FSSC 22000 requirements explained: the eighteen Version 7 additional requirements and the evidence behind each

What does FSSC 22000 require?

A certified site has to meet three sets of requirements at once. Part 1 of the Version 7 scheme document names them as its normative basis: ISO 22000:2018 for the food safety management system, the prerequisite programme (PRP) standards of the ISO 22002 series that the scheme assigns to your food chain category, and the FSSC 22000 additional requirements agreed by the Foundation's stakeholders.

The first two are ISO texts that any food business can adopt. The third is written by Foundation FSSC and exists only inside the scheme. It reaches topics the ISO texts leave open, from intentional threats to food through to food that is never sold.

Version 7, released on 1 May 2026, moves the PRP basis to the 2025 editions of ISO 22002, pairing ISO 22002-100 with a sector part, and revises the additional requirements. The management system clauses are in the ISO 22000 requirements guide.

Additional requirements 2.5.1 to 2.5.5: suppliers, labels, threats and the logo

2.5.1 Management of services and purchased materials

Services and purchased materials come under supplier control, with one sharper point on testing. The laboratory that analyses your product must deliver precise, repeatable results from validated methods, which the scheme links to evidence such as proficiency testing, a regulator-approved scheme or accreditation to a standard like ISO/IEC 17025.

2.5.2 Product labelling and printed materials

Any claim on a label or pack needs validation evidence behind it. Artwork is approved before printing, and printed stock that is left over has to be accounted for, so an obsolete label cannot find its way back onto the line.

2.5.3 Food defence and 2.5.4 Food fraud mitigation

These are two separate requirements with the same shape. Each needs a documented assessment and a plan, and the scheme requires that both are developed and maintained by people with the knowledge and competence to judge the risks. The food defence and food fraud guide covers the method.

2.5.5 Logo use

The FSSC 22000 logo may be used only under the scheme's rules.

Additional requirements 2.5.6 to 2.5.9: allergens, monitoring, culture and quality control

2.5.6 Management of allergens

A precautionary allergen label is allowed only where your risk assessment shows cross-contamination is a real risk, and printing one does not remove the duty to control the allergen or to test that the control works. The assessment is revisited when industry trends show allergen contamination in similar products.

2.5.7 Environmental monitoring

Sites in categories BIII, C, I and K run a risk-based monitoring programme for relevant pathogens, spoilage organisms and indicator organisms.

2.5.8 Food safety and quality culture

Management sets culture objectives and keeps a documented plan with targets and timelines, covering at least communication, training, employee feedback and engagement, and performance measurement.

2.5.9 Quality control

Quality parameters are set for every product in line with its finished specification. Line start-up and change-over checks confirm that packaging and labels from the previous run have gone, and quantity is controlled by unit, weight or volume. This is quality control only; it is not a quality management system.

Additional requirements 2.5.10 to 2.5.14: storage, cross-contamination, PRP checks, design and traceability

2.5.10 Transport, storage and warehousing

Stock rotation follows first-expired, first-out alongside first-in, first-out, so shelf life, not arrival date alone, decides what leaves first.

2.5.11 Hazard control and measures for preventing cross-contamination

Applies to every category except FII. One point the text names is packaging meant to have a functional effect on the food, such as extending its life, which has to be controlled as part of the hazard picture.

2.5.12 PRP verification

For categories BIII, C, D, E, FI, G, I and K, the site runs routine inspections of premises and equipment against its PRPs, monthly being the scheme's example, and follows up what they find.

2.5.13 Product design and development

Organisations that design packaging apply design principles covering containment and protection, shelf life and the reduction of food loss and waste, and cooking instructions for ready-to-cook products are validated.

2.5.14 Traceability

A requirement for primary conversion of animals (C0): traceability extends to every edible part of the carcass.

Additional requirements 2.5.15 to 2.5.18: equipment, food loss, communication and multi-site groups

2.5.15 Equipment management

New equipment is bought against a documented specification that addresses hygienic design, and brought in under risk-based change management with evidence that commissioning succeeded.

2.5.16 Food loss and waste

The organisation holds a documented policy and objectives setting out how it will reduce food loss and waste. Where product is donated, or surplus and by-products go to animal feed, the scheme expects those routes to be under control.

2.5.17 Communication requirements

The certification body must be told within three working days when a serious event begins that affects the food safety system, legality or the integrity of the certificate.

2.5.18 Requirements for organisations with multi-site certification

Groups certified under one multi-site certificate run a central function with qualified people. Internal auditors need two years of full-time food industry experience, one of them within the organisation; lead auditors hold a 40-hour lead auditor course in FSMS, QMS or FSSC 22000; and technical reviewers are impartial.

Which requirements apply to you, and what proves them

Start with your food chain category: four titles carry a category limit and one applies only to multi-site groups.

"None stated" refers to the title only; the text can still narrow a requirement to certain activities, such as packaging design.

Where sites fall short, and how to avoid it

Most findings on the additional requirements come from treating them as documents rather than routines. Template threat assessments, swabs filed but never trended and a culture plan never measured look complete in a folder and fail on the floor.

Timing is the other trap. Surveillance audits cover the whole scheme every year, and at least one of them in each three-year cycle arrives unannounced, so the records have to be current on any working day. The unannounced audit guide shows how to prepare, and the FSSC 22000 Version 7 guide sets out what changed from Version 6.

FSSC 22000 requirements: questions buyers ask