Food Outsourcing Requirements 2026–2027: What Is Changing

What changes in 2026–2027 for outsourced processes?

The underlying rules stay in place; how they are applied becomes more precise. None of the texts published in 2026 by BRCGS, IFS and the Foundation FSSC rewrites clause 3.5.4 of BRCGS Food Safety Issue 9, requirements 4.4.4 to 4.4.7 of IFS Food Version 8 or the FSSC rule on outsourced processes. What changes concerns the subcontractors themselves, the content of audit reports and the certificate calendar of your co-packers.

For a brand owner, European or Moroccan, that has products made or partly processed by a third party, the table brings together the dates to know, as at 5 November 2026.

What does FSSC 22000 Version 7 change for a site that outsources or makes products for a brand?

Four points, which you can read by comparing Version 7 with Version 6.

Printed labels. In Version 6, artwork management and print control (2.5.2 d) applied only to food chain category I, the manufacturers of food packaging. In Version 7, it applies to any organization that prints labels or materials: approval of an artwork standard or master sample, management of changes and of obsolete artwork, approval of each print run, detection of printing errors during the run, segregation of print variants, and accounting for unused printed material. A co-packer that prints your labels on the line is directly concerned.

Laboratories. Requirement 2.5.1 a now targets laboratory analyses that verify or validate parameters critical to food safety, and adds that they are performed in accordance with the applicable requirements of ISO/IEC 17025, whether the laboratory is internal or external.

Specifications. Microbiological, physical, chemical and allergen specifications used for food safety purposes are based on appropriate scientific principles where relevant legislation is absent (2.5.1 d). The emergency procurement procedure and the specification review now extend to subcategory BIII, pre-process handling of plant products.

Activities across several addresses. A process split across two addresses can be covered by one audit only if both belong to the same legal entity, operate under the same management system and are in the same country (Part 3, 5.2.2). Off-site storage that also serves other customers is no longer an off-site activity of the main site. A co-packer, as a separate legal entity, therefore does not enter its customer’s certificate: it falls under the control of external providers.

The rule on outsourced processes itself is stable. The certificate scope does not include subcontracted or outsourced processes outside the organization’s legal responsibility and control, and ISO 22000:2018 clauses 7.1.6 and 8.1 still apply; the document setting out the changes to the annexes does not mark this rule as changed. The transition dates come from the upgrade process published by the Foundation on 1 May 2026.

Do the 2026 BRCGS position statements change clause 3.5.4?

No. Mandatory interpretations of BRCGS Food Safety Issue 9 are published in document F926. Its version 4, dated 27 April 2026 and effective from 10 August 2026, aligns it with the GFSI Benchmarking Requirements version 2024 and contains four position statements: the site’s responsibility in unannounced audits (1.1.10), the ban on changing certification body within the four-month audit window, the definition of an initial audit, and protective footwear (7.4.2). Version 4.1, dated 6 October 2026, rebrands the document.

Clause 3.5.4 therefore applies as published in the official English checklist, F904A: outsourcing declared to the customer, the processor approved through a certificate or an audit with a defined scope, risks built into the HACCP plan, a service specification, a contract, and checks on the product when it returns. BRCGS is preparing Issue 10 of the standard, with no announced date: until it is published, Issue 9 is what gets audited.

What does IFS Food doctrine version 5 clarify?

Two points of form that matter to a brand owner. The IFS Food Version 8 Doctrine, version 5, published in April 2026, does not change requirements 4.4.4 to 4.4.7. On purchasing, its only clarification concerns requirement 4.4.1, with specific procedures for animals, fish and seafood subject to control of prohibited substances.

Mixed products. When a finished product combines components made on site with the same or similar components bought in, the report must explain it. If those components are produced on behalf of the site as partly outsourced processes, the certificate carries the sentence “Besides own production, the company has partly outsourced processes” and the report describes them.

The language of the report. The partly outsourced processes section is among the report information that must be translated into English, together with the company profile, the audit scope, the exclusions, the overall summary and the deviations and non-conformities. A European buyer can therefore read, in the IFS report of a Moroccan site, what that site hands over to third parties.

According to its foreword, the doctrine applies new or adapted rules two months after the publication of the relevant version, unless stated otherwise. The IFS Food Version 8 standard remains the basis: fully outsourced products are not covered by IFS Food, and IFS recommends certifying them under IFS Broker or an equivalent GFSI-recognised standard.

What should you do in 2027 if you outsource, or manufacture for a brand?

Update your outsourcing files before the 2027 audits. ISO 19011:2026, published on 27 May 2026 according to the ISO committee page, offers a recent framework for organising the programme; the FSSC 22000 Version 7 scheme still cites the 2018 edition.

• Each co-packer and subcontractor is listed with its standard, its certificate version and, if it holds FSSC 22000 v6, its upgrade date.
  
• The scope of each certificate has been checked in the official database and covers the activity entrusted.
  
• Contracts and service specifications are up to date (BRCGS 3.5.4.4 and 3.5.4.5, IFS Food 4.4.5).
  
• The co-packer that prints your labels has shown its artwork management and print control procedure.
  
• The laboratories that test your critical parameters work to ISO/IEC 17025.
  
• Your customers have been informed in writing of each outsourced step and have agreed where they require it.
  
• The description of your partly outsourced processes is ready for your next IFS audit, in English if your customer reads it.
  
• Your subcontractor audit programme for 2027 is set based on risk.
  

The full method is in our guide to the second-party food audit, and the step-by-step conduct in our guide on how to prepare and conduct a co-packer audit. For the transition itself, see our FSSC 22000 hub.