The international standard that integrates HACCP into a certifiable management system. For wineries, food manufacturers, cold-chain logistics and HORECA with own production that need a single audited system recognised by customers and public authorities.
ISO 22000:2018 is the Food Safety Management System (FSMS) standard published by the International Organization for Standardization. It replaces the 2005 edition by adopting the High Level Structure (HLS) shared with ISO 9001 and ISO 14001, which makes system integration straightforward. Its core is the HACCP (Hazard Analysis and Critical Control Points) method — mandatory in the EU under Regulation (EC) 852/2004 — elevated into a management framework with a PDCA cycle, management responsibility and periodic review. The certificate is issued by a certification body accredited by ENAC (the Spanish national accreditation body) or the equivalent body in the country of operation; Summum guides the client through the entire implementation process until the third-party audit is successfully passed.
The standard applies to every link in the chain: agricultural and livestock production, processing and packaging, controlled-temperature storage and logistics, wholesale and retail distribution, and HORECA operations with own kitchen production. Its advantage over merely complying with Regulation 852/2004 is that ISO 22000 adds end-to-end documented traceability, critical supplier management, change control and interactive communication between chain links. This makes it the natural starting point for companies that will later need IFS Food or BRC Global Standard, since all three schemes share the HACCP foundation and the concept of Prerequisite Programmes (PRPs).
During implementation we build the system from the initial gap assessment to the audit dossier: we identify biological, chemical, physical and radiological hazards; establish operational PRPs and Critical Control Points (CCPs) with their critical limits, monitoring frequencies and corrective actions; draft the Hazard Analysis and HACCP plan; and train the Food Safety Team required by chapter 7 of the standard. The goal is that the ISO 22000 certificate, issued by a body such as AENOR, Bureau Veritas or SGS, remains sustainable over time and delivers real business value, not just a document on the wall.
We review facilities, product flows and existing documentation. We identify the biological hazards (Listeria, Salmonella, E. coli…), chemical hazards (allergens, pesticides, mycotoxins) and physical hazards relevant to the sector. We assess which Prerequisite Programmes (PRPs) are already in place and which need to be established or strengthened before building the HACCP plan.
We set up the Food Safety Team, draw up on-site verified flow diagrams, determine CCPs and operational PRPs with their critical limits, monitoring frequencies, records and corrective action procedures. We draft the Food Safety Policy, measurable objectives and the interactive communication procedure with suppliers and customers.
We roll out the system together with the client's team: Food Safety Team training on ISO 22000:2018 requirements, operator training on CCP controls and incident recording, and the first real-data recording cycle. We conduct a full internal audit (clause 9.2 of the standard) to identify deviations and close them before the certification audit.
We coordinate with the ENAC-accredited certification body (AENOR, Bureau Veritas, SGS or another of the client's choice) for Stage 1 (document review) and Stage 2 (on-site audit). We prepare the team for interviews, resolve any non-conformities that arise and remain present until the certificate is issued. After certification we support the annual surveillance audits.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Full HACCP plan
Hazard analysis, CCP decision tree, critical limits, monitoring, corrective actions and verification documented in accordance with Codex Alimentarius and Regulation (EC) 852/2004.
Prerequisite Programmes (PRPs)
Design or review of the PRPs required by Annex II of Regulation 852/2004 and clause 8.2 of ISO 22000:2018: cleaning and disinfection, pest control, water, personal hygiene, traceability and allergen management.
Allergen management
Protocol for declaration, segregation and labelling of the 14 allergens subject to mandatory declaration under Regulation (EU) 1169/2011. Review of supplier technical data sheets and cross-contamination risk matrices.
End-to-end traceability
Upstream and downstream traceability procedure with a defined response time. Documented and evaluated product recall simulations in accordance with clause 8.9 of ISO 22000:2018.
Food Safety Team training
Training programme for the Food Safety Team and production staff: practical HACCP, record keeping, response to non-conformities and food safety incident reporting.
Certification audit dossier
System manual, process map, procedures, technical instructions and implementation evidence ready for the Stage 1 and Stage 2 audit by the ENAC-accredited body.
ISO 22000 integrates naturally with IFS Food and BRC Global Standard for companies selling to major retailers, and connects with the ISO 14064 carbon footprint service when the client reports under CSRD or international buyer requirements.
IFS Food v8 and BRC Global Standard v9 are the GFSI schemes required by Mercadona, Carrefour and Tesco. They are built on the same HACCP foundation as ISO 22000; certifying against ISO 22000 first makes the subsequent IFS or BRC audit faster and smoother.
View service → calidadThe food chain is one of the sectors under greatest CSRD and buyer pressure to measure and reduce emissions. We implement ISO 14064 in an integrated way with the FSMS when the client needs to report Scopes 1, 2 and 3.
View service → sistemasThe traceability required by ISO 22000 demands real-time data capture in production and logistics. Summum Sistemas integrates agri-food ERP solutions with food safety management records to eliminate paper and cut recall response times.
View service →It does not replace it — it encompasses it. Regulation (EC) 852/2004 requires all food businesses to implement a HACCP system based on Codex Alimentarius principles. ISO 22000:2018 embeds that HACCP within a broader management system with management responsibility, objectives, indicators, internal audits and continual improvement. Complying with the standard means complying with the legal requirement, but it also gives the client an internationally recognised certificate issued by an ENAC-accredited body.
For small or medium-sized companies with a single production site, the typical process takes between 4 and 7 months: one month for gap assessment and system design, two or three months for implementation and training, and one or two months for the internal audit plus coordination with the certification body. Companies that already have a documented and active HACCP system reduce that timeline because part of the work is already done.
ISO 22000 is an International Organization for Standardization standard, general in scope and applicable to any link in the food chain. IFS Food (promoted by French and German retailers) and BRC Global Standard (promoted by the British Retail Consortium) are private standards recognised by GFSI (Global Food Safety Initiative), more demanding on product and process requirements, and typically required by major European supermarkets. All three share the HACCP foundation; obtaining ISO 22000 first makes the subsequent IFS or BRC audit easier because the documentary system is already built.
The certificate is issued by a certification body accredited by ENAC (Entidad Nacional de Acreditación) in Spain, or by the national accreditation body of the relevant country if the company operates outside Spain. AENOR, Bureau Veritas, SGS, TÜV Rheinland and Lloyd's Register are common examples. Summum guides the entire implementation and audit-preparation process, but the certification decision is taken and the certificate is issued by that independent third party.
Yes. The standard applies to the entire food chain, including wine production. A winery is subject to food hygiene legislation under Regulation 852/2004 from harvest through to bottling. ISO 22000 provides a structure for hygiene controls throughout the process, allergen management (sulphites subject to mandatory declaration), lot traceability and grape supplier qualification, all within a single auditable system compatible with the requirements of international importers.