Comparison · food safety
HACCP or FSSC 22000: obligation versus certification
Comparing them as alternatives is the mistake at the outset: HACCP is a legal obligation for every food business operator, and FSSC 22000 is a voluntary certification scheme that incorporates it. You do not choose between them; you decide whether to add a recognised certification on top of the HACCP you already have to have.
The short answer
HACCP is a legal obligation: article 5 of Regulation (EC) 852/2004 requires every food business operator to apply procedures based on its principles, with or without certification. FSSC 22000 is voluntary and is built on three pieces — ISO 22000, the relevant sector prerequisite programme and a set of additional scheme requirements — so it includes HACCP and adds an auditable management system recognised by GFSI. The real question is not which, but whether you need to prove to a customer what the law already obliges you to have.
- HACCP
- Mandatory by lawArt. 5 of Regulation (EC) 852/2004
- FSSC 22000
- Voluntary certificationVersion 6; audits since 1 April 2024
Side by side
What each one covers
| Criterion | HACCP | FSSC 22000 |
|---|---|---|
| Nature | Legal obligation | Voluntary certification |
| Basis | Codex Alimentarius CXC 1-1969, 2020 revision | ISO 22000 + ISO/TS 22002-x prerequisites + scheme requirements |
| Includes HACCP | It is HACCP | Yes, through ISO 22000 |
| Management system | Not required as such | Yes, with the Annex SL structure |
| External audit | Official control by the health authority | Accredited certification body |
| GFSI recognition | Not applicable | Yes |
| Integrable with other ISO standards | Not directly | Yes, shares structure with ISO 9001 and 14001 |
| Scope | Every food business operator except primary production | By prerequisite module: processing, packaging, transport, feed |
How to decide
What you actually need
HACCP
HACCP alone is enough if…
- No customer requires a recognised certification
- You sell locally or through your own channel
- Your official control is limited to health inspection
- You are clear it is the legal minimum, not a choice
FSSC 22000
Take the step if…
- A retailer or a manufacturer asks you for GFSI certification
- You export and are asked to evidence the system to third parties
- You already have other ISO systems and want to share a structure
- You need a management system, not just a hazard plan
Frequently asked questions
What people ask us before getting started
Is HACCP mandatory even for a small business?
Yes. Article 5 of Regulation (EC) 852/2004 reaches every food business operator, with the exception of primary production. What the rule does allow is flexibility in how it is documented, according to the size and risk of the activity.
Can I be certified in HACCP?
Some bodies issue HACCP certificates, but they are not a GFSI-recognised scheme and do not equate to a system certification. If a customer asks for "GFSI certification", a HACCP certificate will not serve.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the food safety management system standard. FSSC 22000 is a scheme that uses it as a base and adds the sector prerequisite programme and its own additional requirements, which is what earns it the GFSI recognition ISO 22000 alone does not have.
FSSC 22000, IFS or BRCGS?
All three are GFSI-recognised and serve when a customer asks for certification. FSSC fits particularly well if the company already works with ISO standards, because it shares the Annex SL structure with ISO 9001 or ISO 14001.
Are prerequisites the same as HACCP?
No, and confusing them is the most common mistake. Prerequisites are the baseline conditions — cleaning, pest control, maintenance, training, traceability — on which HACCP rests. A well-built HACCP on weak prerequisites does not hold.
How much extra work is certification if I already have HACCP?
It depends how alive that HACCP is. If the critical control points are genuinely monitored and the records exist, the step is mainly building the management system layer: policy, objectives, internal audit and management review.
From mandatory HACCP to a certifiable system
We'll show you the module running with data similar to yours.
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, art. 5 EUR-Lex · 29 April 2004
- General Principles of Food Hygiene, CXC 1-1969 Codex Alimentarius (FAO/WHO) · 2020 revision
- FSSC 22000, version 6 Foundation FSSC · 31 March 2023
- ISO 22000:2018 — Food safety management systems ISO · 2018 ed.
Keep exploring
Related pages
HACCP, without folders or surprises
A living HACCP plan: identified hazards, critical control points with limits, and monitoring logged for…
FSSC 22000, without folders or surprises
ISO 22000 plus sector prerequisites and additional scheme requirements, in a single structure.
ISO 37301 or ISO 19600: which applies today
ISO 19600 was withdrawn in 2021 and replaced by ISO 37301, which is certifiable. What changed, what carries…
IFS Food or BRCGS: whichever your customer asks for
Both are GFSI-recognised and cover the same ground. What really separates them: scoring system, KO and…
Differences between HACCP and FSSC 22000 certification
HACCP is a preventive system that has been mandatory in the European Union since Regulation (EC) 852/2004, whose article 5 requires every food business operator to apply procedures based on its seven principles, with or without certification involved.
FSSC 22000 is a voluntary, GFSI-recognised certification scheme built on ISO 22000, the relevant sector prerequisite programme and its own additional requirements, so it embeds HACCP within a management system auditable by an accredited body.