ISO 22000 vs FSSAI Licence: What Each One Actually Covers (and Why Exporters Need Both)

A retail chain's vendor form asks for your ISO certificate. You already hold an FSSAI licence, so you type its number into the box and move on. Two days later the buyer writes back: this is not what we asked for, and the certificate still shows as missing. The two documents sound like cousins. They are not, and mixing them up costs food businesses real orders.

The short answer: The FSSAI licence is the law: without it, you cannot legally run a food business in India. ISO 22000 is a voluntary certificate: an accredited auditor checks that your food safety management system actually works the way the standard says. One gives you permission to operate. The other gives buyers a reason to trust how you operate.

What does the FSSAI licence actually cover?

The FSSAI licence is the Indian state's permission to run a food business. Section 31 of the Food Safety and Standards Act, 2006 says it plainly: no person shall start or carry on a food business except under a licence or registration. It is issued by the Food Safety and Standards Authority of India and state food safety authorities through the FoSCoS portal, and it gives your business the 14-digit number you print on labels and display at the premises.

Which tier you need follows your turnover, on thresholds revised from 1 April 2026. Basic Registration covers turnover up to ₹1.5 crore. A State Licence covers above ₹1.5 crore and up to ₹50 crore — applying for the right FSSAI licence tier matters, because trading on the wrong tier is a violation in itself. A Central Licence is required above ₹50 crore, and regardless of turnover for importers, exporters, e-commerce food businesses and operators working across several states. Older guides still quote the pre-2026 limits of ₹12 lakh and ₹20 crore; those no longer apply.

Two more features of the current position catch owners out. First, validity: registrations and licences issued under the amended regulations carry perpetual validity from 2026 — there is no renewal cycle any more. But the annual licence fee and the annual return still have to be paid and filed, and if the fee is not paid the licence is treated as deemed suspended. Perpetual validity removes the expiry date, not the obligations. Second, the penalty for skipping the licence altogether: Section 63 of the Act punishes operating a food business without a licence with imprisonment of up to six months and a fine of up to ₹5 lakh.

What the licence checks, in practice, is whether your business and premises meet the legal conditions for your category — the kind of business, the premises, basic hygiene. It is a permission with conditions, backed by inspections. It does not examine how your food safety system runs on an ordinary working day.

What does ISO 22000 actually cover?

ISO 22000:2018 is a voluntary international standard for a food safety management system — an FSMS. It takes the hygiene basics your licence already expects and organises them into a system: prerequisite programmes (PRPs) for day-to-day hygiene, hazard analysis built on HACCP principles, control points that get monitored and recorded, and a management layer of policies, internal audits, reviews and corrective action around all of it. Schedule 4 of India's own licensing regulations already expects food businesses to work to good manufacturing and hygiene practices, and larger licensees to run an FSMS; ISO 22000 is the organised, auditable way of doing exactly that.

Nobody in government issues it. An accredited certification body — one whose own accreditation you can verify, in India typically through NABCB — audits you in two stages, documents first and then on site, and issues a certificate that runs for three years with an annual surveillance audit. That is what ISO 22000 certification involves when it is done properly.

Think of it the way you think about driving. The FSSAI licence is your driving licence: the state's permission to be on the road at all, and driving without it is an offence however careful a driver you are. ISO 22000 is closer to an independent advanced-driving assessment that a fleet owner asks for before trusting you with their cargo. It says nothing about your legal right to drive. It says a great deal about how you actually drive — and the fleet owner, not the state, is the one asking.

ISO 22000 vs FSSAI licence, side by side

Does ISO 22000 replace the FSSAI licence?

No. This is the single most expensive misunderstanding in this area, so let me be blunt: an ISO 22000 certificate has never licensed anyone to sell food in India, and presenting one to a food safety officer does not answer a missing licence. The licence is a legal permission; the certificate is a voluntary audit result. They sit on different shelves.

The reverse also fails. A valid FSSAI licence does not satisfy a buyer who asked for a certified FSMS, because the buyer is not asking whether the state permits you to operate — they are asking for independent evidence of how you control hazards. Vendor teams verify certificates against the issuing body's register, which is why the mismatch surfaces within days, politely and finally.

Who can stop at the FSSAI licence?

Plenty of businesses, honestly. If you run a home bakery, a cloud kitchen, a restaurant or a packaged brand selling within India, and no buyer, aggregator or tender has asked you for ISO, the licence at the correct tier plus genuine hygiene discipline is the complete legal ground. Swiggy, Zomato and the marketplaces ask for your FSSAI licence number, not an ISO certificate. Money is finite: at that stage, it is usually better spent on the basics the licence expects — water testing, pest control, trained staff, clean records — than on a certificate nobody has demanded.

That answer changes the moment your growth depends on somebody else's vendor list. Which brings us to the businesses that need both.

Who genuinely needs both?

Exporters first, because both gatekeepers stand in their path. To export food from India you need an FSSAI Central Licence regardless of your turnover — that is the legal gate. Then the commercial gate: buyers in the European Union, the United States and the United Kingdom routinely ask for ISO 22000 or an equivalent HACCP-based certification before onboarding a supplier, as the EXIM and certification guides for exporters describe in detail. Hold only the licence and the buyer's quality team stops the onboarding. Hold only the certificate and you cannot legally ship. Exporters need both documents because two different authorities — the Indian state and the foreign buyer — each demand one.

The same logic reaches suppliers to organised retail chains, airlines, railways, large caterers and quick-service restaurant chains, whose vendor audits ask for a certified food safety system, and manufacturers bidding for institutional tenders where ISO 22000 appears as a qualifying condition. If that is your market, treat the two as one project: the records ISO 22000 needs — cleaning logs, supplier checks, batch traceability — are largely the records a serious FSSAI inspection expects too, as I set out in the guide to what ISO 22000 certification costs a food business.

What does each one cost?

The FSSAI side is the cheap side. Government fees are modest: ₹100 a year at registration level, and a few thousand rupees a year for State and Central Licences on the published fee schedules. Professional help, if you use it, is priced per application.

The ISO side is a project, not a form. Our consultancy for ISO 22000 is ₹12,999 for units with up to 25 employees and ₹24,999 for 26 to 100 employees, with the certification body's audit fees extra at actuals — the two-bill structure, the market bands other consultants quote, and a worked three-year illustration are all in the cost guide linked above. Anyone quoting you one small all-in figure for a certificate should be asked one question: which accredited body is issuing it?

Which one should you get first?

The licence. Always. You cannot legally sell a single day of food without it, and the application is quick compared to a certification project. Get the tier right — remember the thresholds moved on 1 April 2026 — and keep the annual fee and return diarised even though the licence no longer expires.

Take up ISO 22000 when one of three triggers fires: a buyer or tender asks for it, an export plan becomes real, or your operation has grown to the point where informal controls — the owner walking the floor — stop being enough. Starting earlier than the trigger is not wrong, but starting before your basic hygiene is in order is: auditors audit the floor you actually run, and paperwork laid over a dirty unit fails at Stage 2.

Unsure which side of that line your business sits on? Run your facts through the compliance fee calculator for the licence side, and talk to us before paying anyone for a certificate a buyer may never verify.

Five mistakes I keep seeing

Sending the licence when ISO was asked for. Different documents, different issuers. The mismatch is found at vendor verification, after you have priced the order.

Buying a cheap certificate for an export buyer. Certificates from unaccredited sellers fail the first check a foreign quality team runs — the accreditation chain. A rejected certificate is worse than none; it tells the buyer you did not know, or hoped they would not check.

Reading "perpetual validity" as "nothing more to pay". The licence no longer expires, but miss the annual fee and it is deemed suspended. Suspended is not a status you want discovered during an inspection.

Staying on Basic Registration after crossing ₹1.5 crore. The 2026 thresholds moved the line a long way up, which helps small businesses — but a unit that has genuinely crossed into State Licence territory and keeps trading on a registration is in violation every day it does so.

Certifying before cleaning. ISO 22000 audits evidence — records over time, controls that visibly run. Three months of honest records beat a beautifully written manual over an unmanaged floor.

Questions food businesses ask us

Is ISO 22000 mandatory for a restaurant or cloud kitchen? No. Your legal requirement is the FSSAI licence at the correct tier. ISO 22000 becomes worth its cost when a corporate catering contract, a mall landlord or an aggregator's premium programme asks for a certified food safety system — until then it is a choice, not a compulsion.

Can I export food with only an FSSAI licence? You need the Central Licence to export legally, whatever your turnover. Most overseas buyers then additionally ask for ISO 22000 or HACCP-based certification before they will buy. Plan for both documents if exporting is the goal.

Does ISO 22000 help during an FSSAI inspection? It is not a legal shield and no officer is obliged to go easier on you. But inspections test exactly what a working FSMS produces — hygiene records, supplier documentation, traceability — so a business running the system tends to face inspections calmly, with the file already in order.

My turnover just crossed ₹1.5 crore. What changes? Your tier. Since 1 April 2026, registration covers turnover up to ₹1.5 crore; above it you need a State Licence (up to ₹50 crore) or a Central Licence. Upgrading late is treated the same as trading on the wrong document, so move as soon as the crossing is clear.

How long does ISO 22000 take, if I decide to go for it? Published guides put a small single-site unit at roughly three to four months from gap assessment to certificate, and mid-sized units at four to six. The variable is rarely the auditor's diary — it is how much of the system already exists in your unit's daily working.