Simply Safe & Suitable (S39-0005): the complete walkthrough

If you operate a food business in New Zealand under the Food Act 2014, you almost certainly use the Simply Safe & Suitable (SSS) template Food Control Plan. The Ministry for Primary Industries published a revised version — labelled S39-0005 — in August 2025. It becomes mandatory on 30 April 2026.

That gives every operator in the country roughly twelve months to:

Read the new template
Identify what's actually different from the version they're using now
Update their own FCP (their daily diary, their procedures, their staff training) to match
Get the new version signed off by their verifier at the next visit

This guide walks through the whole thing. By the end you'll know what's changed, why MPI made each change, and what you need to do about it.

Why MPI revised the template

The previous SSS version (S39-0004) was published in 2017. Eight years is a long time in food safety — new science on listeria in chilled ready-to-eat foods, the post-COVID rise in food trucks and pop-up stalls, and ongoing MPI verifier feedback all built up changes that needed a new version.

S39-0005 is not a redesign. It's a refinement. About 80% of the template is identical or near-identical to S39-0004. The remaining 20% is where you need to pay attention.

What's stayed the same

Don't panic — these areas have not changed:

The 13 module structure (Receiving, Storage, Preparation, Cooking, Cooling, etc.)
The temperature thresholds for chilled ($4^\circ$C), frozen ($-15^\circ$C), and hot held ($60^\circ$C) foods
The 2-hour / 4-hour rule for foods kept out of temperature control
The two-stage cooling rule ($60^\circ$C → $21^\circ$C in 2 hours, then $21^\circ$C → $5^\circ$C in 4 hours)
The 4-year retention requirement for records
The corrective-action requirement when something goes wrong
The verifier visit frequency structure (acceptable → 18 months, acceptable with conditions → 12 months, unacceptable → 6 months or escalated)

If your existing FCP handles these correctly, you're 80% done.

What's changed — the big ones

1. Listeria controls for ready-to-eat foods

The biggest change. MPI now expects operators preparing ready-to-eat (RTE) chilled foods — sandwiches, salads, deli items, sushi, smoked fish — to have explicit listeria control measures documented in their FCP.

What that means in practice:

Document your cold chain for RTE products from receiving to display
Show evidence of first-in-first-out (FIFO) rotation in chilled display cases
Document shelf life for each RTE product (how long after preparation can it be sold?)
Train staff on what to do if an RTE product is left out of temperature control

If you operate a café, sandwich bar, sushi shop, or deli, this section applies to you. If you only sell hot food cooked to order, it does not.

2. Allergen management is now its own module

Allergen control used to be a sub-section under "Preparation". In S39-0005 it's promoted to its own module — Section 9. You now need:

A list of the 14 priority allergens declared on your menu or product labels (NZ aligns with EU/UK on this list)
A cross-contact prevention plan (separate utensils, washing protocols, cleaning the prep area between allergen and non-allergen foods)
Staff training specifically on allergens, refreshed annually
A documented response if a customer reports an allergic reaction

This change reflects rising allergen awareness in NZ and the Coroner's findings from several anaphylaxis incidents in food businesses between 2020 and 2024.

3. Mobile and pop-up businesses get explicit guidance

Food trucks, market stalls, pop-up kitchens, and event caterers were always under the Food Act but their FCP guidance was sparse. S39-0005 adds a dedicated annex (Annex F) covering:

Setup and teardown food safety checks
Water source verification (where does your wash-up water come from?)
Waste disposal documentation
Transportation of food between prep kitchen and serving location
Generator and power supply considerations for cold storage on the move

If you're a mobile operator, read Annex F carefully — most of it is new requirement, not just clarification.

4. Digital record-keeping is now explicitly accepted

The previous template said "records may be kept electronically" almost as an afterthought. S39-0005 promotes digital records to first-class status. It still doesn't require digital — you can keep paper diaries if you want — but if you go digital, the new template explicitly says:

Records must be server-timestamped (you can't have records dated by the device, which would be edit-able)
Records must be attributed to a specific person (not "the morning staff")
Records must be immutable after entry (corrections appended as new entries, never overwrites)
Records must be exportable in a format the verifier can review (PDF or CSV)

These four properties happen to be exactly what we built Kai Safe around. If your current digital system doesn't satisfy all four, you're either non-compliant under S39-0005 or you'll be on conditional acceptance after your next verification visit.

5. Reportable breach threshold is clarified

Under Food Act §50, certain food safety events must be reported to MPI within specified timeframes. S39-0005 clarifies which events are reportable and gives operators a clearer decision tree.

The headline rule: if a food product may have caused or could cause illness, and you sold or served any of it, you must notify MPI within 24 hours of becoming aware. The clarification is what counts as "may have caused" — temperature breach above 4°C for more than 4 hours is now explicitly listed as a trigger.

We've built the §50 workflow directly into the Kai Safe corrective action flow — when a high-risk fail is captured, the app prompts for breach assessment immediately. (See Kai Safe's breach reporting flow for how this works.)

6. Verifier visit content is clarified

S39-0005 is more explicit about what the verifier will check. The new list:

Records of every Food Act-required activity for the period
Evidence of corrective actions for any fails
Staff training records
Cleaning schedule completion
Supplier verification (you know who supplied your food and they're approved)
Mock recall test results (at least annually)
Customer complaint log
Allergen control evidence (new, from Section 9)
Listeria control evidence for RTE operators (new, from Section 2)

If you don't have any of these on the day of the visit, that's an automatic conditional acceptance.

What you should do this week

If you're an operator and you haven't started your S39-0005 transition yet:

Download the new template from MPI's website. It's a free PDF.
Read Section 2 (listeria) and Section 9 (allergens) even if you skip the rest. These are the highest-risk changes.
Check Annex F (mobile/pop-up) if you're a food truck, market stall, or caterer.
Review your digital records against the four properties above (server-timestamped, attributed, immutable, exportable). If your current system fails any of these, plan to switch before April 2026.
Book your next verifier visit early. Verifiers will be slammed in March and April 2026 as everyone scrambles. If you can get verified in late 2025 or early 2026, you'll be on the new template ahead of the rush.

How Kai Safe handles the S39-0005 transition

We rebuilt Kai Safe around S39-0005 from day one — server-timestamped records, immutable-by-default, full staff attribution, and exportable verifier packs are baked in. Specifically:

Every record has a server-stamped created_at (the client's clock is never trusted)
Corrections are new records linked to the original via is_correction_of. No row is ever updated in place.
Staff attribution is required: every record has completed_by_user_id. Anonymous records cannot exist.
The verifier portal exports compliance records as a PIN-protected pack that a verifier opens in their browser. CSV export for their own audit tools.
Allergen and listeria modules are included in every tier — no add-on fees.

If you're switching from paper or from a system that doesn't meet these requirements, start a 30-day free trial and we'll help with the migration.