Do you need ISO 22000? A decision guide for food manufacturers, suppliers and the people who answer customer requests

Who asks for ISO 22000, and what they are really asking

The question rarely starts inside the plant. It arrives in a supplier approval form or a draft supply agreement, and who is asking tells you which answer will satisfy them.

• Retailers and brand owners buying private-label or co-packed products want third-party assurance, and large retailers commonly ask for a GFSI-recognised certificate rather than ISO 22000 on its own.
• Export buyers and importers use certification to cut their own supplier audits; some accept ISO 22000, others list the schemes they recognise.
• Food-service and hotel chains ask central kitchens and ingredient suppliers for a recognised certificate, with close attention to allergens and traceability.
• Regulators and public buyers in some markets refer to food safety certification in licensing, export registration or tenders; there, the exact text of the rule decides.
• Parent companies and investors may set certification as a group standard for every site.

A questionnaire or a customer audit may not call for a certificate at all yet. If the request named a standard, note the name exactly as given.

What food law requires, and what certification adds

Keep two obligations apart. The first is legal. In the European Union and the United Kingdom, food hygiene law requires food business operators working after primary production to put in place, implement and maintain permanent procedures based on HACCP principles. Many other countries have comparable rules. That duty exists with or without a certificate, and no certificate replaces it.

The second is voluntary. ISO 22000 takes the Codex HACCP method and surrounds it with prerequisite programmes, traceability, emergency preparedness, verification, internal audit and management review, so that food safety is run as a system rather than kept as a file. Certification means an independent, accredited certification body has audited that system and decided it conforms.

So a business without working HACCP-based controls has a legal gap to close before certification. One with sound controls has the foundation, and the decision becomes commercial: who will value the certificate, and is ISO 22000 the one they value?

When the customer actually wants a GFSI-recognised scheme

The Global Food Safety Initiative benchmarks certification programmes and publishes the list it recognises. In September 2026 that list includes FSSC 22000, BRCGS, IFS and SQF among others. ISO 22000 on its own is not on it. FSSC 22000 is: it combines ISO 22000 with the sector prerequisite programmes of the ISO 22002 series and additional scheme requirements.

A buyer who says "ISO 22000 or equivalent" will usually accept ISO 22000; one who says "a GFSI-benchmarked certificate" will not. The detailed comparison of HACCP, ISO 22000 and FSSC 22000 sits in HACCP vs ISO 22000 vs FSSC 22000: which one, and when.

Packaging, logistics, feed and ingredient suppliers

ISO 22000 applies to any organisation in the food chain, not only food makers, which makes it useful for suppliers whose customers are food manufacturers.

• Food packaging manufacturers must show that hygiene, migration and foreign-body risks are controlled. Some customers want ISO 22000 or FSSC 22000, others a BRCGS or IFS packaging standard; the prerequisite programmes differ, so confirm first.
• Storage, transport and distribution businesses are judged on temperature control, cleaning, pest control, segregation and traceability. ISO 22000 suits those serving several food sectors with one system.
• Feed producers sit in the food chain because feed affects food from animals. Check whether the customer names a feed-specific scheme before settling on ISO 22000.
• Ingredient, additive and supplement suppliers are audited hardest on allergens, contaminants and traceability, and brand owners often expect a GFSI-recognised scheme here.

Decision table: situation, recommendation and why

Once the scheme is clear, see ISO 22000 scope: sites, products and processes, and the mistakes that cost you, ISO 22000 timeline: how long certification takes, stage by stage and ISO 22000 certification cost: what moves the price.

Questions to ask the customer, and yourselves, before committing

Ask the customer

• Which standard or scheme will you accept, in writing, and is a GFSI-recognised certificate a condition?
• By what date, and will a plan with milestones hold the business meanwhile?
• Which products and sites must the certificate cover?

Ask yourselves

• Do HACCP-based controls work on every line and shift, or only on paper?
• Do the prerequisite programmes need building works, equipment or layout changes?
• Who will lead the food safety team, and do they have the time and authority?
• Which scheme are other customers likely to ask for next?

Certification bodies for food safety management systems are accredited to ISO/IEC 17021-1 and apply ISO 22003-1, by accreditation bodies recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. Choosing the body is covered in Choosing an ISO 22000 certification body: accreditation, food categories and quotes.

When not to certify yet

"Not yet" is sometimes the most useful answer. Wait when:

• The site needs works. Prerequisite programmes cannot be met by documents when zoning, drainage or pest proofing fall short.
• The hazard analysis has never really been done. A plan copied from a template will not survive an auditor.
• The customer has not confirmed the scheme. Learning late that a named GFSI scheme was required costs time.
• There is no one to lead it. Without a food safety team leader with time and authority, the system stalls.
• You cannot run the system long enough before the audit. Monitoring, verification and mock recall records have to exist; a certificate in days is not certification.

Whether the effort pays is weighed in ISO 22000 benefits: what changes in the plant, and what does not.

Deciding on ISO 22000: questions buyers ask