FSSC 22000 Version 7 Changes: What Actually Changed, and What You Have to Do About It

Home / Guides / FSSC 22000 Version 7

FSSC 22000 · VERSION 7.0 · UPGRADE

By Mthokozisi Nkosi, founder of ASC Food Safety Consultants. FSSC 22000 and BRCGS Lead Auditor, SAATCA registered R638:2018 Lead Implementer, HPCSA registered Environmental Health Practitioner, MSc International Public Health. Published 18 September 2026.

Which FSSC 22000 Version 7 changes force a rebuild rather than a re-label?

Three of them. The prerequisite programme standards, the food chain category structure, and the grading of findings. Everything else you hold can usually be updated in place, with a revision number and a fresh approval signature. Those three cannot, because they change the document your evidence has to point at, the list of requirements you are measured against, and the language your own auditors have to write in.

The test for each item in your system is this: does Version 7.0 change what the document says, or what it refers to? A cleaning procedure that was correct in Version 6 is still correct; the clause reference in its header is not. But the applicability register that told you which additional requirements to satisfy can now be wrong in both directions, listing requirements that no longer reach you and missing ones that now do.

Sites in Johannesburg, Cape Town and Gqeberha make the same mistake at every version change: a find and replace on the clause numbers, called a transition. That gives you a system that reads correctly and fails at sampling, because the auditor asks for the record, not the header.

Where did the prerequisite programme requirements go?

Into ISO 22002-100:2025, with whatever sector detail remains held in a sector part. For food manufacturing that part is ISO 22002-1:2025. The introduction to ISO 22002-100:2025 is explicit: the document comprises the common PRPs from the prior sector specific series ISO 22002-1, ISO 22002-2, ISO 22002-4, ISO 22002-5, ISO 22002-6 and the new ISO 22002-7, extracted into it to provide a unified understanding of PRPs across sectors, and where unique sector specific PRPs remain they are provided in the other parts of the series, designed to be used in conjunction with it.

ISO 22002-1:2025 clause 1 says the same from the other side: it specifies, in conjunction with ISO 22002-100, requirements for prerequisite programmes in food manufacturing, and does not apply to other parts of the food supply chain. Read together, the effect is plain. Many ISO 22002-1:2025 clauses carry one sentence, that the requirements in ISO 22002-100 shall apply. Clause 4.1 reads that way, and so do 12.1, 13.1, 16.1, 16.2 and 16.3.

What is left with real sector content in ISO 22002-1:2025 is short, and worth knowing by heart because these are the clauses a food manufacturing auditor opens the sector part to find. Water, ice and steam at 6.2. Air and ventilation at 6.3. Boiler chemicals at 6.6. Recycling and reuse at 8.2. Clause 12, where 12.2 requires a segregation or zoning plan, 12.3 covers allergen cross contact, 12.4 physical contamination and brittle materials, 12.5 chemical contamination. Cleaning in place at 13.4. Rework, all of clause 17.

So the rebuild is a clause map, not a rewrite. For every prerequisite programme procedure you hold, you need to know whether its requirement now lives in Part 100, in Part 1, or in both. Get that map wrong and your internal audit will sample the wrong document and find nothing, which is the worst possible outcome because it reads as conformity.

What is the transition deadline for FSSC 22000 Version 7?

The Scheme text does not state one, and this guide will not invent a date. Part 3 section 5.7 on upgrade audits says the Foundation will issue instructions when upgrade audits are required, and that this typically occurs when there is a significant change to the Scheme requirements such as a version change. It then puts four duties on the certification body: follow the Foundation’s upgrade requirements, make sure staff and auditors know the process, recalculate additional audit duration where applicable, and re-issue the certificate after a successful upgrade audit where required.

The Scheme gives you the mechanism and puts the date in a separate instruction, so your deadline lives in two places: the Foundation’s published upgrade instructions, and your certification body’s audit programme for your site. Part 2 section 2.2 adds a third source of dated obligations, the Board of Stakeholders Decision list, whose decisions overrule or clarify existing Scheme rules and, in the Scheme’s own words, shall be implemented and applied within the defined transition period. That section also makes your FSSC 22000 contact person responsible for tracking the interpretation articles.

One trap. Part 3 section 5.8 is headed Transition audits and it is not about you. A transition audit is where an organization holding accredited ISO 22000 or another GFSI recognized certification moves to FSSC 22000: the existing certificate must still be valid with an equivalent scope, the audit meets the objectives of a Stage 2, and it results in a certificate valid for three years. If you hold Version 6, your section is 5.7.

So write to your certification body, ask for the upgrade instruction that applies to your certificate and the date of your first Version 7.0 audit, and file the reply. That email is the only defensible record of your deadline, and the one your management review should reference under ISO 22000:2018 clause 9.3.2.

How does Version 7 grade audit findings?

Minor, major or critical, and nothing else. Part 3 section 6.2 states that there are three nonconformity grading levels and lists them as minor nonconformity, major nonconformity and critical nonconformity. It then closes with one line that changes how many internal audit procedures have to be written: the Scheme does not allow Opportunities for Improvement.

The same section says where a finding is written: nonconformities shall always be written to the most relevant Scheme requirement linked to the specific audit criteria in ISO 22000:2018, the specified PRP standard or the FSSC 22000 additional requirement. That is a three way choice on every finding, and the reason a Version 6 internal audit checklist does not survive. A single clause column cannot record which of the three documents the clause sits in, so your finding register will not reconcile with the certification body report.

The definitions carry the timelines. Under 6.2.1 a minor is issued when the finding does not affect the capability of the management system to achieve the intended results, and the certification body approval of your corrective action plan must be completed within 28 calendar days after the last day of the audit or the certificate is suspended. Under 6.2.2 a major is issued when the finding does affect that capability, or for a legislative noncompliance linked to quality, and it must be closed within 28 calendar days. Under 6.2.3 a critical is issued where there is a significant failure in the management system, a direct adverse food safety impact with no appropriate action observed, or food safety legality or certification integrity at stake, and the certificate is suspended within three working days for a maximum of six months.

Two things follow. Your internal auditors need to grade to three levels and defend the grade, which is a skill and not a form. And the habit of softening a finding into an observation so that nobody has to close it no longer has anywhere to go.

What does the scope structure mean for your certificate?

Your food chain category decides which prerequisite programme standard binds you and which additional requirements reach you, so the category on your certificate is now a live compliance variable rather than a label. Part 1 section 3 sets out the categories in Table 1, aligned with ISO 22003-1:2022, and Table 1.1 adds sub(sub)categories for those categories with a wide range of technologies.

Read Table 1 across and you get the normative documents for each category in one line. Category C, food manufacturing, carries ISO 22000:2018, ISO 22002-100:2025, ISO 22002-1:2025 and the FSSC 22000 additional requirements, for every one of its subcategories. Category E carries ISO 22002-2:2025, category I carries ISO 22002-4:2025, category G carries ISO 22002-5:2025, category D carries ISO 22002-6:2025 and subcategory FI carries ISO 22002-7:2025, which is new to the series. Subcategory FII carries no PRP standard at all, the single exception Part 2 section 2.4 allows.

Part 1 section 3.2 expands category C into five subcategories: C0 primary conversion of animal carcasses, CI perishable animal products, CII perishable plant based products, CIII mixed products and CIV ambient stable products. Table 1.1 subdivides CIV into six sub(sub)categories, so a CIV site running a retort and a dry blending line sits in CIV-1 and CIV-2 and the audit samples both.

This is where most of the real work of applicability sits. If you are not certain which of the eighteen additional requirements reach your site, read which FSSC 22000 Version 7 additional requirements actually apply to you before you write a gap assessment line.

What do you rebuild, and what do you only re-label?

Rebuild four things. Re-label the rest.

Rebuild one: the prerequisite programme clause map. A table with one row per PRP procedure you hold, and columns for the ISO 22002-100:2025 clause, the ISO 22002-1:2025 clause, and whether the sector part adds anything or defers to Part 100. Your internal audit programme samples from this table, so if the table is wrong the audit is decorative.

Rebuild two: the applicability register for 2.5.1 to 2.5.18. One row per requirement, your food chain category, the scope stated in the requirement heading or in its sub requirements, and a yes or no with the reason. Some requirements are scoped in the heading and re-scoped inside, and 2.5.11 is the clearest case of that. Get this wrong and you either build something nobody asked for or miss something you will fail on.

Rebuild three: the internal audit checklist and its grading. Three grades, no fourth category, and a column that records whether the requirement sits in ISO 22000:2018, the PRP standard or the additional requirements, because Part 3 section 6.2 requires the finding to be written to the most relevant Scheme requirement in exactly those terms.

Rebuild four: the hazard analysis records that were thin in Version 6 and are sampled harder now. The justification for acceptable levels under ISO 22000:2018 clause 8.5.2.2.3, the selection and categorisation decision under 8.5.2.4.2, and the rationale for every critical limit under 8.5.4.2. Those three are covered in detail in the documented information Version 7 asks for and where sites fall short.

Re-label everything else: policy headers, document reference tables, the normative references list in your manual, and the customer documents that quote your certification scope. Revision control tasks, and the part of a transition that looks like progress and is not.

Questions people ask