Food safety management systems — Requirements for any organization in the food chain
The international food-safety management-system standard for any organisation in the food chain. It combines interactive communication, system management, prerequisite programmes, and Codex HACCP within the ISO high-level structure, and introduces two levels of risk — organisational (strategic) and operational (HACCP/OPRP).
What this does not cover
stated in the document's own scope- Specifies the food-safety management system; the detailed prerequisite-programme requirements are in the companion ISO/TS 22002 series, not in ISO 22000 itself.
- Is voluntary and certifiable, but does not replace mandatory food law such as EU food hygiene regulation or the US FSMA preventive-controls rule (21 CFR Part 117).
- Addresses food safety, not food quality, authenticity, or nutritional attributes.
- On its own it is not a GFSI-recognised scheme; that recognition applies to FSSC 22000, which pairs ISO 22000 with sector PRPs.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ISO 22000:2018 specifies the requirements for a food-safety management system for any organisation in the food chain — from primary producers and manufacturers to transport, storage, retail, and providers of equipment, packaging, and cleaning agents. It combines four elements that determine food safety: interactive communication along the chain, systematic management, prerequisite programmes (PRPs), and the hazard-analysis principles of Codex HACCP. Built on the ISO high-level structure, the 2018 edition introduced two distinct plan-do-check-act cycles and two levels of risk — organisational (strategic risks and opportunities) and operational (food-safety hazards handled through the hazard-control plan of critical control points and operational PRPs).
Scope & applicability
Any organisation in the food chain — producers, processors, transport, retail, and suppliers of equipment, packaging, and services — regardless of size.
Legal basis & how it acquires force
ISO 22000 is a voluntary international consensus standard; it does not replace statutory food law. Food safety is governed by binding regulation — for example the EU General Food Law and hygiene package, or the US Food Safety Modernization Act and 21 CFR Part 117 (preventive controls) — which mandate HACCP-based controls but not certification to any specific standard. ISO 22000 provides a certifiable framework that helps demonstrate those obligations are met; combined with sector PRP specifications it forms the basis of the FSSC 22000 scheme recognised by the Global Food Safety Initiative (GFSI).
Document structure
| Part | Covers |
|---|---|
| Clause 4 — Context of the organization | Understanding the organisation, interested parties, and the scope of the food-safety management system |
| Clause 5 — Leadership | Leadership and commitment, food-safety policy, and organisational roles and responsibilities |
| Clause 6 — Planning | Actions to address risks and opportunities and food-safety objectives |
| Clause 7 — Support | Resources, competence, awareness, communication, and documented information |
| Clause 8 — Operation | Prerequisite programmes, traceability, emergency preparedness, hazard analysis, the hazard-control plan, and control of nonconformity |
| Clauses 9–10 — Performance evaluation and improvement | Monitoring, internal audit, management review, nonconformity, corrective action, and continual improvement |
Key requirements
- Operate a food-safety management system within the ISO high-level structure
- Establish prerequisite programmes and a HACCP/OPRP hazard-control plan
- Address organisational context and risk-based planning
- Manage nonconformities, corrections, and corrective actions
- Continually improve the food-safety management system
Implementation tips
- Distinguish operational PRPs from CCPs deliberately — ISO 22000 expects both, controlled differently
- If pursuing FSSC 22000, add the sector PRP (ISO/TS 22002-x) requirements on top of ISO 22000
- Leverage the ISO high-level structure to integrate with ISO 9001 if you already run one
Revision notes
The 2018 second edition adopted the ISO high-level structure, added organisational-context and risk-based-planning clauses, and clarified the two-level (strategic/operational) risk model.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
ISO 22000 incorporates the Codex Alimentarius HACCP principles and uses the ISO high-level structure shared with ISO 9001 and ISO 14001, so it integrates with other management-system standards. With the sector-specific prerequisite technical specifications (the ISO/TS 22002 series), it forms FSSC 22000, one of the food-safety certification schemes benchmarked by GFSI and accepted across international food supply chains.
ISO 22000:2018: frequently asked questions
Quick answers to common questions about ISO 22000:2018.
Who can use ISO 22000?
Any organisation in the food chain, regardless of size or complexity — producers, manufacturers, transport and storage operators, retailers, and providers of equipment, packaging, cleaning agents, and ingredients. It is designed to apply across the whole chain.
What are the two levels of risk in ISO 22000:2018?
Organisational (strategic) risk — the risks and opportunities addressed in planning at the management-system level — and operational risk — the food-safety hazards controlled through the hazard-control plan of critical control points and operational prerequisite programmes.
How does ISO 22000 relate to HACCP?
ISO 22000 incorporates the Codex Alimentarius HACCP principles within a management-system framework, adding interactive communication, system management, and prerequisite programmes around the hazard-analysis core.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the management-system standard. FSSC 22000 is a certification scheme that combines ISO 22000 with sector-specific prerequisite specifications (ISO/TS 22002) and additional requirements; FSSC 22000, not ISO 22000 alone, is recognised by GFSI.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.