October 16, 2026 · 7 min read
Certification tracking for a food manufacturer: one register
By Anna, co-founder, build and content
Certification tracking software for a food manufacturer needs to do three things: hold every certificate expiry, every audit date and every open non-conformity in one register, put a named owner on each, and turn the approaching ones into tasks before anyone asks. Most plants have the data. It sits in a spreadsheet, a shared drive folder and somebody’s inbox, and each copy is slightly out of date.
This post is the narrow version of that problem: the calendar and the corrective-action clock. It is not about gathering evidence for an audit, which we covered in compliance audit preparation, automated. Here the question is simpler. When does each thing run out, and who is holding it?
Why the register matters more than the paperwork
A certification scheme is a set of clocks. The certificate runs for a cycle. The next audit has a window. A finding opens a deadline the day it is raised. None of these clocks care that your quality manager is on leave or that the Tuesday shift forgot a sign-off.
The FSSC 22000 scheme (version 6, published April 2023 and still the audited version until 30 April 2027) is blunt about this. A major non-conformity has to be closed by the certification body within 28 calendar days of the last day of the audit, and if it cannot be closed in that window the certificate is suspended. A critical non-conformity suspends the certificate within 3 working days of being issued, and the organisation owes the certification body its investigation and action plan within 14 calendar days of the audit.
Those are not abstract numbers. They are the shortest fuse in your whole system, and they start at the moment you are least able to read a spreadsheet: right after a hard audit.
The calendar also includes the scheme itself
Your own dates are only half of it. In May 2026, according to Eurofins’ summary of the transition, FSSC published version 7 of the scheme. Version 6 audits remain allowed until 30 April 2027, the upgrade audit window for version 7 runs from 1 May 2027 to 30 April 2028, and all version 7 certificates have to be uploaded to the assurance portal by 30 June 2028.
That is a plant-level planning problem sitting on top of the routine one. Eurofins reports it clearly; what it cannot do is tell you which of your own audits lands where in that window. A register can. If your surveillance audit falls in spring 2027, whether it is a version 6 audit or an upgrade audit is a decision with a date attached, and the date needs an owner.
Where lapses actually come from
It is tempting to think expiry problems come from bad systems. In most plants they come from ordinary things: a renewal started late, a corrective action that moved from one person to another, a document attached to an email instead of the record.
The wider food-safety record points the same direction, with a caveat. A peer-reviewed analysis in the journal Foods, published in September 2026, looked at 24,761 FDA product recall records covering fiscal years 2013 to 2025. Microbiological hazards were the largest category at 46.2% of records, against 27.1% for allergens.
The authors classify recalls by hazard, not by root cause, so the study does not say which of those recalls started with a lapsed control. It does show that the hazards certification schemes exist to control are the ones that dominate recalls. A register that keeps those controls current is guarding the part of the job that actually matters.
| Record | The clock | What goes wrong | What the register does |
|---|---|---|---|
| Certificate | Expiry date, then renewal audit window | Renewal booked late, auditor availability gone | Raises a task for the owner well before expiry |
| Audit | Scheduled date and readiness | Date known by one person | Raises a task when the audit approaches |
| Major non-conformity | 28 days to closure under FSSC 22000 v6 | Action sits unowned after the audit | Keeps a task open until the record says closed |
| Critical non-conformity | 3 working days to suspension, 14 days to evidence | Treated as a normal ticket | Same task, named owner, visible to management |
| Scheme change | Fixed transition dates | Nobody owns the scheme itself | A dated entry like any other |
What our agent does, step by step
We built this for our own food manufacturing business, which holds several certifications at once. The agent is a tomte, our word for one production agent with one defined job. This one’s job is to make sure nothing in the register goes stale unnoticed.
The steps are plain:
- One store holds the records. Certificates, the audit calendar, non-conformities, documents and trainings live in the same place, behind sign-in and a per-user allow list. Being logged into the company system is not enough to see compliance data.
- A job runs every day. It reads every certificate, audit and non-conformity, and compares each date against today.
- It raises work, not alerts. An approaching expiry, a coming audit or a still-open non-conformity becomes a task in our task backbone, assigned to the person who owns the record. A task has a name on it. A dashboard colour does not.
- Tasks close themselves. When the record changes to renewed, completed or closed, the task closes on the next run. Nobody tidies up afterwards, which also means a closed task is evidence the record actually changed.
- It reports on itself. The agent files a daily health note, so a silent failure of the agent itself shows up as a missing note.
An assistant sits alongside it and answers questions from the register and the reference material, with instructions to say so when the records do not contain the answer instead of guessing.
What changed
The change is in who finds out first. Before the register, an approaching expiry was discovered by whoever happened to look at the folder, often close to an audit. Now it arrives as a task with an owner, in the same queue as the rest of that person’s work. A corrective action cannot sit in a meeting note, because the open non-conformity keeps generating the task until the record says closed.
We are not publishing run counts or time-saved figures for this agent. They are internal and we have not put them on the proof pages, so we will not quote them here. What we can say is the shape of the change: dates stopped depending on memory.
Where it is not allowed to act
The refusals are the design. Compliance sign-off is always a person pressing approve. The agent cannot mark a compliance action complete, and it is excluded from the automated performance scoring we apply to the rest of our agent fleet, because scoring an agent on closing compliance items would reward the wrong behaviour.
What it does not do yet
Staff can update the status of an existing certificate or non-conformity in the app, but creating a brand new certificate or non-conformity record still needs a developer. That is a real gap for any plant that raises findings weekly. It is the first thing we would fix in a client build, as an entry form with an owner and a due date required before the record can be saved.
An item with no date cannot be flagged either. The agent compares dates, so a record without one is invisible to it. Any version of this system needs a rule that nothing enters the register without a date and an owner.
What it would cost as a Sprint
If you want the same register on your own accounts, this is a single-system build, and that is what the AI Workforce Sprint is: a fixed-scope build of one working agent or internal app, from $9,500, in 4 to 6 weeks, shipped to your own GitHub, Supabase and Netlify with auth, documentation and a recorded handover. Prices are current as of July 2026 on our pricing page.
For this problem the written scope would list your certification schemes, the record types, the owners, the warning windows and the entry forms, so there is no argument later about what done means. If you are not sure the register is your highest-value automation, the $1,900 operations audit exists to answer that first, and the fee is credited against a build if you proceed. You own the code, the data and the accounts from the first day.
The number to weigh against it is the 28-day clock above, and what a suspended certificate does to your customers.
Start async
If certificate dates and open findings are living in more places than you can count, describe the setup at /start. Start async: no call follows. A written reply arrives within one business day, and you will have a fixed price before you have had a meeting.