Guide

GFCO Gluten-Free Certification: The 10 ppm Standard, Validation and the Programme Auditors Actually Want

Gluten-free is one of the few claims in food where the certification mark drives shelf placement and where regulators set a hard numerical threshold. FDA 21 CFR 101.91 and EU Regulation 828/2014 both define 'gluten-free' as below 20 ppm. The Gluten-Free Certification Organization (GFCO), the largest third-party gluten-free certifier in North America, sets a stricter 10 ppm threshold and runs an annual audited programme covering ingredient sourcing, segregation, testing and recordkeeping. For a bakery, snack manufacturer, cereal, pasta, brewery or oat processor, GFCO is the most-recognised mark in US natural and grocery retail. This guide is the operating manual for getting through the audit and holding the certificate year over year.

Start free trial Free trial, no credit card, onboard in days, not months.

The two thresholds: regulatory 20 ppm vs GFCO 10 ppm

Under FDA 21 CFR 101.91 a food bearing the 'gluten-free' claim must contain less than 20 ppm gluten. EU Regulation 828/2014 uses the same 20 ppm threshold for 'gluten-free' and a 100 ppm threshold for 'very low gluten'. The Codex Alimentarius standard CXS 118-1979 also sets 20 ppm. GFCO's programme requires finished product to test below 10 ppm — a deliberate margin against the legal limit so a positive lot doesn't immediately breach the regulatory floor. Certifying to GFCO therefore means designing the programme to a 10 ppm operating limit, with action levels triggered well below that.

Validation testing — the R5 ELISA method and why it matters

GFCO requires gluten testing using a method validated against the AOAC International or AACCI gold standard — in practice the R5 Mendez ELISA (R-Biopharm RIDASCREEN Gliadin) is the reference. Cocktail ELISA is acceptable for hydrolysed and fermented products (beer, sourdough, soy sauce) where R5 alone underreads. Lateral flow tests are acceptable for environmental and in-process screening but not for finished-product release decisions. The test plan must cover every finished SKU at a defined frequency (typically one lot per SKU per production run for the first six months, then risk-based), plus incoming high-risk ingredients (oats, naturally gluten-free flours, shared-equipment ingredients).

Segregation: receiving, storage, production, packaging

Cross-contact is the failure mode that ends gluten-free programmes. GFCO expects documented segregation across the whole flow: dedicated receiving lanes or scheduling for gluten-containing materials, physical separation in storage (dedicated rooms, sealed bins, colour-coded scoops), dedicated lines where possible and scheduled changeovers where not, captive utensils, dust control (gluten flour aerosolises and settles for hours), and packaging on dedicated or thoroughly cleaned equipment. A mixed-facility plant must demonstrate the changeover cleaning validation that gets the line from gluten-containing to below 10 ppm — typically wet cleaning to a documented standard with rinse sampling at first-product.

Supplier control — ingredient declarations and oats

Every ingredient must have a supplier declaration covering gluten status, including a statement on shared-equipment and shared-facility exposure. Oats are the special case: naturally gluten-free but contaminated with wheat, rye or barley in the field, in transport and at the mill. GFCO accepts only purity-protocol oats or mechanically/optically sorted oats that test below 10 ppm — and the certificate covers the oat supply specifically. Naturally gluten-free flours (rice, corn, sorghum, tapioca, cassava, almond, chickpea) all carry field and mill cross-contact risk and require supplier testing or certificates.

Labelling: claim, mark, allergen statement

FDA 21 CFR 101.91 governs the 'gluten-free' claim itself; it can sit anywhere on principal display panel or information panel. The GFCO mark is a trademarked artwork with placement and clear-space rules in the GFCO Brand Standards Manual — a non-conforming mark can fail the annual audit on labelling alone. Wheat is still a Big 9 allergen under FALCPA / FASTER Act even when the product is gluten-free (e.g. wheat starch processed to below 20 ppm) — the 'Contains: Wheat' allergen statement is still required if wheat-derived ingredients are present. This catches first-time certifiers regularly.

The annual GFCO audit — what to expect

GFCO uses approved certification bodies (NSF, SCS Global Services and others) for on-site audits. The first audit is full-scope and covers the GFCO Manufacturing Standard, the test plan, supplier declarations, segregation, cleaning validation, label artwork, training and management of change. Surveillance audits run annually. Expect a document review day (Food Safety Plan, gluten-free programme, test records by SKU and lot, supplier files, changeover records) and a plant walk on production day including a changeover observation if scheduled. Findings are graded; major findings need closure before the mark can be renewed.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

HACCP

Food-safety framework that identifies hazards and the critical points where they must be controlled.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Food safety QMS

Gluten-free programme on one spine with FSMA and GFSI.

Audits & CAPA

Annual GFCO audit run from the platform.

Document control

Cleaning validation, label artwork and SOPs version-controlled.

Supplier control

Gluten-status declarations and oat purity certificates.

Industries this hits hardest

Bakery & confectionery Food & beverage Ingredients & dry mixes

Frequently asked

Do I have to test every lot for gluten under GFCO?

Not after the initial period. GFCO requires every finished SKU to be tested at start-up; after a documented track record (typically six months of compliant results) a risk-based plan is acceptable — frequency by line, SKU, ingredient risk and historical results. The plan must be in writing, justified, and reviewed annually.

Can I run a GFCO-certified product on shared equipment?

Yes, but you must validate the changeover cleaning to demonstrate residual gluten below 10 ppm in first-product, and run a documented line clearance and LFT or R5 verification on every changeover. Many sites move to dedicated lines after the first surveillance audit because the changeover verification cost outweighs the equipment cost.

Is GFCO certification recognised in the EU?

GFCO is a North American mark; in the EU 'gluten-free' is governed by Regulation 828/2014 and most retailers accept any compliant 20 ppm claim with their own private-label oversight. AOECS Crossed Grain (the European licensed symbol) is the EU equivalent of GFCO. A manufacturer supplying both markets typically holds both certifications — the underlying programme is the same; the audit and the mark differ.

Does the FALCPA wheat allergen statement still apply if the product is gluten-free?

Yes, if any wheat-derived ingredient is present (e.g. wheat starch processed to below 20 ppm). FALCPA cares about wheat as an allergen, not about gluten level. The 'Contains: Wheat' statement still appears and FDA has not exempted gluten-free claim products from FALCPA labelling.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →