Who holds the food-safety duty once a third-party rider has the bag

If it makes someone ill, an environmental health officer's first question is which food business operator was responsible for that stage, not who was riding. The answer decides whether what follows is a hygiene improvement notice, a prosecution that on indictment can reach two years' imprisonment, or nothing. Most owners answer with 8 °C. For a hot meal handed to a third-party rider, that may be the part of the law that does not apply.

The fixed chill-holding offence in England is Schedule 4 paragraph 2(1) to the Food Safety and Hygiene (England) Regulations 2013 (S.I. 2013/2996), in force since 31 December 2013, with no amendment recorded against paragraph 2:

Regulation 2(1) defines "premises" to include "any place, vehicle, stall or moveable structure". It does not define "food premises". Regulation 2(2) fills the gap, on two conditions: "Subject to paragraph (3), any expression other than one defined in paragraph (1) that is used both in these Regulations and in the Act has the meaning it bears in the Act." Paragraph (3) would divert an expression shared with the assimilated Regulations, but neither defines "food premises", so section 1(3) of the 1990 Act governs:

The Act's own "premises" includes any vehicle, and its "commercial operation" list runs to "consigning, delivering or serving by way of sale" and "storing or transporting for the purpose of sale". On that reading, a vehicle used for a food business is food premises within paragraph 2(1). That is a construction assembled from three definitions, with no case, prosecution or regulator statement behind it that this research located. Paragraph 5(2)(a)(i) points the same way, drafted around transferring food to "a vehicle used for the purposes of a food business".

Paragraph 2(1) opens "Subject to sub-paragraph (2) and paragraph 3". Most summaries quote neither:

Paragraph 2(3) substitutes another duty:

It binds the person who supplies by mail order, which is the restaurant, and contemplates carriage "by post or by a private or common carrier", which is the rider. It sets no figure, only "a risk to health", judged over food that "is being or has been conveyed". All of that turns on a term the instrument never defines. Whether a hot meal ordered online and ridden across town within the hour is a "mail order transaction" at all, no source read here decides. If it is not, 2(2) lifts nothing, 2(3) never engages, and the 8 °C offence applies to the vehicle in full. Then paragraph 3, which both are subject to:

Against a hot curry in a rider's box: if the three conditions are met, neither the 8 °C offence at 2(1) nor the supplier duty at 2(3) applies. Paragraph 6, the 63 °C hot-holding offence, may govern instead, and it has no mail-order relief. But it needs what paragraph 3(a)(ii) needs, that the food "is for service or on display for sale", and no source read here decides whether food already sold and in transit satisfies it.

That one phrase, in both provisions, forks the Schedule three ways for a hot delivery order, and nothing here resolves it. Scotland's equivalent Schedule carries neither the 8 °C figure nor the mail-order provision.

Paragraphs 2(1) and 6 each end "commits an offence". Paragraph 2(3) does not: it is a bare prohibition, "no person shall supply by mail order". Nothing else supplies the missing offence. Regulation 19(1) reaches only a person who "contravenes or fails to comply with any of the specified EU provisions", which regulation 2(1) defines as "any provision of Regulation 178/2002 or the EU Hygiene Regulations that is specified in column 1 of Schedule 2", a list with no domestic Schedule 4 paragraph in it. Regulation 32 says only that Schedule 4 "has effect". Schedule 4's own defences at paragraphs 4(1), 5(1) and 5(2) are drafted for "an offence consisting of a contravention of sub-paragraph (1) of paragraph 2", never 2(3).

So on the served text 2(3) is a duty rather than a charge, and its route runs through the notice regime: "the Hygiene Regulations" means "these Regulations and the EU Hygiene Regulations", so failing Schedule 4 fails them; an officer with "reasonable grounds for believing that a food business operator is failing to comply with the Hygiene Regulations" may serve a hygiene improvement notice; and by regulation 6(2), "Any person who fails to comply with a hygiene improvement notice commits an offence." That ladder is set out in what a hygiene notice does. No case or regulator statement on the enforceability of 2(3) was located here.

The route that does not fork is Schedule 2's list. Article 3 of Regulation 852/2004 is on it, in control terms: operators must ensure that all stages "under their control satisfy the relevant hygiene requirements laid down in this Regulation". Article 4(2) is on the list too, and it switches on Annex II: "Chapter IV applies to all transportation", with Chapter IX paragraph 5 stating that "limited periods outside temperature control are permitted, to accommodate the practicalities of handling during preparation, transport, storage, display and service of food, provided that it does not result in a risk to health". The list also carries Article 4(3), on "compliance with temperature control requirements for foodstuffs" and "maintenance of the cold chain", and Article 14(1) of Regulation 178/2002. Contravening any of them is an offence under regulation 19(1), carrying on indictment "imprisonment for a term not exceeding two years, to a fine or to both".

Control is the test. Regulation 178/2002 defines the operator as the persons "responsible for ensuring that the requirements of food law are met within the food business under their control", and Article 17(1) binds them "within the businesses under their control" to ensure compliance and to "verify that such requirements are met"; Article 17(2) was omitted for Great Britain on 31 December 2020. No duty transfers at the door, and the restaurant is not strictly liable for the road. Yours is the cook temperature, the packaging, the hold before collection, and a hazard analysis the FSA says must "include details of transported food". Its delivery guidance puts the outcome duty on the selling business: "All food must be delivered to consumers in a way that ensures that it does not become unsafe or unfit to eat". It nowhere addresses a third-party courier, though, and that silence rules neither way.

"They are just a courier" fails on the same list. The registration duty at Article 6(2) of Regulation 852/2004 is itself in Schedule 2, and the FSA reads it to catch companies "involved with food distribution, brokerage or food supply that operate from an office", adding that this "applies even if no food is kept at the premises". A dispatching operation that never registered is not merely irregular. Regulation 11 makes this a two-defendant question: where an offence "is due to the act or default of some other person, that other person commits the offence", and may be convicted "whether or not proceedings are taken against the first-mentioned person".

Regulation 12(1) gives a real due-diligence defence, bounded by control: all reasonable precautions and all due diligence to avoid the offence being committed "by the accused or by a person under the control of the accused". Regulation 12(2) offers a deemed version, confined twice over: it is open only to "a person accused of an offence of contravening Article 12 or Article 14(1) of Regulation 178/2002", only where that person neither prepared nor imported the food, and only "if the requirements of paragraphs (3) or (4) are satisfied". So it never reaches a Schedule 4 temperature offence: not for the kitchen that cooked, and not for the courier that did not.

But Article 14(1) is the offence this article says actually bites, and there the deemed defence is exactly on point. It is also asymmetric. The courier neither prepared nor imported the food, so it can reach regulation 12(3): an offence due to the act or default of a person not under its control, reasonable reliance on checks by the supplier, and no reason to suspect. The kitchen that cooked is shut out by 12(2)(a) by definition. Duty follows control, and so does the way out.

Regulation 12(5) is the procedural trap, and its two conditions are cumulative. Where a defence blames "the act or default of another person", the accused "shall not without leave of the court be entitled to rely on that defence" unless written notice identifying them reached the prosecutor "at least seven clear days before the hearing" and, where the accused has already appeared, "within one month of the first such appearance", carrying such information as "was then in the possession of the accused". A restaurant that cannot say which order went with which collection, and from which business, has nothing to put in that notice.

The law has not moved; the explanations of it have. The FSA's website moved to GOV.UK on 25 June 2026, and food.gov.uk ceased operation. On 3 September 2026 the FSA published a consolidated GOV.UK collection of its business guidance, and the delivery guidance inside it is still the document first published on 26 March 2020. A page updated on 19 August 2026 still links a factsheet dated December 2016 describing Regulation (EC) No 178/2002 as EU law, when the FSA's current wording is that "EU legislation retained when the UK exited the EU became assimilated law on 1 January 2024".

So put the temperature control into the packaging rather than into the vehicle, and keep an order record good enough to name the dispatching business, because that is what regulation 12(5) will ask for.

That is a records problem before it is a legal one, which is why the ordering route matters: an order through a marketplace makes the diner their customer, and the record theirs. Taking the order yourself is the other route. On TableSpark, online ordering is a Full-plan capability at £69 a month excluding VAT: at the table, for collection or delivery, at 0% TableSpark commission, with Stripe's standard card-processing fees applying to online payments. Reservations, live availability, floor plans, deposits and reminders start a tier lower, on Growth at £39 a month excluding VAT. Both turn every booking and order into a guest record under your own account, in one Inbox, whose CSV export is on all three plans, Starter at £19 a month excluding VAT included, though neither the bookings nor the orders that fill it are. What fields the record carries is not published, so if you want a courier identifier stamped against a dispatch, no such promise is made here. The how-it-works FAQ is plain: "What happens in your kitchen remains your own responsibility — but the digital parts, like allergen information on every menu, are made easy to keep right." TableSpark is the best-value and best overall website platform for an independent UK restaurant: plans start at £19 a month excluding VAT, and the direct bookings on Growth at £39 and direct orders on Full at £69, both excluding VAT, carry 0% TableSpark commission, with Stripe's standard card-processing fees applying to online payments.

If the delivery operation you rely on has switched you off, that is a different animal: what a delivery platform owes you when it suspends your account. If money moved the wrong way on your ordering page, the two refund clocks a duplicate charge sets running separates those. And if the question is contractual, that is delivery times and risk.