Food Defence and Food Fraud Requirements: What Changes in 2026-2027

What changes with FSSC 22000 Version 7?

The logic. In Version 6, FSSC 22000 itself described the threat assessment and its plan (2.5.3.1 and 2.5.3.2), then the vulnerability assessment and its plan (2.5.4.1 and 2.5.4.2). In Version 7, published in May 2026, that foundation moves into the prerequisite programmes: requirements 2.5.3 and 2.5.4 apply “in addition to” clauses 16.2 and 16.3 of ISO 22002-100:2025.

FSSC keeps four requirements of its own, identical for food defence and for fraud (the scheme uses the US spelling “food defense”):

The content of clauses 16.2 and 16.3 belongs to the ISO text, which is sold, not published: we do not reproduce it here. The document of changes to the annexes does show what the auditor will have to summarise in the report under clause 16: a defined methodology, internal and external threats, significant threats and vulnerabilities, mitigation measures and their verification, the training and communication strategy, the periodic review, and an overview of access control, site security and any reported breaches. For fraud, the auditor records the breadth of the assessment: the supply chain, not only the site.

Two further details complete the picture. A non-conformity is raised against the most specific clause, for example 2.5.3 (a). And the Version 7 glossary takes its definitions of food defence and food fraud from version 2024 of the GFSI requirements. The full overview of the changes is in our article on FSSC 22000 Version 7 changes.

Which dates matter?

FSSC 22000 dominates the calendar. The other schemes have set no new deadline on these topics.

The detailed transition calendar is in our article on the FSSC 22000 Version 7 timeline.

What does version 2024 of GFSI benchmarking change?

It puts competence first. The GFSI’s key changes document lists among the new elements of Part III the requirement that appropriate knowledge and expertise be used to develop and maintain an effective food defence threat assessment plan, and likewise for the food fraud assessment plan.

Among the strengthened elements, the food defence plan must be developed, implemented, verified, maintained and reviewed on a regular basis, or when a new threat is established. An agent or broker must ensure the same of its suppliers’ food defence plans. A documented food fraud management plan specifies the measures implemented to mitigate the public health risks from the identified vulnerabilities; it follows the same cycle, with a review when a new vulnerability is established.

These requirements are addressed to scheme owners, who translate them into their own texts. That is what FSSC 22000 Version 7 does with its competence requirements. The GFSI page listing programmes undergoing benchmarking against version 2024, consulted on 5 November 2026, includes FSSC 22000 Version 7; the outcome is still to be confirmed.

On the auditor’s role, the reference remains the GFSI’s 2014 position, repeated in its 2018 technical document: the auditor checks the assessment and the plan, and is not expected to detect fraud.

And BRCGS Food Safety Issue 9, IFS Food Version 8 and PAS 96?

Nothing changes in the requirements. BRCGS Food Safety Issue 9 remains in force, with section 4.2 for food defence and section 5.4 for product authenticity, claims and chain of custody; Issue 10 is in preparation, with no date announced. IFS Food Version 8 keeps requirements 4.20 and 4.21, with a review and an effectiveness test of the food defence plan at least once within a 12-month period.

The IFS Food Version 8 Doctrine, version 5, published in April 2026, adds a clarification that matters for Moroccan sites. The part of 4.21.2 on external inspections and regulatory visits does not apply if no food defence legislation in the country of the audit requires external food defence inspections, or if the site does not export to the United States and no food defence inspection by the US Food and Drug Administration (FDA) is required.

On the methods side, BSI’s PAS 96 page presents the PAS 96:2026 edition, under the title “Food Defence – Protection and Prevention from Deliberate Acts”. BSI says it reflects recent food defence cases, an updated cybercrime threat and alignment with the TACCP process. The guide remains voluntary: no standard requires it.

What should you do before 2027?

Prepare the FSSC upgrade audit if it concerns you, and use the annual review to strengthen the evidence that every scheme now expects.

• Link the threat assessment and the vulnerability assessment to clauses 16.2 and 16.3 of ISO 22002-100:2025.
  
• Build a competence file for the people who carry out the assessments: training, experience, method.
  
• Write the methodology down if it exists only in a spreadsheet.
  
• Extend the fraud assessment to the supply chain, beyond the site.
  
• Document the training and communication strategy and the access control measures.
  
• Record the applicable legislation in each country of sale, or the fact that there is none.
  
• For an FII trader, collect suppliers’ food defence and food fraud mitigation plans.
  
• Agree the date of the upgrade audit with the certification body.
  

For the method itself, see our food defence and food fraud guide and our food fraud vulnerability assessment method.