ISO 22002:2025 Series Update: What Changed in PRP and How to Prepare Your Business

The update of the ISO 22002 series in 2025 has become one of the most notable changes in the area of prerequisite programs (PRP) in recent years. For companies, this is not just new document titles but a revision of the logic behind managing basic food safety conditions. While businesses previously relied on ISO/TS 22002 as separate technical specifications, the market is now transitioning to full international ISO standards with a new modular architecture.

This change matters for business for three reasons. First, approaches are being aligned across different links of the food chain: manufacturing, catering, packaging, logistics, feed, and retail. Second, it becomes easier to build a unified system when a company operates across multiple segments simultaneously. Third, auditing becomes more structured because common requirements are placed in a separate foundational module.

This is precisely why the ISO 22002:2025 update should be viewed as a management project rather than a "one-off" document replacement in the regulatory framework. In Ekontrol's practice, the best results come from companies that shift their focus to real processes from the very first weeks: how PRPs work on the ground, how records are maintained, who is responsible for verification, and how management monitors compliance.

The main event of 2025 is that a number of documents in the series transitioned from ISO/TS status to full ISO status. This is an important signal for the market: PRP requirements are no longer perceived as supplementary or temporary — they form a stable regulatory foundation for food safety management systems.

According to ISO pages, in July 2025 the following were published: ISO 22002-1:2025, ISO 22002-2:2025, ISO 22002-4:2025, ISO 22002-5:2025, ISO 22002-6:2025, ISO 22002-7:2025, and ISO 22002-100:2025. Some of the previous ISO/TS documents received withdrawn (cancelled/replaced) status. For businesses, this means the need to update the applicability matrix, training programs, and internal audit templates.

This change also has direct commercial benefits. When a company demonstrates that it promptly adapts its system to the new edition of requirements, it appears as a more reliable supplier for retail, importers, and certification audits. For the client, this is a sign that the supplier does not operate "on inertia" but keeps the system up to date.

The key idea behind the reform is modularity. The series now includes a foundational document — ISO 22002-100:2025 — with general PRP requirements for the food, feed, and packaging chain. Sector-specific parts detail these requirements for a particular operational context. This approach reduces duplication and makes the requirements structure more logical for implementation and auditing.

What does this mean in practice? If a company has, for example, food production, its own warehouse, and packaging operations, it is easier to build a unified PRP framework based on Part 100 and then add specific sector requirements. Previously, this often required cross-referencing multiple documents with repeating blocks, creating unnecessary complexity.

For internal auditing, modularity is also convenient. The team can separately monitor "baseline" requirements that must be met everywhere and separately — special requirements for a specific operation. This reduces the risk of gaps and facilitates preparation for external ISO 22000 certification or schemes that use PRP as a mandatory foundation.

As of 2025, ISO is publishing updated parts of the series with a clear focus on the type of activity. ISO 22002-1:2025 describes PRP for food manufacturing. ISO 22002-2:2025 covers catering and on-site food services. ISO 22002-4:2025 focuses on the production of packaging for food and feed products. ISO 22002-5:2025 covers transport and storage. ISO 22002-6:2025 — feed and animal feed. ISO 22002-7:2025 — retail and wholesale.

The management value of such a division is obvious: each business can more quickly determine its applicability profile and avoid a situation where the system is overloaded with requirements that do not match its operations. At the same time, it is important to remember that parts of the series are interconnected, and module selection should be made after analyzing the actual process chain, not just by the department name.

In practice, Ekontrol recommends starting with a map of the company's activities: where contamination risks arise, where critical handoffs of responsibility occur, which operations can affect safety and traceability. After that, the applicable set of ISO 22002 parts is determined and a plan is formed to update PRP without unnecessary bureaucracy.

Below is a simplified working map that helps quickly orient your team to the new ISO 22002 series structure and determine where to start the PRP review.

For companies working with ISO 22000 or preparing for FSSC 22000, the update of the ISO 22002 series means a revision of the PRP foundation. The core logic of the food safety management system is not cancelled, but the evidence structure changes: you need to clearly demonstrate how baseline prerequisite programs are aligned with the new documents.

In practical terms, this affects several areas. First, the reference base in internal documents and training materials changes. Second, the internal audit program and verification checklists are updated. Third, supplier requirements are revised if the company outsources packaging, storage, or transportation services.

Commercially, this is also important. During a client audit or certification body assessment, the question about the relevance of the regulatory base comes up as one of the first. If a company shows a structured transition plan to ISO 22002:2025, it reduces audit pressure and accelerates approval from partners. Therefore, updating PRP should be done not "at the last minute" but as a planned stage of system development.

A separate question currently concerning the market is the transition timeline. In communications from relevant ISO committees, it is noted that for these documents, the IAF does not establish an automatic standard transition period as it does for "major" management system standards. This means that specific deadlines are determined by certification scheme owners or other regulatory/contractual mechanisms.

For business, the conclusion is simple: do not wait for a universal date "for everyone" but immediately clarify the requirements with your certification body, key clients, and the industry scheme under which the company operates. Timelines may vary across different supply chains, and a mistake in this area can be costly if discovered only at the audit stage.

In Ekontrol projects, we recommend maintaining a separate transition map: which requirements are already implemented, which are in progress, and which depend on external decisions. Such a map eliminates uncertainty for management and allows resource management without last-minute rushes.

Readiness assessment begins with a brief gap analysis between the current system and the new ISO 22002:2025 structure. At this stage, it is important to evaluate not only documents but also actual operational practices. If a procedure states one approach while the team works differently, this will almost always surface during an audit.

Next, a prioritized list of changes is formed. Critical gaps that could directly affect safety or traceability are addressed first. Then supporting elements are adjusted: record forms, instruction templates, training programs, and service provider contracts. This approach avoids stretching out the project and overloading staff.

After implementing changes, an internal effectiveness review is needed. The team must ensure that new requirements work consistently under normal production loads, not just in "audit mode." This step most often distinguishes a formal update from a truly managed PRP system.

The most common risk is confusing a "series update" with "cosmetic editing." A company changes references in documents but does not restructure its control practices. As a result, until the first serious inspection, the system looks tidy but fails to provide the necessary risk management capability.

The second risk is incorrectly determined applicability of the series parts. For example, a business operates simultaneously in manufacturing and retail but only updates the manufacturing block. In such a case, "blind spots" appear during supply chain and product handoff inspections.

The third risk is weak engagement with staff and suppliers. If training is limited to distributing a new document and partner requirements are not revised, nonconformities accumulate in operations. To avoid this, a brief but regular implementation program is needed: explaining changes, testing understanding, verifying on-site compliance, and taking prompt corrective actions.

During the transition to the new ISO 22002 series, companies often focus only on central procedures, but the real resilience of the system is determined by smaller working documents. If shift checklists, operator instructions, raw material receiving forms, or sanitation inspection logs are not synchronized with the new PRP logic, the system begins to falter at the daily practice level. Therefore, updates should be cascaded: from policies and procedures to workplace tools.

The first step is to review the document hierarchy. The company determines which documents are foundational, which are operational, and which confirm compliance through records. Each document is then checked against three questions: does it align with the new ISO 22002:2025 structure, is it actually used by staff, and does it provide the auditor with clear evidence of control? If even one answer is negative, the document needs to be either reworked or removed to avoid unnecessary formalism.

The second step is updating training programs. For most companies, this block is critical because safety rules are executed by people, not documents. A good practice is to segment training by role. For shift supervisors, deviation management and risk escalation are important. For operators — hygiene, parameter control, and response to non-standard situations. For warehouse and logistics staff — traceability, container condition, and control of storage and transport conditions. For the procurement department — supplier evaluation and quality agreement requirements.

The third step is reviewing supplier interactions. In the new ISO 22002 series architecture, the question of "control handoff" between companies becomes even more important. This means the customer must clearly describe in contracts, specifications, and incoming inspection programs which specific PRP conditions are mandatory for the partner. If the supplier performs critical operations such as packaging or storage, it is advisable to verify not only the partner's documentation but also actual compliance through periodic assessments.

The fourth step is digital discipline of records. At many companies, problems arise not from a lack of control but from incomplete or untimely records. In Ekontrol projects, we recommend establishing simple rules: who fills out the form, at what point in the process, who checks completeness, how corrections are documented, where the document version is stored, and who has the authority to modify the template. This reduces the risk of contradictions during audits and accelerates internal investigations.

The fifth step is regular verification of change effectiveness. After updating documentation and training, it is important not to stop. The system must go through several cycles of practical application with internal monitoring: traceability testing, incident response checks, sanitation program compliance assessment, and analysis of recurring nonconformities. If these cycles produce consistent results, then you can say the transition to ISO 22002:2025 has truly taken place, rather than remaining at the level of a formal update.

For business, this approach has a direct impact: less risk of critical audit findings, faster onboarding of new employees, higher operational predictability, and a stronger position in negotiations with retail chains and international partners. This is why updating documents, training, and supplier management should be planned as a single block rather than three independent tasks.

A working transition scenario typically involves several stages. At the start, management defines the project scope, responsible persons, and target deadlines. Then the team conducts a gap analysis and develops a roadmap. In the third stage, PRPs, procedures, records, and training programs are updated. After that, an internal audit is launched and identified nonconformities are closed. The final stage is preparing the evidence base for an external audit or client inspection.

To avoid stopping operations, changes are best introduced in waves: critical areas first, then lower-priority items. This approach works more reliably than simultaneously "rewriting everything." The team does not lose productivity, and management sees progress at clear checkpoints.

In Ekontrol's service projects, we build the transition exactly this way: short implementation sprints, documenting results after each sprint, and only then moving to the next block. This allows the business to maintain its operational rhythm while simultaneously increasing the maturity of its safety system.

Working sequence to start the transition:

• identify the applicable parts of the ISO 22002 series for your processes;
• close critical PRP gaps before updating secondary blocks;
• verify the results with an internal audit before the external inspection.

The ISO 22002:2025 series update is not a technical formality but an opportunity to elevate the PRP system to a more mature level. The modular architecture with ISO 22002-100 and sector-specific parts gives businesses a convenient framework for managing risks across different links of the food chain. With proper implementation, a company gains not only better audit readiness but also more consistent operational results.

The critical success factor is to act proactively. The sooner a company conducts a gap analysis, updates its PRPs, and trains its team, the lower the cost of "firefighting" nonconformities before an audit. This is especially important for exporters and retail chain suppliers, where system relevance requirements are checked regularly.

If your company needs a practical transition plan, the Ekontrol team can support implementation from diagnostics through to preparing the evidence base for an audit. Ultimately, you get not just updated documents but a working safety system that supports business growth.