ISO 22000 for Restaurants and Cloud Kitchens: Food Safety Beyond the FSSAI Licence

You already have the FSSAI licence on the wall. The number is on every bill, every aggregator listing, every packet that leaves your kitchen. So when someone says "get ISO 22000", the honest question is: what does it add? A second certificate to frame, or something that actually changes how your kitchen runs?

The short answer: ISO 22000:2018 is a food safety management system for your whole kitchen, not another licence. Your FSSAI licence is the legal permission to operate; ISO 22000 proves, day after day, that food safety is controlled from receiving to the delivery bag. Restaurants and cloud kitchens get it when a buyer, aggregator or franchisor asks for it.

FSSAI vs ISO 22000 — licence and system are different jobs

Think of it like driving. The FSSAI licence is the driving licence. It says you are allowed on the road. ISO 22000 is the maintenance log and the driving habits — the brakes checked, the speed kept, the logbook filled in. The licence says you may drive. The system proves you drive safely every single day.

The FSSAI licence is mandatory under the Food Safety and Standards Act, 2006. Without it you cannot legally run a food business at all, and Section 63 carries a fine of up to ₹5 lakh and six months' imprisonment for operating without one. The 2026 framework, in force since 1 April 2026, sorts you by turnover: Registration up to ₹1.5 crore, State licence from ₹1.5 crore to ₹50 crore, Central licence above ₹50 crore — and the licence is now perpetual, with annual fees still payable.

ISO 22000 is voluntary. Nobody at the FSSAI will ask for it. What it does is give your kitchen a documented system: hazard analysis, prerequisite programmes, control measures, and the records that prove they ran. A buyer who cannot stand in your kitchen and watch you work asks for the certificate instead. That is the whole deal, and it decides whether the certificate is worth your money.

One more thing the two share, which surprises owners: the hygiene foundation is the same. The prerequisite programmes in ISO 22000 for catering — ISO/TS 22002-2 — line up closely with Schedule 4 of the FSSAI regulations, the good manufacturing and hygiene practices your licence already assumes. If your kitchen already follows Schedule 4 properly, you are not starting from zero. You are formalising what you do, and writing down what you now carry in your head.

Who actually asks for it — and when it pays

Nobody buys ISO 22000 for the frame. They buy it because someone on the other side of a deal wants proof. In food service, that someone is usually one of four.

Aggregators. Swiggy and Zomato have increasingly begun asking their cloud-kitchen partners for food safety certification. It is a trend, not a published mandate for every partner, so check your own onboarding terms — but the direction is plain. A cloud kitchen with a certificate clears onboarding faster and gets fewer questions later.

Hotels and institutions. A hotel chain, a hospital, a corporate canteen contract, an airline caterer — these buyers run their own vendor audits, and an ISO 22000 certificate is often the first filter. Without it, your quote may never reach the tasting.

QSR franchisors. If you want to open a branded outlet, the franchisor's operations manual will almost certainly demand a certified food safety system. The brand's name is on the door; they will not risk it on a kitchen they cannot verify.

Retail and export buyers. A restaurant that also sells packaged food — sauces, pickles, ready-to-eat packs — into retail or export meets buyers who ask for ISO 22000 by name. We covered that split in detail in our ISO 22000 vs FSSAI licence guide.

So here is the decision rule. If you run one outlet, serve walk-ins, and nobody in your supply chain has asked for certification, the FSSAI licence plus good hygiene is enough for now. Spend the money on the kitchen, not the certificate. If you are signing up with aggregators as a cloud kitchen, chasing a hotel or institutional contract, franchising, or putting your own brand on retail shelves — get ISO 22000, because the deal will stall without it. And if you plan to grow from one kitchen to three, get it early: a system built into one kitchen copies cleanly. A system bolted onto three kitchens does not.

The kitchen walkthrough — what the auditor actually looks at

Forget the certificate for a minute. Here is what changes inside the kitchen when ISO 22000 lands, in the order the food moves.

Receiving. Every delivery is checked before it enters storage: temperature of chilled items, packaging intact, expiry dates, supplier name recorded. The delivery boy waits while someone signs the receiving log. It takes two minutes. It is also the first thing an auditor asks to see, because a bad batch that enters the store poisons everything after it.

Storage. Raw and cooked kept apart, always. Vegetables above meat, never below. Cold storage holding temperature, checked and logged twice a day. Dry store off the floor, first-in-first-out, labels on everything. The auditor opens your fridge and reads it like a book. A fridge with raw chicken above the curd tells them everything about your system before a single document is opened.

Preparation. Separate boards and knives for raw meat, vegetables and ready-to-eat food — colour-coded if you can manage it. Hands washed between tasks, not just at the start of the shift. This is where most small kitchens leak: one board, one knife, one pair of hands, and the hazard moves from raw to cooked without anyone noticing.

Cooking. Your HACCP plan sets the cooking temperature for each food category, and the person on the line checks it with a probe thermometer and writes the reading down. Not "cooked until done" — a number, a time, a signature. The temperature itself comes from your own HACCP study and the guidance you follow; the standard demands the control, not a particular number.

Cooling and holding. Cooked food that waits — for a buffet, for a delivery slot, for the next order — is where bacteria do their best work. Hot holding stays hot, cold holding stays cold, and the cooling window from cooked to chilled is timed and logged. A cloud kitchen with a 40-minute delivery radius lives or dies on this step.

Service and the delivery handoff. The last control point is the bag. Sealed, labelled with the time it left, handed to the rider with a check. If a customer complains, you can trace that order back to the batch, the cook, the supplier, the receiving log. That traceability — one step back, one step forward — is clause 8.3 of the standard, and it is the difference between a complaint you can answer and a complaint that becomes a rumour.

None of this is exotic. It is the discipline of doing the obvious things every single time, and writing them down so you can prove it. That is what the auditor is really auditing: not the certificate on the wall, but whether the system survives a busy Saturday night.

The menu problem — HACCP by food category, not by recipe

A factory makes the same biscuit every day. A restaurant does not. Your menu has forty dishes, it changes with the season, the chef experiments on Tuesdays, and the specials board changes by the hour. A HACCP plan written recipe by recipe would collapse in a week.

ISO 22000 handles this the sensible way: the hazard study runs by food category, not by individual recipe. Raw meat and poultry is one category. Ready-to-eat salads and cold desserts is another. Baked goods, rice and gravies, dairy — each category gets its own hazard profile, its own critical control points, its own limits. A new dish slots into an existing category, and the controls follow it. The chef keeps the freedom to create; the system keeps the hazards in view.

This is also why the food safety team matters more in a restaurant than in a factory. The standard wants a team that knows the kitchen — the head chef, the person who orders, the person who runs the pass — sitting down together and working through the hazards. A consultant can write the plan, but only the team that cooks the food can say where the real risks sit. If your HACCP plan was written by someone who never stood in your kitchen during service, it is a document, not a system.

Prerequisite programmes in a restaurant kitchen

Before any hazard plan works, the basics have to hold. In ISO 22000 these are the prerequisite programmes — PRPs — and for catering they follow ISO/TS 22002-2. In plain words, they are the thirteen areas that keep the kitchen itself safe: the layout and the flow of people and food, water and utilities, waste handling, equipment maintenance, what you buy and from whom, keeping allergens and foreign bodies out of the wrong dish, cleaning and sanitising, pest control, personal hygiene, rework, warehousing and transport, product information, and food defence.

Three of these bite hardest in a restaurant. Allergen separation — a kitchen that serves nut-free, gluten-free and Jain food from the same pass needs a real separation routine, not a promise. Cleaning and sanitising — the schedule, the chemicals, the contact time, and someone checking it happened. Personal hygiene — and here the FSSAI side helps you directly: under the FOSTAC rules, you need one trained food safety supervisor for every twenty-five food handlers. That supervisor is usually the person who makes your PRPs real.

The hygiene rating scheme is the public face of the same discipline: one to five smileys, from Fair up to Excellent, displayed where customers can see it. A restaurant with a strong PRP routine tends to score well; a restaurant that treats hygiene as a pre-inspection tidy-up does not. The rating is voluntary to display, but aggregators and customers increasingly look for it.

The cloud-kitchen case — many brands, one kitchen, one certificate

A cloud kitchen is the hardest test of this system, and the best argument for it. Five brands, one kitchen, no dine-in, every order leaving in a bag. The questions owners ask are always the same, so here are the answers.

One kitchen, one licence. The FSSAI licence belongs to the premises, not the brand. One kitchen holds one licence, and every virtual brand cooking there shares that licence number. The same logic holds for ISO 22000: one kitchen, one scope, one certificate — and the scope names every brand and every food category the kitchen produces. You do not certify five brands separately. You certify the kitchen, and the brands sit inside its scope. We walked through the licence side of this in our FSSAI licence for cloud kitchens guide.

The aggregator question. Since the brands share a kitchen, they also share the hazards — one receiving dock, one cold room, one set of hands. The auditor checks the kitchen, not the brand logos. And because delivery is the only channel, the handoff controls matter more than in a dine-in restaurant: sealed bags, time stamps, temperature at dispatch. Get this right and the certificate covers all five brands at once. Get it wrong and one brand's complaint becomes all five brands' problem.

One extra trap: a cloud kitchen that adds a brand serving a new food category — say, moving from biryani to sushi — has changed its scope. The hazard study needs updating, the category controls need adding, and the certification body needs to know. Tell them before the audit, not during it.

What documents a restaurant actually needs

The full list is in our ISO 22000 documents checklist, but the short version for a restaurant is this: the scope of your system, your food safety policy and objectives, the prerequisite programmes, product and process descriptions, a confirmed flow diagram of your kitchen, the hazard assessment method, and the hazard control plan. Then the records that prove it ran — temperature logs, receiving logs, cleaning schedules, training records, calibration of your thermometers, and the traceability records for every batch.

Two points owners get wrong. First, a food safety manual is not mandatory — the standard asks for documented information, and a manual is simply the practical way to hold it. Second, there is no fixed document count. A single-kitchen restaurant usually lands around fifteen to thirty documents and records in total. A vendor selling a 108-document kit is selling a product, not a requirement.

What it costs, and how long it takes

Our consultancy for ISO 22000 runs at ₹12,999 for the Standard package and ₹24,999 for Growth, for a single site. Certification-body audit fees sit on top of that, charged at actuals — no certification body publishes a fixed tariff, so get the written quote before you commit and make sure it covers both audit stages, the annual surveillance audits, and the three-year recertification cycle. The certificate itself is valid for three years, with a surveillance audit every year.

Time, honestly: a single kitchen that already follows FSSAI Schedule 4 properly usually takes three to four months from gap analysis to certificate. A multi-outlet operation or a kitchen building its hygiene routines from scratch takes four to six months. Anyone promising a certificate in two weeks is selling paper, not a system — and a certificate that collapses at the first surveillance audit costs more than the one that took four months.

For the full cost picture, including the audit fees your certification body will quote, start with our ISO 22000 certification page, or run your numbers through the compliance fee calculator.

Ready for audit? A ten-point check

Run through this the week before your auditor arrives. If you can answer yes to all ten, you are ready.

1. Your FSSAI licence is current, and the number on the licence matches the number on your bills and listings.
2. Your food safety policy is signed, displayed, and understood by the team — not just filed.
3. Your flow diagram matches the kitchen as it actually runs, and you have walked it with the team.
4. Temperature logs exist for receiving, cold storage, cooking and holding — filled in daily, not backfilled.
5. Your probe thermometer is calibrated, and the calibration record exists.
6. Allergen separation has a written routine, and the team can explain it without prompting.
7. Your FOSTAC-trained supervisor is on the roster, and training records exist for the rest of the team.
8. Cleaning schedules are signed off daily, and pest control visits are recorded.
9. You can trace one dish from a customer complaint back to the supplier, the batch and the cook.
10. Your last internal audit and management review are documented, with corrective actions closed — not just noted.

Five mistakes restaurants keep making

Treating the certificate as the goal. The certificate is the receipt. The system is the purchase. A kitchen that buys the certificate and drops the system fails its first surveillance audit, and the money is gone either way.

Writing the HACCP plan without the chef. A plan written in an office, by someone who has never worked a service, reads beautifully and fails on the first busy night. The chef must be in the room when the hazards are mapped.

One board, one knife, one pair of hands. Cross-contamination is the most common finding in food-service audits, and the cheapest to fix. Separate the tools, separate the boards, wash between tasks.

Backfilling logs. An auditor can tell a log filled in on Friday for the whole week. The handwriting changes, the numbers are too neat, the gaps vanish. A missing entry is a minor finding. A fabricated log is a trust problem, and trust is the whole audit.

Forgetting the delivery bag. Dine-in restaurants control the plate to the table. Cloud kitchens lose control at the door. If your system stops at the pass, the last mile — the rider, the bag, the time — is uncontrolled, and that is where your food spends its riskiest minutes.

Frequently asked questions

Is ISO 22000 required for restaurants in India?
No. The FSSAI licence is the legal requirement under the Food Safety and Standards Act, 2006. ISO 22000 is voluntary. Restaurants get it because a buyer, aggregator, hotel, franchisor or export customer asks for it — or because they want one system that holds a growing operation together. If nobody in your chain has asked for it, the licence plus good hygiene is enough for now.

Can a cloud kitchen get ISO 22000 certified?
Yes. One kitchen, one scope, one certificate — and the scope names every brand and food category the kitchen produces. The licence belongs to the premises, so all virtual brands cooking there share the kitchen's FSSAI licence number, and the same logic carries into ISO 22000. If you add a brand in a new food category, update the hazard study and tell your certification body before the audit.

What does an ISO 22000 auditor check in a restaurant?
The food's whole journey: receiving checks and logs, storage separation and temperatures, preparation hygiene, cooking controls with probe-thermometer readings, cooling and holding discipline, allergen separation, cleaning and pest control records, and the delivery handoff. Then the documents — scope, policy, PRPs, flow diagram, hazard control plan — and the records that prove they ran.

How much does ISO 22000 cost for a restaurant?
Our consultancy is ₹12,999 for the Standard package and ₹24,999 for Growth, for a single site. Certification-body audit fees are extra, charged at actuals — get the written quote before you commit. A single kitchen usually takes three to four months from gap analysis to certificate; a multi-outlet operation takes four to six.

Does ISO 22000 replace the FSSAI licence, and what about FSSC 22000?
No — your FSSAI licence stays mandatory, and ISO 22000 does not replace it. The two do different jobs: the licence is permission to operate, the system is proof that food safety is controlled daily. FSSC 22000 is a separate, GFSI-recognised scheme built on ISO 22000 plus sector PRPs and extra scheme requirements — the route most large retail and export buyers ask for by name. We compare the two in the next post in this series.

The licence gets you on the road. The system keeps you safe on it, every service, every delivery, every Saturday night. If your kitchen is growing — more brands, more outlets, bigger buyers — build the system now, while one kitchen is still easy to hold in your hands. If you want help turning your kitchen's real routines into a system that survives an audit, start with our ISO 22000 certification page, or check the FSSAI licence guide for restaurants and cafés to make sure the licence side is solid first.