The 2026 FDA Food Code: what multi-unit operators need to change

Executive summary: what multi-unit operators need to know about the 2026 Food Code

• The FDA released the 2026 Food Code on September 17, 2026. It's a model code, so its requirements apply only after a state or local agency adopts it, and adoption usually takes years.

• The biggest change is a written food safety management system (FSMS), which covered establishments must have in place within four years of their jurisdiction adopting the 2026 code.

• Operators also need a written employee illness policy, a person in charge who actively maintains control of food safety, and food defense training.

• Holding temperatures, date marking and reheating rules are unchanged, while cooling gains a 2-inch depth method and an approved alternative that uses continuous electronic monitoring.

• Multi-unit operators that standardize on the 2026 requirements now avoid running a different program in every state and will already have the written records the new code asks for.

What is the 2026 FDA Food Code?

The 2026 FDA Food Code is the newest edition of the FDA's model rules for restaurants, retail food stores and other foodservice operations, released on September 17, 2026. It replaces the 2022 edition as the FDA's recommended standard, but it doesn't become law on its own. Each state, county or city health agency decides when to adopt it, and many adopt it with their own changes.

The gap between release and adoption can run for years. In the FDA's most recent adoption report, based on 2024 data, agencies in only seven states had adopted the 2022 edition, covering about 16% of the U.S. population. Agencies in 36 states were on the 2013 edition or newer. A brand operating in 20 states is likely already working under several editions at once, and the 2026 code adds another.

Even before adoption, the new edition sets direction, because inspectors train on it, auditors reference it, and the next round of state rules will be built from it.

The changes multi-unit operators should plan for

The FDA's summary of changes runs long, and much of it is technical cleanup. Five changes will touch how a multi-unit operation runs day to day.

1. A written food safety management system

A new section, § 8-201.15, describes when a food establishment must have a food safety management system, and the code now defines the term as a preventive approach to controlling the factors that cause foodborne illness. According to Food Safety Magazine's summary, covered establishments must develop and maintain a written FSMS, carry it out during all hours of operation and show it to the regulatory authority on request. They have four years from the date their jurisdiction adopts the 2026 code to comply. Regulators can exempt establishments they judge to pose minimal foodborne illness risk based on their operations and how much food preparation they do.

Most chains that cook, cool, hold or prep fresh food should plan on being covered. In practice, food safety procedures need to be written down, followed on every shift and easy to prove to an inspector, without depending on what a few experienced managers remember. For a brand with dozens or hundreds of locations, that means one documented system that every store runs the same way, rather than a binder that differs by region. Our upcoming guide to building a written FSMS across locations goes deeper on what it should contain.

2. Active managerial control, spelled out

The person in charge has always been responsible for food safety during a shift, and the 2026 edition makes that explicit. A new lead-in to § 2-103.11 says the person in charge must maintain active managerial control by ensuring compliance with the duties that follow. Active managerial control means preventing problems through routine monitoring and correction during the shift instead of catching them at the next inspection.

For multi-unit teams, the work here is mostly training, because every shift lead who can be the person in charge needs to know what they're responsible for checking. Headquarters also needs a way to see whether those checks happen.

3. A written employee illness policy

Part 2-5 is now titled "Policies and Procedures for Employee Illness Management," and § 2-501.11 requires a written employee illness policy that's kept on file and available to the regulator on request. The model inspection form now includes an "Illness Documentation" item, designated Priority Foundation, according to Morrison Foerster's analysis.

The same part of the code moves cleanup procedures for vomiting and diarrheal events into their own section, § 2-502.11. Medical clearance to return to work now accepts two consecutive negative results from a validated laboratory test, replacing the requirement for two negative stool cultures.

If your stores already train on illness reporting but the policy isn't written down at each location, that's the gap to close, and it's one of the quickest items on this list.

4. New cooling options

Cooling cooked food is one of the riskiest steps in any kitchen, and the 2026 code adds flexibility to § 3-501.15. Placing food at a depth of 2 inches or less is now a recognized cooling method. The code also lets the regulatory authority approve an alternative cooling process for cooked TCS food under specified conditions, which include refrigeration with continuous electronic monitoring of time and ambient air temperature.

The time and temperature limits for cooling haven't moved. Cooked food still needs to go from 135°F to 70°F within two hours and to 41°F or below within six hours total, as explained in our guide to cooling foods safely with the two-stage rule. The alternative method needs your regulator's approval, so treat it as an option to raise with each jurisdiction rather than a change to roll out everywhere at once. Operators that already run continuous temperature monitoring are in a strong position to use it.

5. Food defense

The 2026 code defines "food defense" for the first time, makes it a required knowledge area for the person in charge and calls for employee training on it. Food defense covers deliberate tampering or contamination, as opposed to accidental contamination, so the practical updates are about access control to storage and prep areas, watching for unusual activity and knowing who to tell.

Smaller changes that still touch your SOPs

These won't reshape a food safety program, but each one can change a procedure, a training module or a line on an inspection.

The FDA's release also lists updates to consumer advisories, allergen cross-contact, food donations and vending machine controls. Review those sections of the full code with your food safety team, especially if you run catering, vending or a donation program.

What didn't change in the 2026 Food Code

Many of the numbers kitchen teams use every day stay the same. The FDA's summary of changes leaves these limits where they were:

• Cold holding at 41°F (5°C) or below and hot holding at 135°F (57°C) or above, as covered in our temperature danger zone guide

• Date marking ready-to-eat TCS food for up to seven days at 41°F or below

• Reheating, time as a public health control, or the cooling time limits

So there's no need to reprint temperature charts or relabel product because of this edition. The work is in documentation, policy and training.

When do the 2026 Food Code changes take effect?

Nothing in the 2026 code applies to a location until that location's state or local agency adopts it. Some states adopt within a year or two, others skip an edition entirely, and a few counties write their own rules. The FSMS requirement adds a second clock, because covered establishments then have four years from adoption to comply.

For a multi-unit operator, that creates a patchwork in which one store may be inspected under the 2013 code while another, two states away, is under 2026. Two approaches are common:

• Track each jurisdiction separately and update procedures as each one adopts. This keeps work to a minimum in the short term, but it means running different programs in different regions and retraining every time a state moves.

• Standardize on the strictest current standard everywhere. This means building one program to the 2026 code now. It takes more effort up front, but every store runs the same procedures, field leaders audit against one standard and new markets don't require a rewrite.

For chains with 50 or more locations, the second approach is usually easier to manage, because one standard across stores takes less upkeep than tracking dozens of adoption dates. It's still worth keeping a simple adoption tracker so your team knows when a written FSMS becomes enforceable in each state.

Why it pays to start before your state adopts

The case for moving early is mostly operational, and the FDA's own data supports it. In the FDA's 2017 to 2018 restaurant study, part of its Retail Food Risk Factor Study, inadequate food safety management systems were the strongest predictor of out-of-compliance risk factors. Fast food restaurants with a well-developed FSMS averaged 1.5 out-of-compliance items, compared with 4.5 for restaurants with no FSMS. Full-service restaurants showed the same pattern, at 2.2 versus 5.3.

In effect, the FSMS requirement writes that finding into the code, since a written system that's followed on every shift tends to produce fewer violations, fewer discarded batches and fewer surprises during inspections. It also gives regional and corporate teams something concrete to check, because each written step was either completed and recorded or it wasn't.

High staff turnover is another reason to write procedures down and build them into daily tools, since a new shift lead can then follow them on day one. The program also stops depending on a few experienced managers who might leave.

What to update first: a checklist for multi-unit operators

These steps work whether your first state adopts the 2026 code next year or in five years.

1. Map your jurisdictions. List every state and county you operate in, the Food Code edition each one enforces today and any announced adoption plans.
2. Write the employee illness policy. Put your reporting, exclusion and restriction rules into one written policy, make sure every location can produce it on request and train shift leads on it.
3. Inventory your current procedures. Gather the SOPs, logs and checklists you already use for receiving, cold and hot holding, cooling, date marking, cleaning and corrective actions. Most of an FSMS already exists in pieces.
4. Find the gaps between "written" and "done." For each procedure, ask whether it's written down, whether it's followed on every shift and whether you could prove it to an inspector. The third question usually exposes the gaps.
5. Define the person in charge's daily checks. Turn active managerial control into a short list of monitoring tasks each shift lead completes and records.
6. Add food defense to training. Cover access to storage areas, deliveries and what to report.
7. Review your cooling methods. Decide whether the 2-inch depth method fits your menu, and whether the monitored alternative is worth raising with your regulators.
8. Update the small SOPs. Work through the table above, starting with the jewelry, glove, sanitizer and disinfection changes.

If your team already has a HACCP plan, much of the structure for a written FSMS is already in place. Our plain-English guide to HACCP explains how the two fit together.

How BOHA! helps turn written procedures into daily records

A written food safety management system only works if stores follow it and the records prove it. The BOHA! platform is built to connect those two steps across every location:

• Procedures: BOHA! Checklist turns written SOPs into daily food safety, cleaning and audit tasks, with a digital record of what was completed, backed by photos and notes, plus corrective tasks assigned from the app.
• Temperature checks: BOHA! Temp guides teams through food temperature checks and the corrective actions that follow, building audit-ready HACCP records as they work.
• Equipment monitoring: BOHA! Sense monitors refrigeration, storage temperature, and humidity around the clock and alerts the team when a unit moves out of range.
• Visibility: BOHA! Control Center gives field and headquarters teams a view of food safety activity across locations, so gaps show up before an inspection does.

Together, they give multi-unit operators one consistent food safety record per location instead of a stack of paper logs. That's the kind of documentation a written FSMS calls for. Read more about digital HACCP records that prove compliance, or see how the pieces fit on our Food Safety & Compliance page.

If you're planning how your locations will meet the 2026 Food Code, talk with the BOHA! team about building one food safety system that runs the same way in every store.

Frequently asked questions about the 2026 FDA Food Code

When was the 2026 FDA Food Code released?

The FDA released the 2026 Food Code on September 17, 2026. It's the first full edition since 2022 and replaces it as the FDA's model code for retail food and foodservice.

Is the 2026 Food Code mandatory?

The 2026 Food Code isn't mandatory on its own. The Food Code is a model that state, local, tribal and territorial agencies choose to adopt, sometimes with changes. Its requirements apply to a restaurant only after that restaurant's jurisdiction adopts the 2026 edition.

What is a food safety management system under the 2026 Food Code?

It's a written, preventive system for controlling the factors that cause foodborne illness, such as improper holding, cooling, cross-contamination and poor employee health practices. Covered establishments must write it down, follow it during all hours of operation and make it available to the regulator on request. They have four years from their jurisdiction's adoption of the 2026 code to comply.

Do restaurants need a written employee illness policy?

Restaurants need one wherever the 2026 Food Code is adopted. Section 2-501.11 requires a written employee illness policy that's maintained and available to the regulator on request, and the model inspection form now includes an illness documentation item. Writing the policy now is a simple step most operators can take before their state adopts the code.

Did temperature requirements change in the 2026 Food Code?

The core temperature limits didn't change in the 2026 Food Code. Cold holding stays at 41°F or below, hot holding at 135°F or above, and the cooling limits remain 135°F to 70°F within two hours and to 41°F within six hours total. The code adds a 2-inch depth cooling method and an approved alternative cooling process that uses continuous electronic monitoring.

How does the 2026 Food Code affect multi-unit operators differently?

Multi-unit operators often run stores in states that enforce different Food Code editions, so the 2026 changes will arrive at different times in different markets. Many chains choose to standardize on the 2026 requirements everywhere so every location follows one written system, instead of tracking and retraining state by state.

What's the difference between an FSMS and a HACCP plan?

A HACCP plan controls specific hazards at critical control points in a process, such as cooling or acidifying sushi rice. A food safety management system is broader and covers the whole operation, including employee health, training, cleaning, supplier controls and the person in charge's daily monitoring. A HACCP plan is often one part of an FSMS.