Food Safety Certifications for Buying and Exporting Food From India

Retail food buyers rarely ask whether a factory is safe. They ask which scheme it holds. That's the whole commercial logic of food safety certificates, and it's why an Indian cashew processor with a spotless HACCP plan can still lose a retail contract to a smaller plant down the road that holds BRCGS.

This guide is part of our certifications hub. It covers the factory-level food safety schemes. Testing a lot before it ships is a different job, and it has its own guide on food import testing.

1. Five Names That Mean Three Different Things

The confusion starts because the five names sit on different levels.

HACCP (Hazard Analysis and Critical Control Point) is a method. You list the hazards at each step, find the points where you can control them, set limits and keep records. It comes from the Codex Alimentarius general principles of food hygiene, and every serious scheme below has HACCP inside it. A "HACCP certificate" is a certificate that someone audited that plan, and its weight depends entirely on who did the audit.

ISO 22000 is a food safety management system standard. It wraps HACCP in a management system (policy, records, internal audit, management review). On its own it is not on the GFSI list.

BRCGS Food Safety, IFS Food and FSSC 22000 are the certification schemes. Each one is owned by a scheme owner that sets the rules, approves the certification bodies and runs a public database. FSSC 22000 is built from ISO 22000 plus sector prerequisite programmes from the ISO 22002 series plus its own extra requirements, which is why a plant with ISO 22000 can upgrade to FSSC 22000 without starting over (FSSC scheme page, read 17 Oct 2026).

2. What GFSI Recognition Actually Means

GFSI, the Global Food Safety Initiative, doesn't certify anyone. It benchmarks the schemes. A scheme owner that passes the benchmark gets recognised, and retailers that sign up to the idea agree to accept any recognised scheme instead of sending their own auditors. GFSI calls it "once certified, accepted everywhere" (GFSI recognition page, read 17 Oct 2026).

When I read the GFSI list on 17 October 2026, the schemes recognised against its 2020 requirements included BRCGS (Food Safety issue 9, Packaging Materials issue 6, Agents and Brokers, Storage and Distribution), FSSC 22000 version 6, IFS Food version 8, SQF, PrimusGFS, GLOBALG.A.P., the Global Seafood Alliance processing standard and JFS-C, with CanadaGAP and JFS-C already recognised against the 2024 version. Each recognition covers named scopes, so a scheme can be recognised for processing but not for farming.

So when your customer writes "GFSI certified supplier" in a contract, it means one of those schemes, at the version on the list, covering the right scope.

3. Which Certificate Your Market Usually Wants

None of these is a legal border requirement in the EU, UK, US, Australia, New Zealand or the UAE. The border wants registration and clean goods. It is the customer who wants the certificate.

• UK retail and foodservice mostly ask for BRCGS. It began as the British Retail Consortium standard.
• German, French and Italian retail lean towards IFS Food.
• US retail and big food brands accept SQF, BRCGS or FSSC 22000, and many name all three.
• Ingredient buyers and multinational brands often prefer FSSC 22000 because it maps onto their own ISO systems.
• Australia, New Zealand and the Gulf follow whichever scheme the retail or brand customer specifies. Ask them before you ask the supplier.

The US has its own layer on top. Under the FSVP rule an importer has to verify the foreign supplier, and an audit report is one way to do it. A certificate helps, but the FDA does not treat it as proof. Our data shows why that matters for India - 295 Indian firms sat on the US Salmonella red list (Import Alert 99-19) on 23 September 2026, about a quarter of the whole list (our count from FDA pages). Some of those firms held certificates. A certificate is a yearly audit of a system, and Salmonella lives in a lot.

4. What an Importer Should Check

Here is the check I'd run before a first order. It takes about fifteen minutes.

Step 1 - Ask for the certificate and the latest audit report. The certificate is a single page. The audit report shows the grade, the non-conformities and how they were closed. A supplier who sends the certificate but refuses the report is telling you something.

Step 2 - Find it in the scheme owner's database. BRCGS has its public Directory, IFS has the IFS Database, and FSSC 22000 has a Public Register of certified organisations (FSSC scheme page). Search by company name or certificate number. If it isn't there, treat the PDF as unproven, whatever the logo says.

Step 3 - Read the scope line word by word. It names the site address and the products, such as "sorting, grading and packing of cashew kernels". Your product has to be inside it, made at that address. Multi-site groups often certify one plant and quote the certificate for all of them.

Step 4 - Check the dates and the audit type. All three schemes audit every year. IFS requires at least one audit in every three to be unannounced (IFS Food page). BRCGS shows an unannounced audit with a "+" on the grade. An unannounced audit is a better signal than a bigger grade.

Step 5 - Check the certification body. It should be accredited for that scheme by a national accreditation body (UKAS, DAkkS, ANAB, or NABCB in India). If the certifier's name means nothing to you then look it up in the scheme owner's list of approved bodies.

Red flags

• The certificate says "HACCP certified" and the issuer is a company you can't find on any accreditation register.
• ISO 22000 offered when your customer asked for GFSI.
• The scope covers "food products" with no product named.
• The grade is low and the audit report is "not available".
• A trader holds the certificate but the goods come from a plant that doesn't. Trading is a normal model, and many good traders exist, but the certificate that matters is the one on the plant that makes it. BRCGS has a separate Agents and Brokers standard for exactly this case.

When to ask

Ask for the certificate before samples, and the audit report before a price. Once a purchase order is signed, it's hard to walk away over a scope line.

5. What a Certificate Does Not Prove

It doesn't prove your lot is safe. It doesn't prove pesticide residues meet your border's limits, which is the EU's biggest reason for rejecting Indian food. It doesn't cover allergen labelling for your market unless you have checked the label. And it doesn't stop a plant from changing its raw material supplier the week after the audit.

That's why serious buyers pair the certificate with lot testing in a lab they choose. The method is in our food import testing guide, and for shrimp and other seafood the separate seafood marks are in MSC and ASC seafood.

6. How an Indian Exporter Gets One

This half is for the Indian food business. The order below works for BRCGS, IFS and FSSC 22000, with the differences noted.

Who is involved in India

There is no Indian government issuer for these schemes. The scheme owner (BRCGS, IFS or FSSC) sets the standard. A certification body approved by that owner does the audit. NABCB, the accreditation board under the Quality Council of India, accredits certification bodies in India to ISO/IEC 17021-1 (management systems) and ISO/IEC 17065 (products), and it is a member of the international accreditation network (NABCB home page, read 17 Oct 2026). Your FSSAI licence is a separate legal requirement and has to be in place first.

Before you start

You need a valid FSSAI central licence for export, a building where raw and finished goods are separated, pest control on contract, potable water tested, and someone on staff who will own the system. If the building fails on layout, fix that first. No auditor can certify a plant where raw cashew and packed kernels cross in the same corridor.

The steps

Step 1 - Pick the scheme your buyer names. Ask the buyer in writing which scheme and which scope they accept. Don't guess. A plant selling to a UK retailer and a German discounter may need both BRCGS and IFS. This takes a day.

Step 2 - Buy the standard and run a gap analysis. Download the standard from the scheme owner's site and score your plant against every clause. Expect two to four weeks for this.

Step 3 - Build the system. That means the HACCP plan per product line, prerequisite programmes (cleaning, pest control, glass and brittle plastic, allergens, water, maintenance), traceability, supplier approval, a food defence and food fraud assessment, a food safety culture plan, internal audits and a management review. For most plants this is the long part, about two to four months.

Step 4 - Run it for real and keep the records. Auditors want to see the system working, usually with at least two to three months of records. A system written in a week shows.

Step 5 - Choose a certification body and book the audit. Pick one approved by the scheme owner for your food category. Ask whether its auditors are approved for your category, and check the current audit fee with each body yourself. Booking lead time is usually a few weeks.

Step 6 - The certification audit. One to three days on site depending on size and lines. The auditor raises non-conformities by severity. Major or critical ones can stop certification.

Step 7 - Close the non-conformities. You send evidence of the fix within the deadline your scheme sets (check it in the scheme document, it is usually a few weeks). Then the body's technical review decides and the certificate is issued. Expect the certificate four to eight weeks after the audit.

Step 8 - Get listed. Make sure the certificate appears in the scheme owner's database and tell your buyer the certificate number. Buyers will search for it.

Validity and renewal

All three schemes audit every year. IFS Food makes one in three audits unannounced, and BRCGS and FSSC 22000 have unannounced options or requirements of their own (check the current rule in your scheme document). Miss the audit window and the certificate lapses, and buyers' systems flag it automatically.

Common reasons plants fail or lose the certificate

• Traceability tests that can't trace a lot back to the raw material within the time the standard allows.
• Pest control records that don't match what the auditor sees.
• Allergen controls missing in plants that handle sesame, peanuts or tree nuts.
• Water testing reports out of date.
• A HACCP plan that names hazards but not the critical limits.
• The scope on the application doesn't match what the plant actually makes.

What to send the buyer

The certificate, the latest audit report with the non-conformities closed, the certificate number for the database, and your FSSAI licence. For US buyers, add your FDA food facility registration (see FDA food facility registration).

The work in steps 2 to 7 is heavy for a small plant. If you'd like someone to manage the readiness work and the audit day, SourcingSync (opens in a new tab) does that for Indian exporters.

7. A Worked Example With Cashew Kernels for a UK Retailer

This example is an illustration built from the rules above, not a real firm.

Say you're a UK importer buying cashew kernels from a processor in Kollam or Mangaluru for a private label line. Your retailer's code of practice says "BRCGS grade A or above, or equivalent GFSI scheme".

The processor sends an ISO 22000 certificate. That fails the retailer's rule, even if the plant is good. You ask whether they hold BRCGS, and they say a sister unit does. You search the BRCGS Directory and find the sister unit, scope "grading and packing of cashew kernels", grade A, last audit unannounced. That's the plant you contract with, and the purchase order names its address.

Then you still test the first three lots for Salmonella and aflatoxin in a lab you choose, because the certificate covers the system and the lab covers the lot.

8. Frequently Asked Questions

Is HACCP enough to export food from India? For the border, the legal floor in most markets is a hazard control plan, which HACCP satisfies. For retail customers, usually not. They ask for a GFSI scheme.

Is FSSC 22000 better than BRCGS? Neither is better. They're recognised as equal by GFSI. Pick the one your customer names.

Can a trader hold a food safety certificate? Yes. BRCGS has an Agents and Brokers standard and IFS has IFS Broker. But you still want to see the plant's certificate.

Does FSSAI recognise these certificates? FSSAI licensing is a separate legal requirement. Holding BRCGS doesn't replace an FSSAI licence. Check the current FSSAI rules for audits on the FSSAI portal.

How do I know which version a certificate is on? It's printed on the certificate (for example "Issue 9" or "Version 6"). If your customer asks for a version that is newer, check the scheme owner's transition dates.

9. Next Steps

• See all certificate guides in the certifications hub.
• Test the lot as well as the plant with food import testing.
• Check a US-bound supplier against FDA import alerts.
• Register for the US with FDA food facility registration.
• For organic, halal or kosher claims on top, see organic certification, halal certification and kosher certification.
• For factory management systems outside food, see ISO 9001 and management system certificates.