Food Business Compliance Made Easy

Food Business Compliance Made Easy

Running a food business in India means navigating five overlapping regulatory layers at once: FSSAI licensing, labelling standards, GST classification, Legal Metrology packaging rules, and state operational permits. The load is predictable once you map each layer to its authority, due date and document requirement. This guide covers every mandatory step for FY 2026-27, with worked Rs. examples, penalty figures and actionable checklists — whether you run a cloud kitchen, a packaged-food brand, a QSR chain or a D2C nutraceutical company.

Get Your FSSAI Licence Category Right Before You Open

Every food business operator (FBO) in India must hold either an FSSAI registration or an FSSAI licence before commencing operations. Getting the category wrong — applying for a basic registration when your turnover warrants a state licence, for example — is the single most common compliance error and the most avoidable reason for a suspension notice.

Which Category Applies to You?

Certain categories always require a central licence regardless of turnover: food importers, operators at airports and seaports, central government canteens, and manufacturers supplying the defence forces. If you operate from two states even at ₹5 crore turnover, a central licence is mandatory — there is no "multi-state state licence."

How to Apply or Renew on FoSCoS in 2026

FSSAI operates entirely through the FoSCoS portal (Food Safety Compliance System — foscosn.fssai.gov.in). The 2026 version integrates licence application, premise inspection scheduling and product-category approval into a single dashboard. Follow this sequence:

1. Register on FoSCoS using your PAN, GSTIN or CIN.
2. Select the correct licence category based on actual — not projected — turnover and operational scope.
3. Upload documents: premise proof (rent deed or ownership title), business registration certificate, ID proof of FBO, list of food categories to be handled, water-testing report issued within the last 6 months, pest-control certificate.
4. Pay the licence fee online. Fees are non-refundable and vary by state for state licences.
5. Schedule a premise inspection through the portal calendar. The food safety officer (FSO) visits, uploads photographs and audit findings in real time, and marks the result on the portal.
6. Respond to deficiencies shown on the portal — the correction window is typically 30 days.
7. Download your licence certificate. It carries a unique 14-digit FSSAI Licence Number that must appear on all packaging, invoices, websites and aggregator listings.

Renewal must be filed at least 30 days before expiry. A licence can be issued for one to five years; most state licences default to one year unless you request a longer term upfront. Operating on an expired licence is treated as operating without a licence under Section 63 of the FSS Act, 2006 — the penalty is imprisonment up to six months and/or a fine up to ₹5 lakh.

Amendment obligations: any change in premises, products, food categories or directors must be reported via an amendment application within 30 days of the change. A mismatch between the active licence and actual operations is among the most common triggers for an unannounced inspection.

FSSAI Labelling Rules 2026: Every Element That Must Appear on Your Pack

The Food Safety and Standards (Labelling and Display) Regulations, 2020, enforced with increasing strictness through 2026, set out mandatory label elements for all pre-packaged food. A violation is a Section 52 offence carrying a penalty up to ₹3 lakh per SKU. Non-compliant products are increasingly delisted by quick-commerce platforms within 24 hours of a flagged complaint.

Mandatory Label Elements

Every pre-packaged food product must clearly display:

• Product name and common name of the food
• Ingredient list in descending order of weight at time of manufacture
• Allergen declaration in bold or contrasting text: wheat/gluten, milk, eggs, fish, shellfish, peanuts, tree nuts, sesame, soybean, sulphites above 10 ppm — each must be explicitly named
• Nutritional information per 100 g or 100 ml: energy (kcal), total fat, saturated fat, trans fat, total carbohydrate, added sugars, protein, sodium
• Front-of-Pack Label (FOPL): if total fat, saturated fat, trans fat, added sugar or sodium exceeds the prescribed threshold per serving, a red indicator must appear on the front panel — this is not optional for products that meet the trigger levels
• Net quantity in grams, kilograms, millilitres or litres — not in proprietary or brand-defined units
• Veg/Non-veg symbol: filled green circle inside a green square (veg) or filled brown circle inside a brown square (non-veg)
• Vegan symbol: if making a vegan claim, use only the FSSAI-prescribed vegan logo downloadable from FoSCoS
• Name and full address of manufacturer, packer or importer
• FSSAI Licence Number of the manufacturer/packer
• Country of origin (mandatory for all imported products)
• Batch or lot number for traceability
• Date marking in DD/MM/YYYY or DD/MMM/YYYY format: "Best before" for shelf life under three months; "Use by" for highly perishable products; "Expiry date" for products with shelf life above three months

E-Commerce Product Detail Pages

If you sell on Amazon, Flipkart, Swiggy Instamart, Blinkit or any quick-commerce platform, identical information must appear on the product detail page (PDP) — not just the physical label. The Central Consumer Protection Authority (CCPA) has issued directions requiring platforms to delist SKUs where this information is absent or inaccurate. Aggregators now run automated compliance checks, and a delisting can wipe out online revenue overnight.

Legal Metrology Additions

Over and above FSSAI rules, the Legal Metrology (Packaged Commodities) Rules, 2011 require:

• MRP inclusive of all taxes, printed as "MRP ₹\_\_ (inclusive of all taxes)"
• Consumer care contact: email address or phone number on the label
• Month and year of manufacture

If you reprice a product, a revised MRP sticker is permitted — but it must be placed over the old MRP, never concealing the manufacture date or expiry date. A sticker that covers the date marking is treated by Legal Metrology inspectors as a separate concealment offence, independent of the MRP correction itself.

GST Classification for Food Businesses: Five Situations Where Operators Go Wrong

Standalone Restaurants and QSR Chains

Restaurant services supplied from standalone premises attract 5% GST without input tax credit (ITC) under FY 2026-27. This applies to most QSRs, dhabas, cafes and casual-dining restaurants.

The 18% with-ITC rate applies only when the restaurant operates inside a hotel where the declared room tariff for any unit exceeds ₹7,500 per night. If even one room in the hotel crosses this threshold, all food and beverage supplies from that hotel's restaurant attract 18% with ITC. Operators in hotel-adjacent or co-branded spaces must confirm room tariff bands before choosing their rate.

Cloud Kitchens and Delivery-Only Operations

A cloud kitchen supplies food as a restaurant service (SAC 9963) and is taxable at 5% without ITC — whether the customer orders directly or through Swiggy or Zomato.

Under Section 9(5) of the CGST Act, 2017, the electronic commerce operator (ECO) — Swiggy, Zomato or any food aggregator — is the deemed supplier for restaurant services routed through its platform and is responsible for collecting and depositing the 5% GST. The restaurant itself does not collect GST on ECO-routed orders. However, the restaurant must still:

• Report ECO-routed supplies in Table 14 of GSTR-1 (supplies through ECO on which ECO is liable to pay tax)
• Ensure the ECO's GSTIN is correctly mapped in the restaurant's GST profile
• Reconcile monthly: the total value reported in Table 14 must match the ECO's GSTR-8 filing

Where cloud kitchens go wrong: reporting ECO-routed orders in Table 12 (B2C outward supplies) instead of Table 14. This creates mismatches against the ECO's GSTR-8, generating automated demand notices.

Packaged Food: Key HSN Codes and Rates for FY 2026-27

Verify each HSN classification against the applicable GST rate notification before billing. HSN errors in invoices cause mismatches in GSTR-2B that can block ITC for your buyers.

Cloud Kitchen Compliance: A Consolidated Checklist

Cloud kitchens attract above-average inspection frequency because they combine restaurant operations with home-delivery logistics and aggregator dependencies. Use this checklist across every kitchen premises:

FSSAI Layer

• [ ] Individual State FSSAI licence for each physical kitchen premises — each address is a separate licence, not a branch of a single licence
• [ ] Separate food categories listed per premise where menus differ
• [ ] FoSTaC-certified Food Safety Supervisor physically present at each kitchen
• [ ] Daily temperature logs for cold storage (below 5°C) and hot-holding equipment (above 63°C)
• [ ] Pest control records with certificates — at minimum quarterly visits
• [ ] Water-testing report (coliform and chemical parameters) renewed every 6 months

GST Layer

• [ ] SAC 9963 applied to all restaurant services
• [ ] Table 14 GSTR-1 entries for Swiggy/Zomato orders
• [ ] Monthly reconciliation of ECO remittance certificate against GSTR-1 Table 14 values
• [ ] No ITC claimed on kitchen interiors, equipment or consumables (5% restaurant service = blocked ITC)

Operational Layer

• [ ] Municipal trade licence for commercial kitchen use at each address
• [ ] Shop and Establishment Act registration for each state of operation
• [ ] FSSAI Hygiene Rating application — increasingly required by aggregators for premium listing tiers and advertising

Labour Layer

• [ ] EPF registration once you employ 20 or more persons
• [ ] ESIC registration once you employ 10 or more persons (in notified establishments)
• [ ] Contract labour register maintained if using third-party packing or delivery workforce

Plastic Packaging and EPR: What D2C Food Brands Must Do by June 2027

If your food brand uses plastic packaging — pouches, wrappers, multi-layer laminates, PET bottles, shrink wrap — and you place plastic above the notified thresholds into the Indian market, you are a producer or brand owner under the Plastic Waste Management (PWM) Rules, 2016 (as amended in 2022) and must comply with Extended Producer Responsibility (EPR) obligations.

Steps to EPR Compliance

1. Register on the CPCB EPR Portal (eprnpwm.cpcb.gov.in). Separate logins exist for producers, importers and brand owners.
2. Declare your plastic footprint: total kilograms of each plastic category — rigid plastic, flexible plastic, multi-layer plastic — placed in the market during the reporting year.
3. Procure EPR certificates equivalent to your declared footprint, either by setting up your own collection and processing infrastructure or by purchasing certificates from registered waste processors listed on the CPCB portal marketplace.
4. File your Annual EPR Compliance Report by 30 June each year. For FY 2026-27, the deadline is 30 June 2027.
5. Retain transaction records for three years, available for inspection by CPCB or State Pollution Control Boards at any time.

Non-registration and non-filing attract penalties under the Environment Protection Act, 1986 — up to ₹1 lakh per day of continuing non-compliance, plus directions to halt production or imports. For D2C food brands that launch before EPR registration is complete, this is a hidden liability that auditors increasingly flag during due diligence for investment rounds.

Common Mistakes That Trigger FSSAI and GST Notices

Mistake 1 — Wrong Licence Category Based on Projected Turnover

You applied for a basic registration when your billing crossed ₹12 lakh in Year 1. Operating at the wrong tier is not a warning — it is suspension territory. Fix: upgrade to a state licence immediately on crossing the threshold and file the category change on FoSCoS before the next inspection. Do not wait for the annual renewal cycle.

Mistake 2 — Missing Allergen Declaration on a Live SKU

A product page on a quick-commerce app lists "mixed nut trail mix" without disclosing tree nuts and peanuts as allergens. This is simultaneously a Section 52 FSSAI labelling violation (penalty up to ₹3 lakh per SKU) and a CCPA consumer-protection issue that can trigger platform delisting. Fix: audit every active SKU against the full allergen checklist in the FSS (Labelling and Display) Regulations, and update both the physical label and the platform PDP in the same revision cycle.

Mistake 3 — Reporting ECO Orders in GSTR-1 Table 12 Instead of Table 14

Cloud kitchens that book Swiggy/Zomato revenue in Table 12 (B2C outward supplies) instead of Table 14 create mismatches against the ECO's GSTR-8. The mismatch compounds month-on-month and generates an automated demand notice from the GSTN system. Fix: update your accounting software or ERP to tag ECO orders with the aggregator's GSTIN and route them to Table 14; reconcile before the 11th of each following month.

Mistake 4 — MRP Sticker Placed Over the Expiry Date

When repricing stock, warehouse teams sometimes affix the new MRP sticker directly over the manufacture or expiry date. Legal Metrology inspectors treat this as deliberate concealment of a mandatory date-marking — a separate offence from the MRP revision. Fix: redesign your label template so MRP and date-marking zones do not overlap, and brief warehouse staff with a visual guide on correct sticker placement.

Mistake 5 — FoSTaC Certificates Allowed to Lapse

An FSSAI inspection finds that the Food Safety Supervisor's FoSTaC certification expired eight months ago. The kitchen is immediately marked non-compliant, a hygiene rating downgrade is issued, and the aggregator partner receives an automated alert that can trigger delisting. FoSTaC certification is valid for five years. Fix: enter the expiry date as a recurring calendar task on day one, and treat renewal as a non-negotiable operational milestone, not an administrative afterthought.

Worked Example: Compliance Cost and Penalty Exposure for a 3-Kitchen Cloud Brand

Scenario: SpiceBox Foods Pvt. Ltd. operates three cloud kitchens in Delhi NCR with combined FY 2026-27 turnover of ₹1.6 crore. Sales are 80% via Swiggy/Zomato, 20% through a direct WhatsApp and website channel.

Annual FSSAI Compliance Budget

That is less than 0.15% of annual turnover — the marginal cost is negligible against the risk it offsets.

Monthly GST Calculation

• Monthly revenue: ₹13.3 lakh
• Swiggy/Zomato portion (80%): ₹10.64 lakh — GST collected and deposited directly by the ECO under Section 9(5); SpiceBox reports this in Table 14 of GSTR-1
• Direct orders (20%): ₹2.66 lakh — SpiceBox collects and deposits 5% GST = ₹13,300/month

If SpiceBox mis-books all ECO orders as direct B2C and wrongly claims ITC on kitchen renovations (say ₹50,000 of ITC in the year):

• ITC wrongly availed: ₹50,000
• Penalty for ITC availed without entitlement: equal to ITC = ₹50,000
• Interest at 24% p.a. on short-paid output tax (if any): calculated from the due date
• Exposure on the ITC issue alone: ₹1,00,000 + interest before any mitigation

A correctly run SpiceBox pays ₹13,300/month in GST on direct orders, files Table 14 for aggregator orders, claims zero ITC, and has no dispute exposure. The compliance discipline costs minutes per month; getting it wrong costs lakhs.

Export, Recall and Crisis Response: Build the Plan Before You Need It

Recall Obligations for Packaged Food Manufacturers

FSSAI's Food Recall Procedures require every FBO manufacturing packaged food to maintain a written recall plan covering:

• Batch traceability: lot number, manufacture date, distribution records per consignment
• Customer and retailer communication protocol with named responsible persons
• Regulator notification within 24 hours of identifying a Class I recall trigger (serious health risk)
• Product segregation, safe disposal and replacement logistics

A recall executed without a pre-written plan results in delayed response times, which regulators treat as aggravated non-compliance — compounding both the original safety issue and the enforcement outcome.

Export-Focused Operators

If you export processed food, you need all of the following aligned with your domestic FSSAI and GST positions:

• APEDA registration (apeda.gov.in) for all scheduled export products
• FSSAI Export Endorsement on each consignment certificate
• Destination-country labelling compliance: the EU, USA, UAE and GCC each impose their own label mandates; verify against the importing country's food authority requirements before the first shipment
• RBI EDPMS reconciliation: export proceeds must be realised and reported within the prescribed period (currently 9 months for goods exports); failure triggers FEMA notices that create indirect tax and banking complications

Key Takeaways

• Match your FSSAI licence category to actual turnover, not estimates. Upgrade immediately when you cross ₹12 lakh (basic to state) or ₹20 crore (state to central). Operating at the wrong tier is a suspension risk, not a paperwork gap.
• Every label change is a compliance event. Allergen additions, MRP revisions and new claims — organic, vegan, gluten-free — all require a fresh review against the FSS (Labelling and Display) Regulations, 2020 and Legal Metrology (Packaged Commodities) Rules, 2011, before the revised product ships.
• Cloud kitchens use Table 14 in GSTR-1 for ECO-routed orders — not Table 12. Misclassification creates monthly mismatches against the ECO's GSTR-8 that compound into demand notices.
• EPR registration on the CPCB portal is required before you place plastic packaging into the market, not after. The Annual EPR Compliance Report for FY 2026-27 is due by 30 June 2027.
• FoSTaC certifications expire in five years. Enter the renewal date as a tracked task from day one — an expired certification during an unannounced inspection is an instant compliance failure and aggregator-delisting trigger.
• A documented recall plan costs nothing to write but contains a crisis that would otherwise end a brand. Build it before your first product batch ships, not after the first complaint.
• Total FSSAI compliance spend for a ₹1.6 crore cloud kitchen brand is under ₹30,000 per year — under 0.2% of revenue. The alternative: a single Section 63 prosecution carries a fine up to ₹5 lakh, and an aggregator delisting can destroy months of marketing investment overnight.