Microbiological Testing and Criteria: EU, UK and US

Five cheese samples leave the dairy for the laboratory. A small departure, with a whole batch’s future attached. Together, their results can decide whether that batch meets a microbiological criterion. Send the cheese to another market, though, and the same result can mean something different. [1, 2, 7, 10]

In the EU and UK, legal criteria apply to specified foods and production stages. In the US, preventive controls, adulteration law and enforcement policies work together. Before your samples reach the laboratory, their batch code, sampling plan and destination already matter. So does a deceptively simple question: are you looking for an organism, or measuring how much is there? [1, 2, 7, 10]

Before the laboratory, tell your sample’s story

A finished pack, a piece of curd taken during manufacture and a packing-line swab each tell you something different. Before anything leaves the dairy, establish exactly what your sample represents. Its record should connect it to its lot, sampling point, date and analytical purpose. Give the laboratory the organism, method and required reporting units, too. [7, 11]

A presence test asks whether a specified organism is detected in a stated quantity, such as 25 g. Enumeration asks how much is there, commonly expressed as colony-forming units per gram, or cfu/g. A result below an enumeration method’s reporting limit is not the same as a negative presence test. Read the method, portion size and reporting limit together. [1, 11]

Testing supports prevention; it cannot replace it. Contamination can be uneven, and only part of your batch reaches the laboratory. Hygiene, control of milk treatment, prevention of recontamination and appropriate storage remain central, even when sampled units meet their limits. The FDA’s draft Listeria guidance specifically discusses the limitations of relying on certificates and testing. [2, 11]

Four different jobs behind the word “testing”

A food safety criterion asks whether a product or batch placed on the market is acceptable. A process hygiene criterion asks whether production is functioning acceptably. An unsatisfactory result under its sampling plan requires corrective action. It applies at a specified production stage, not as a finished-product retail limit. [1, 12]

Environmental monitoring follows possible contamination routes through processing areas and equipment, and checks sanitation controls. Routine verification considers the wider picture: product testing, environmental results, calibration and review of monitoring records. Your packing-line swab and cheese sample may belong in the same investigation. They still measure different things. [7, 8]

Start with the cheese, then choose the organisms

Your cheese should shape your testing programme, not the other way round. Milk treatment, moisture, acidity, ripening and exposure after processing help identify which hazards need investigating. No single panel suits every cheese. These are the principal organisms and measurements you will encounter: [8, 12]

• Listeria monocytogenes: a pathogen addressed through ready-to-eat food criteria and environmental controls. Cheese can become contaminated after pasteurisation. [3, 8]
• Salmonella: covered by EU food safety criteria for cheeses made with raw milk or milk heated less than pasteurisation, subject to the specified risk-elimination exception. [1]
• Pathogenic E. coli: includes Shiga toxin-producing strains. A routine E. coli hygiene count does not identify these pathogens. [10, 12]
• Coagulase-positive staphylococci: counts assess process hygiene in specified cheese categories. High counts can trigger testing for staphylococcal enterotoxins. [2]
• Indicator organisms: E. coli, coliforms or Enterobacteriaceae can inform hygiene investigations. Which organism matters, and how you interpret it, depends on your product and scheme. [2, 10]

The Food Safety Authority of Ireland makes an important distinction: Regulation 2073/2005 does not set criteria for every pathogen relevant to cheese, including E. coli O157. That absence is not permission to disregard them. The broader obligation remains to keep unsafe food off the market. [12]

Meet n, c, m and M: the details that decide

A high count cannot be averaged away. In EU and GB dairy criteria, n means the number of sample units. In a three-class enumeration plan, m separates satisfactory results from the intermediate band, M is the upper limit, and c is the maximum number of units allowed in that intermediate band. Every unit contributes to your decision. [1, 2]

Take heat-treated milk or whey cheeses. Their E. coli process hygiene plan uses five units, permits two in the intermediate band, and sets m at 100 cfu/g and M at 1,000 cfu/g. It applies when counts are expected to be highest during manufacture. [2]

All five results at or below m are satisfactory. Up to two above m, but no higher than M, are acceptable. Any unit above M, or three above m, makes the result unsatisfactory. You therefore need the individual results, not simply an average. [2]

For presence testing with n of five and c of zero, all five units must meet the stated absence requirement. Portion size matters: five examinations of 25 g are not automatically interchangeable with one examination of a pooled 125 g portion. Alternative sampling or methods need the applicable legal justification and validation. [1, 2]

EU criteria: there is more to it than the cheese’s name

A familiar cheese name will not lead you straight to the right legal criterion. Regulation (EC) No 2073/2005 puts food safety criteria in Annex I, Chapter 1, and process hygiene criteria in Chapter 2. To find the correct row, you need the milk treatment, ripening status, intended use and sampling stage. [1]

The differences are substantial. Raw-milk cheese has a coagulase-positive staphylococci plan with m of 10,000 and M of 100,000 cfu/g. For pasteurised unripened soft cheese, the corresponding limits are 10 and 100 cfu/g. These assess different products and stages, so you need to read the numbers in context. [2, 12]

Under the relevant cheese rows, counts above 100,000 cfu/g trigger enterotoxin testing. The toxin criterion is separate from the bacterial count. Neither can stand in for the other. [2, 12]

The Regulation does not prescribe one testing frequency for all cheese. Businesses establish appropriate sampling through their food safety procedures and risk assessment. Customer specifications may add requirements, but you must record those separately from the legal criterion. [12]

This page summarises published guidance from the official sources it cites. It is not medical advice. Guidance differs between countries and changes over time, so check the current source for where you live, and ask your doctor, midwife, pharmacist or dietitian about your own circumstances.

Listeria: follow the cheese beyond packing day

For ordinary ready-to-eat foods able to support Listeria growth, the EU permits the 100 cfu/g criterion when the producer demonstrates, to the competent authority’s satisfaction, that the limit will not be exceeded throughout shelf life. Otherwise, since 1 July 2026, the requirement is not detected in 25 g throughout shelf life while the product is on the market. Both plans use five units and c of zero. [3]

That change came through Regulation (EU) 2024/2895. It was adopted on 20 November 2024, published on 21 November and entered into force on 11 December 2024. Its application date was 1 July 2026. Previously, the absence requirement in this branch applied before the food left the producing business’s immediate control. [3]

Foods unable to support growth generally have the 100 cfu/g shelf-life criterion. Annex I automatically classifies foods meeting defined acidity and water-activity combinations, and those with a shelf life shorter than five days; other products need scientific justification. Water activity means the water available for microbial growth, not total moisture. [1, 4]

To build your shelf-life evidence, you can bring together product measurements, scientific literature, predictive modelling and laboratory studies. Challenge testing deliberately introduces the organism under controlled laboratory conditions to investigate growth. Durability studies examine naturally contaminated product. [4]

The Commission’s guidance explains how to select and interpret this evidence. One satisfactory result at packing cannot establish how your cheese will behave through distribution and storage. The evidence needs to account for what happens beyond packing day. [4]

Great Britain and Northern Ireland: know your legal route

Great Britain and Northern Ireland need separate legal checks. Great Britain uses the assimilated version of Regulation 2073/2005. Northern Ireland applies the EU Regulation under the Windsor Framework arrangements, including the amendment applying from 1 July 2026. [2, 5]

The FSA explicitly distinguishes these texts. You must consider an EU amendment separately against GB law, rather than assume it applies in both places. The table sets out the different routes. [2, 5]

Listeria in ordinary ready-to-eat cheese: November 2026

Market	Your route to the requirements	Authority
EU	Growth-supporting product: 100 cfu/g with accepted shelf-life evidence; otherwise not detected in 25 g throughout marketed shelf life.	Regulations 2073/2005 and 2024/2895. [1, 3]
Great Britain	Growth-supporting product: evidence-based 100 cfu/g route, or absence in 25 g before leaving producer control.	Assimilated Regulation 2073/2005. [2]
Northern Ireland	EU criteria, including the July 2026 extension of the absence requirement.	EU Regulation 2073/2005. [3, 5]
United States	FDA adulteration assessment and cheese enforcement policies; EU numerical criteria do not establish US compliance.	FDA regulations and import policy. [7, 15]

Food Standards Scotland also directs businesses to the GB microbiological criteria legislation. If you run a Scottish dairy, read that text alongside FSS guidance and the enforcing authority’s requirements. Older terminology on a guidance page does not change the operative legislation. [6]

The US: begin with prevention, not the release test

FDA regulates cheese through federal food law and, for covered facilities, 21 CFR Part 117. A food safety plan identifies hazards and preventive controls, with exemptions or modified requirements for specified operations. Environmental pathogens must be considered when ready-to-eat food is exposed before packaging without a subsequent effective control. [7, 8]

Alongside those controls sit the cheese standards in 21 CFR Part 133. Section 133.113, for example, requires Cheddar made from unpasteurised dairy ingredients to be cured for at least 60 days at not less than approximately 1.7 °C (35 °F). That is a minimum ageing condition, not a microbiological release test. See raw milk, thermised and pasteurised cheese for the milk-treatment distinctions. [9]

FDA’s dairy compliance policy addresses Salmonella, enterohaemorrhagic E. coli and staphylococcal enterotoxin under the adulteration provisions. It is enforcement guidance, not an EU-style cheese sampling schedule. State and local authorities have additional roles, including retail oversight. FDA’s Food Code is a model, so you need to establish its local adoption. [10, 13]

With Listeria, pay close attention to the document’s status. FDA’s 2008 CPG 555.320 discusses a 100 cfu/g approach for certain foods, but remains labelled draft and not for implementation on the FDA website. Its 2017 control guidance is also draft. [11, 14]

FDA’s cheese import alert identifies Listeria-positive cheeses for enforcement. If you import cheese, follow the current applicable policy. A draft threshold does not provide permission. [15]

Read the report with the sample’s journey in mind

Producers arrange verification sampling, authorities sample for official controls, and import investigations can involve private laboratories. EU and GB criteria specify reference methods, including EN ISO 11290 methods for Listeria detection and enumeration. Alternatives must meet the relevant validation and acceptance conditions. [1, 2, 15]

In the US, product testing or environmental monitoring used as verification needs written procedures. These must specify scientifically valid sampling and analytical methods, and identify the laboratory conducting the testing. Choose your method with its purpose clearly in mind. [7]

Read your report alongside its sampling location, production stage, lot definition and previous results. Repeated environmental findings can expose a persistent contamination route even while finished-product samples remain negative. A negative cheese sample does not cancel out that wider evidence. [1, 7, 8]

In the EU and GB, processing areas and equipment must be sampled where ready-to-eat manufacture poses a Listeria public-health risk. US environmental monitoring is required when the applicable hazard analysis identifies the relevant need for a preventive control. The requirement follows the risk and the applicable rules. [1, 7, 8]

When a result fails, look beyond another sample

Start by identifying what failed: a food safety criterion, a process hygiene criterion, an environmental target or a contractual specification. Investigate the cause and assess affected product, including related lots and the period when control may have been lost. Your corrective action must address recurrence, not simply produce another negative sample. [7, 16]

EU and GB Regulation 2073/2005 distinguish food safety failures from the improvements required after process hygiene failures. If a food safety criterion is not met, the product or batch must be withdrawn or recalled under applicable food law. This is subject to Article 7 provisions on further processing and alternative uses. [1, 2]

The FSA tells businesses supplying unsafe food to act immediately and notify their competent authority. Where consumers may have received it, the FSA’s incidents team must also be told. Scotland uses FSS arrangements. [16]

In the US, Part 117 corrective action includes evaluating affected food and preventing its entry into commerce where compliance cannot be ensured. Food with a hazard requiring a preventive control needs a written recall plan. The Reportable Food Registry creates a separate reporting duty for responsible parties when its serious-harm threshold is met, subject to the statutory conditions. [7, 17]

A withdrawal removes food from the supply chain; a recall also communicates action to consumers. Follow the affected batch details and official notice. For the wider context, see cheese food safety and Listeria and cheese safety.

In England, Northern Ireland and Wales, consult FSA guidance on food incidents, withdrawals and recalls. [16] In Scotland and the US, check current FSS and FDA recall notices. Your next step needs to match the place as well as the product.

Before dispatch, put the destination first

Build your destination check around the cheese itself: milk treatment, readiness to eat, growth characteristics, shelf life, packing exposure and intended market. Record the legal category, sampling plan, analytical method, acceptance rule and evidence supporting shelf life. Keep customer requirements in a separate column from law and enforcement policy. [1, 4, 7]

For EU and Northern Ireland destinations, check the current EU text and applicable amendment dates. For Great Britain, use the assimilated text and FSA or FSS guidance. For the US, check FDA regulations, the applicable cheese standard, import alerts and the importer’s Foreign Supplier Verification Program obligations, including any exemption or modified requirement. [2, 3, 5, 18]

Choose your laboratory with those requirements in hand. FDA’s cheese import alert requires specified Listeria testing supporting admission of detained food to use a laboratory accredited under its Laboratory Accreditation for Analyses of Foods programme. Check import detention procedures and their evidence requirements before commissioning tests. Your cheese’s destination belongs at the beginning of the testing plan, not the end. [15]

The Rind Question

Questions people ask

What is the difference between a presence test and enumeration?

A presence test asks whether an organism is detected in a stated quantity, such as 25 g. Enumeration estimates its concentration, commonly in colony forming units per gram. A result below an enumeration method's reporting limit is different from a negative presence test.

What do n, c, m and M mean in cheese testing?

In a three class enumeration plan, n is the number of sample units, m separates satisfactory results from the intermediate band, and M is the upper limit. The value c is the maximum number of units allowed in the intermediate band. A high count cannot be averaged away.

How do the Listeria rules differ across the EU, Great Britain and Northern Ireland?

For ordinary ready to eat foods able to support Listeria growth, the EU permits a limit of 100 cfu/g if the producer demonstrates that it will not be exceeded throughout shelf life. Otherwise, since 1 July 2026, Listeria must not be detected in 25 g throughout shelf life while the product is on the market. Northern Ireland applies the EU criteria, while Great Britain has an evidence based 100 cfu/g route or requires absence in 25 g before the food leaves producer control.

How often must cheese be tested under EU rules?

The EU Regulation does not prescribe one testing frequency for all cheese. Businesses establish appropriate sampling through their food safety procedures and risk assessment. Customer specifications may add requirements, which must be recorded separately from the legal criterion.

What happens if cheese fails a food safety criterion?

Under EU and GB rules, the product or batch must be withdrawn or recalled, subject to provisions on further processing and alternative uses. The FSA tells businesses supplying unsafe food to act immediately and notify their competent authority. Where consumers may have received it, the FSA's incidents team must also be told; Scotland uses FSS arrangements.

Sources

1. European Commission. Commission Regulation (EC) No 2073/2005 on microbiological criteria for foodstuffs, 2005 original legal text. Read alongside subsequent amendments, particularly source 3.
2. UK legislation publisher. Commission Regulation (EC) No 2073/2005, assimilated text, retrieved November 2026, including Annex I dairy criteria and interpretation notes.
3. European Commission. Commission Regulation (EU) 2024/2895 amending Regulation (EC) No 2073/2005 as regards Listeria monocytogenes, 2024; applicable from 1 July 2026.
4. European Commission services. Guidance document on Listeria monocytogenes monitoring and shelf-life studies for ready-to-eat foods, SANCO/11510/2013, revision of 18 December 2025. Non-binding guidance.
5. Food Standards Agency. Managing food safety, retrieved November 2026, section on revised shelf-life guidance and the EU and Northern Ireland amendment.
6. Food Standards Scotland. Microbiological criteria, sampling and pathogens, undated retrieved edition, November 2026. The page concerns meat, but identifies the governing microbiological criteria legislation.
7. US Office of the Federal Register and FDA. 21 CFR Part 117: Current good manufacturing practice, hazard analysis, and risk-based preventive controls for human food, electronic text retrieved November 2026, especially sections 117.130, 117.139, 117.150 and 117.165.
8. FDA. Resources for the control of Listeria monocytogenes for manufacturers of soft fresh Queso Fresco-type cheeses, retrieved November 2026.
9. US Office of the Federal Register and FDA. 21 CFR 133.113: Cheddar cheese, electronic text retrieved November 2026, paragraph (a)(1).
10. FDA. CPG Sec. 527.300: Dairy products, microbial contaminants and alkaline phosphatase activity, undated retrieved PDF edition, especially section III, “Policy”. Non-binding enforcement guidance.
11. FDA. Control of Listeria monocytogenes in ready-to-eat foods, January 2017, draft guidance for industry, not for implementation.
12. Food Safety Authority of Ireland. Food safety workbook for farmhouse cheesemakers, undated retrieved edition, Appendix 3.
13. FDA. Food Code 2022, explanatory page and January 2023 version information, retrieved November 2026. Cited for its model status, not as the latest edition.
14. FDA. CPG Sec. 555.320: Listeria monocytogenes, February 2008, draft, not for implementation.
15. FDA. Import Alert 12-10: Detention without physical examination of cheese due to microbiological contamination, displayed publication date 7 August 2026, retrieved November 2026.
16. Food Standards Agency. Food incidents, product withdrawals and recalls, updated 20 August 2026. Applies to England, Northern Ireland and Wales, with a separate Scotland signpost.
17. FDA. Reportable Food Registry for industry, retrieved November 2026.
18. FDA. FSMA final rule on Foreign Supplier Verification Programs for importers of food for humans and animals, retrieved November 2026.

Researched through official legislation, food authority publications and laboratory guidance, comparing product criteria, preventive controls and enforcement documents by jurisdiction.

Last checked: November 2026

Last checked November 2026.