Few label elements are simultaneously as reassuring and as vague as the certification row: GMP · HACCP · ISO 22000:2018. Each term names a real, auditable system — but they operate at different layers, and “GMP” in particular means something materially different for a food supplement than for a medicine. Decoding the stack turns a badge wall into information.
GMP: the manufacturing floor’s constitution
Good Manufacturing Practice is the set of binding rules governing how production actually runs: qualified premises and equipment; documented procedures for every step; trained personnel; supplier qualification and raw-material identity testing; in-process controls; finished-product specifications; batch records that let any unit be reconstructed on paper; hygiene and pest-control regimes; and a complaint-and-recall system. Its philosophical core is that quality is manufactured, not inspected-in: end-product testing alone cannot catch every failure, so the process itself must be controlled and documented at each step. In the EU framework, supplements are food — so their GMP obligations flow from food law (Regulation 852/2004’s hygiene architecture and HACCP duty), elaborated by industry codes; in the US, supplements have their own dedicated GMP rule, 21 CFR Part 111. Either way, an operator claiming GMP is claiming: every batch we make follows written, audited procedures and leaves a complete paper trail.
Not pharmaceutical GMP — an honest distinction
Pharmaceutical GMP is a stricter regime: process validation to tighter tolerances, pharmacopoeial-grade specifications on every input, stability programs determining expiry dating, qualified-person batch release, and inspection by medicines agencies. Food-supplement GMP borrows the architecture — documentation, traceability, controlled processes — with proportionality to food-level risk. Marketing that blurs this (“pharmaceutical-grade facility”) should be read carefully: some supplement plants genuinely operate under drug-GMP licences because they also make medicines, and that is a meaningful statement; the phrase alone, without a licence behind it, is decoration. The precise consumer question is: certified against which standard, audited by whom?
HACCP: the hazard brain inside the system
HACCP is not a separate badge so much as the analytical method GMP-era food safety runs on: identify every biological, chemical and physical hazard along the process; determine the critical control points where those hazards must be controlled; set measurable limits, monitoring, corrective actions, verification and records. We walk through all seven principles applied to a supplement line in our Codex CXC 1-1969 explainer — the code that made HACCP the global default. In the certification stack, HACCP is the layer that answers: where exactly could this product hurt someone, and what is measurably preventing it?
ISO 22000:2018: the management system that makes it durable
ISO 22000 is where the layers integrate into a certifiable whole: a food safety management system (FSMS) combining prerequisite programmes (the GMP/GHP floor: sanitation, maintenance, pest control, supplier control), full HACCP methodology, and — the distinctly ISO contribution — management-system discipline: leadership accountability, defined responsibilities, internal audits, corrective-action loops, documented risk thinking, and continual improvement, aligned since the 2018 revision with the same high-level structure as ISO 9001. Certification is not self-declared: an accredited certification body conducts a two-stage initial audit (documentation review, then on-site verification that practice matches paper), issues a certificate valid for three years, and returns for surveillance audits — typically annually — with full recertification at cycle end. Nonconformities found at any visit must be closed with evidence, or the certificate is suspended. That audit cadence is the practical difference between “we have procedures” and “outsiders regularly verify we follow them.”
Why “EU-manufactured” carries weight
Geography, in this context, is shorthand for enforcement infrastructure: an EU food-business operator is registered with and inspectable by a member-state authority under the 852/2004 hygiene framework, embedded in RASFF’s alert network, subject to the contaminant limits of Regulation 2023/915, and — for supplements — bound by Directive 2002/46/EC’s composition and labelling rules. None of that makes any single factory infallible; it means failures have a supervisory system designed to find them. “EU-manufactured, ISO 22000-certified, with independent batch CoAs” is therefore a three-layer claim — jurisdiction, management system, and product evidence — and it is the combination, not any single badge, that constitutes a serious quality posture.
The clinical bottom line
Read the certification row as a stack: GMP is the disciplined factory floor; HACCP is the hazard analysis running inside it; ISO 22000:2018 is the externally audited management system holding both to schedule, on a three-year certification cycle with annual surveillance. Food-supplement GMP is proportionate to food risk — distinct from pharmaceutical GMP — and jurisdiction adds the enforcement layer. Badges plus batch-level laboratory evidence together tell the full quality story; either alone tells half.
Primary sources
- ISO 22000:2018 — Food safety management systems: requirements
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs (HACCP obligation)
- US 21 CFR Part 111 — cGMP for dietary supplements (comparative reference)
- GMJ: Codex CXC 1-1969 and the seven HACCP principles
Was this article helpful?
Disclaimer. This article is health journalism intended for general information and education. It is not medical advice and is not a substitute for professional diagnosis or treatment. Always consult a qualified healthcare provider about your individual circumstances. Full disclaimer →
Related Coverage
Editorial standards. This article was produced under the GMJ News editorial process, with oversight by the GMJ Editorial Board. Our editorial process. Spotted an error? Contact the editorial team.
