What an ISO 22000 certificate tells a European food buyer

An ISO 22000:2018 certificate tells a European buyer that a certification body has audited the supplier's food safety management system (FSMS) and found it to conform to the standard, for the sites and activities named in its scope. It does not tell the buyer that a product is safe, and it does not stand in for the obligations EU food law places on food business operators. A supplier file has to answer both, with different documents.

What the certificate is

ISO 22000:2018 sets requirements for an FSMS in any organization directly or indirectly involved in the food chain. Clause 1 lists what the standard is meant to enable, including safe products and services in accordance with their intended use, and the ability to demonstrate compliance with applicable statutory and regulatory food safety requirements.

For the organization, certification is a choice. Clause 1 names certification or registration of the FSMS by an external organization as one route, and self-assessment or self-declaration of conformity as the others.

Accredited certification follows two documents. ISO/IEC 17021-1:2015 sets the requirements for bodies that certify management systems of any type. ISO 22003-1:2022 is used with it and adds the food-specific requirements; its clause 1 says it also gives customers information and confidence about how their suppliers' certification was granted.

What it does not say

ISO 22003-1 clause 1 states that FSMS certification does not attest to the safety or fitness of an organization's products. The same paragraph adds that an FSMS requires the organization to meet all applicable food-safety-related statutory and regulatory requirements through its management system.

The audit treats that second point as a capability of the system, not a legal verdict. ISO/IEC 17021-1 §9.2.1.2 b) makes one audit objective the ability of the management system to ensure the client meets applicable statutory, regulatory and contractual requirements. Its note is direct: "A management system certification audit is not a legal compliance audit."

At stage 1, ISO 22003-1 §9.3.2 c) reviews the extent to which the FSMS includes adequate processes and methods for identifying and implementing relevant food safety legislation. Under §9.3.4, the availability of relevant authorizations is checked when information on regulatory compliance is collected.

So the certificate reports on the system that is meant to keep the organization within food law. It is not a finding that the law has been met.

What EU food law requires

Regulation (EC) No 178/2002, which lays down the general principles and requirements of food law:

• Food shall not be placed on the market if it is unsafe (Article 14(1)).
• Food business operators shall ensure that food meets the requirements of food law relevant to their activities, and verify that they are met. Member States enforce food law through a system of official controls (Article 17).
• Food imported into the EU for placing on the market there shall comply with the relevant requirements of food law, or with conditions the EU recognises as at least equivalent, or with the requirements of a specific agreement with the exporting country where one exists (Article 11).

Regulation (EC) No 852/2004, on the hygiene of foodstuffs:

• It takes as a principle that primary responsibility for food safety rests with the food business operator (Article 1(1)(a)).
• Operators comply with the general hygiene provisions of Annex I, Part A, for primary production, or the general hygiene requirements of Annex II for later stages (Article 4).
• Article 5, headed "Hazard analysis and critical control points", requires operators after primary production to put in place, implement and maintain a permanent procedure or procedures based on the principles it lists, from identifying hazards to establishing documents and records. Operators give the competent authority evidence of this in the manner that authority requires.
• For imported food, Article 10 states that the relevant requirements of food law under Article 11 of Regulation (EC) No 178/2002 include Articles 3 to 6 of Regulation (EC) No 852/2004.

Where the two meet

ISO 22000 points the management system at the law. Clause 5.2.1 c) requires the food safety policy to commit to satisfying applicable food safety requirements, statutory and regulatory ones included. Clause 8.2.3 requires applicable statutory, regulatory and mutually agreed customer requirements to be identified when prerequisite programmes are selected or established.

The certificate is a certification body's decision about a system, within a stated scope, and its status can change during the cycle. The legal obligations attach to the food business operator and to the food placed on the market, and public authorities enforce them.

Buyer requirements beyond ISO 22000

A purchase specification can ask for more than ISO 22000. The standard allows for this: clause 0.4 of its Introduction says other guidance, specifications and requirements specific to food sectors can be used together with it. A note to clause 1 of ISO 22003-1 also refers to bodies that certify an FSMS against criteria "additional to, or other than, those in ISO 22000".

When a specification names such a scheme, an ISO 22000 certificate does not answer that line of it. Of the food safety standards, CAS's EGAC accreditation covers ISO 22000 only. It does not extend to other food safety certification schemes.

What this means for you

If you are a buyer or importer in the EU: read the ISO 22000 certificate as evidence about the supplier's management system, for the sites and activities in its scope. Treat what EU food law requires as a separate item in the file.

If you are an exporter: food imported for placing on the EU market has to meet the requirements Article 11 of Regulation (EC) No 178/2002 sets, certified supplier or not.

If you are certified to ISO 22000 and adding an EU market: the standard already requires applicable statutory and regulatory requirements to be identified, for example in clauses 8.2.3 and 8.5.1.2. The requirements of the new market are among them.

This is generic information about the requirement, not advice on any particular management system.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch