Does food exported to the EU have to come from an EU-authorised establishment?

For food of animal origin – yes, in most cases. See the list of approved establishments.

For food of non-animal origin –not necessarily. In many cases, the exporting business must simply be known to the importer and accepted as a supplier of food into the EU.

For food containing plants or plant products covered by EU plant-health rules – no, but exporters must obtain a phytosanitary certificate issued by the national authorities in their country.