Vic Food Safety Program for Cafes 2026: What You Must Do Now

Victorian cafes operating in 2026 must comply with the updated Food Safety Program requirements or face enforcement action. Here's what's changing, what you need to do immediately, and how to embed compliance into your daily operations without burning out your team.

Why the Victorian food safety rules matter (and what happens if you ignore them)

Victoria's Health and Wellbeing Act and the Food Standards Code set the baseline. From 2026, the Department of Health is tightening compliance expectations for high-risk food handling venues — and cafes are squarely in the spotlight. Why? Because cafes serve vulnerable populations (kids, elderly), operate high-volume services (think Fitzroy on a Saturday morning), and often have tight margins that tempt shortcuts.

Non-compliance isn't a warning letter anymore. The Department is issuing compliance notices, suspension of licences, and fines up to $20,000+ for serious breaches. Your local council's environmental health officer will inspect unannounced, and they're armed with a checklist that's tougher than it was three years ago.

The good news: compliance is achievable if you start now. Most venues that fail inspections did so because they left it to chance, not because the rules are impossible.

What exactly is a Food Safety Program in Victoria?

A Food Safety Program (FSP) is a documented system that shows how your cafe identifies and controls food safety hazards. It's not a vague policy document gathering dust in a filing cabinet — it's a live, working record that proves you're actively managing risk.

Under the Food Standards Code, all Victorian food businesses must have an FSP. For cafes, this typically includes:

• Hazard Analysis and Critical Control Points (HACCP) — identifying where things can go wrong (e.g. cross-contamination, temperature abuse) and how you stop it
• Standard Operating Procedures (SOPs) — step-by-step guides for high-risk tasks (cleaning, food storage, handling allergens)
• Staff training records — proof that your team knows the rules
• Temperature and cleaning logs — daily documentation that you're actually doing what you said you'd do
• Supplier verification — confirmation that your suppliers (Bidvest, PFD, Countrywide, or whoever you use) are also compliant
• Corrective action records — what you did when something went wrong

The Department expects your FSP to be specific to your menu, your kitchen layout, and your suppliers. A generic template won't cut it.

The three critical changes for 2026

1. Allergen management is now a standalone requirement

Victoria is moving away from treating allergens as a footnote in your FSP. From 2026, you must have a dedicated allergen control plan that covers:

• Ingredient labelling and supplier declarations (ask Bidvest, PFD, and your other suppliers for allergen statements on every product)
• Cross-contamination prevention (separate prep areas, utensils, cleaning protocols)
• Staff training on allergen awareness (not just a 20-minute induction chat — documented, refreshed annually)
• Clear menu labelling or verbal disclosure protocols

The trigger: even a trace amount of undeclared allergen can trigger an enforcement response. If a customer with a nut allergy orders a cappuccino and your barista didn't know the chocolate dust contains hazelnut, you're liable.

Action now: Audit every product you use. Contact Bidvest, PFD, Countrywide, and smaller suppliers for allergen statements. Create a master allergen register (a simple spreadsheet works). Brief your team — don't assume they know what's in everything.

2. Food Safety Supervisor role is now mandatory for larger cafes

If your cafe employs more than 10 people or turns over >$500k annually, you must appoint a Food Safety Supervisor (FSS). This person doesn't need to be the owner, but they do need formal training and documented responsibility.

The FSS's role:

• Oversees the FSP and its implementation
• Conducts internal audits
• Manages staff training
• Responds to incidents (customer complaints, temperature breaches, pest sightings)
• Keeps records and liaisons with the Department if needed

Many cafe owners assume this is an extra hire. It's not — it's often a promotion for your longest-serving staff member, paired with a 2-day Food Safety Supervisor course (run by TAFE or private providers across Melbourne, Brisbane, Sydney, Perth).

Action now: Identify your FSS candidate. Enrol them in a recognised course before the end of 2025. Budget for their time away from the floor during training.

3. Digital record-keeping is now the default expectation

The Department is moving away from paper logs. While they're not explicitly banning pen-and-paper, inspectors now expect digital temperature logs, cleaning checklists, and training records. Why? Because digital records are tamper-proof, timestamped, and easier to audit.

This doesn't mean you need fancy software — a simple spreadsheet with restricted editing and automatic timestamps works. But paper logbooks sitting on a shelf? That's a red flag for inspectors.

Action now: Set up digital templates for temperature checks, cleaning logs, and incident reports. Train your team to use them. If you're running multiple shifts, use a system that alerts you if a log isn't completed by a certain time.

The counter-intuitive tactic most cafe owners miss

Here's what separates compliant cafes from those that fail inspections: they invite the inspector in proactively, once a year, for a non-enforcement chat.

Most owners see an inspection notice and panic. Instead, build a relationship with your local council's environmental health officer. Ring them up, ask if they can do a friendly pre-compliance visit (many councils offer this), and use it as a dry run. They'll spot gaps in your FSP, suggest fixes, and when the formal inspection comes, you're already sorted.

Why is this counter-intuitive? Because owners assume inspectors are adversaries. They're not — they want you to succeed. A proactive conversation also shows good faith if there's ever a breach.

Building your Food Safety Program: a step-by-step playbook

Step 1: Map your menu and identify hazards (Week 1-2)

List every item you serve. For each, ask: What can go wrong? (Raw eggs in hollandaise? Dairy allergies in the latte? Listeria in deli meat?)

For a typical Melbourne cafe:

• Espresso drinks — steam wand cleanliness, milk storage temperature
• Toasted sandwiches — cross-contamination (gluten-free bread near regular bread), temperature of filled items
• Acai bowls — thawing procedures, allergen labelling (nuts, coconut)
• Breakfast pastries — supplier verification, allergen declarations

Document this in a simple table: Hazard | Likelihood | Severity | Control | Monitoring.

Step 2: Write your SOPs (Week 2-4)

For each high-risk task, write a step-by-step guide. Example:

SOP: Daily Steam Wand Cleaning

1. After each drink, purge steam wand with steam for 3 seconds
2. Wipe with damp cloth immediately
3. At end of shift, soak in hot water for 5 minutes, brush internally, rinse
4. Record completion on digital log

SOPs should be posted at the relevant station (laminated, if you like) and reviewed annually.

Step 3: Set up your monitoring system (Week 4-5)

Decide what you'll measure daily:

• Fridge temperatures (check at opening, record at 10am and 3pm)
• Cleaning completion (steam wand, benches, floors)
• Staff absences (so you know who was on duty if an incident occurs)

Use a shared Google Sheet or a dedicated app. Set phone reminders for non-negotiable checks.

Step 4: Train your team (Ongoing)

Don't do a one-off induction. Rotate 15-minute toolbox talks monthly — one month it's allergen awareness, next month it's temperature control, then cross-contamination. Document attendance.

For Christmas, ANZAC Day, Melbourne Cup, and other high-volume trading days, brief your team extra carefully. Casual staff covering public holiday penalty rates often lack depth of experience — they need clear, simple instructions.

Step 5: Audit and adjust (Quarterly)

Once a quarter, review your logs. Are temperature breaches happening? Is the steam wand log being skipped? Adjust your SOP or your monitoring. This shows the Department you're continuously improving, not just ticking boxes.

Supplier compliance: your shared responsibility

Your suppliers (Bidvest, PFD, Countrywide, and others) are part of your food safety chain. You must verify that they're compliant.

Ask them for:

• Food Safety Plan documentation
• Allergen statements for all products
• Traceability records (so if there's a recall, you can trace it back)
• Proof of regular audits

Keep these on file. If an inspector asks, you can show you've done due diligence on your supply chain.

Where Calso fits in

Managing FSP documentation, staff training records, and daily compliance logs is time-consuming — especially when you're also running the floor during a lunch rush. Calso automates the operational admin side: scheduling temperature checks, flagging incomplete logs, storing training records digitally, and alerting you to gaps before an inspector arrives. This frees you and your team to focus on compliance as a culture, not a burden.

Want early access?

Calso is invite-only for founding venues. If you're serious about embedding compliance into your cafe's operations and want to join a community of early-adopter venues, join the waitlist at calso.com.au/join. Founding-venue access includes priority onboarding and direct line to the team — limited spots available in your city.

Key takeaways

• Victorian cafes must have a documented Food Safety Program by 2026 — it's not optional
• Allergen management, Food Safety Supervisor roles, and digital record-keeping are the three big changes
• Start now: audit your suppliers, appoint your FSS, and set up digital logs
• Invite your local council for a proactive chat — it's a game-changer
• Compliance is easier when it's embedded in daily operations, not bolted on at the end