Understanding FSSC 22000: structure, version 7 and practice for food manufacturers

FSSC 22000 is one of the five food safety standards recognised by the Global Food Safety Initiative and is now used by more than 30,000 companies worldwide. The Food Safety System Certification builds on ISO 22000, the ISO/TS 22002 series and additional FSSC requirements. In early May 2026, the Foundation FSSC published Version 7, which certified sites must implement within 12 months. Anyone working in food production, packaging or storage will sooner or later come into contact with this standard.

‍

What is FSSC 22000 and who is behind it?

FSSC 22000 is an internationally recognised certification scheme for food and feed safety management systems, developed and maintained by the Foundation FSSC, based in Gorinchem in the Netherlands. The standard is considered equivalent to IFS Food and BRCGS.

The Foundation FSSC is an independent foundation and therefore not owned by an industry association. This structure sets the scheme apart from standards such as IFS, which originated from the retail sector. The Global Food Safety Initiative confirms equivalence through GFSI benchmarking, last updated in 2024.

Three components work together: ISO 22000 as the baseline standard for the management system, the ISO/TS 22002-x series for sector-specific prerequisite programmes, and additional FSSC requirements defined directly by the foundation. This three-pillar model makes FSSC 22000 a complete certification scheme, whereas ISO 22000 alone only covers the management system.

Through its broad GFSI recognition, FSSC 22000 opens access to international supply chains that require a recognised scheme. Anyone supplying into these chains will sooner or later need one of the GFSI schemes. The structure of the three pillars determines which specific requirements a company must implement.

‍

How is FSSC 22000 structured?

FSSC 22000 combines ISO 22000 as the management system standard with the sector-specific ISO/TS 22002 series for prerequisite programmes, plus additional requirements from the Foundation FSSC. Together, these three pillars form the complete set of requirements.

ISO 22000 provides the underlying logic: HACCP principles, a process-oriented approach, and risk assessment at both organisational and operational level. The ISO/TS 22002 series translates this logic into specific sectors. Six sub-standards plus an additional PAS specification cover the food chain.

An overview of the sector-specific prerequisite programmes maps six series plus PAS 221 to the relevant stages of the food chain:

‍

‍

The third pillar supplements the ISO standards with specific FSSC requirements on topics such as food defence, food fraud mitigation, allergen management, labelling, traceability and multi-site certification. These additional requirements are what set FSSC 22000 apart from ISO 22000 alone. The move to Version 7 changes exactly these three building blocks in depth.

‍

What requirements does Version 7 introduce from May 2026?

The Foundation FSSC published Version 7 in early May 2026. Certified companies have a 12-month transition period in which to bring their management system in line with the new requirements. Audits under Version 6 remain valid until 30 April 2027.

At the heart of Version 7 is the move to the new ISO 22002-x:2025 standards series. This means the Foundation FSSC is integrating the revised PRP baseline standard ISO 22002-100:2025, which for the first time provides a unified core framework for all sectors. Updated auditor competence requirements follow the 2024 GFSI benchmark.

Three key changes have a direct impact on food production:

• Sustainability as a core requirement: stronger alignment with the UN Sustainable Development Goals and design principles for Save Food Packaging under AIP and WPO
• Stricter food safety culture requirements: requirement 2.5.8 calls for a measurable safety and quality culture across all levels of the organisation
• Expanded protection requirements: updated provisions on food defence (2.5.3a), food fraud mitigation (2.5.4a), allergen management (2.5.6h) and food loss & waste (2.5.16a)

In concrete terms, the transition period means upgrade audits under Version 7 take place between 1 May 2027 and 30 April 2028. Companies that miss this window lose certification validity. The Foundation FSSC expects sites to start their gap analysis no later than the fourth quarter of 2026. The transition affects not just documentation, but the entire audit and monitoring system.

‍

How does certification and auditing work?

Initial FSSC 22000 certification takes place in two stages, followed by annual surveillance audits and recertification after three years. Certificate validity is 3 years and lapses automatically without a successful recertification.

The audit cycle follows four fixed steps, which every certified organisation goes through within three years:

1. Stage I audit: review of management system documentation, site conditions and audit readiness. Typically takes 1-2 auditor days
2. Stage II audit: on-site visit assessing the system's conformity in day-to-day practice, including observations, interviews and sampling across all PRP areas
3. Annual surveillance audits: two audits in years 2 and 3, reviewing maintenance records, training, internal audits and CAPA measures from the previous year
4. Recertification audit: before the three years expire, a full repeat of the conformity assessment with an updated risk assessment

Accredited certification bodies operating across the EU and the UK cover the market widely. Among the best-known providers are SGS, Bureau Veritas, DEKRA Certification, TÜV Rheinland, DNV, Lloyd's Register, Intertek, NSF, BSI and Kiwa. The choice of body depends on sector expertise, geographic coverage and the audit plan.

In almost every case, the effectiveness of the prerequisite programmes determines whether an audit closes without a major non-conformity.

‍

What role do prerequisite programmes (PRPs) play?

Prerequisite programmes under ISO/TS 22002-1 form the operational pillar of FSSC 22000 and define the basic hygiene and safety conditions of a production site. These programmes create the conditions that allow the HACCP system within ISO 22000 to function at all.

ISO/TS 22002-1 lists 18 PRP chapters that together describe the hygienic foundation of food production. These cover building construction and layout, the arrangement of premises and workstations, utilities for air, water and energy, and cleaning and disinfection.

Nine core PRP areas shape day-to-day audit practice and regularly draw auditors' attention:

• Air and energy supply: filtered supply air, controlled exhaust air flows and defined pressure differentials between production zones
• Cleaning and disinfection: validated cleaning schedules, documented effectiveness and approved cleaning agents
• Cross-contamination prevention: physical separation, airflow direction and allergen management under 2.5.6h
• Pest control: monitoring stations, entry barriers and documentation of all control measures
• Personal hygiene: airlock concepts, protective clothing and demonstrable hygiene training
• Equipment maintenance: preventive maintenance and approved spare parts suitable for food contact
• Recall procedures: defined crisis processes with an annual exercise requirement
• Storage and transport: temperature monitoring, the FIFO principle and contamination-safe packaging
• Food defence and food fraud: risk assessments for intentional contamination and economically motivated fraud

In an audit, what matters most is the effectiveness of these programmes in day-to-day production, not simply the existence of a document. This is exactly where equipment technology determines the audit outcome.

‍

What technical solutions support FSSC 22000 compliance in practice?

Industrial extraction and filtration technology meets several PRP requirements at once, combining hygiene, occupational safety and product quality in a single installation. Clean air is direct evidence that the prerequisite programmes under ISO/TS 22002-1 are working.

Flour, sugar, milk powder and spice dust carry allergens through the air into zones that are nominally meant to be allergen-free. Requirement 2.5.6h in Version 7 calls for documented allergen management, and source extraction directly at mixing, sieving and filling stations measurably reduces cross-contamination. HEPA filters with a separation efficiency of 99.97 percent at a particle size of 0.3 micrometres meet the requirements for clean-air spaces.

Food dusts such as flour, starch, sugar and milk powder are also explosive. ATEX compliance under EU Directives 1999/92/EC and 2014/34/EU (or the equivalent DSEAR and UKEX framework in the UK) interlocks with the FSSC requirements here, since zones 20, 21 and 22 are typical in production areas. Bursting discs, flame arrestors and antistatic components decouple the risks from both regulatory worlds.

‍

FSSC 22000 compliance with dust extraction systems from Kiekens

Kiekens has been developing industrial dust extraction and filtration technology for more than 115 years. Its systems are certified to IFS, BRC and ATEX, available in stainless steel for hygienic design, and span the range from low-vacuum source extraction to high-vacuum systems for entire production lines. A free baseline measurement documents the starting situation and provides the data foundation for audit evidence.

Consistent dust extraction also supports requirement 2.5.16a on food loss & waste. Less product drift means less waste, shorter cleaning times and longer machine uptime. This directly links FSSC 22000 compliance to the UN sustainability goals that Version 7 brings further to the fore.

‍

What are the differences from IFS Food and BRCGS?

All three schemes are GFSI-recognised and therefore equivalent in international supply chains, but differ in ownership, standards basis and application focus:

‍

‍

The choice depends on customer structure, regional reach and the company's existing ISO landscape.

‍

What does FSSC 22000 certification cost?

A single production site with 50 to 100 employees pays between 8,000 and 18,000 euros for the initial FSSC 22000 audit, with annual surveillance audits at roughly 40 to 60 percent of the initial cost. The final amount depends on company size, complexity, number of sites and the chosen certification body. Investment in equipment, training and external advice comes on top of this.

‍

By when does a company need to move to Version 7?

Audits under FSSC 22000 Version 6 remain valid until 30 April 2027. Upgrade audits under Version 7 take place between 1 May 2027 and 30 April 2028. Companies unable to present a valid Version 7 certificate by 30 April 2028 lose their certification status. The Foundation FSSC recommends starting the gap analysis no later than the fourth quarter of 2026.