ISO 22000:2018 Food safety management system
Combine HACCP with a complete management system — for supplying retail chains, exporting and working with international brands.
- at its core
- HACCP
- PDCA cycles
- 2
- via FSSC 22000
- GFSI
- certificate validity
- 3 yrs
The new edition is at draft stage
The current edition is ISO 22000:2018. The revision is at draft (DIS) stage in 2026, and publication is expected no earlier than 2027.
Separately, FSSC 22000 version 7 was published in May 2026 with a one-year implementation period.
What is ISO 22000
ISO 22000 sets the requirements for a food safety management system for any organisation in the food chain — from production and processing to storage, transport, packaging and retail.
The standard combines HACCP principles with prerequisite programmes (PRP) and a systematic management approach. It runs two PDCA cycles — at organisation level and at operational level.
FSSC 22000 is a certification scheme based on ISO 22000 with additional requirements, recognised by GFSI — often required by international brands.
Which certificate do you need?
HACCP is mandatory for everyone. Which standard you add on top depends mostly on who you sell to.
Most often accepted by Bulgarian chains. Check whether some chains require IFS instead.
Basis: HACCP + prerequisite programmes To the standard- Farming and livestock
- Processing
- Packaging
- Storage and transport
- Retail
- Catering and HoReCa
- Animal feed
A recall in 47 minutes
Friday, 15:00. A supplier reports that a lot of sesame may contain salmonella. This is how ISO 22000 traceability solves it before the product reaches people.
Alert
The supplier reports sesame lot L-2481.
- Food safety team convened
- Emergency procedure
- Time of the alert logged
One step back
When was the lot received and where was it used?
- Goods-in records
- Warehouse check
- Remaining stock blocked
One step forward
The sesame went into three batches of bread.
- Production records
- Batches B-101, B-102, B-103
- Quantities per customer
Recall
Customers and the authority are notified, the product is stopped.
- 4 customers notified
- Authority notified
- Stock blocked
Review
What do we improve after the incident?
- Supplier evaluation
- Updated hazard analysis
- Recall drill once a year
HACCP is the law. ISO 22000 is the system around it.
Legal food requirements remain. The standard connects them into a system that still works when something goes wrong.
Reg. 852/2004 Procedures based on HACCP principles Hazard analysis, OPRPs and the control plan in one system Reg. 852/2004 General hygiene requirements Prerequisite programmes with owners and verification Reg. 178/2002 Traceability and withdrawal of unsafe food A practised procedure and recall drills Reg. 1169/2011 Food information and allergens Allergen control across the whole process Food Act (BG) Registration of the site with the authority Context, scope and legal requirements in one place ISO 22000 only Not explicitly required Communication along the chain — suppliers, customers and authorities ISO 22000 only Not explicitly required Verification, internal audit and management review A system that passes the retailer’s audit
Documents that work on the shop floor, and evidence buyers and the authority recognise.
Free consultation- Food safety policy and objectives
- Food safety team and product descriptions
- Prerequisite programmes (PRPs)
- Hazard analysis, OPRPs and HACCP plan
- Traceability system with a test
- Recall procedure and drill report
- Supplier evaluation
- Verification, internal audit and management review
The next step after ISO 22000
When a buyer asks for a GFSI-recognised scheme, the ISO 22000 work is most of the way there.
The structure of the standard
Clauses 4–10 are mandatory. Hazard control sits in clause 8 and works as a second, operational PDCA cycle.
Clause 4 — Context of the organisation
Your place in the chain, interested parties, legal requirements, scope.
Clause 5 — Leadership
Commitment, food safety policy, roles and the food safety team.
Clause 6 — Planning
Organisation-level risks and opportunities, objectives, planning of changes.
Clause 7 — Support
Resources, infrastructure, work environment, competence, communication along the chain.
Clause 8 — Operation
PRP, traceability, emergency preparedness, hazard analysis, hazard control plan, verification.
Clause 9 — Performance evaluation
Monitoring, analysis, internal audit, management review.
Clause 10 — Improvement
Nonconformity, corrective action, updating the system.
How hazards are controlled
The core of clause 8 — from basic hygiene conditions to critical control points.
- 01
Prerequisite programmes (PRP)
Hygiene, cleaning, pest control, maintenance, personnel.
- 02
Hazard analysis
Biological, chemical, physical and allergen hazards for each product and process.
- 03
OPRP
Operational programmes for hazards not controlled at critical control points.
- 04
HACCP plan
Critical control points, limits, monitoring and corrective actions.
- 05
Traceability
One step back and one step forward — from supplier to customer.
- 06
Product withdrawal
A rehearsed withdrawal and recall procedure.
What you gain
Access to retailers and export
A certificate buyers recognise.
HACCP in a complete system
The legal requirement built into working management.
Fewer incidents
Fewer complaints, rejects and withdrawals.
Traceability
Fast response to a batch problem.
A basis for FSSC 22000
An easy step up to a GFSI-recognised scheme.
Consumer trust
Proven care for product safety.
The route to certification
Six stages with a clear deliverable at each.
- 01 1–2 wks
Current state review
Premises, PRP, existing HACCP system.
- 02 2–4 wks
Prerequisite programmes
Hygiene programmes and infrastructure.
- 03 2–3 wks
Hazard analysis and HACCP
Hazards, OPRP, critical control points.
- 04 2–3 wks
Documentation and traceability
Procedures, records, product withdrawal.
- 05 1–2 wks
Verification and internal audit
System verification and management review.
- 06 Stage 1 + 2
Certification audit
Stage 1 and Stage 2 by an accredited body.
Timeline and cost — what drives them
The cost depends mainly on the number of products, lines and the state of the premises. These are the factors — plus an estimator.
Employees and shifts
Set the workload and audit days.
Product lines
Number of products, processes and HACCP plans.
Premises and PRP
State of the premises and hygiene programmes.
Client requirements
ISO 22000, FSSC 22000, BRCGS or IFS.
Laboratory testing
Verification and analysis programme.
Certification fee
Paid separately to the certification body.
01 What is the difference between HACCP and ISO 22000?
HACCP is a legal requirement and a hazard control method. ISO 22000 builds HACCP into a complete management system with PRP, leadership, communication and improvement.
02 ISO 22000 or FSSC 22000?
FSSC 22000 includes ISO 22000 plus additional requirements and is GFSI-recognised. If your clients are international brands or retailers, they usually ask for FSSC 22000, BRCGS or IFS.
03 What does the revision mean for me?
Nothing for now — ISO 22000:2018 is the valid standard. The new edition is expected no earlier than 2027 and will have a transition period.
04 Is it suitable for logistics and packaging?
Yes. ISO 22000 covers the whole food chain, including warehouses, transport and packaging manufacturers.
05 How long does it take?
Usually 3 to 6 months, depending on the premises and the number of products. Use the estimator for guidance.
No such question in the list — ask us directly and we will reply.
Your first consultation is free
Tell us about your company and your goal. You will get a clear plan and a quote within one business day.