habit, not a spring cleaning. The bakeries that score well do the same small things every day.

Daily opening and closing routine

Open with a temperature check on every cooler and freezer, a sanitizer concentration test, and a hand sink check. Close with a walkthrough for standing water, uncovered food, and pest evidence.

Record it. An undocumented check is treated as a check that did not happen.

The weekly self-audit

Once a week, walk your own kitchen with the county form in hand. Score yourself. Fix what you find before someone else writes it down.

Your bakery business plan should include this walkthrough so a shift lead can run it when you are away.

Records that survive a surprise visit

Keep at least the retention period your county requires, often 30 to 90 days for temperature logs and longer for training records.

Training that holds up

Food handler cards and certified food protection manager credentials expire. Track the dates in the same place you track your cooler logs.

New hires should not touch food before their orientation covers hand washing, illness reporting, and allergen awareness.

When you change the menu or the space

Adding equipment, a new process, or a new room usually triggers a plan review amendment. Call the health department before the work, not after.

A remodel without approval can void your permit status and force a full re-application.

Cost and time planning

Permit fees, plan review fees, and certified manager courses are real startup costs. So is the time between application and approval, which can run from a couple of weeks to a few months depending on the county backlog.

Build that window into your lease and your payroll plan. Opening day depends on an inspector's calendar as much as on your oven.

Common questions