FSSC 22000 Version 7 Changes: Every New Requirement, Explained

Where can you find the official list of Version 7 changes?

In two documents that the Foundation FSSC published with the scheme. The first, Changes Version 6 and Version 7 – Scheme, reproduces the Version 7 text and shows every new or changed passage in red. The second does the same for Annexes 1 to 5, including Annex 2 on audit reports.

For this guide, we re-read these documents, the May 2026 Version 7 scheme and the April 2023 Version 6 scheme, then sorted every difference by family of requirements. Nothing is taken from a third-party summary. Where a point depends on a paid ISO standard, we say so. The transition dates are covered separately, in our article on the FSSC 22000 Version 7 timeline.

A useful reminder: only the English version of the scheme is authoritative. Translations are reading aids; if in doubt, the English text prevails. Sites in French- or Arabic-speaking countries that work from a translation should keep this in mind.

What changes in the normative core?

The prerequisite programmes (PRPs), and almost nothing else. ISO 22000:2018 remains the management system standard. Version 7 only adds that it applies “including any amendments issued by ISO” (Part 2, §2.3), which covers the 2024 amendment on climate change. Annex 2 draws a direct consequence: the audit report must confirm that the site has determined whether climate change is a relevant issue and whether it has taken its interested parties’ requirements on the subject into account.

The PRPs, on the other hand, change in nature. In Version 6, Part 2 required “technical specifications”: ISO/TS 22002-1:2009 for food manufacturing, ISO/TS 22002-2:2013 for catering, ISO/TS 22002-4:2013 for packaging, ISO/TS 22002-5:2019 for transport and storage, ISO/TS 22002-6:2016 for animal feed and BSI/PAS 221:2013 for retail. Version 7 requires the ISO 22002-x series: ISO 22002-100:2025, common to all sectors, plus the sector part for your category. Only trading without physical handling (FII) remains exempt.

According to the Foundation, ISO 22002-100:2025 was published in July 2025 and brings the common requirements together to avoid duplication. The Version 7 FAQ explains that these texts are now international standards, hence the disappearance of the “TS” prefix. A food manufacturer therefore applies Part 100 and ISO 22002-1:2025; a packaging-only manufacturer applies Part 100 and ISO 22002-4:2025.

The additional requirements now refer to clauses of the new standards: 16.2 and 16.3 of ISO 22002-100:2025 for food defence and food fraud, 11.1 for time and temperature after slaughter, 10 and 12 of ISO 22002-1:2025 for the procurement of animals and fish and for slaughterhouse inspection, and 12 of ISO 22002-6:2025 for additives in animal feed. What this means in a Moroccan plant is set out in our article on ISO 22002-100:2025 and the sector PRPs.

What changes in categories and scope?

The categories stay the same, but they are subdivided. The new Table 1.1 in Part 1 creates sub-subcategories for the broadest families. A few examples speak directly to Moroccan exporters:

• CIV-1: thermally and/or pressure-processed products, including pasteurisation and commercial sterilisation (UHT, canning, retorting); this is the case of a fish cannery in Safi, on Morocco’s Atlantic coast;
• CIV-5: vegetable or animal fats and oils, olive oil included;
• CI-2: perishable fish, molluscs and crustaceans, kept chilled;
• I-1 to I-5: plastic, paper and board, metal, glass and other packaging materials.

These subdivisions are used to qualify auditors. The upgrade process document is explicit: they affect neither licensing nor the accreditation of certification bodies. For you, the consequence is simple: the certification body must send an auditor qualified in your sub-subcategory.

Scope is also clarified on several points:

• a manufacturer that also runs a wholesale activity on its main site adds subcategory FI;
• a manufacturer that stores only its own products is audited within its own category, on site and off site; if it stores for other companies, sister companies included, it adds category G;
• an off-site warehouse is included in the main site’s audit only if it belongs to the same legal entity, falls under the same system and is in the same country; if it also stores for a sister company, category G is added to the main site’s certificate; if it stores for third-party customers, it falls outside that scope and needs a separate category G certification;
• in-line unwinding, preform blowing or printing carried out alongside a food manufacturing activity stays within the food scope, with no category I; in-line manufacturing of bottles from resin, however, falls under category I.

One last scope change: multi-site certification, with sampling, is now open to pre-process handling of plant products (BIII). A group of citrus packhouses in the Souss, the farming region around Agadir in southern Morocco, can therefore aim for a group certificate, provided it has a central function and meets the rules of Part 3 §5.3.

Which additional requirements change in Part 2?

The most visible changes concern seven topics; the others extend a scope or update references. The table compares the text of the two versions, heading by heading.

Three rows deserve a comment for a Moroccan site.

Food defence and food fraud change logic. In Version 6, FSSC itself described the threat assessment, the vulnerability assessment and the plans. In Version 7, the core of these requirements moves into ISO 22002-100:2025, and FSSC adds its own requirements: competent personnel, a plan that is implemented and supported by the management system, legal compliance and regular updating. Prepare evidence of competence: training, experience, method.

Printing is no longer just a packaging converter’s concern. A cannery in Agadir that prints its own labels must now demonstrate artwork control: approval of the print proof, management of obsolete versions, checks on every print run, segregation of variants and reconciliation of unused labels.

Culture becomes a question of resources. Management must provide sufficient resources, and commitment from all personnel must be demonstrable. Our article on FSSC 22000 food safety culture in Version 7 explains how to measure it and prove it.

Five headings do not change in substance: use of the logo (2.5.5), environmental monitoring (2.5.7), quality control (2.5.9), equipment management (2.5.15) and the obligation to inform the certification body within 3 working days of a serious event (2.5.17).

What changes in the certification process?

Audit duration first, then cycle rules that used to be implicit. The FSSC time added to the base duration is recalculated: 0.5 day below 100 full-time equivalents (FTE) with no more than two HACCP studies, 1 day from 100 to 249 FTE, 1.5 days above that or from three studies. The reduction of the base duration by up to 0.25 day that Version 6 allowed disappears. The small-site exemption no longer requires a “simple process” and now applies up to two HACCP studies. The detail, and what it means for your quote, is in our article on FSSC 22000 v7 audit duration.

The other new rules in Part 3:

• Cycle. No audit in the cycle may be skipped. A recertification audit held more than 6 months before expiry starts a new 3-year cycle and therefore shortens the current certificate; the certification body must warn you beforehand.
• Relocation. Once activity has stopped at the old site, the certificate is withdrawn within 3 working days of the certification body being notified; Stage 2 at the new site must take place within 6 months, otherwise the whole initial audit has to be repeated.
• Unannounced audits. Blackout days must now be agreed in advance with the certification body, where Version 6 only said they “may” be. If nothing is running on the day of the visit, the audit is rescheduled. The certificate shows the dates of the last unannounced audit.
• Full remote audits. Possible after a serious event, under the dedicated addendum, but never more than twice in a row; after that, an on-site audit is mandatory.
• Certificates. A new decision date is now also issued after an unannounced audit, without changing the expiry date, and the certificate may carry an effective date after an early recertification.

What does not change: three grades of nonconformity, no “opportunities for improvement”, 28 calendar days to address a minor or close a major, 14 days to respond to a critical, at least half of audit time on the shop floor, and at least 20% more time when an interpreter is needed.

Annex 2 adds two reporting rules. A nonconformity on a PRP is raised against the clause of ISO 22002-100:2025, unless it concerns a requirement specific to the sector part. And several deviations against the same requirement give a single nonconformity, which the auditor must assess to decide whether it is a systemic issue, and may then grade higher, as a major for example.

What does Version 7 change for certification bodies and auditors?

A lot, and that is what makes audits more specialised. According to the upgrade process document, every certification body must have its accreditation extended to Version 7 before 1 May 2027. A body that is already accredited may not issue non-accredited v7 certificates. No new licence applications are accepted for Version 6, and a new certification body can only apply for a v7 licence from 1 October 2026.

On the auditor side:

• every v6 auditor must pass a training course and an exam on Version 7, then on ISO 22002-100:2025 and the sector parts for their categories, before any v7 audit;
• auditors must be requalified for their sub-subcategories, with the auditor register up to date by 1 May 2027;
• the 40-hour lead auditor course must be recognised by a competent body, such as CQI/IRCA, and cover ISO 19011 and the relevant elements of ISO/IEC 17021-1;
• PRP training of at least 3 hours covers ISO 22002-100 and the relevant sector parts;
• consultancy experience counts only if it is in food safety, and for 6 months at most;
• the profile of every new auditor is pre-approved by the Foundation.

For a Moroccan site, the practical question becomes: does your certification body have an auditor qualified in your sub-subcategory who also speaks your working language? Without one, it has to add a technical expert, whose time does not count towards audit duration, or an interpreter, which lengthens the audit.

Part 5 moves in the same direction. Accreditation bodies must be members of Global ACI and signatories to its Multilateral Recognition Arrangement, where Version 6 referred to the IAF. Their witness audits are carried out on real FSSC 22000 audits: an audit against another standard or a simulated audit does not count.

What does Version 7 say about artificial intelligence?

It governs the use of AI by certification bodies, and only by them. Section 9 of Part 3 applies “where Artificial Intelligence (AI) is being used in the certification process”. The certification body must then:

1. have a governance framework based on fairness, accountability, reliability, accuracy, transparency, confidentiality and security;
2. carry out a documented risk assessment of each AI system, from development to use;
3. test and validate each system before deployment, then monitor it continuously;
4. never let AI replace human judgement or the certification functions defined by ISO 22003-1:2022;
5. define roles and train its personnel on the limits and risks of AI;
6. make that use transparent and communicate it to stakeholders, the certified organisation included.

Your plant therefore has no new AI requirement. You do gain a right to information: ask your certification body whether it uses AI to plan, write or review your reports, and how human decision-making is preserved. If you use an AI tool yourself to draft procedures, no specific FSSC rule applies, but your system is still judged on what it actually does.

Where should you start to build these changes in?

With the PRPs and your audit date, then with the headings that affect your category. The detailed step-by-step plan is in our FSSC 22000 v6 to v7 upgrade plan; here is the checklist for the changes themselves.

• Download the v7 scheme and the two “Changes Version 6 and Version 7” documents.
  
• Confirm your category, sub-subcategory and number of HACCP studies.
  
• Buy ISO 22002-100:2025 and your sector part, then rebuild the PRP cross-reference table.
  
• Update the PRP inspection checklists (2.5.12) with the clauses of the new standards.
  
• Link food defence and food fraud to clauses 16.2 and 16.3, with evidence of competence.
  
• Check whether you print labels or packaging (2.5.2 d).
  
• Add numerical targets and deadlines to your food loss and waste objectives (2.5.16).
  
• Plan the resources for the culture plan and the evidence of staff commitment (2.5.8).
  
• Document the climate change analysis in the context of the management system.
  
• Ask your certification body for the recalculated audit duration, the auditor’s qualification and any use of AI.
  

Want to compare each rule before and after? Our FSSC 22000 v6 vs v7 comparison covers the same points in table form.