Is GFSI Certification Mandatory to Supply Major Retailers?

The answer fits in one sentence: no in law, yes in practice. No European regulation, no French statute requires a manufacturer to be certified against IFS Food, BRCGS or FSSC 22000. But if you want to be listed by a major retail chain — and even more so to manufacture its private label — the GFSI-recognised certificate is, de facto, the condition of entry. Let us pin down exactly what is mandatory, what is not, and why this legal boundary matters less than commercial reality.

What the law actually requires

Every food business operator, certified or not, is subject to the EU “hygiene package”: food hygiene, traceability, withdrawal and recall, and permanent procedures based on HACCP principles. On top of that, establishments handling products of animal origin destined for other establishments need the agrément sanitaire (French sanitary approval) issued by the authorities — we detail who is concerned in our article on the mandatory agrément sanitaire.

That is the perimeter of the mandatory. The GFSI schemes are not part of it: they are private, voluntary standards, owned by private organisations and audited by accredited certification bodies.

What retailers require in practice

Contractual reality is different. Since the early 2000s, major chains have massively tied supplier listing to private certifications, gathered under the banner of GFSI (Global Food Safety Initiative) — the initiative launched in 2000 by the consumer-goods industry to harmonise food-safety schemes.

This shift is documented in the research: Linda Fulponi’s survey of quality directors at major retailers across OECD countries, published in 2006 in Food Policy (“Private voluntary standards in the food system: The perspective of major food retailers in OECD countries”), already showed that leading retailers regarded third-party-certified private standards as their central tool for managing supplier risk — and expected them to become a generalised condition of market access (see the study). Twenty years on, that is exactly the situation: the requirement has become the norm.

Concretely, three levels of requirement depending on your situation:

Your situation	Typical requirement
Private-label manufacturer	GFSI-recognised certificate required almost systematically, scheme sometimes imposed, minimum grade sometimes specified
Own brand listed through a central buying office	Certificate very frequently required in the listing file or as a condition of staying listed
Local supplier listed directly by stores, regional products	Variable requirement, sometimes lighter — but tightening over time

Why does private label concentrate the requirement? Because the product carries the retailer’s name: in a crisis, it is the retailer’s brand and liability on the line. The GFSI certificate is its upstream insurance policy.

“Voluntary” does not mean “negotiable”

Be clear-eyed about the word “voluntary”. The GFSI requirement is a contract clause: the chain is free to impose it, you are free to decline — and not be listed. In practice the balance of power leaves little room, and the requirement spreads beyond retail: industrial buyers, organised food service and exporters adopt it in turn.

Training providers in France know this mechanism well through Qualiopi: a certification formally tied to a choice (accessing public funding) that became unavoidable for making a living. Here, the “funder” imposing its standard is private: your retail customer. One notable difference: where Qualiopi is a single public framework, retail accepts several equivalent private schemes — IFS Food, BRCGS, FSSC 22000 — thanks to GFSI mutual recognition.

How to meet the requirement without missteps

1. Get the requirement in writing. “GFSI certification” can mean “any recognised scheme” or “IFS Food only, Higher Level preferred”. The specification, and it alone, is authoritative. That is the first step before choosing — our comparison IFS, BRCGS or FSSC 22000: which scheme to choose? then walks through the criteria.

2. Do not aim for the bare minimum. Retailers look at the grade (IFS score, BRCGS grade) and the audit regime. A site scraping the threshold, audited only announced, is fragile the moment the specification tightens.

3. Build on your regulatory base. A solid HACCP, a well-kept sanitary control plan, a properly managed agrément sanitaire: this legal foundation covers part of the road to the scheme. The remaining gap — food defense, food fraud, food-safety culture, infrastructure requirements — is handled as a project.

4. Anticipate the timeline. Between the decision and the certificate come the upgrade work, certification-body availability and the close-out of audit findings. A prospect asking for the certificate “by the next listing review” will not leave you the time to earn it if you start from zero.

Take action

The GFSI requirement is not an option to debate; it is a project to plan. Start by listing exactly what your customers and prospects require, then read our full guide to the GFSI schemes: IFS Food, BRCGS, FSSC 22000 — status, steps, frequent questions and a free ebook to structure your compliance.