ISO 22000: the international standard for food safety management systems
Updated 2026-07-12 · Reviewed by: Redazione ce85204 — revisione editoriale assistita da AI (2026-07-12)
ISO 22000 is the international ISO standard for food safety management systems (FSMS): it integrates the HACCP principles, prerequisite programmes (PRPs) and operational prerequisite programmes (OPRPs). It is voluntary and does not replace the obligations under Regulation 852/2004.
ISO 22000 is the international standard, published by the International Organization for Standardization (ISO), that specifies the requirements of a food safety management system (FSMS). It can be adopted by any organisation in the food chain, from primary production to distribution, and certified by an accredited certification body. Like all voluntary certifications, adoption is optional.
At a glance
- It is the reference ISO standard for the FSMS: it combines the management structure common to ISO standards (Annex SL) with the HACCP principles Article 5(1) of Regulation (EC) No 852/2004.
- It distinguishes prerequisite programmes (PRPs) from operational prerequisite programmes (OPRPs) and critical control points (CCPs).
- It is voluntary: it does not replace registration Article 6(2) of Regulation (EC) No 852/2004, self-control Article 5(1) of Regulation (EC) No 852/2004 and training Annex II, Chapter XII, point 1 of Regulation (EC) No 852/2004.
- On its own it is not GFSI-recognised: FSSC 22000 is, and it incorporates ISO 22000.
Commentary
What it is
The current version, ISO 22000:2018, adopts the high-level structure common to all ISO management-system standards (Annex SL), the same as ISO 9001. This allows food safety to be integrated with other corporate management systems. The technical core remains hazard analysis under the HACCP principles, which Regulation 852/2004 requires by law in any case Article 5(2) of Regulation (EC) No 852/2004, enriched by two characteristic elements: the process approach with the Plan-Do-Check-Act cycle and risk-based thinking applied at both the organisational and the operational level.
ISO 22000's best-known conceptual contribution is the three-way split of control measures. Alongside baseline prerequisite programmes (PRPs) and critical control points, the standard introduces operational prerequisite programmes (OPRPs): control measures for significant hazards that are not managed at a CCP with a measurable critical limit but through action criteria and monitoring. The distinction between CCP and OPRP is one of the most delicate technical points in application.
Who asks for it
ISO 22000 is valued by organisations that want an internationally recognisable management system, integrable with ISO 9001, and by markets where GFSI recognition is not imposed by the customer. Many retail buyers, however, require a GFSI-recognised scheme: in that case ISO 22000 alone is not enough and FSSC 22000, which incorporates it, is chosen.
Accreditation
ISO 22000 certification is issued by bodies accredited under ISO/IEC 17021 for management systems, within the European framework of Regulation (EC) No 765/2008 (ACCREDIA accreditation in Italy). Accreditation and the EA-MLA mutual recognition arrangements are what make the certificate usable across borders.
Relationship with the obligations under 852
ISO 22000 presupposes and organises the same obligations the Regulation imposes, but does not replace them. The certified business remains subject to registration of the establishment Article 6(2) of Regulation (EC) No 852/2004, to the obligation of HACCP procedures Article 5(1) of Regulation (EC) No 852/2004 and to official control by the competent authority Article 6(1) of Regulation (EC) No 852/2004. The certificate is not a legal title, as explained in why there is no certificate under Regulation 852/2004.
Common errors
- Confusing ISO 22000 and FSSC 22000. ISO 22000 is the system standard; FSSC 22000 is the GFSI scheme that incorporates it by adding technical PRPs and additional requirements.
- Believing certification replaces the legal HACCP. The Article 5 obligation remains autonomous Article 5(1) of Regulation (EC) No 852/2004: ISO 22000 implements it, it does not exempt from it.
- Treating OPRP and CCP as equivalent. They are distinct categories: a CCP has a measurable critical limit, an OPRP is governed through action criteria.
Frequently asked questions
Is ISO 22000 mandatory?
No. It is a voluntary standard. The legal obligations are registration Article 6(2) of Regulation (EC) No 852/2004, HACCP Article 5(1) of Regulation (EC) No 852/2004 and training Annex II, Chapter XII, point 1 of Regulation (EC) No 852/2004.
What is the difference between ISO 22000 and FSSC 22000?
FSSC 22000 is a GFSI-recognised scheme comprising ISO 22000, the technical prerequisite programmes (ISO/TS 22002) and additional requirements. ISO 22000 alone is not GFSI-recognised.
What are OPRPs?
Operational prerequisite programmes: control measures for significant hazards managed through action criteria and monitoring rather than a measurable critical limit typical of a CCP. See OPRP.
Does ISO 22000 apply in all countries?
The certificate is internationally recognisable thanks to accreditation and the EA-MLA arrangements. It is not, however, a legal title: statutory obligations remain the national and EU ones Article 5(1) of Regulation (EC) No 852/2004.
Sources
- EUR-Lex — Regulation (EC) No 852/2004, consolidated text as of 24 March 2021: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02004R0852-20210324 — accessed 2026-07-12.
- ISO — ISO 22000:2018 Food safety management systems — Requirements for any organization in the food chain: https://www.iso.org/standard/65464.html — accessed 2026-07-12.
- ACCREDIA — Italian national accreditation body: https://www.accredia.it/en/ — accessed 2026-07-12.
Drafting and review
ce85204 editorial team. Draft generated with AI from primary sources; editorial review AI-assisted (see methodology).