Food safety in the European Union (EU) is governed by a risk-based legal framework, within which microbiological criteria serve as an important tool for assessing and managing food-related risks. These criteria are primarily designed to detect or quantify microorganisms and to support the verification of process hygiene. However, microbiological criteria alone may not adequately address hazards associated with pre-formed toxins. This limitation becomes particularly relevant in the case of Bacillus cereus and its emetic toxin, Cereulide. This article examines the relationship between microbiological criteria and the broader concept of food safety under EU law, with a specific focus on toxin-mediated risks. Using case studies, including recent Cereulide contamination in infant formula, the analysis highlights a potential gap between regulatory compliance and actual food safety. While products may comply with microbiological criteria established under Regulation (EC) No 2073/2005, they may still pose a risk to human health due to the presence of heat-stable toxins that may not be addressed by microorganism-based standards. By combining legal analysis with scientific evidence, including documented cases of severe intoxication and recent developments in food safety regulation, this article demonstrates the limitations of current microbiological approaches in addressing toxin-related hazards. The findings suggest that a more integrated and risk-based approach is needed, one that goes beyond compliance with microbiological criteria and also takes into account toxin formation and relevant storage and handling conditions.