Is ISO 22000 certification mandatory for food businesses?

It is one of the questions food business owners ask most: do you need ISO 22000 certification to operate? The legal answer is clear: no. But it deserves a fuller picture, because commercial practice tells another story — and confusing regulatory obligations with customer requirements costs dearly the businesses that mix them up.

What the law actually requires

No French or European text makes ISO 22000 certification mandatory. What regulation does impose is a baseline of food safety control, with or without a certificate:

• the EU “hygiene package”, including Regulation (EC) No 852/2004: food hygiene, and permanent procedures based on HACCP principles for every food business operator;
• the PMS (plan de maîtrise sanitaire, the sanitary control plan), which in France gathers good hygiene practices, HACCP and traceability — detailed on our HACCP and PMS page;
• the sanitary approval (agrément sanitaire) for establishments preparing or processing products of animal origin and delivering them to other establishments;
• the food-hygiene training required in commercial catering — see our food hygiene training page.

These obligations are enforced by the French authorities (DDPP), which never ask for an ISO certificate: they check your practices and your records. A business with no certification but an impeccable PMS is fully compliant; a certified business whose practices have drifted is not — the certificate creates no immunity, and the two registers remain legally separate.

Where “voluntary” does not mean “optional”

ISO 22000 is thus a voluntary scheme. But in some commercial relationships it becomes a de facto requirement:

• industrial buyers: many impose third-party certification of food safety control on their suppliers, to replace or lighten their own supplier audits;
• contract catering and public tenders: certification serves as standardised evidence in bid files;
• exports: an international certificate speaks to buyers who know neither the PMS nor the DDPP;
• major retail: the topic then shifts to GFSI-recognised schemes (IFS, BRCGS, FSSC 22000), most often required for listing, especially under private label — see our GFSI-recognised schemes page.

Research confirms this mechanism: the study by Lena Mensah and Denyse Julien, published in 2011 in Food Control from a survey of UK agri-food businesses, shows that compliance is organised around a triptych — regulation, customer requirements and private certification standards — with commercial requirements often weighing as heavily as the law in business decisions (see the study).

The summary table

Requirement	Status	Who enforces it
Hygiene and HACCP (EU hygiene package, PMS)	Mandatory	DDPP (French state services)
Sanitary approval (animal-origin products delivered to other establishments)	Mandatory	Prefect / DDPP
Food-hygiene training in commercial catering	Mandatory	State services
ISO 22000 certification	Voluntary	Accredited certification body, at your request
GFSI-recognised schemes (IFS, BRCGS, FSSC 22000)	Voluntary in law, often required by contract	Accredited certification bodies

Three special cases that fuel the confusion

Small food-trade businesses. A caterer, bakery or butcher is fully subject to the hygiene package and the PMS, but ISO 22000 certification generally only makes sense for them when they supply professionals — institutions, resellers — who request it. For a retail clientele, the investment is rarely justified: the priority is an impeccable PMS.

Public contract-catering tenders. Public buyers cannot require what the law does not, but they can value certification in their selection criteria. An ISO 22000 certificate then acts as standardised proof of food safety control — not a legal prerequisite, but weight in the score.

Organisations that train in food safety. Mind the change of register: ISO 22000 certifies a food business’s management system, not a training activity. A provider delivering food-hygiene courses and seeking French public funding (CPF, OPCO) falls under Qualiopi certification — an entirely different scheme, detailed in our guide to the 32 indicators.

How to decide, concretely

Ask yourself three questions, in order:

1. Is my regulatory baseline beyond reproach? If the PMS is incomplete or dormant, that is the absolute priority — no certification will offset a regulatory nonconformity, and the inspection will not wait for your audit.
2. Who is asking me for what? Re-read your customers’ and prospects’ specifications: some require ISO 22000, others a GFSI scheme, others settle for an audit. Launching a certification without checking the expected standard is the sector’s most expensive mistake.
3. What is the cost/stake ratio? The project has a real cost — audit, annual surveillance, internal time — to set against the markets it opens or secures. Our article on the ISO 22000 certification budget details the lines, and our step-by-step guide the full process.

Take action

Before any decision, take stock on the ISO 22000 certification page: the scheme’s exact status, process, three-year cycle and a free ebook. You will quickly know whether certification is a sound investment for your markets — or whether your priority lies elsewhere.