By Mthokozisi Nkosi, Food Scientist, SAATCA Registered R638:2018 Lead Implementer (SAATCA register RG003), Lead Auditor registered with Exemplar Global and IRCA, Founder of ASC Food Safety Consultants. Updated November 2026.
Short answer: yes, a coffee shop or cafe needs a Certificate of Acceptability (COA) from the municipality, even if you only steam milk and sell cakes someone else baked. The certificate is issued in the name of a trained person in charge, and every barista, server and kitchen hand needs food safety training. In a cafe the risks sit in small places: milk, which R638 requires to be kept colder than most chilled food, cream cakes on the counter, allergens in milks and bakes, and a team of three people doing every job at once.
Milk is your highest risk ingredient
Most chilled food under Annexure E of R638 must be kept at 5 °C or colder. Milk is listed with raw fish, poultry and offal in the stricter group: 4 °C or colder. An under counter fridge that is opened two hundred times in a morning rush often sits above that. Regulation 6(5)(a) requires every fridge used for storing or displaying perishable food to have a thermometer that can be read easily. Check it at the busiest time, not when you open.
Habits I correct in almost every cafe I visit:
- The milk jug that never goes back. Pour what you need, steam it and return the carton to the fridge between orders. Do not top up a jug of old milk with fresh milk.
- The steam wand. Milk dries on the wand and inside the tip. Purge and wipe it after every drink, with a cloth used only for that. Regulation 6(4)(b) requires surfaces in contact with food to be cleaned as often as needed during work, not only at closing.
- Milk in the display fridge door. The door is the warmest part of the fridge.
Allergens: milk alternatives are not allergen free
The R146 labelling regulations list the common allergens as egg, cow’s milk, crustaceans and molluscs, fish, peanuts, soybeans, tree nuts and significant cereals. A cafe usually stocks four or five of them before it bakes anything. Cow’s milk is one. So is soya milk. Almond and cashew milks are tree nuts, and oat milk counts too, because R146 names oats as one of the significant cereals.
If one steam wand and one jug serve cow’s milk and almond milk, a customer who ordered almond for a milk allergy may be drinking both. R638 counts unintended allergens as contamination (regulation 5(2)(b)) and regulation 11(1)(c)(viii) requires hands to be washed after handling a common allergen that could cross contaminate other food. Keep a separate, marked jug for each alternative milk and purge the wand thoroughly between them.
You do not need a printed label on a slice of cake. Regulation 54(3)(h) of R146 exempts ready to eat food prepared and sold in a catering establishment, but the list of ingredients, including allergens, must be available at the point of sale on request. That means a file or card for every item you make. Keep one for bought in cakes too, built from the supplier’s ingredient list, because your customer cannot tell who baked it. Wrapped muffins or biscuits that you sell prepackaged need a full label.
Opening or buying a cafe?
The person whose name goes on your COA must be trained under regulation 10(1)(a), with accredited training where applicable. The ASC Food Safety Practices for Persons in Charge course is on the SAATCA register for R638 Person in Charge training, is HPCSA CPD accredited and is run by a FoodBev SETA accredited training provider. It is fully online, self paced, and ends in a video proctored assessment.
About the provider: ASC Food Safety is an Exemplar Global Recognised Training Provider, with 28 of its auditor, HACCP, GMP and ISO courses recognised.
Cakes, the counter and bought in bakes
A carrot cake under a glass dome and a fresh cream cake are not the same product. Cream, custard, cheesecake and cream cheese icing are perishable and belong in a chilled display at 5 °C or colder (Annexure E). Regulation 8(4)(b)(i) only relaxes that for food sold within four hours of preparation, and a cheesecake that arrived yesterday does not qualify.
Whatever is on the counter, regulation 8(3) requires unwrapped ready to eat food to be protected from droplets, insects, dust and bare hands. That means covers, sneeze guards and tongs. Regulation 10(14) says staff may not touch ready to eat food with bare hands unless it cannot be avoided.
Many cafes buy cakes from a home baker. Regulation 10(17) makes the person in charge responsible for making sure food sold from the premises complies with the Act and its regulations, so the supplier’s problem becomes yours. Ask for a copy of their COA and an ingredient list for each product, and keep a record of what you bought and when (regulation 10(18) requires traceability). Our post on home based and online food sellers explains what your supplier needs.
Small teams, one person doing everything
In a three person cafe the barista takes payment, makes the coffee, plates the cake and clears tables. R638 requires hand washing after handling money (regulation 11(1)(c)(v)), and you need a hand basin with soap and disposable towels (or another hygienic hand-drying method) that is used only for hands. Regulation 11(3)(h) forbids cleaning equipment in it, so the jugs go to the wash up sink.
Small teams also put pressure on people to work when they are ill. Regulation 11(2)(b) says a person with symptoms such as diarrhoea, vomiting, fever, or a sore throat with fever may not handle food until a medical practitioner certifies them fit, and regulation 10(15) requires those reports to be recorded. Plan a stand in before you need one.
Who in a cafe needs which course
- Owner or manager named on the COA: the Persons in Charge course.
- The shift lead who opens on the owner’s day off: Persons in Charge as well. Team seats are 5 for R7 645 or 10 for R14 440.
- Baristas and kitchen staff: the Basic Food Safety Practices for Food Handlers course.
- Servers and cleaners who do not prepare food: at least the Basic Food Hygiene Awareness course (R420, about 4 hours).
The general split is in who needs which course. When you apply, use the COA application checklist and the municipal COA guide.
Questions cafe owners ask
We only sell coffee and prepacked snacks. Do we still need a COA? Yes. You handle milk, which is perishable food, and regulation 3(1) applies to any premises where food is handled.
I am buying a cafe that already has a COA. Can I use it? No. Regulation 3(9)(a) makes a COA non transferable between people. See what a new owner must do, and if you are changing the layout too, read change of ownership and renovation.
There are only three of us. Does everyone really need training? Yes. Regulation 10(1)(b) covers every other person working on the premises, and a small team is exactly where one untrained person makes a difference.
Training your baristas? See the food handler course.
