Supplier Audit Requirements 2026–2027: Why EU and UK Buyers Ask More

Why are supplier audit requirements tightening in 2026–2027?

Because several texts and standards are changing at the same time, and each one shifts part of the burden of proof onto the supplier. Four causes are dated and verifiable: new versions of the GFSI-recognised standards, the EU Packaging and Packaging Waste Regulation (PPWR), value-chain data for the Corporate Sustainability Reporting Directive (CSRD) and, further out, the EU corporate sustainability due diligence directive.

One caveat before any figure. We found no official source that measures the number of supplier audits commissioned by European or UK buyers in Morocco. Percentages that circulate without a reference should not drive your audit budget.

The timeline below brings together the deadlines that weigh on supplier approval.

What do the new versions of GFSI standards change for the buyer?

They force the buyer to re-check certificates it thought were settled. The GFSI distinguishes programmes recognised against the 2020 version of its requirements from those recognised against the 2024 version. FSSC 22000 Version 7, SQF Edition 10 and the current versions of IFS Logistics, IFS Broker and IFS PACsecure are among the programmes undergoing benchmarking against the 2024 version. The page of recognised programmes still lists BRCGS Packaging Materials at Issue 6, although audits have been carried out against Issue 7 since April 2025.

In practice, a buyer that requires “a GFSI-recognised certificate” must decide whether it accepts a new version before that version is recognised. According to the SQFI Edition 10 FAQ, Edition 9 remains the only recognised SQF programme until Edition 10 is recognised. Foundation FSSC states that Version 7 is still undergoing benchmarking.

FSSC 22000 Version 7 also pushes its certified sites, often the buyer itself or its industrial customers, to manage their suppliers more tightly:

• finished products are labelled according to the legal requirements of the intended country of sale, allergens included;
• a claim (allergen, origin, production method) requires validation evidence and verification through traceability and mass balance;
• purchasing specifications are based on scientific principles where there is no legal requirement;
• tests that verify a critical parameter go to a competent laboratory, according to the applicable requirements of ISO/IEC 17025.

A Moroccan supplier that delivers to a v7-certified site will receive these questions, and often the visit that checks the answers. The detail of the changes is in our FSSC 22000 Version 7 guide.

Why does the PPWR add packaging to supplier approval?

Because since 12 August 2026, the compliance of packaging placed on the EU market is proven with information from the whole chain. Regulation (EU) 2025/40 designates a single manufacturer per packaging item, often the filler or the brand owner. That manufacturer draws up the EU declaration of conformity from the information and documentation its suppliers pass on, and remains solely responsible for compliance with the sustainability and labelling requirements, according to the Commission’s FAQ.

For an exporter of canned fish or olive oil, and for the buyer approving it, there are two immediate consequences:

• the PFAS limits have applied since 12 August 2026 to food-contact packaging, with no sell-through period for packaging placed on the market after that date;
• the approval questionnaire gets longer: packaging composition, PFAS evidence, approved packaging suppliers, artwork that will change with harmonised labelling, from 12 August 2028 at the earliest.

Roles, dates and evidence are detailed in our PPWR guide for non-EU exporters.

CSRD and due diligence: more requests, or better-framed ones?

Better framed, for now. The CSRD has been scaled back: the Omnibus I directive, in force since 18 March 2026, limits sustainability reporting to companies with more than 1,000 employees and more than €450 million in net turnover. According to the Commission, the number of companies in scope falls by about 85%.

The staff working document of 3 July 2026 provides that a company with no more than 1,000 employees, in the value chain of a company subject to reporting, may decline to provide information beyond the voluntary standard. Directive (EU) 2026/470 defines this “protected undertaking” by two criteria only, no more than 1,000 employees on average and being in the value chain of a reporting undertaking, with no condition of establishment in the EU; the cap applies only to information requested for sustainability reporting, not to the buyer’s due diligence or risk management. The CSRD therefore explains ESG questionnaires; it does not impose on-site audits.

The due diligence directive comes later. Member States must transpose it by 26 July 2028 at the latest and apply it from 26 July 2029. The groups in scope will have to address adverse impacts on human rights and the environment in their chains of activities; the Commission announces limits on information requests addressed to smaller partners, as well as model contract clauses. From 2027, Moroccan suppliers can already gather the social and environmental evidence they hold: our ESG and CSR page sets out the method.

On the UK side, the basis does not change. Section 21 of the Food Safety Act 1990 gives the person charged a defence if they prove that they took all reasonable precautions and exercised all due diligence. Import controls, however, will move: according to the UK government (page updated on 30 July 2026), the sanitary and phytosanitary agreement with the European Union is intended to take effect in mid-2027, subject to ongoing negotiations. Great Britain is then expected to align with the EU’s third-country import rules, and some rest-of-world goods not routinely inspected today, including animal products and certain citrus fruits, will need to be inspected.

What should a Moroccan supplier do in 2027?

Anticipate the questions rather than suffer them. One hour in a management meeting is enough to run this check, and buyers can send the same list to their suppliers ahead of the next audit:

• The customer list is up to date, with the standard, version and edition each customer requires in writing.
  
• The FSSC 22000 v7 upgrade date, or the SQF Edition 10 audit date, is fixed with the certification body and communicated to buyers.
  
• The certificate scope covers every product, line and address delivered.
  
• The labelling requirements of each country of sale are identified, allergens included.
  
• Each printed claim is backed by a validation and a mass balance.
  
• Packaging suppliers have sent their PFAS evidence and the composition of their materials.
  
• Basic ESG data is gathered once, with supporting documents, to answer every questionnaire.
  
• Contracts with subcontracted carriers and warehouses are written and signed.
  
• A mock audit against the buyer’s specification is planned before the buyer’s visit.
  

For the step-by-step preparation, read how to prepare a factory for a buyer’s supplier audit. For the full approach from the buyer’s side, see our guide to supplier audits in Morocco.