ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
FSSC 22000 Version 7 was published in May 2026, and every certified site in the world now has a fixed window in which to upgrade. The dates are public, they are not negotiable, and — the part most sites get wrong — they are four separate clocks anchored to different events rather than one deadline.
Reading them as a single date is how a transition project starts six months late.
| Milestone | Date | What it constrains |
|---|---|---|
| Version 7.0 published | May 2026 | The requirement set exists and can be built to |
| Last date a Version 6 audit may be delivered | 30 April 2027 | Your certification body’s calendar |
| Upgrade audits conducted | 1 May 2027 – 30 April 2028 | A twelve-month window for every certified site |
| New CB applications accepted to Version 7 | From 1 October 2026 | Anyone changing certification body |
| CB accreditation extended to Version 7 | Before 1 May 2027 | Not in your control — but check it |
| Upgrade packs uploaded to the Assurance Platform | By 30 June 2028 | Your CB’s administrative deadline |
| Remaining Version 6 certificates withdrawn | After 30 June 2028 | Automatic, and removed from the public register |
The consequence worth sitting with: a certificate still on Version 6 after 30 June 2028 is withdrawn automatically and disappears from the public register of certified organisations. No warning letter, no grace period.
The Foundation states the drivers in the Scheme’s own Introduction. There are five, and two of them do most of the work.
The ISO 22002 prerequisite programme series was incorporated. That series was reissued in 2025 and restructured — a common Part 100 now carries the prerequisite programmes shared across sectors, with the sector-specific parts sitting on top. This is the largest practical change in FSSC 22000 Version 7 for most manufacturers.
The Scheme was aligned to the GFSI benchmarking requirements 2024. That alignment is what keeps the certificate commercially useful to retailers.
The remaining three: requirements supporting the Sustainable Development Goals were strengthened, the food chain category structure was given more definition, and there were editorial changes throughout.
If your prerequisite programmes were written against the withdrawn ISO/TS 22002 series, they now reference a structure that no longer exists. The requirements did not vanish — most moved into the common part — but the clause numbering changed, and it changed in ways you cannot infer.
The Scheme itself cites ISO 22002-1:2025 clause 10 for the procurement of animals, fish and seafood, and clause 12 for lairage inspection. Under the withdrawn 2009 edition, clause 10 was cross-contamination and clause 12 was pest control. Anyone renumbering by assumption will produce a document set that cites the wrong clauses with total confidence.
Budget a mapping exercise against your own licensed copies. It is an afternoon’s work and it cannot be skipped.
Under FSSC 22000 Version 7, food defence and food fraud appear in the prerequisite programme standard as well as in the Additional Requirements. Both layers apply.
Practically, that means a threat assessment and a vulnerability assessment are no longer bolt-ons satisfied by a single annual spreadsheet. They are prerequisite programme content with Additional Requirement obligations layered on top, including a named competence requirement for the personnel who produce each plan.
Say this to your team explicitly, because during a version transition people assume everything is different and stop trusting the system they already run.
FSSC 22000 Version 7 updated how audit duration is calculated. Certification bodies must review the calculation for every certified organisation and issue either a new Version 7 contract or a Version 7 addendum to the existing one.
This is not your task, but it is your problem if it is not done — a Version 7 upgrade audit cannot proceed without it. Ask your CB for the recalculated duration and the contract in writing, early. It is the item most sites discover late.
An upgrade audit under FSSC 22000 Version 7 is a full audit against the new requirements. It may be conducted announced, or unannounced where that is needed to meet the three-yearly unannounced audit requirement.
Where the ICT audit approach is used, both the remote and the onsite components are completed against Version 7. You cannot run half the audit to one version and half to the other.
Work backwards from your planned upgrade audit date, not forwards from today. The audit is the fixed point.
Steps 5 and 6 are the ones that slip. Step 5 depends on someone outside your organisation; step 6 depends on people being available, which they are not in the fortnight before an audit.
The FSSC 22000 Toolkit ships a five-document transition section built for exactly this sequence, including a gap analysis with the dated milestones and a 25-item upgrade readiness checklist that separates the items in your control from the ones that depend on your CB.
If you are not yet certified, this is the easiest moment in years to start. Build to FSSC 22000 Version 7 directly and skip the upgrade entirely — you never hold a Version 6 certificate and never run a transition project.
Initial audits follow a simple rule: both Stage 1 and Stage 2 are conducted to Version 7 when the audit takes place from 1 May 2027 onwards. Before that date, a Stage 1 may be delivered to Version 6 with the Stage 2 to Version 7. Read our guide to FSSC 22000 certification for how the wider scheme fits together.
Most of the transition work is editing, not authoring. It helps to know which documents actually move.
Prerequisite programme documents. Every one of them now references a restructured standard. The content largely survives; the citations do not.
The food defence and food fraud plans. Both now answer to two layers, and both carry a competence requirement for whoever produces them. If the same person wrote both in an afternoon last year, that will not hold.
Your management review agenda. Several inputs come from the Additional Requirements rather than from ISO 22000 — quality control results, culture plan progress, food loss and waste objectives, the allergen plan review and the environmental monitoring programme review. An agenda built from ISO 22000 alone omits all of them, which is why the agenda is worth rebuilding from the Scheme’s own list of inputs rather than amending last year’s.
Your internal audit programme and checklist. These must cover the Version 7 requirement set, including the quality elements the Additional Requirements bring inside the audit scope.
The scope and category determination. Version 7 gives the food chain category structure more definition, including sub(sub)categories. Those relate to auditor competency rather than to your requirements, but your certification body needs them recorded correctly or the audit is assigned to an auditor who is not qualified for your technology.
What generally does not move: your hazard analysis, your HACCP plan, your monitoring records, your traceability system and your recall procedure. If a consultant tells you FSSC 22000 Version 7 requires rebuilding those from scratch, ask which clause says so.
>Frequently asked questions about FSSC 22000 Version 7
Your upgrade audit must fall between 1 May 2027 and 30 April 2028. The precise date is set with your certification body and usually coincides with a scheduled surveillance or recertification audit.
Free of charge from the Foundation. Parts 1 to 5, the five Annexes, the Board of Stakeholders decision list and the Upgrade Process are all published at fssc.com. Only the ISO standards underneath the Scheme are paid.
Where the upgrade is conducted during a surveillance audit, the expiry date from the Version 6 certificate is maintained. The certificate is reissued referencing Version 7, but the cycle does not restart.
Remaining Version 6 certificates are set to withdrawn automatically after 30 June 2028 and no longer appear on the public register. Recovering from that means a fresh initial certification, not an upgrade — which is a materially longer and more expensive route than a transition would have been.
FSSC 22000 Version 7 is not a difficult transition, but it is a scheduled one with a hard stop and two dependencies outside your control. Confirm your CB’s accreditation and contract early, get the prerequisite programme mapping done from your own licensed copies, and work backwards from an audit date you have actually booked. Sites that do those three things treat FSSC 22000 Version 7 as an administrative upgrade. Sites that do not treat it as an emergency in 2028.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026