FSSC 22000 Food Chain Categories: The Complete Breakdown

FSSC 22000 food chain categories decide almost everything about your certification project. They determine which prerequisite programme standard you are audited against, which of the 18 Additional Requirement groups you carry, and what your certificate is allowed to say.

Get the category wrong and you build a management system to the wrong requirement set — then discover it at the audit rather than at the desk.

What this guide covers

• The 13 FSSC 22000 food chain categories
• Subcategory FII carries no prerequisite standard at all
• How FSSC 22000 food chain categories drive the Additional Requirements
• Sub(sub)categories affect the auditor, not your requirements
• One site frequently holds more than one category
• The boundary between BIII and CII
• Determining your FSSC 22000 food chain categories
• Exclusions constrain what you may claim
• What the category decides about your prerequisite programmes
• Categories and the audit itself
• Frequently asked questions on FSSC 22000 food chain categories
• The practical point

The 13 FSSC 22000 food chain categories

Part 1 of the Scheme sets out the FSSC 22000 food chain categories as thirteen (sub)categories, aligned to the categories defined in ISO 22003-1. Each carries its own set of normative prerequisite documents.

One of the FSSC 22000 food chain categories carries no prerequisite standard

The row worth pausing on. Of all the FSSC 22000 food chain categories, FII — brokering, trading and e-commerce without physical handling — is the only one with no prerequisite programme standard. An FII organisation is audited against ISO 22000 and the FSSC Additional Requirements only.

Applying a manufacturing prerequisite standard to a broker is wasted work, and an auditor will treat every unused programme as a claim you did not meet. FII carries its own specific obligations instead: it must ensure its suppliers hold their own food defence plan and food fraud mitigation plan.

How FSSC 22000 food chain categories drive the Additional Requirements

Clause 2.5 of Part 2 contains 18 requirement groups. Eight are scoped to particular categories by their own heading; five more say “all food chain categories” while carrying category-conditional requirements inside them. Only the remainder apply universally without qualification.

Some examples of how the FSSC 22000 food chain categories cut the requirement set:

• Environmental monitoring applies to BIII, the C range, I and K — eight of the thirteen.
• Traceability of edible carcass parts applies to C0 only.
• Food loss and waste applies to everyone except category I, packaging manufacturers.
• Product design and development applies to everyone except G, transport and storage.
• Equipment management and hazard control apply to everyone except FII.
• Multi-site internal audit requirements apply to BIII, E, F and G.

Adopting a group your category does not carry commits the site to evidence an auditor will then expect to see. Omitting one you do carry is a straightforward nonconformity. Both errors cost money and neither is recoverable on the day.

Sub(sub)categories affect the auditor, not your requirements

Several of the FSSC 22000 food chain categories divide further. C0 splits into red meat and aquatic species. CI splits four ways. CIV splits into six process technologies — thermal, dried, preserved, bakery, fats and oils, beverages. Category I splits into five packaging materials, and K into two.

These sub(sub)categories relate only to auditor competency. They do not change your requirement set, and they do not affect certification body licensing or accreditation scope. Record them anyway: your CB uses them to assign a qualified auditor, and a mismatch delays the audit.

One site frequently holds more than one of the FSSC 22000 food chain categories

This is the determination worth checking hardest, and it goes wrong in a consistent way. Organisations record their primary manufacturing category and stop.

Storage and transport for others. A manufacturer that only stores and moves its own product is audited under its production category. The moment it provides storage or transport as a service to another organisation — including a sister company — Category G applies in addition.

Wholesale at the main site. Manufacturers and caterers that also carry out wholesale activities at the main site need subcategory FI alongside their production category.

Every applicability decision must then be taken against the union of your categories, not the primary one. That is a materially larger requirement set than most sites expect.

The boundary between two FSSC 22000 food chain categories

A specific line that catches fresh produce sites. Subcategory BIII covers handling that leaves harvested plant product in its original whole form — washing, sorting, grading, trimming, waxing, drenching. Processing such as cutting and dicing changes the form of the product and moves the activity into CII.

A packhouse that adds a cutting line has changed category, and with it the requirement set. Re-run the determination whenever a new process is introduced, not only at recertification.

Determining your FSSC 22000 food chain categories

Work through this before writing a single procedure.

1. List every activity carried out on site, including services provided to other organisations.
2. List every product and product group.
3. Map each activity to a category using Part 1 of the Scheme.
4. Identify the sub(sub)categories for auditor assignment.
5. Record any activity deliberately excluded from scope, with justification.
6. Derive the prerequisite standards from the table above.
7. Derive the applicable Additional Requirement groups.
8. Record the reasoning for every group you decide does not apply.

Step 8 is the one people skip. An unrecorded “not applicable” is a nonconformity; a recorded and reasoned one is not. An empty folder is not evidence of a decision, and at surveillance nobody can reconstruct why a group was left out.

The FSSC 22000 Toolkit opens with exactly this sequence — a category determination record and an applicability matrix generated from the Scheme’s own wording, 18 groups against all 13 categories, with columns for your determination and your reasoning.

Exclusions constrain what you may claim

Where an activity at the site is excluded from the certificate, you may not use the FSSC 22000 logo or refer to your certified status in a way that implies the excluded activity is covered. That constraint follows directly from your category and scope determination, and it is checked at audit.

What the category decides about your prerequisite programmes

The FSSC 22000 food chain categories point you at one of six sector-specific prerequisite standards, and they are genuinely different documents rather than variations on a theme.

A manufacturer working to ISO 22002-1 gets requirements written around processing plant, zoning and product contact surfaces. A caterer working to ISO 22002-2 gets requirements written around open food handling and service. A logistics provider under ISO 22002-5 gets vehicles, temperature integrity and load segregation. A packaging manufacturer under ISO 22002-4 gets migration, set-off and food contact compliance.

Since the 2025 reissue, all of them sit on top of a common part — ISO 22002-100 — which carries the prerequisite programmes shared across sectors. That restructure means a site that changes category no longer replaces its entire prerequisite set; the common layer stays and the sector layer swaps.

FSSC 22000 food chain categories and the audit itself

Your FSSC 22000 food chain categories also shape the audit. The certification body must hold a licence covering every category in your scope, and must assign an auditor qualified for your sub(sub)categories. Neither is your responsibility to arrange, but both are worth confirming before the audit is booked — a CB that is not licensed for one of your categories cannot certify that part of your scope.

Category also affects audit duration indirectly. Where more than one food chain category is included in the scope of certification, additional reporting time may be required based on audit complexity, and combined audits carry a longer total duration that must be justified in the report.

None of this is negotiable on the day, which is why the category determination belongs at the start of the project rather than on the application form.

Once your categories are set, see which Additional Requirements you carry and which ISO 22002 part applies.

>Frequently asked questions on FSSC 22000 food chain categories

How do I know which category we fall into?

The FSSC 22000 food chain categories are defined in Part 1 of the Scheme, free from the Foundation at fssc.com. It gives the activity description for each category alongside worked examples. Where an activity sits near a boundary, ask your certification body before you build — they issue the scope statement.

Can our category change without us doing anything?

Not by itself, but it changes more often than sites expect. A new process, a new product technology, a service extended to another organisation or a new production area can all move or add a category. Re-run the determination on each of those triggers.

Does a multi-site organisation use one category for all sites?

Not necessarily. Sites can differ in their FSSC 22000 food chain categories, and the FSSC 22000 food chain categories are determined per site activity. Multi-site certification itself is only available for BIII, E, F and G, and carries its own central function and internal audit requirements.

What if we get the category wrong?

The certification body will catch it when it assesses your proposed scope against Part 1 and ISO 22003-1. That is better than the alternative, but it means rework — and where you have built to a lighter requirement set, it can mean postponing the audit. Determining categories correctly at the outset is cheaper than any of that.

The practical point

FSSC 22000 food chain categories are not an administrative label on a form. They are the switch that decides your prerequisite standard, your Additional Requirement set and your certificate wording. Spend an hour on the determination and record the reasoning both ways, and the rest of the project becomes a finite, scoped job. Skip it, and you will be building to somebody else’s requirement set. For how the wider scheme fits together, see our guide to FSSC 22000 certification, or our comparison of FSSC 22000 vs ISO 22000 if you are deciding between routes.