What a Salt Certificate Actually Covers

A food safety certificate attaches to one legal entity, one address and one certificate — that is the IFS rulebook’s own wording — together with a named product scope and an expiry date, usually twelve months out. It never attaches to a brand. BRCGS, IFS, SQF and FSSC 22000 are certification programme owners recognised by GFSI; ISO 22000 is a standard and HACCP is a management system, and neither of those last two is a certificate you can hold up. A logo on a website is not a certificate. The certificate is a document with a site address on it.

The schemes, and who owns each one

Five names get used interchangeably in supplier emails. They are not the same kind of thing.

What GFSI actually does, and does not do

The Global Food Safety Initiative certifies nobody. It benchmarks certification programmes against a published set of requirements and recognises the ones that meet them. When a buyer asks whether a supplier is “GFSI certified”, the sentence is wrong but the question is sensible: they are asking whether the supplier holds a certificate from a programme GFSI has recognised.

Here is a detail worth checking rather than assuming. Recognition is granted against a version of the benchmarking requirements. As of September 2026 GFSI lists twelve programme owners recognised against Version 2020, including BRCGS, IFS, SQF and FSSC 22000, and only two — CanadaGAP and Japan’s JFS-C — against the newer Version 2024. So “GFSI-recognised” is not one state. It has a vintage, and that vintage is public.

ISO 22000 is a standard. HACCP is a system. Neither is a certificate.

ISO 22000:2018 is titled Food safety management systems — Requirements for any organization in the food chain. ISO is explicit that using it does not require certification at all: “Certification is not a requirement of ISO 22000 and many organizations benefit from using the standard without seeking certification.” ISO also does not certify anyone; if a company wants a certificate it goes to a third-party certification body. So a supplier can be entirely ISO 22000 compliant and hold no paper at all, and another can hold an ISO 22000 certificate that no GFSI-recognised programme stands behind.

HACCP is further from a certificate again. The FDA defines it as “a management system in which food safety is addressed through the analysis and control of biological, chemical, and physical hazards” across the chain from raw material to consumption, and sets out seven principles, from hazard analysis to record keeping. Every scheme in the table above requires a HACCP plan. None of them is HACCP. When a data sheet lists “HACCP” among certification logos, it is telling you the plant has a plan — which, for anyone selling into a regulated market, is the floor rather than a distinction.

Why “our salt is BRCGS certified” is an incomplete sentence

IFS states the principle more cleanly than anyone: “Certification is always site-specific (one legal entity, one address, one certificate), in relation to the actual processing activities of the site.” The audit scope has to be written out on the certificate and in the report, with product and packaging types described. The certificate then runs for a defined term and is loaded into a public database.

A complete sentence has five parts. The short version has none of them.

• Certificate owner — the legal entity named on the document, which may not be the brand you buy from
• Scheme and version — BRCGS Food Safety Issue 9 is not BRCGS Packaging Materials
• Site address — the plant audited, not the head office and not the second plant
• Product and process scope — the SKUs and activities the auditor actually looked at
• Issue and expiry dates — and the certification body and its accreditation

All of that is checkable without asking the supplier a second question. BRCGS, FSSC and IFS each run a public register of live certificates. If a certificate is real, it is listed. If a PDF arrives and the register has never heard of it, that is the whole answer.

Two worked examples from the salt trade

BRCGS publishes a case study on Cornish Sea Salt. Read the dates in it rather than the grade. The company says it has worked with BRCGS since 2009, with a first score of a B, and that its best result to date is a AA+ on its first unannounced audit. Those are the two ends of a progression spanning fifteen years and many audits, and the case study does not date the AA+ one. Compressed into a single clause — “AA+, up from a B” — it reads as one dramatic jump, which is not what the document says. We had written it that way ourselves before we read it properly.

Now read what the certificate covers. It covers the audited site and the products in scope; the case study describes sea salts, blended sea salts and seasoning blends. It says nothing about where the seawater came from, and it cannot, because a food safety audit is not an origin audit. On origin the company’s own page says only that the salt is “hand-harvested from Grade A waters off the British Cornish coast”. We looked for a company statement of inputs sourced outside Cornwall and found none, and have withdrawn our own earlier working note to that effect in Who Actually Makes Your Sea Salt. A grade and an origin question are two separate conversations. Conflating them is the commonest mistake in this area. Supplying the origin half yourself is worse.

Necton, the Portuguese producer behind Marnoto, states that its salt “meets the requirements of the Halal, Kosher, Organic and BRCGS — Global Food Safety Standard certifications”. Look at the page rather than the sentence. The sentence says “Kosher” and names no certifier; the certifier appears only in the row of marks beneath it, where a Star-K symbol sits alongside a halal mark, an organic mark and the BRCGS mark. A logo is where you have to go to learn who issued it, which is a strange place to look. Four certifications in one sentence, almost certainly all true, and as published unusable: no certificate numbers, no site address, no product list, no expiry dates. We are not picking on Necton — this is what nearly every producer page in the category looks like, ours included. It is the gap between a marketing page and a procurement pack, and the fix is to ask.

Kosher and Halal are issued by bodies, not by governments

Neither is a state licence anywhere in the United States, and neither is a property of a substance. Pure salt is a mineral; nothing in it is kosher or non-kosher in the abstract. What is certified is a plant, a process and a list of products.

The Orthodox Union’s own procedure makes the structure visible: an applicant supplies the products to be certified and their ingredients, a contract covers the requirements, and labels bearing the symbol are submitted for approval before use. The symbol is licensed for approved products, not granted to a company in general. Halal works the same way and has no single federal issuer in the United States either, and importing countries maintain their own lists of which foreign certifiers they accept. That last point is the one exporters learn expensively: a halal certificate that satisfies one market may not satisfy another.

So the questions are identical to the food safety ones. Which body issued it, to which plant, for which products, valid until when.

Traceability is the part nobody asks for

A certificate tells you that a site ran a system on the day it was audited. It tells you nothing about the bag in front of you. The link between the two is the lot code, and the useful test of a supplier is whether a lot code runs backwards to a specific harvest: which pond or pan, which harvest date, which pack date, which analysis. If it does, a recall is a phone call. If it does not, a recall is a guess.

That is also where an origin claim becomes more than a story. Argentina’s sea salt rule, which we covered in Argentina Wrote Sea Salt Into Law in 2024, sets composition limits but creates no seal and no auditor — so what a producer can show you there is a lab analysis against the numbers, tied to a lot. Testing policies work the same way: our piece on microplastics in sea salt is ultimately about which lot was tested, by whom, and against what method.

Where we stand, since we are asking it of everyone else

We hold none of these certificates. Gaucho Provisions is pre-launch, we do not operate a plant, and we will not display a mark we do not hold. What we are pursuing is FDA food facility registration, the baseline obligation for a facility that manufactures, processes, packs or holds food for consumption in the United States, renewed on a two-year cycle. We are not going to put a date on it, because the date is not ours to promise.

The honest position is that a small importer at this stage has documents, not certificates: origin paperwork, lot analyses and a supplier we can name to a regulator. That is less impressive than a wall of logos. It has the advantage of being the thing the logos are supposed to stand for, and it is the approach we take to every number we publish, as in What Is Actually in Maldon.

Two weaknesses in our own position, stated before anyone else states them. First, we have asked our Patagonian producer for the current scope and expiry of its food safety certification and have not yet seen the certificate; until we do, we will describe its status as unverified rather than summarise it. Second, GFSI recognition status and certificate validity both change without notice, so every fact here is dated to September 2026 and should be rechecked against the registers before it is used in a purchasing decision.