Essential business documents for UK cafes and coffee shops in 2026

TL;DR: Running a cafe or coffee shop in the UK means operating under food safety law, employment law, licensing law, and data protection rules simultaneously, often while serving customers. The paperwork that protects you is not optional, but most of it is straightforward once you have the right templates in place. This post covers the eight document categories every cafe needs: food safety and HACCP records, allergen management (Natasha's Law and the 14 major allergens), staff employment contracts and training records, premises licensing, health and safety records, financial records and till reconciliation, GDPR and data protection, and incident and complaint logs. Get these in order and an unannounced Environmental Health Officer visit becomes manageable rather than alarming. The worst route is no route — a cafe operating without documented food safety procedures is exposed on multiple fronts. Most disputes can be traced back to missing records rather than bad practice, and the fix is almost always the same: document what you are already doing.

A cafe or coffee shop is a food business, an employer, a licensed premises in many cases, and a data controller, sometimes all at once, often before 9am. The paperwork that governs each of those roles is not there to obstruct you. It is there to protect your customers, protect your staff, and protect your business when something goes wrong.

The good news: most of it records what you are already doing. The goal is not to invent new procedures; it is to make your existing procedures visible on paper.

Every food business in the UK is required to have a food safety management system based on HACCP principles (Hazard Analysis and Critical Control Points). For a cafe, this does not need to be a lengthy document. It does need to be written down, implemented, and kept up to date.

Temperature control is the highest-risk area for most cafes. Food-poisoning bacteria multiply rapidly between 5°C and 63°C. Your HACCP records should show:

• Fridge and chilled display temperatures checked and logged daily (below 5°C for milk, prepared sandwiches, cakes, pastries).
• Hot-holding temperatures if you serve soups, hot food, or hot drinks in multi-serve dispensers (above 63°C).
• What action staff take if a fridge temperature is out of range, including who they report to, what food is quarantined, and how the issue is recorded.

Temperature logs do not need to be elaborate. A printed sheet with columns for date, time, fridge reading, and staff initials is sufficient. EHO inspections look at whether logs exist, whether they are being completed consistently, and whether out-of-range events have been acted on.

Cross-contamination prevention matters particularly for cafes that prepare or handle loose food. If you slice bread, assemble sandwiches, or handle unwrapped cakes, your HACCP should document how you prevent allergen cross-contact: separate boards, separate utensils, distinct preparation areas for allergen-free items.

Cleaning schedules are a standard HACCP requirement. A written schedule covering daily tasks (surfaces, equipment contact points, floors), weekly tasks (deep clean of coffee machine group heads, fridge interiors), and monthly tasks (extractor filters, storage areas) shows inspectors that hygiene is managed systematically.

Supplier records complete the picture. A simple list of every food and beverage supplier (name, contact details, products supplied) means that if a product recall is announced, you can identify affected stock within minutes.

Natasha's Law came into force in October 2021 and extended full ingredient and allergen labelling requirements to prepacked-for-direct-sale (PPDS) foods: items made and wrapped on your premises before sale, such as sandwiches, salads, or individually wrapped cakes.

Every item on your menu, whether made in-house or bought in, must be documented for the 14 major allergens:

1. Cereals containing gluten (wheat, rye, barley, oats)
2. Crustaceans
3. Eggs
4. Fish
5. Peanuts
6. Soybeans
7. Milk
8. Nuts (almonds, hazelnuts, walnuts, cashews, pecans, Brazil nuts, pistachios, macadamia nuts)
9. Celery
10. Mustard
11. Sesame
12. Sulphur dioxide and sulphites
13. Lupin
14. Molluscs

Do not assume: verify with your suppliers. A croissant from a bakery supplier may contain sesame from a shared production line. Your supplier should provide an allergen declaration in writing; keep this on file and update it whenever you change supplier or product.

Allergen training records are a distinct requirement. All staff who handle food or answer customer queries about ingredients must receive allergen awareness training. Document when each team member completed training, what it covered, and who delivered it. If a customer has a reaction and claims they asked about allergens, your training records become critical evidence.

Customer allergen enquiries: if a customer asks whether a product contains a specific allergen, note it. A simple log (date, query, response given, staff member) is sufficient. This is not about bureaucracy; it is about demonstrating you took the question seriously.

If you employ anyone (full-time, part-time, or zero-hours) you need employment documentation. The absence of a written contract does not mean no contract exists; it means you have less evidence of what was actually agreed.

A written employment contract should confirm:

• Job title and core responsibilities.
• Hours of work and days, or for zero-hours staff, the basis on which hours are offered.
• Rate of pay, pay period, and pay method.
• Holiday entitlement. The statutory minimum is 5.6 weeks per year, pro-rated for part-time workers.
• Notice period on both sides.
• Probationary period terms, if applicable.
• Conduct expectations and reference to your disciplinary procedure.

Without written contracts, a dispute about agreed hours or holiday accrual becomes a your-word-against-theirs situation. The contract removes that ambiguity.

Before a new member of staff starts work, you must check that they have the legal right to work in the UK. Keep a copy of the document you checked (passport, biometric residence permit, or share code confirmation) alongside a note of the date you verified it. This is a legal requirement, not an administrative courtesy.

Beyond allergen training, document:

• Induction training: cafe procedures, till operation, customer service standards, emergency procedures.
• Food hygiene training: if any staff member has completed a Level 2 Food Hygiene certificate (recommended for anyone handling food), keep a copy of the certificate.
• Health and safety training: COSHH (chemical hazards from cleaning products), fire evacuation procedures, first aid awareness.
• Ongoing development: any additional training, refreshers, or product knowledge sessions.

Training records serve two purposes: they demonstrate due diligence if something goes wrong, and they give you a clear picture of where gaps exist.

If you have a conversation with a team member about performance, punctuality, or conduct, note it. Record the date, what was discussed, what was agreed, and the review point. A brief written note is not heavy-handed; it is protection for both parties. If a formal warning is issued, document the process: the issue, the meeting, the outcome, and the right of appeal. This paper trail demonstrates fair procedure if a claim is made against you.

Most cafes do not automatically need a premises licence to serve food and coffee. However, you will likely need a premises licence from your local authority if you:

• Sell or supply alcohol (even wine with brunch, or beer at an evening event).
• Provide regulated entertainment such as live music, recorded music played to an audience, or dance.
• Operate as a late-night refreshment business (serving hot food or drinks to the public between 11pm and 5am).

Licensing conditions vary between councils, and what one council treats as incidental music may require a licence in another jurisdiction. Check with your local authority's licensing team before assuming you are exempt.

If you hold a premises licence, display it prominently on the premises. Ensure all staff understand the licence conditions, particularly any restrictions on hours of alcohol service or entertainment.

Food business registration is a separate requirement. You must register your food business with your local authority's environmental health team before you open (or before you make significant changes to your operation). Registration is free and straightforward. EHO inspections (which assess food hygiene and safety) can be unannounced. Your HACCP records, temperature logs, allergen documentation, and cleaning schedules are what an inspector will want to see.

A written health and safety risk assessment is required for all businesses with five or more employees. For smaller cafes, best practice is to document it regardless. A risk assessment identifies the hazards in your cafe (hot surfaces, wet floors, heavy lifting, chemical cleaning products) and records the controls you have in place to manage them.

Maintain an accident and incident log. Record every event with the date, what happened, who was involved, and what action was taken. This covers customers who slipped, staff members who scalded their hand, and near-misses. RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations) requires you to report certain serious workplace incidents to the Health and Safety Executive. An ongoing log makes this straightforward.

Maintain current certificates for:

• Public liability insurance: covers injury or property damage claims from customers.
• Employers' liability insurance: legally required if you have any employees. The minimum cover is £5 million.
• Contents and equipment insurance: covers your espresso machine, POS system, refrigeration, and stock.
• Business interruption insurance: worth considering for a cafe, where a broken refrigeration unit or a burst pipe can close you for days.

Keep insurance certificates accessible. If a claim is made against you, the first question is whether you have valid cover.

Daily till reconciliation (comparing your physical cash against your POS reading) is your first line of defence against errors and discrepancies. A simple daily record covering opening float, closing till total, cash banked, and any discrepancies noted takes five minutes and provides a clear audit trail.

Keep all supplier invoices and delivery notes. These are your evidence of purchases for tax purposes, and they are required if you are working out your cost of goods sold for Making Tax Digital quarterly reporting. See Making Tax Digital for cafes and coffee shops for detail on what quarterly financial records look like in practice.

If you collect customer data (email addresses for a loyalty scheme, phone numbers for table reservations, or newsletter sign-ups) you are a data controller under UK GDPR. This means:

• A privacy notice explaining what data you collect, why, how long you keep it, and who you share it with. This can be a short page on your website or a printed card at the counter.
• ICO registration: most small businesses processing personal data need to register with the Information Commissioner's Office. The fee is currently £40 per year. Check your status at ico.org.uk.
• Data security: keeping records in a secure location, limiting access, and deleting data when it is no longer needed.
• Customer rights: a customer can request a copy of data you hold about them or ask for it to be deleted. Having a simple process for handling these requests means you are prepared if one arrives.

A straightforward incident log (date, what happened, who was involved, action taken, resolution) serves you in multiple ways. It demonstrates to inspectors that you take food safety events and customer complaints seriously. It provides evidence if a claim is made. And it gives you a record from which patterns become visible: if the same fridge appears in multiple temperature incidents, that is useful information.

If you do nothing else this month: create a simple incident log. A notebook or a shared spreadsheet works fine. The worst route is no route.

Paperwork for paperwork's sake is worth avoiding. But the documentation a cafe genuinely needs is not bureaucracy — it is the written record of the things a well-run cafe is already doing. The gap between doing something and having it on paper is smaller than it looks.

LaunchKit's cafe and coffee shop business documents bundle (£19.99 Premium) includes HACCP templates, temperature monitoring logs, allergen management worksheets, staff induction checklists, employment contract templates, right-to-work verification records, incident logs, cleaning schedules, and EHO readiness checklists, structured for a cafe operation and ready to complete rather than build from scratch.

If you are also preparing for Making Tax Digital, the MTD Compliance Kit for cafes and coffee shops (£16.99) covers the quarterly financial record-keeping side.

This article is general guidance, not legal advice. For employment contracts, consult a qualified HR adviser or employment solicitor.