Certified food protection manager for a new café: FDA Food Code §2-102.12

This is part 5 of our 7-part series Opening a café: from idea to first day. Earlier: the concept, the location, the menu and the equipment.

A café can have spotless equipment and still fail an inspection, because food safety is mostly about people: who is in charge, what they know, and whether the habits run on a busy morning. The FDA Food Code puts that responsibility on a named role, and asks that the person in that role be certified.

This post quotes the Food Code's rules on the person in charge and the certified food protection manager, explains why your state's version is the one that counts, and lists the food safety basics to have running before you open.

This is general information, not legal advice. Quotes are from the FDA Food Code 2022, checked on October 5, 2026. Your state or local food code is the one that applies; ask your health department.

First: the Food Code is a model, not a federal law

The Food Code says so itself: "The model Food Code is neither federal law nor federal regulation and is not preemptive" (Preface). States, counties and cities adopt it, sometimes in full, sometimes with changes, and sometimes an older edition.

The FDA tracks this. Its adoption page notes that "Restaurant and retail food store oversight in the United States is typically handled at the state and local levels, rather than the federal level," and its 2024 report counts 11 state agencies in 7 states on the 2022 edition, and 46 state agencies in 36 states on one of the three most recent editions: 2022, 2017 or 2013 (FDA: adoption of the Food Code). The FDA has since published a 2026 edition, whose §2-102.12 keeps the 2022 wording quoted below, word for word.

So read the federal model to understand the idea, then find your own state's code and your local health department's rules for the details.

The person in charge

The Food Code builds food safety around one role. A "Person in charge" is "the individual present at a FOOD ESTABLISHMENT who is responsible for the operation at the time of inspection" (§1-201.10).

Someone has to fill that role whenever you're open: "the PERMIT HOLDER shall be the PERSON IN CHARGE or shall designate a PERSON IN CHARGE and shall ensure that a PERSON IN CHARGE is present at the FOOD ESTABLISHMENT during all hours of operation" (§2-101.11(A)).

For a small café, that means every shift on the schedule needs a named person in charge, including the early open and the quiet afternoon. It's usually the owner, the manager or a shift lead.

The Code also lists what the person in charge makes sure of (§2-103.11), from keeping unnecessary people out of food areas to checking deliveries. One example: "EMPLOYEES are effectively cleaning their hands, by routinely monitoring the EMPLOYEES' handwashing" (§2-103.11(D)).

How the person in charge shows they know the rules

"Based on the RISKS inherent to the FOOD operation, during inspections and upon request the PERSON IN CHARGE shall demonstrate to the REGULATORY AUTHORITY knowledge of foodborne disease prevention, application of the HAZARD Analysis and CRITICAL CONTROL POINT principles, and the requirements of this Code" (§2-102.11).

The Code gives three ways to show it: having no violations of priority items during the current inspection, "Being a certified FOOD protection manager who has shown proficiency of required information through passing a test that is part of an ACCREDITED PROGRAM", or answering the inspector's questions correctly.

§2-102.12: the certified food protection manager

The rule itself, in full:

2-102.12 Certified Food Protection Manager. (A) The PERSON IN CHARGE shall be a certified FOOD protection manager who has shown proficiency of required information through passing a test that is part of an ACCREDITED PROGRAM. (B) This section does not apply to certain types of FOOD ESTABLISHMENTS deemed by the REGULATORY AUTHORITY to pose minimal risk of causing, or contributing to, foodborne illness based on the nature of the operation and extent of FOOD preparation.

Two words carry most of the weight:

Accredited program. A certificate counts when it comes from a program accredited for food protection managers. The Code says a person in charge certified by a program "that is evaluated and listed by a Conference for FOOD Protection-recognized accrediting agency" as meeting the Conference's standard "is deemed to comply with §2-102.12" (§2-102.20(B)). Before you pay for an exam, check that the program is accepted where you are.
Minimal risk. Part (B) lets the regulator exempt some establishments, based on what they do and how much food they prepare. Whether a coffee-and-packaged-pastry counter qualifies is the regulator's call, not yours.

Why states land in different places

The Food Code's own explanation of this section expects variation. It says "It is appropriate for State and local agencies, by way of codes and ordinances or by policy to establish criteria for what types of permitted establishments could be exempt from the mandatory manager certification requirement and for determining the conditions under which the minimum number of certified food protection managers must be some number greater than one" (Annex 3, §2-102.12). Its list of factors includes "The size and scope of the operation", "The hours of operation", "The types of foods sold or served" and "The number of staff".

So your state may:

require a certified manager at every establishment, or only some types;
require one on site at certain times, or one responsible for all hours;
set a deadline after a manager is hired;
add a separate food handler card for other staff.

Florida is a good example of a state with its own numbers: at least one certified food protection manager responsible for all periods of operation, and one present whenever four or more employees work with food at once, with separate food handler training for everyone else. Our Florida food manager and food handler post quotes the rules.

What to do before opening

Find your rule. Ask your health department which code and edition applies, whether your café needs a certified food protection manager, and when one must be on site.
Get certified before opening day. Take an accredited exam yourself, or have your manager take it, before the opening inspection. The person in charge will be asked questions during it.
Certify a second person. A single certified person can't cover every shift, sick days or a vacation. Your first shift lead is the usual choice.
Name the person in charge on every shift. Put it on the schedule, not in people's heads.
Keep the certificates on site. Originals or copies as your regulator asks, with expiry dates tracked.
Book the food handler training your state requires for everyone else, with the deadlines on the calendar.

The food safety habits to have running

A certificate shows knowledge; the inspector also looks for habits. Before the first guest, have these working, each with a written routine:

Handwashing and stocked hand sinks. See our handwashing procedure.
Employee illness reporting and who stays home. See the illness reporting form and exclusion chart.
Temperature checks on every fridge and anything held hot. See food temperature logs for a new café.
Receiving checks on deliveries. See the receiving log.
Cleaning and sanitizing, with sanitizer tested. See the cleaning schedule template.
Allergen answers staff can give. See the allergen matrix.

Then run a walk-through yourself before the inspector does: the food safety self-inspection checklist goes area by area.

Where Mays fits

Certificates on file. With Labor law compliance turned on, each team member's page has a Certificates tab for their Food handler card and Food protection manager (CFPM) certificate, with the issuer, number, issue and expiry dates, and a photo or PDF. See Food safety certificates.
What your location needs. The location's Food safety certificates panel applies the rule from its address where Mays has one: a food handler card by a deadline after hire, a certified food protection manager at the location, or a certified person on every shift (for example Hawaii and the District of Columbia), with a warning on the schedule before you publish where the rule is per shift. Where Mays has no rule yet, it keeps the certificates and their reminders.
Reminders. Mays reminds the team member 30 days and 7 days before a certificate expires and on the day, and sends the location's managers one message listing their team's cards.
The habits as checklists. Put temperature checks, sanitizer tests and hand sink checks on the opening and closing checklists, with number and photo answers. With wireless thermometers connected, each one's temperature log downloads as a PDF or CSV for the health department, with your License / Permit # printed at the top. See Health-department temperature logs.

What Mays doesn't do yet: where the rule isn't a certified person on every shift, it doesn't check that a certified person is scheduled at the times your rule asks for, such as Florida's four-or-more rule, so check that yourself when you build the schedule. There's also no person-in-charge marker on a shift: a position such as Shift lead under Scheduling → Positions gives those shifts their own colour on the schedule, so you can see who is in charge when.

Your food safety checklist before opening

Your state's code, edition and certified manager rule, confirmed with the health department
At least one certified food protection manager before the opening inspection
A second certified person for the shifts the first can't cover
A person in charge named on every shift
Certificates on site with expiry dates tracked; food handler training booked
Handwashing, illness reporting, temperatures, receiving, cleaning and allergens running as routines

Next: the last 30 days

With the rules covered, part 6 is a countdown for the last 30 days before opening. When you're ready, start your free trial: 30 days, every module, no card needed. Or book a walkthrough and we'll set up your certificates and food safety checklists with you.