FSMA and HACCP certification for bio-food

01Overview and value chain

Markers: [EC: FSSC 22000 v7 / ISO 22000 | OECD: 1.4 Agricultural biotechnology | Regulator: FDA (US), EFSA (EU)]

Food safety certification is the mechanism by which a manufacturer converts an internal process into something a regulator, a retailer or a customs authority will accept. Three demands drive the market in 2026 and they are converging. The first is traceability: FDA’s FSMA Section 204 requires firms to capture key data elements at critical tracking events, so that a contaminated lot can be followed through the chain rather than reconstructed after an outbreak. The second is scheme revision: FSSC 22000 Version 7 was released on 1 May 2026 and takes effect on 1 May 2027 with a twelve-month transition, adding requirements on food loss and waste, quality control, equipment management, allergen management, packaging design and auditor competence, and folding food safety and quality culture into the standard itself. The third is the underlying HACCP discipline of hazard analysis and preventive control, which every scheme still rests on. Beneath all of it sits laboratory verification, where the hard cases are products like ready-to-eat fermented, salt-cured and dried foods whose validation is complicated by limited data and artisanal processes. The providers are the global testing, inspection and certification houses, and their competitive move in this cycle has been to attach digital platforms to what used to be a purely human audit.

The key directions of food safety certification are:

1. FSMA 204 Traceability: audit and system work against FDA’s Food Traceability Rule, verifying that key data elements are captured at critical tracking events and that records can actually be produced on demand, increasingly supported by dedicated digital traceability platforms.
2. FSSC 22000 Version 7 Transition: the scheme upgrade published 1 May 2026 and effective 1 May 2027, strengthening allergen and feed controls, establishing a single hygiene baseline, enhancing food defence and governance, and adding explicit requirements on food loss and waste.
3. HACCP Preventive Controls and Training: hazard analysis and critical control points as the underlying method, delivered as accredited instructor-led training and management-system implementation rather than as a document exercise.
4. Laboratory Verification: the analytical testing that substantiates the plan — pathogen and composition testing for food, feed and supplements, including the difficult validation of ready-to-eat fermented, salt-cured and dried products.

Sectoral value chain

[Hazard Analysis] ──> [System Implementation] ──> [Verification Testing] ──> [Third-Party Audit]
                                                              │
                                                     (nonconformity closure)
                                                              │
                                                              ▼
[Market & Customs Access] <─── [Certification / Filing] <─────┘

Value chain levels

Cross-cutting technologies of the sector:

• Digital Audit and Traceability Platforms: cloud audit systems and traceability tools that attach data visibility and cross-site performance comparison to what was previously a purely manual audit record.
• Food Safety and Quality Culture Assessment: the behavioural dimension now written into the scheme rather than left implicit, assessed alongside documented controls.
• Environmental Monitoring Programmes: structured sampling of the production environment rather than the product alone, clarified in the current scheme revision as a distinct requirement.

02US

The US axis is FSMA — both the preventive-controls framework and the Section 204 traceability rule — with providers pairing audits against the rule with training and cloud platforms.

FSMA 204 traceability audits, multi-site audit programmes, laboratory verification

• SGS (FSMA 204 Food Traceability Solutions): launched in March 2025, the offering combines expert-led FSMA 204 audits that assess key data elements and critical tracking events with the TRAKKEY digital traceability platform, aimed squarely at readiness for FDA’s Section 204 requirements.
• NSF (audit programmes and HACCP training): NSF Food Safety Plus is a growth-focused audit service for brands expanding across multiple locations, complementing standard audits with an optional self-audit tool and the NSF Connect cloud audit platform for regulatory compliance, data visibility and cross-site performance comparison; NSF also runs IACET-accredited instructor-led virtual training on HACCP and food safety leadership.
• Eurofins (US testing base): its US Food, Feed and Supplement Testing operation is a full-service analytical laboratory of roughly 100 to 150 employees headquartered in Des Moines, Iowa, with an office in Salinas and distributed teams across the US, Bulgaria and Belgium, and it flags validation of ready-to-eat fermented, salt-cured and dried products as genuinely difficult given limited data, artisanal processes and FSIS expectations.

03CN

China’s route is licensing and filing rather than voluntary certification alone: a producer needs a domestic production licence to operate and a customs filing to export, with HACCP certification functioning as the internationally recognised overlay.

SC production licence, export producer filing with customs, HACCP as export standard

• Production licence (SC): food production and processing enterprises must hold a production licence to manufacture food legally in China, assessed under the food production licence review general rules issued in their 2022 edition by the market regulator.
• Export producer filing: enterprises exporting food must complete the export food producer filing with the customs administration. The published conditions require a completed filing, an established and traceable food safety and hygiene control system operating effectively across production, processing and storage, compliance with any special requirements of the importing country and applicable international agreements, genuine assumption of enterprise responsibility with a non-discredited customs credit status, and no notification from an importing authority in the past year arising from the enterprise’s own safety or hygiene problems.
• HACCP as the export overlay: Chinese trade guidance presents HACCP — hazard analysis and critical control points — as the globally recognised food safety management system promoted by the FAO and WHO, and as the standard that supermarkets, platforms and customs check before a product can be listed for export.

04EU

Europe hosts the certification bodies and the scheme itself, and the defining event of this cycle is the FSSC 22000 Version 7 transition, described consistently across three independent certifiers.

FSSC 22000 v7 release and transition, scheme content changes, quality-culture integration

• DNV (release and timing): FSSC 22000 Version 7 was released on 1 May 2026 and comes into effect on 1 May 2027 with a twelve-month transition period, introducing improvements across product categories and audit duration together with new requirements on food loss and waste, quality control, equipment management, allergen management, packaging design and auditor competence, and integrating food safety and quality culture.
• LRQA (what changes in practice): its account of Version 7 emphasises stronger food safety and quality culture, risk-based thinking extending to food fraud and supplier controls, and clearer environmental monitoring, with the twelve-month transition window running to May 2027; it also points to the World Health Organization’s foodborne illness estimates covering 2000 to 2021 across 42 hazards as the evidence base now shaping priorities.
• Bureau Veritas (certification body role and framing): operating as an FSSC 22000 certification body across the scheme’s categories and product scope, it characterises Version 7 as a comprehensive upgrade rather than an incremental update, citing stronger allergen and feed controls, a single hygiene baseline, enhanced food defence and governance, and concrete action on food loss and waste.

05Leading companies and research institutes

06Tech stack and innovations

The stack has two halves: the management-system requirements a scheme imposes, and the evidence infrastructure — data capture and laboratory analysis — that proves they are met.

1. Traceability Data Architecture (FSMA 204):
   • The rule’s substance is data: key data elements recorded at critical tracking events, so that a lot can be followed forward and back through the supply chain on demand rather than reconstructed after the fact.
   • Providers have responded by pairing the audit with a digital traceability platform, moving the deliverable from an opinion about readiness to a system that produces the records.
2. Scheme Revision (FSSC 22000 Version 7):
   • Released 1 May 2026 and effective 1 May 2027 with a twelve-month transition, the version adds requirements on food loss and waste, quality control, equipment management, allergen management, packaging design and auditor competence.
   • It also moves two previously soft areas into the standard: food safety and quality culture is integrated rather than encouraged, and risk-based thinking extends explicitly to food fraud and supplier controls, with environmental monitoring clarified.
3. HACCP as the Underlying Method:
   • Hazard analysis and critical control points remains the method every scheme rests on — identifying and controlling biological, chemical and physical hazards — and is promoted internationally by the FAO and WHO as the common baseline.
   • Delivery is increasingly through accredited instructor-led training aimed at managers who must sustain the system daily, on the premise that a system fails through behaviour rather than through documentation.
4. Laboratory Verification and Its Hard Cases:
   • Analytical testing across food, feed and supplements supplies the evidence that controls work, from pathogen testing to composition and shelf life.
   • The genuinely difficult category is ready-to-eat fermented, salt-cured and dried products, where limited data and artisanal processes complicate validation — the honest limit of a testing-led approach.

07Value chains and production pipelines

Industrial pipeline of a food safety certification cycle (FSMA Section 204, FSSC 22000 v7, HACCP, China SC licence and export filing)

┌───────────────────────────┐      ┌───────────────────────────┐
│ 1. Hazard Analysis        │ ───> │ 2. System Implementation  │
└───────────────────────────┘      └───────────────────────────┘
                                                  │
                                                  ▼
┌───────────────────────────┐      ┌───────────────────────────┐
│ 4. Verification Testing   │ <─── │ 3. Traceability Data      │
│                           │      │    Capture                │
└───────────────────────────┘      └───────────────────────────┘
               │
               ▼
┌───────────────────────────┐      ┌───────────────────────────┐
│ 5. Third-Party Audit      │ ───> │ 6. Certification &        │
│                           │      │    Market Access          │
└───────────────────────────┘      └───────────────────────────┘

Stage 1: Hazard Analysis

Biological, chemical and physical hazards are identified for the specific process and product, and the critical control points that manage them are defined. This is the HACCP core, and every certification scheme and export filing ultimately tests whether it was done honestly for this process rather than copied from a template.

Stage 2: System Implementation

Preventive controls, monitoring, corrective actions, allergen management and hygiene baselines are built into daily operation. Under the current scheme revision, food safety and quality culture is part of what is assessed, so implementation is judged on behaviour as well as on records.

Stage 3: Traceability Data Capture

Key data elements are recorded at critical tracking events so a lot can be traced in both directions. This is where the FDA traceability rule bites, and where audits now assess whether the records can actually be produced on demand rather than merely whether a procedure exists.

Stage 4: Verification Testing

Laboratory analysis substantiates that controls work — pathogen, composition and shelf-life testing on product and environmental samples. Ready-to-eat fermented, salt-cured and dried products are the hard case, where limited data and artisanal variability make validation genuinely difficult.

Stage 5: Third-Party Audit

An accredited body audits the system against the chosen scheme, raises nonconformities and verifies closure. For organisations certified to FSSC 22000, the twelve-month transition window to 1 May 2027 governs when the audit is conducted against Version 7 rather than Version 6.

Stage 6: Certification and Market Access

The certificate or filing is the artefact that retailers, platforms and customs authorities check. In China that means the SC production licence for domestic manufacture plus the export food producer filing with customs, which additionally requires a clean credit status and no importing-authority notification in the past year arising from the enterprise’s own hygiene failures.