The trays arrive at noon. By three there is still half a tray of chicken salad on the table, and somebody asks whether that is fine.
It is a fair question with a real answer, which is more than you would guess from searching for it. Ask a room of office managers and you will get a dozen confident replies that contradict each other.
That is not because anyone is careless. It is because food safety rules are written for the people who cook and move food, not for the people who receive it. The part that happens in your conference room rarely gets spelled out anywhere. It is a short list, and it is worth having.
Your catering partner carries the regulated part
Food safety law regulates food establishments, meaning operations that handle food and then hand it to someone to eat.
Your caterer is one. That means a permit, inspections, a certified food protection manager, and temperature requirements that run from their kitchen through to the moment the food changes hands. Hot food at 135°F or above. Cold food at 41°F or below.
That is the demanding part of food safety, and it is handled before anything reaches your office.
An office is not a food establishment. The exclusions the code lists all turn on private addresses, so an office is neither included nor excluded. It is simply not addressed, which is why searching for office food safety rules turns up so little.
Nothing in your conference room is inspected, and nothing needs to be. What happens there is much shorter than what happens upstream: how long the food sits, how it is labeled, and who decides when it is finished.
Knowing which service you bought
Staffed service means your caterer holds those temperature standards through the event. Drop-off means they hand the food over in good condition and the timing is yours from there.
Both are normal. Neither is better. They just leave you with different jobs, and it is worth being clear which one you have bought.
Two questions settle it at the point of ordering: are you staying to serve, or dropping and leaving, and what time did the food leave your kitchen? Any caterer worth using answers both without hesitating, and the answers tell you exactly what you need to do next. Our guide to corporate catering mistakes covers the rest of what to ask.
Two clocks, and only one of them is yours
Most of the contradictory advice comes from here. Two separate rules get blended into one, and they were written for different people.
USDA consumer guidance says perishable food should not sit between 40°F and 140°F for more than two hours, or more than one hour if the room is above 90°F.
The Food Code has a provision called Time as a Public Health Control, at section 3-501.19, that lets a licensed operator go four hours. It also requires written procedures prepared in advance, food that starts at or below 41°F or at or above 135°F, and every container marked with the time it has to be gone.
Four hours sounds more generous than two, so people reach for it. But it is not a longer version of the same rule. It is a tool for licensed operators with paperwork in place. In an office, two hours is the one that fits, and two hours is plenty for a lunch that people actually come and eat.
One more line in that provision is worth borrowing. When the time is up, the food is done. Not moved to the fridge for tomorrow, and not left out because it still looks fine. Deciding that in advance is easier than deciding it at three o'clock.
If your team eats at odd hours this takes a little more thought. We wrote about that in what to feed a team working late.
One recordkeeping rule worth knowing
This one surprises people, and it is better to meet it here than cold.
Under OSHA's recordkeeping regulation at 29 CFR 1904.5(b)(2)(iv), an illness that comes solely from an employee eating food for their own consumption is not work related. Getting sick from leftovers you brought from home is not a workplace injury.
There is an exception, and it turns on who paid. Food poisoning from food the employer supplied is work related, which puts it on the OSHA 300 log.
The line is narrower than it first looks. A 2010 OSHA letter of interpretation dealt with an employee who had an allergic reaction to a company-provided lunch and found the case was not recordable, because an allergic reaction is not food poisoning.
None of this is an argument against feeding people. It is a filing rule, and the only cost of knowing it is the minute you just spent. Worth adding alongside it: OSHA has no standard written for foodborne pathogens, so there is no office food safety rule sitting there waiting to be complied with. Recordkeeping is the whole of it.
Heat kills pathogens. It does nothing to allergens.
These are two different problems that often get treated as one.
Cross-contamination means pathogens going where they should not. Cooking addresses it, and so does sanitizer. Cross-contact means an allergen going where it should not, and nothing addresses it except keeping the allergen physically away from the food. There is no step that undoes it.
In practice that means separate serving utensils, real distance between dishes, and labels that name the allergen rather than the dish. "Pad thai" tells a person with a peanut allergy nothing. Our post on food allergies in the workplace covers the rest.
It is worth admitting that family-style serving is good for how a team eats together and awkward for keeping allergens apart. If your team likes it, plate the allergen-free options separately before anyone sits down. This is the part of the list that rewards attention most, because it is the part where getting it right is entirely within your control.
The law on donating leftovers is narrower than people assume
The instinct to donate what is left is a good one, and the law is friendlier to it than most people fear.
The Bill Emerson Good Samaritan Food Donation Act protects food donors from civil and criminal liability, so that fear of a lawsuit does not keep good food away from people who need it. In January 2023, the Food Donation Improvement Act widened that protection by adding qualified direct donors, who can give food straight to people in need instead of routing it through a charity.
Here is the part that catches companies out. Qualified direct donor is a closed list written into the statute: restaurants, caterers, grocers, wholesalers, agricultural producers, school food authorities and colleges. An ordinary company is not on it.
So your caterer can donate directly. You route through a nonprofit partner. That is not a reason to skip it. It is just the route.
Step back from the paperwork, though, because there is a bigger idea here. Leftover donation is reactive. It only exists because somebody guessed wrong about headcount, and it hands an office manager a logistics problem at five o'clock on a Thursday.
Giving does not have to work that way. Sharebite donates the equivalent of one meal for every meal ordered on the platform, through long-standing partnerships with Feeding America and City Harvest. That happens at the point of order rather than the point of disposal, so it does not depend on anything being left over. More than 22 million meals so far.
Ordering closer to real headcount is the other half of this, and we covered it in reducing food waste in corporate meals.
Who owns what
The third row is the one that usually has nobody's name in it, and it is the easiest of the four to fix.
One page makes this routine
Everything above fits on a single sheet. Who starts the clock. Who labels the food. Who clears the table. Who decides about what is left.
That sheet is the whole job. It turns something people argue about into something nobody has to think about, which is what good operations tend to look like.
The other half is choosing vendors who make it easy, because a caterer partner who shows up on time, at temperature, and able to tell you what is in each dish has already done most of the work for you.
If you have just taken over a food program and found no such page, you are in good company. We wrote a guide for exactly that.
