CODEX AND SA LAW

Is Codex Alimentarius Law in South Africa? How Codex, the WTO SPS Agreement and Our Own Regulations Fit Together

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 15 min read

No. Codex Alimentarius is a voluntary body of FAO and WHO standards and no Codex text is enforceable in South Africa by itself. What binds you is South African legislation, principally the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 with R638 of 2018 and R146 of 2010. Codex still reaches you by four routes, and the fourth, where our regulations are silent, is the one that costs money.

Is Codex Alimentarius law in South Africa?

No. Codex Alimentarius is a body of voluntary international standards published by the Food and Agriculture Organization and the World Health Organization, and no Codex text has legal force in South Africa on its own. The instruments that bind you are South African: the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and its regulations, and the other statutes set out below.

That is the whole answer to the question as asked, and it is where most articles stop. Stopping there is what gets people into trouble, because it is read as permission. I have sat across the table from technical managers who told me, with complete confidence, that a Codex limit did not apply to them because Codex is not law here. They were right about the law and wrong about their exposure, and the difference cost one of them a delisting.

The honest position is that Codex is not binding by itself, and reaches you anyway through four routes. The rest of this article works through them in the order of how often I see each one bite.

What is Codex Alimentarius, and who writes it?

Codex Alimentarius is the joint food standards programme of the Food and Agriculture Organization and the World Health Organization. Its decision making body is the Codex Alimentarius Commission, which meets once a year and adopts, in one batch, everything its committees have forwarded. The 49th Session, CAC49, ran from 6 to 10 July 2026 in Geneva, with about 600 delegates from 119 members.

The work itself happens in the committees, not at the Commission. There are subject committees covering matters that cut across all foods, such as food hygiene, food labelling, contaminants, food additives, pesticide residues and residues of veterinary drugs, and commodity committees covering particular products. There are also regional coordinating committees, and Africa is served by the FAO and WHO Coordinating Committee for Africa. A text can take years to move through the committee steps before it reaches the Commission, which is why an adoption in July is usually the visible end of a process that started long before.

Two practical points matter more than the machinery. The first is that every Codex text is a free download from the FAO. There is no subscription, no licence fee and no reseller. If someone is charging you for a Codex standard, they are charging you for a file you can fetch yourself. That is a genuine difference from ISO, whose standards are bought from the ISO Store, and from SANS, whose standards are bought from the SABS.

The second is that Codex texts are written to be adopted by governments, not to be applied straight onto a production line. They are drafted in the language of a competent authority setting a national measure. When a customer specification lifts a Codex limit and drops it into your contract, it has skipped that translation step, and part of the work of a compliance file is putting the translation back.

Codex is the reference every regulator in the world argues from. It is not the regulator you answer to.

CXS, CXG and CXC: what the three Codex prefixes mean

Codex texts carry a prefix telling you what kind of document you have. CXS is a standard, which sets requirements, such as CXS 1-1985, the General Standard for the Labelling of Prepackaged Foods. CXG is a guideline, which explains how to apply or assess something. CXC is a code of practice, describing how to run a process hygienically, such as CXC 1-1969 on food hygiene.

The prefix matters commercially, because it changes what a customer is asking of you when they name one. A CXS usually carries a number you either meet or do not meet, and evidence is a test result or a specification. A CXG usually carries a method, and evidence is a documented assessment showing you followed it and what you concluded. A CXC usually carries practices, and evidence is your prerequisite programmes, your procedures and the records that show they operate.

One correction worth making here, because it circulates constantly. There is no 2026 edition of CXC 1-1969. The published text still reads adopted 1969, amended 1999, revised 1997, 2003, 2020 and 2022, with editorial corrections in 2011. The 2022 revision, published as the 2023 edition, with its seven principles, twelve steps and the HACCP annex, remains the current text. A further revision is in progress at the Committee on Food Hygiene and has not been adopted. Anyone citing a 2026 general principles of food hygiene is citing something that does not exist. The obsolete CAC/RCP style reference is also worth retiring from your documents.

Route one: when a South African regulation adopts a Codex limit

Where a South African regulation sets a limit or a method taken from a Codex text, or refers to a Codex text by name, the limit is law. The binding instrument is the South African regulation, and the Codex text is the reasoning that produced the number. This is the cleanest of the four routes, and the only one where quoting Codex to an inspector is beside the point.

The mechanism is called incorporation by reference, and South African law uses it routinely. The clearest verified example in our own system is not a Codex one but works identically: SANS 289:2022, on labelling requirements for prepackaged products and general requirements for the sale of goods subject to legal metrology control, is incorporated under the Legal Metrology Act 9 of 2014 by Notice 877 in Government Gazette 41854 of 24 August 2018, as amended. The SANS document is voluntary in itself. Once a notice incorporates it, its permitted units, minimum digit heights, placement and prominence rules are enforceable, and short measure prepackages are an offence.

Apply that logic to Codex and the practical instruction follows. Do not assume a Codex limit is in force here, and do not assume it is not. Read the South African instrument itself and see whether it names the Codex text or reproduces the figure. If it does, the South African wording governs, including any date, edition or amendment qualifier attached to the reference. If it does not, you are in one of the other three routes.

Route two: how the WTO SPS Agreement puts Codex at the centre of trade

Under the World Trade Organization framework for sanitary and phytosanitary measures, Codex is the named international reference for food safety measures. That is why importing authorities lean on Codex figures, and why a national measure that departs from Codex attracts more scrutiny. Confirm the position for your destination market before you rely on it, because the framework settles argument between governments rather than deciding a question for your factory.

Read that carefully, because it is misquoted in both directions. The SPS Agreement binds governments, not factories. It does not make Codex compulsory for your production line, and no inspector will ever cite it at you. What it does is settle the burden of argument between countries, and that determines the answers your export customers receive when they ask their own authorities a question.

The consequences for a South African manufacturer are indirect and entirely real. When an importing country applies a limit that matches Codex, expect it to hold, so there is no point building a commercial strategy on the hope that it will move. When an importing country applies a limit stricter than Codex, that measure attracts more scrutiny, which is why stricter national limits tend to be published with supporting risk assessments and why they are the ones that occasionally change. And when your own government sets a measure, this framework is part of why a South African limit will often track a Codex figure, even where the regulation does not say so on its face.

The operational instruction is simple to state and easy to neglect. For every export market, hold two numbers per parameter: the Codex figure and the destination country figure. Where they match, your exposure is a testing and control question. Where the destination is stricter, your exposure is a specification and supplier question, and it needs to be settled before a container sails rather than after. Our guide to importing food into South Africa covers the mirror image of this problem for goods coming the other way, where a foreign supplier meets a Codex limit and arrives at a South African requirement they never checked.

Route three: when your customer or your certification scheme names a Codex text

This is the route that binds most South African manufacturers most often, and it has nothing to do with legislation. A retailer specification, a supply agreement or a certification scheme names a Codex text, and from that moment you are contractually bound to it. Breach is not a prosecution. It is a non conformance, a rejected consignment, a withheld payment or a delisting.

The scheme version of this is familiar to anyone who has been through a GFSI recognised audit. Codex sits underneath the HACCP requirements of every major scheme, and CXC 1-1969 with its twelve steps and seven principles is the text the methodology comes from. An auditor will not usually cite the Codex code at you, but the structure of what they expect is drawn from it, and a HACCP study that departs from the twelve step sequence has to explain itself. If you are working out which scheme you are actually being asked for, our BRCGS versus FSSC 22000 versus IFS decision framework sets out the differences, and the FSSC 22000 Version 7 guide for South Africa covers the current scheme position.

The customer version is more dangerous, because it arrives without ceremony. A specification comes back from a buyer with a new line in it naming a Codex standard, someone in commercial signs it, and nobody in technical is asked whether the site can meet it. I have opened supply agreements that committed a manufacturer to a contaminant limit their raw material had never been tested against, and to an allergen management approach their layout could not deliver.

• Every incoming customer specification is reviewed by technical before signature, not after, with a named reviewer recorded
• Every external requirement named in a signed specification is captured on your register with the source document and the date it was agreed
• Where a specification names a Codex text, the text is downloaded, read and filed, not cited from memory or from the customer’s summary
• Where the requirement exceeds what your process can currently deliver, that gap is raised commercially before signature, in writing
• Contract review runs on a cycle, because specifications are amended quietly and the amended version is the one you will be audited against
• The register records who inside your business owns each requirement and when the position was last verified
• Scheme requirements and customer requirements are held in the same register, because an auditor treats a signed customer specification as a requirement you undertook to meet

The register is the deliverable that makes this manageable, and the assessment behind it is the Interested Parties analysis every management system standard now expects. Customers, regulators, certification bodies, insurers and importing authorities each impose requirements, and each set has to be identified, recorded and reviewed. The Interested Parties Risk Assessment Template (RA23) at R690 gives you the register, the procedure, the completion guide and the read me for exactly that, in editable Word and Excel, mapped to BRCGS, IFS and SQF clauses.

Route four: what happens where South African law is silent

Where our regulations say nothing about a hazard, a limit or a practice, Codex is the text an expert witness, an insurer, a certification body or an importing authority reaches for. Silence is not permission. Section 55 of the Consumer Protection Act 68 of 2008 gives a right to safe, good quality goods, and section 61 imposes liability for harm caused by unsafe goods irrespective of negligence.

This is the point most readers have never had put to them plainly, so let me put it plainly. When something goes wrong and the matter becomes contested, nobody asks whether a regulation covered the situation. They ask what a competent manufacturer in your sector should have known and should have done. That question is answered by reference to the best available international guidance, and for food, the best available international guidance is Codex. It is free, it is scientifically based, it is written by the FAO and the WHO, and it is the reference every technical expert in the room will already have on their laptop.

Precautionary allergen labelling is the sharpest live example. R146 of 2010 has no precautionary allergen labelling rule at all. There is no South African requirement telling you when a “may contain” statement is justified and when it is not. In July 2026, CAC49 added an annex to CXS 1-1985 titled Guidelines on the use of precautionary allergen labelling, which says such a statement is permitted only after allergen management measures are in place and a risk assessment shows the residual risk cannot be adequately controlled, and that where used, the statement must begin with “may contain” or an equivalent phrase. The annex carries reference doses expressed as mg total protein from the allergenic food(s), including 2.0 mg for peanut, egg, milk and sesame, and 4.0 mg of total gluten from all relevant sources for coeliac disease.

None of that is South African law. Regulation 43 of R146 of 2010 remains the South African allergen declaration rule and its list is unchanged. But if a consumer is harmed by a product carrying a defensive “may contain” that was never based on any assessment, the question in the room will be what basis you had for the statement, and the Codex annex is the document that now describes what a defensible basis looks like. Our South African allergen labelling guide covers the regulation 43 position, and the Codex precautionary allergen labelling article works through the annex and the reference doses in detail.

The four instruments that decide the answer for your product

The core set is smaller than people expect and wider in reach. The Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, with R638 of 2018 and R146 of 2010, carries hygiene and labelling. The Agricultural Product Standards Act 119 of 1990, the Legal Metrology Act 9 of 2014, the NRCS compulsory specifications and the Consumer Protection Act 68 of 2008 carry the rest, with Port Health at entry points.

Category regulations sit on top of that set and are easy to miss because they are product specific. R.733 of 10 September 2012 governs sweetener use and its label statements, including the non-nutritive sweetener descriptor, the laxative statement for polyols above 50 g per kilogram, and “Contains phenylalanine” where aspartame is used. The Regulations Relating to Soft Drinks, R.1769 of 9 August 1985, as amended by Notice R.317 of 17 April 2012 in Government Gazette 35265, require a “High caffeine content” statement in letters at least 3,0 mm high on the main panel where a soft drink contains more than 150 mg of caffeine per litre. Fortification of wheat flour, maize meal and wheat bread is mandatory under R.504 of 7 April 2003 as amended by R.1206 of 2008. Our South African food legislation guide works through the full set.

Worked example: one jar of peanut butter and every layer that applies

Take a 400 g jar of peanut butter with a cinnamon swirl, made in Gqeberha, sold to a South African retailer under the retailer’s own brand, with a small export line into a neighbouring market. Nothing about that product is exotic, and it sits under at least seven distinct layers of obligation. This is how the ASC legislation register lays it out, layer by layer.

1. Premises and people, R638 of 2018A valid Certificate of Acceptability under regulation 3(1) before any food is handled on the premises, and a person in charge who is suitably qualified or otherwise adequately trained under regulation 10(1), with routine assessment of training impact and records available to an inspector. R638 names no approved provider, no minimum hours and no delivery mode, so what you must be able to show is that the training was appropriate and that its impact was assessed.
2. The label, R146 of 2010Name of the foodstuff, name and address of the responsible party, ingredients in descending order, storage conditions and net contents in SI units under regulation 9, country of origin under 10, batch identification under 11, date marking under 12, the nutrition table under 50 where required, and peanuts declared as an allergen under regulation 43. If the recipe carries any tree nut, that is a second regulation 43 allergen.
3. Net quantity, Legal Metrology Act 9 of 2014The 400 g declaration must satisfy SANS 289:2022 as incorporated under the Act, on units, minimum digit height, placement and prominence, with quantity control of the contents against SANS 1841. Short measure prepackages are an offence, and this layer is checked by a different regulator from the one that checks the rest of the label.
4. Category and commodity requirementsCheck whether any Agricultural Product Standards Act 119 of 1990 regulation covers the product, and whether any NRCS compulsory specification reaches it. Both checks are done against the product as actually formulated and processed, not against its commercial name, and both are confirmed in writing rather than assumed in either direction.
5. Codex layer one, the peanutAflatoxin control in peanuts is covered by CXC 55-2004, revised at CAC48 in November 2025, its first revision in more than twenty years. The revision adds a table of peanut reproductive growth stages to guide harvest timing, extends scope to feed made from peanut by-products, and adds a new section on the part roasting plays in reducing aflatoxin. CXS 200-1995, the standard for peanuts, was last modified in 2026.
6. Codex layer two, the cinnamonCAC48 added maximum levels to CXS 193-1995 for lead of 2.5 mg/kg in dried bark spices such as cinnamon and 2.0 mg/kg in dried culinary herbs. A spice inclusion of a few percent by mass is still a route by which lead enters a product that will be eaten by children, and your supplier specification and certificate of analysis are where that is controlled.
7. Codex layer three, the allergen statementIf the line also runs a product containing another allergen, the “may contain” decision is governed by no South African rule at all. The CXS 1-1985 annex adopted at CAC49 in July 2026 sets out the assessment logic and the reference doses, including 2.0 mg total protein from the allergenic food(s) for peanut. CXC 80-2020, the code of practice on food allergen management, was amended at CAC49 so that its introduction, its scope at 2.1 and its definitions at 2.3 align with the revisions to CXS 1-1985 adopted at CAC47 in 2024. It carries no allergen list of its own.
8. The liability layer, Consumer Protection Act 68 of 2008Section 61 reaches the producer, the importer, the distributor and the retailer for harm caused by unsafe goods, defects, or inadequate instructions or warnings, irrespective of negligence. Under a retailer’s own brand, the retailer is in that chain with you, which is exactly why their specification will pull Codex requirements into your contract.

Seven layers, four regulators, one jar. Only two of those layers are things most manufacturers would name if asked to list their obligations without notice, and the Codex layers are the ones that arrive through the retailer specification rather than through a gazette. The register that holds all of this on one page, per product, is the whole deliverable.

Does Codex membership change your legal position in South Africa?

Codex membership is a matter for national governments and it is not what decides your legal position. The Codex Alimentarius Commission is the FAO and WHO body that adopts Codex texts, and the region is served by the FAO and WHO Coordinating Committee for Africa. Adoption at the Commission is a step at international level, and a text becomes enforceable here only when a South African instrument gives it force.

The regional committee is where African priorities are put to the Commission. CCAFRICA25, the 25th Session of the FAO and WHO Coordinating Committee for Africa, met from 27 to 31 January 2025 in Kampala, Uganda, and reported as REP25/AFRICA. The Gambia succeeds Uganda as Regional Coordinator for CCAFRICA and will host the 26th Session, and The Gambia Codex Secretariat attended a benchmarking and mentorship session in Kampala from 2 to 5 September 2025.

One caution for anyone searching this topic. When ASC checked on 10 September 2026, there was no Codex output published in 2026 that is specific to South Africa, and you should treat any claim of one with suspicion until you can open the document. The other frequent error is the session number itself: the July 2026 session was CAC49, not CAC48. CAC48 was the earlier session, held from 10 to 14 November 2025 at FAO headquarters in Rome. Getting that wrong in a technical justification is the kind of small mistake that makes an auditor read the rest of the document twice.

Where to find what Codex actually changed in 2025 and 2026

Two Commission sessions did the work. CAC48, held from 10 to 14 November 2025 in Rome, carried the contaminant, residue and peanut aflatoxin changes. CAC49, held from 6 to 10 July 2026 in Geneva, carried the labelling, additive and pathogen changes, including the precautionary allergen labelling annex to CXS 1-1985 and the full revision of the Listeria monocytogenes guidelines.

Rather than restate what belongs in its own article, the full account with the change log sits in our parent guide, the full list of every Codex change from CAC48 and CAC49. The short list of what a South African technical manager should have looked at by now runs to five items.

• The precautionary allergen labelling annex to CXS 1-1985, because R146 of 2010 has no precautionary allergen labelling rule and your export customers will use the Codex logic
• The lead maximum levels added to CXS 193-1995 at CAC48, at 2.5 mg/kg in dried bark spices and 2.0 mg/kg in dried culinary herbs, if you blend, pack or use spices
• The full revision of CXG 61-2007 at CAC49, whose new ready to eat definition is built on what consumption is reasonably foreseeable. Its introduction names diced cantaloupe, frozen vegetables and cold smoked fish as the three foods with published JEMRA risk assessment models, not as a list of foods the definition reaches
• The pesticide maximum residue limit revocations at CAC48, if you export, because a revoked Codex limit removes the fallback your buyer may have been relying on. The adopted report REP25/CAC records the revocations and the 340 new maximum residue limits, so check the position against the Codex text before you build a specification on it
• The reduction in permitted use levels of polyglycerol esters of fatty acids, INS 475, for 19 of the 56 provisions for that additive in the General Standard for Food Additives at CAC49, with six provisions revoked outright, following JECFA advice that the acceptable daily intake could be exceeded

None of those five changed a single word of South African law. All five change what a customer specification, a certification auditor or an importing authority can reasonably ask you for, which is the point this article has been making from the start.

Read next from the ASC Codex set

How do you build a register that answers this question product by product?

One register, one line per requirement, and a review date against every line. The register holds the South African instrument, the Codex or other international text behind it where one exists, the customer or scheme requirement layered on top, the internal owner, the evidence that satisfies it and the date the position was last verified. Anything that cannot be filled in is a gap, not a formatting problem.

The reason this works is that it forces the four routes into the same view. A requirement that came from a gazette and a requirement that came from a buyer’s specification both end up as a line with an owner and an evidence reference. An auditor can be handed the register instead of a folder. A new technical manager can be onboarded from it. And when a customer asks whether you comply with a Codex text, the answer is a row rather than a fortnight of searching.

Where you want the source material rather than the analysis, the three ASC registers are open. The ASC Codex and guidelines register tracks 322 Codex texts and 60 other guidance documents with the 2025 and 2026 change log. The ASC South African legislation register covers 413 instruments across 42 parent Acts. The standards and certification scheme register holds 46 scheme documents and 45 SANS standards. Every Codex text listed is a free download. The ISO and SANS documents must be bought, from the ISO Store and the SABS respectively.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice. Codex texts and South African instruments are amended over time: confirm the current position for your product against the published text or through an ASC regulatory review before acting on it.