ISO 22000 vs HACCP: Differences and Who Actually Needs It

It's happening more and more often: a B2B partner - a hotel chain, a catering platform, a large supplier - asks in the partnership form, "do you have ISO 22000 certification?". The owner of a small restaurant hears that and starts wondering whether their existing HACCP documentation even makes sense anymore, or whether they suddenly have to spend several thousand złoty on certification. Usually the answer is simpler than it seems.

This article explains what ISO 22000 is, how it relates to the HACCP system you've probably already implemented, and when certification actually makes sense for a foodservice venue - and when it's an unnecessary cost.

Key takeaways

• ISO 22000 does not replace HACCP - it's an international food safety management system standard that uses HACCP principles as its core and adds management-system requirements (documentation, audits, continuous improvement).

• HACCP is mandatory in Poland for every foodservice business, while ISO 22000 is a voluntary certification, usually required by large B2B partners.

• ISO 22000 certification is a cost and a process - an independent external audit, certification fees, maintaining the system in subsequent years - rarely justified for a single, independent restaurant.

• Interest in the topic is growing - mainly among venues working with chains, franchises and platforms that make certification a condition of the contract.

What ISO 22000 is

ISO 22000 is an international standard developed by the International Organization for Standardization (ISO), describing the requirements for a food safety management system across the entire supply chain - from raw material producers, through processing, to foodservice and retail.

The standard combines two elements:

• HACCP principles - hazard analysis and critical control points, which is what you already know and (mandatorily) apply

• Management system requirements - a food safety policy, management review, internal audits, continuous improvement, similar to the structure of other ISO standards (e.g. ISO 9001 for quality)

An ISO 22000 certificate is issued by an independent certification body after an audit - it's an external, formal confirmation that a company's food safety management system meets the standard's requirements.

HACCP vs ISO 22000 - key differences

Aspect	HACCP	ISO 22000
Legal status in Poland	Mandatory for every foodservice business	Voluntary, certification is optional
What it covers	Hazard analysis, critical control points, procedures and logs	HACCP principles + management system (policy, audits, review, improvement)
Who verifies it	Sanepid (official inspection)	Independent certification body (commercial audit)
Implementation cost	Documentation + in-house implementation	Documentation + certification audit + surveillance audits in later years
Typical party requiring it	Every foodservice venue, by law	Large B2B partners, chains, platforms, tenders

In practice: if you have a solidly implemented HACCP system, you're closer to ISO 22000 than it might seem - the core of the system (hazard analysis, CCPs, procedures, logs) is shared. What's missing is the management-system "layer" and formal certification by an external body.

When ISO 22000 certification makes sense for a foodservice venue

Certification makes sense when:

• a large B2B partner (a hotel chain, a catering platform, a supplier to retail stores) makes it a formal condition of working together

• you're taking part in public or corporate tenders where the certificate is scored or required

• you run production at a larger scale (e.g. a central kitchen supplying several venues or catering operations), where the scale of risk and number of processes justifies a formalised management system

Certification is usually NOT justified for a single, independent restaurant, bar or food truck selling directly to consumers - there, a solidly implemented, documented HACCP system is the sufficient and legally required level.

What to do if a partner asks about ISO 22000 and you don't have it

Before investing in certification, check whether the partner accepts an alternative - many B2B buyers in practice settle for:

1. presenting complete, current HACCP documentation together with a clean Sanepid inspection history

1. filling in the partner's own food safety supplier questionnaire (a supplier audit instead of formal certification)

1. agreeing to a one-off audit carried out by the partner itself or their representative

If certification is a hard, non-negotiable condition, it's worth calculating the real cost (audit, annual fees, preparation time) against the value of the contract - for a large, long-term deal it may pay off, for a one-off collaboration it usually doesn't.

A solid HACCP system as the foundation for any future certification

Regardless of whether ISO 22000 certification is in your plans, a well-documented and genuinely applied HACCP system is always the foundation - both for Sanepid inspections and for any future certification audit. If your documentation is based on random templates found online, it's worth checking that - see what to watch out for in our article on red flags of free HACCP templates, and how to approach writing a HACCP manual step by step.

Where GastroReady fits in

GastroReady's packages give you a solid foundation aligned with HACCP principles - exactly the part shared with ISO 22000 requirements. If your venue never needs formal certification, you still have a complete, legally compliant system. And if you ever decide to pursue ISO 22000, solid HACCP documentation shortens and simplifies the whole process of preparing for the certification audit.

Frequently asked questions

Does ISO 22000 replace the obligation to have HACCP?

No. ISO 22000 uses HACCP principles as its core, but it's a separate, voluntary certification. The obligation to have and apply a HACCP system in Poland comes from the law and applies to every foodservice business, regardless of whether it holds an ISO 22000 certificate.

How much does ISO 22000 certification cost for a small restaurant?

The cost depends on the size and complexity of the business and the certification body chosen, but it usually includes an initial audit, a certification fee, and annual surveillance audits - for a small, independent venue this runs into thousands of złoty per year, rarely justified without a large partner requiring it.

Can a small restaurant without ISO 22000 work with hotel chains or catering platforms?

It depends on the specific partner. Many B2B buyers accept solid HACCP documentation and a clean Sanepid inspection history instead of formal ISO 22000 certification, especially for smaller or one-off contracts.

Does implementing ISO 22000 require different documentation than HACCP?

Partly, yes - besides the hazard analysis and CCPs (shared with HACCP), ISO 22000 additionally requires a food safety policy, management-review documentation, an internal audit plan, and evidence of continuous system improvement.

Who can carry out ISO 22000 certification in Poland?

Certification is carried out by independent, accredited certification bodies operating on the Polish and international market - it's worth checking the requirements of your specific partner if it's them setting the certification condition.