The Short Answer: ISO 22000 Is Not Legally Mandatory in the UK
If you have been searching for a definitive answer on whether ISO 22000 is mandatory for any industry in the United Kingdom, here it is: no, ISO 22000 certification is not a legal requirement under UK law for any sector. No piece of UK legislation names ISO 22000 as a compulsory standard that businesses must hold a certificate against.
On this page
But that answer on its own is misleading, because in practice, ISO 22000 can feel very much like a requirement depending on your industry, your customers, and the supply chains you operate in. There is a significant difference between what the law demands and what the market demands, and in the UK food industry, those two things are closer together than in almost any other sector.
This article breaks down exactly where ISO 22000 sits in the UK regulatory landscape, which industries feel the strongest pressure to certify, how it compares to other food safety schemes, and what you should actually do if a customer or retailer is asking you for it.
How UK Food Safety Law Actually Works
The UK food safety regulatory framework is built around legislation, not ISO standards. The primary laws governing food safety are the Food Safety Act 1990, the Food Hygiene (England) Regulations 2006 (and equivalent regulations in Scotland, Wales, and Northern Ireland), and the assimilated version of EU Regulation 852/2004 on food hygiene, which remains part of UK domestic law following Brexit.
These laws require food businesses to implement food safety management systems based on Hazard Analysis and Critical Control Points, commonly known as HACCP. The Food Standards Agency enforces these requirements through local authority environmental health officers, who inspect businesses and can issue improvement notices, prohibition orders, or prosecute non-compliant operators.
Critically, the legislation does not specify that you must use ISO 22000 to meet your HACCP obligations. You can satisfy the legal requirement through a documented HACCP plan that you developed yourself, through a simpler industry-specific guide, or through a different third-party certification scheme. ISO 22000 is one way to demonstrate compliance, but it is not the only way and it is not named in the law.
What the Food Standards Agency Says
The Food Standards Agency guidance on HACCP makes clear that businesses must have a food safety management system in place, but it does not mandate any specific certification scheme. The FSA recognises multiple approaches, including industry guides to good hygiene practice, which are approved as alternative means of satisfying the HACCP regulation for certain business types.
So from a purely legal standpoint, a small bakery or a food truck operator can meet their obligations without ISO 22000, without BRCGS, and without any third-party certification at all, provided their HACCP documentation is sound and their practices hold up to inspection.
Where ISO 22000 Becomes Effectively Mandatory
Here is where the practical reality diverges sharply from the legal position. In the UK food industry, particularly in manufacturing and processing, third-party food safety certification has become a de facto commercial requirement. Major retailers, food service operators, and large manufacturers routinely require their suppliers to hold certification against a recognised food safety scheme before they will trade with them.
Retail Supply Chains
The major UK supermarkets, including Tesco, Sainsbury’s, Asda, Morrisons, Waitrose, and Marks and Spencer, typically require their food suppliers to be certified against a Global Food Safety Initiative recognised scheme. ISO 22000 is one of those recognised schemes. If you want to supply product to these retailers, you will almost certainly need a GFSI-recognised certification, and ISO 22000 qualifies.
However, it is worth noting that ISO 22000 alone is not always sufficient. Many UK retailers specifically require BRCGS Global Standard for Food Safety (formerly BRC) or FSSC 22000, which is a certification scheme built on top of ISO 22000 with additional requirements. BRCGS in particular has very strong penetration in the UK retail supply chain, partly because it was developed in the UK specifically to meet retailer requirements.
Food Service and Hospitality Supply Chains
Large food service operators, contract caterers, and hospitality groups buying at scale similarly require their suppliers to demonstrate food safety management. ISO 22000 certification is often accepted in these contexts, particularly for overseas suppliers or for product categories where BRCGS is less commonly applied.
Export Markets
UK food manufacturers exporting to certain markets may find that ISO 22000 or FSSC 22000 is required by the importing country or by the overseas buyer. This is particularly relevant for exports to the Middle East, parts of Asia, and certain African markets where ISO 22000 has strong recognition and is sometimes referenced in import regulations or government procurement requirements.
ISO 22000 vs BRCGS vs FSSC 22000: Understanding the UK Landscape
One of the most common points of confusion for UK food businesses is understanding how ISO 22000 relates to the other food safety certification schemes they hear about. Getting this wrong can cost you time and money if you certify against the wrong scheme for your market.
BRCGS Global Standard for Food Safety
BRCGS is the dominant food safety certification scheme in the UK retail supply chain. It was created by the British Retail Consortium specifically to give retailers a standardised way to assess supplier food safety. If your primary market is UK supermarkets or major food retailers, BRCGS is almost certainly the scheme you need, not ISO 22000 on its own.
BRCGS has its own grading system (AA, A, B, C, D) and is audited unannounced in some categories. It is more prescriptive than ISO 22000 in certain areas, particularly around site standards, product control, and traceability. Many UK food manufacturers hold BRCGS certification and nothing else, because it satisfies their retail customers completely.
FSSC 22000
FSSC 22000 is a certification scheme that uses ISO 22000 as its foundation and adds sector-specific prerequisite programme requirements and additional FSSC requirements on top. It is GFSI recognised and is widely accepted by retailers and food service operators globally. For UK food manufacturers who supply both domestic and international markets, FSSC 22000 can be a good choice because it combines the ISO 22000 framework with the commercial recognition of a GFSI scheme.
If you are already implementing ISO 22000, moving to FSSC 22000 certification is a relatively small additional step. You can read more about what the standard involves in our essential guide to ISO 22000.
Standalone ISO 22000
ISO 22000 certification on its own is most useful in the following situations: you supply food service rather than retail, you operate in an export market where ISO 22000 is the recognised scheme, you are a food sector support business such as a packaging manufacturer or logistics provider, or your customer specifically requests ISO 22000. For UK retail supply, standalone ISO 22000 is often not sufficient because the major retailers have embedded BRCGS or FSSC 22000 into their supplier approval processes.
Which UK Industries Feel the Most Pressure to Get ISO 22000 Certified
While no industry is legally compelled to hold ISO 22000, some sectors experience much stronger commercial pressure than others.
Food Manufacturing and Processing
This is where the pressure is highest. If you manufacture or process food products for sale through retail or food service channels, you will almost certainly need some form of GFSI-recognised certification. ISO 22000 or FSSC 22000 will typically be accepted, though as noted above, BRCGS may be specifically required by certain UK retailers.
Food Packaging Manufacturers
Companies that produce primary packaging for food products, meaning packaging that comes into direct contact with food, are increasingly required to demonstrate food safety management. ISO 22000 has good recognition in this sector. BRCGS also publishes a specific standard for packaging manufacturers.
Cold Chain Logistics and Food Storage
Third-party logistics providers handling food products, particularly temperature-controlled storage and distribution, are often required by their food manufacturer clients to demonstrate food safety management. ISO 22000 is applicable to these businesses, and BRCGS also has a specific standard for storage and distribution.
Food Ingredient and Raw Material Suppliers
Suppliers of food ingredients, flavourings, additives, and raw materials to food manufacturers are frequently required to hold GFSI-recognised certification. ISO 22000 is applicable here, and FSSC 22000 has specific sector programmes for food ingredient manufacturers.
Catering and Food Service
Catering businesses and food service operators are less commonly required to hold ISO 22000 certification compared to manufacturers. Legal HACCP compliance and local authority inspections are the primary accountability mechanism for this sector. However, large contract caterers supplying hospitals, schools, or government facilities may be required to demonstrate more formal food safety management as part of tender requirements. If your business is responding to a tender that requires food safety certification, our article on which ISO certification is required for government tenders is worth reading.
The GFSI Recognition Question
Understanding the Global Food Safety Initiative is important for any UK food business navigating certification decisions. GFSI is a non-profit organisation that benchmarks food safety certification schemes against its requirements. Schemes that meet the GFSI benchmark are recognised as equivalent for the purposes of supplier approval by major food companies and retailers that have adopted a GFSI policy.
Both ISO 22000 (when implemented through FSSC 22000) and BRCGS are GFSI recognised. Standalone ISO 22000 certification is not directly GFSI recognised, which is why FSSC 22000 is often the more commercially useful route for food manufacturers who want the ISO 22000 framework but also need GFSI recognition.
If your customer says they require a GFSI-recognised scheme and you are considering ISO 22000, you should clarify with them whether standalone ISO 22000 will be accepted or whether they specifically need FSSC 22000 or BRCGS. This is a conversation worth having before you invest in certification.
Post-Brexit Considerations for UK Food Businesses
Brexit has had some practical implications for UK food businesses, particularly those trading with the European Union. The UK and EU now operate as separate regulatory territories, and businesses exporting food from the UK to the EU must comply with EU food safety import requirements, including having appropriate documentation and in some cases specific certifications.
For food businesses exporting to EU markets, ISO 22000 or FSSC 22000 certification can support market access by demonstrating that your food safety management system meets internationally recognised standards. While the EU does not mandate ISO 22000 for imports, EU buyers and retailers may require it through their own supplier approval processes.
UK businesses importing food from outside the UK also need to ensure their suppliers meet UK food safety standards, and requiring ISO 22000 or a GFSI-recognised scheme from overseas suppliers is a common way to manage this. If traceability across your supply chain is a concern, our complete guide to ISO 22005 traceability in the feed and food chain covers how traceability standards work in practice.
What to Do If a Customer Is Requiring ISO 22000
If you have received a supplier questionnaire, a tender requirement, or a direct request from a customer asking for ISO 22000 certification, here is a practical approach to handling it.
Step 1: Clarify Exactly What They Need
Before you do anything else, go back to the customer and ask specifically whether they will accept standalone ISO 22000, or whether they require FSSC 22000 or BRCGS. Ask whether they have a GFSI policy. Get this in writing. Many businesses have gone through the effort and expense of obtaining one certification only to find out the customer actually needed a different scheme.
Step 2: Assess Your Current State
If you already have a documented HACCP system and food safety management procedures in place, you may be closer to certification readiness than you think. ISO 22000 builds on HACCP principles, so businesses with strong existing food safety practices often find the gap to certification is manageable. Understanding how to document your system properly is a good starting point, and our guide on how to document your ISO 22000 system walks through what is required.
Step 3: Understand the Timeline and Cost
ISO 22000 certification is not a quick process. For a food manufacturing business with no existing formal food safety management system, expect the implementation and certification process to take six to twelve months. Costs vary depending on business size, complexity, and the certification body you choose. Our article on how much ISO 22000 certification costs gives a realistic breakdown of what to budget for.
Step 4: Get Proper Support
ISO 22000 implementation in a food manufacturing environment is genuinely complex. The standard requires a food safety team, a designated food safety team leader, a documented food safety management system, hazard analysis, validation of control measures, and a structured verification and review process. Most businesses benefit significantly from working with a consultant who has food industry experience, not just general ISO experience.
Practical Advice for Small UK Food Businesses
If you are a small food business, the question of whether to pursue ISO 22000 certification is worth thinking through carefully rather than just reacting to a single customer request.
If your market is local or regional, you sell direct to consumers, or your primary accountability is to the local authority environmental health team, ISO 22000 certification may not deliver a return that justifies the investment. Strong HACCP documentation, good hygiene practices, and a good food hygiene rating will serve you better in the short term.
If you have genuine ambitions to supply major retailers, food service operators, or export markets, then investing in FSSC 22000 or BRCGS certification is a strategic decision that will open doors. In that case, the question is not whether to certify, but which scheme to certify against and how to find a certification body and consultant with genuine food industry expertise.
The food industry is one where choosing the wrong certification partner can be particularly costly. A consultant who understands food safety management but has never worked in a food manufacturing environment will struggle to help you build a system that actually works in practice, not just one that looks good on paper.
Finding the Right Support for ISO 22000 in the UK
Whether you are trying to understand which food safety scheme is right for your business, preparing for your first ISO 22000 audit, or looking to transition from standalone ISO 22000 to FSSC 22000, getting quotes from multiple providers before committing is sensible. Pricing, expertise, and service quality vary considerably across the UK certification and consulting market.
CertBetter makes this process straightforward. You submit one form describing your business, your industry, and what you need, and you receive up to three competing quotes from verified ISO consultants and accredited certification bodies. The service is free for businesses seeking certification help, and it is designed to save you the time and frustration of researching and approaching providers individually. If you are a UK food business navigating the ISO 22000 question, it is worth using the platform to understand your options before you commit.
