GFSI Certification for Folding Carton Plants: A Guide

Not every folding carton touches the food that ends up inside it. Cereal usually ships in an inner liner, so the carton is secondary packaging, one step removed. Run cartons for popcorn, pizza, baked goods, or quick-serve food, though, and the paperboard becomes the only barrier between the fiber, the ink, and the product itself. That distinction, direct contact or not, is the first thing a GFSI-recognized standard asks a folding carton plant to demonstrate it understands.

I get some version of the same call every quarter from a packaging converter: a major brand owner's supplier-approval team has sent a letter requiring GFSI-recognized certification within twelve months, and the plant manager is holding a copy of a food safety standard that was clearly written for a cannery. This article walks through what GFSI certification actually requires of a folding carton plant, which of the three eligible standards fits your operation, and what the audit will actually look at once the paperboard hits your presses.

What GFSI Certification Actually Means for a Packaging Plant

The Global Food Safety Initiative doesn't certify anyone. GFSI is a benchmarking body: it evaluates food safety certification programs against its own set of requirements and publishes a list of schemes that meet the bar. A folding carton plant becomes "GFSI certified" by achieving certification to one of those recognized schemes, not by applying to GFSI directly. That distinction trips up a lot of first-time applicants who spend weeks looking for a GFSI application portal that doesn't exist.

For food manufacturers, the GFSI-recognized options are broad. For packaging manufacturers, the field narrows to three schemes that were purpose-built, or substantially adapted, for converters: the BRCGS Global Standard for Packaging Materials, FSSC 22000 under its packaging manufacturing scope, and the SQF Food Safety Code for the Manufacture of Packaging. All three sit on the same underlying logic as food safety standards, a documented management system, a hazard and risk analysis, prerequisite programs, and third-party audit, but the hazards they ask you to control are specific to converting paperboard, applying ink and coatings, and shipping finished cartons into a food supply chain.

The Three GFSI-Recognized Paths for Folding Carton Manufacturers

BRCGS Packaging Materials

The BRCGS Global Standard for Packaging Materials is the most common route for folding carton and corrugated converters supplying European and UK retailers, and it's increasingly requested by U.S. brand owners too. Issue 6, published in August 2019, restructured the standard around the same seven-section format used across the BRCGS family:

• Senior management commitment
• A hazard and risk management system
• A packaging safety and quality management system
• Site standards
• Product control
• Process control
• Personnel

Clause 1.1 requires documented, visible commitment from the site's most senior operations manager, not delegated to a QA coordinator, and auditors will ask that person direct questions during the opening meeting to confirm it.

FSSC 22000 for Packaging

FSSC 22000 builds its packaging scope on ISO 22000:2018 plus a sector-specific prerequisite program, ISO/TS 22002-4:2013, which was written specifically for packaging manufacturing rather than adapted from a food-processing PRP. Version 6 of FSSC 22000 launched in April 2023, with full transition of existing certificates required by March 31, 2025. Because FSSC 22000 is built on a management-systems standard, plants that already hold ISO 9001 tend to find the documentation architecture more familiar than the BRCGS checklist format.

SQF Food Safety Code for the Manufacture of Packaging

SQFI publishes a distinct code for packaging manufacturers, separate from its food manufacturing and storage-and-distribution codes. Edition 9, released in 2020, rates certified sites as Excellent, Good, or Compliant depending on audit score rather than issuing a certificate with no differentiation. SQF tends to show up as the requested standard when a folding carton plant's largest customer is a North American retailer or foodservice brand that already requires SQF certification of its own manufacturing sites and wants supply chain consistency.

None of the three is objectively "harder." I've seen carton plants pass a BRCGS audit with a AA grade and stumble on FSSC 22000's ISO 22000 documentation clauses in the same year, because the systems ask for different things in different order. The right choice is almost always dictated by what your largest customer's supplier-approval team names in the letter, not by which standard is easiest to implement.

What Auditors Actually Look At Inside a Carton Plant

Hazard and Risk Analysis, Not a Copy-Pasted HACCP Plan

A folding carton plant doesn't have microbiological cook steps, chill chains, or allergen cross-contact in the way a food manufacturer does, so a hazard analysis borrowed from a bakery client and relabeled won't survive an audit. The real question a packaging hazard and risk analysis has to answer is narrower: what can this carton do to the food once it's filled? That generally comes down to three categories: physical contamination (fiber dust, staples, metal fragments shed from die-cutting or stitching tools), chemical migration (inks, adhesives, coatings, and mineral oil hydrocarbons from recycled fiber transferring into the food), and information failure (the wrong carton, the wrong allergen statement, or an outdated dieline going out with a shipment). Every clause in BRCGS Packaging Materials, ISO/TS 22002-4, and the SQF packaging code traces back to controlling one of those three failure modes.

Ink, Coating, and Migration Control

This is where folding carton audits diverge hardest from food manufacturing audits, and where I see the most first-time nonconformities. EFSA's 2012 scientific opinion on mineral oil hydrocarbons flagged migration of MOSH and MOAH compounds from recycled paperboard and printing inks into food as a genuine safety concern, and that finding is now baked into how European retailers specify functional barriers for recycled-content cartons. Under the EU's foundational food contact materials regulation, (EC) No. 1935/2004, Article 3 requires that materials not transfer their constituents to food in quantities that could endanger human health. Regulation (EC) No. 2023/2006 separately sets the good manufacturing practice expectations that inspectors and auditors both reference when they review your ink approval records. A carton plant preparing for certification needs three things in place:

• A documented approval process for every ink, adhesive, varnish, and coating used on food-contact stock
• Migration or extraction testing data where recycled fiber or UV-curable inks are involved
• A written functional-barrier justification anywhere direct food contact isn't achieved through the substrate alone

Hygienic Design and Foreign Material Control

Glass and brittle plastic policies, usually associated with food plants, still apply to a converting facility, because light fittings, sight glasses, and gauge covers exist on a press floor too. What's different is where the physical hazards actually originate: die-cutting blades, stitching wire, glue-gun nozzles, and pallet-wrap equipment shed metal and plastic fragments far more often than any raw material does. Auditors will want a documented foreign material control program that covers tool inspection frequency, a metal-detectable or color-coded policy for maintenance items used near open board, and a glass and brittle plastic register that's actually walked and verified, not just filed.

Prerequisite Programs and Site Standards

ISO/TS 22002-4:2013 and the equivalent BRCGS and SQF site-standard sections cover the same ground you'd expect from any GMP-based prerequisite program: building and equipment layout, utilities, waste management, pest control, cleaning, and personnel hygiene, adjusted for a converting environment. Pest control deserves specific attention here: paperboard warehouses draw different pests than food warehouses, particularly psocids and silverfish that feed on paper fiber and starch-based adhesives, and a pest control program copied from a food client's contract won't name them. EN 15593:2008, a European standard on hygiene management in packaging production for food contact materials, is worth reviewing even for U.S. plants, because several BRCGS and FSSC auditors use it as a reference point for what a mature hygiene program looks like.

Traceability and Mock Recall

Every one of the three schemes requires a traceability system that can move in both directions, backward from a finished carton to the paperboard reel, ink lot, and adhesive batch that went into it, and forward from any raw material lot to every finished carton and shipment it touched. Auditors test this with a mock recall during the on-site visit, usually picking a finished-goods lot at random and giving the QA team a defined window, often two to four hours, to produce a complete trace. Dieline and artwork version control belongs in this same conversation: a carton printed against an outdated allergen statement or barcode is a traceability failure even if every physical control in the plant worked perfectly.

The Certification Process, Start to Finish

1. Select the standard. Confirm what your customer's supplier-approval letter actually names. If multiple customers request different schemes, look for the standard that covers the broadest scope rather than pursuing two certifications in parallel.
2. Run a gap assessment. Compare your current documentation, hazard analysis, and site programs against the chosen standard's full clause set, not just the sections that feel unfamiliar.
3. Build or revise the management system. This includes the packaging-specific hazard and risk analysis, prerequisite programs, ink and migration control documentation, and traceability procedures.
4. Train the team and run internal audits. Every one of the three schemes requires evidence of internal audit activity before certification, not just a policy that says internal audits happen.
5. Conduct a mock recall exercise. Do this before the certification body does it for you. It's the single fastest way to find a traceability gap.
6. Schedule the certification audit. FSSC 22000 and SQF typically run a document-focused Stage 1 followed by an on-site Stage 2; BRCGS Packaging Materials runs a single, more compressed on-site audit against the full standard.
7. Close corrective actions. Minor nonconformities usually carry a 28-day correction window; majors and criticals require faster closure and, in some cases, a follow-up visit before a certificate is issued.
8. Maintain the system. All three certificates require annual surveillance or recertification audits, and the hazard and risk analysis needs a documented annual review even in a year with no audit.

Plants that go into their first gap assessment with an existing ISO 9001 or HACCP-based system in place typically close most gaps within three to six months. Plants starting from a purely informal quality process usually need closer to nine to twelve months, mostly because the hazard and risk analysis and ink approval documentation have to be built from nothing rather than adapted.

Where Carton Plants Usually Lose Points

The nonconformities I see repeated across folding carton audits cluster in a small number of places, and almost none of them are about equipment. They're about documentation that describes a system the plant doesn't actually run.

None of these are equipment problems. They're documentation and ownership problems, and they're exactly the kind of gap a consultant who has actually walked a converting floor catches before an auditor does.

Choosing a Consultant Who Understands Packaging, Not Just Food

A lot of food safety consultants are genuinely excellent at HACCP, allergen control, and environmental monitoring, and genuinely out of their depth the moment you hand them a die-cutting schedule and ask about metal fragment risk from a stitching head. Before hiring anyone to prepare your plant, ask three direct questions: which of the three packaging-specific schemes have they implemented, not just food-safety versions of BRCGS or FSSC; can they speak specifically to mineral oil migration and functional barrier documentation for recycled board; and have they run a mock recall inside a converting facility, where the trace runs through reels and ink lots rather than raw food ingredients. If the answers are vague, keep looking. Our GFSI certification consultants work across BRCGS, FSSC 22000, and SQF specifically because folding carton clients rarely know in advance which standard their customer will ultimately request, and switching schemes mid-project after choosing the wrong consultant is expensive.

If you're still deciding which scheme fits your plant before committing to a consultant, it's worth reading through how BRCGS, SQF, and HACCP-based programs actually compare clause by clause before you commit resources to one path.

How Certify Consulting Supports Folding Carton Plants

I'm Jared Clark, principal consultant at Certify Consulting, and packaging converters are a recurring part of the food safety practice here precisely because the standards were written by people thinking about food plants first and packaging plants second. That gap between what the standard says and what a press floor actually does is where most of the useful consulting work happens: translating a hazard and risk analysis clause into a real answer about ink migration, or turning a generic pest control contract into one that actually covers psocids in a paperboard warehouse. We build the gap assessment against the specific scheme your customer named, write the hazard and risk documentation in language your press operators can actually follow, and sit through the mock recall with your team before an auditor ever does.

Frequently Asked Questions

Does GFSI certify folding carton plants directly?

No. GFSI benchmarks food safety certification schemes; it doesn't audit or certify individual facilities. A folding carton plant becomes GFSI-recognized certified by achieving certification to one of the benchmarked standards, most commonly BRCGS Packaging Materials, FSSC 22000 under its packaging scope, or the SQF Food Safety Code for the Manufacture of Packaging.

Which GFSI-recognized standard should a folding carton plant choose?

Start with your largest customer's supplier-approval requirements. Most brand owners and retailers name a specific scheme in their vendor letter, and that requirement should drive the decision more than any perceived difference in difficulty between BRCGS, FSSC 22000, and SQF.

Do folding carton manufacturers need a HACCP plan even though they don't process food?

They need a hazard and risk analysis built on HACCP principles, but scoped to packaging hazards: physical contamination from converting equipment, chemical migration from inks and coatings, and information errors like mislabeled or misprinted cartons. A food-processing HACCP plan copied and relabeled will not satisfy the audit.

How long does GFSI certification typically take for a packaging plant?

Plants with an existing ISO 9001 or HACCP-based system in place often close gaps and reach certification within three to six months. Plants building a formal quality system from scratch usually need nine to twelve months, primarily to develop hazard analysis and ink/adhesive approval documentation.

Is mineral oil migration really something auditors check for folding cartons?

Yes, particularly for cartons made with recycled paperboard or printed with certain inks. EFSA's 2012 opinion on mineral oil hydrocarbons is the scientific basis auditors and retailers point to, and BRCGS and FSSC auditors increasingly ask to see migration data or a documented functional-barrier justification for recycled-content board.

Last updated: 2026-09-27