Allergen Management Systems for UK Food Businesses: Building One That Works
An allergen management "system" is not just a spreadsheet or a label. It is the complete set of processes by which your business identifies, documents, controls and communicates allergen information across every product you make and sell. For small food businesses in the UK, building an allergen management system that works — and that stands up to scrutiny from an environmental health officer — requires getting six distinct components right. This guide walks through each of them.
What an allergen management system includes
The term "allergen management system" sounds formal, but the concept is straightforward: it is the whole process by which your business ensures that allergen information is accurate and consistently communicated. The FSA's allergen guidance for food businesses identifies six core components that any effective allergen management system should include.
1. Ingredient information
Your allergen management system starts with knowing what is in everything you use. This means obtaining and recording allergen declarations for every ingredient and bought-in product in your inventory — including compound ingredients like sauces, spice blends and pre-made bases. Your ingredient information database is the foundation: if the data here is wrong or incomplete, every downstream process built on it will also be wrong.
2. Recipe allergen data
Once you have accurate ingredient allergen data, you need to calculate the allergen profile of each recipe you produce. This means tracking allergens through every level of a recipe — including sub-ingredients in compound products — to produce an accurate, up-to-date allergen declaration for every finished product. Recipe allergen data must be updated every time a recipe changes and every time an ingredient's allergen profile changes.
3. Cross-contamination controls
Allergen management is not only about declared allergens. It also requires assessing and controlling the risk of unintentional cross-contamination — allergens that might enter a product through shared equipment, shared production lines, airborne dust, or proximity to allergen-containing ingredients during storage. Cross-contamination controls include physical separation of allergen-containing materials, cleaning protocols between production runs, and decisions about when to apply a precautionary "may contain" label.
4. Labelling process
Your allergen management system must include a documented process for producing accurate allergen labels for every product — whether that is PPDS labelling under Natasha's Law, pre-packed labelling for manufactured products, or making allergen information available for loose or made-to-order food. The labelling process must include a step to verify that every label accurately reflects the current recipe before the product is offered for sale.
5. Staff training
The best allergen management procedures are only as effective as the people following them. Every member of staff involved in food preparation, production, labelling or customer service needs to understand their role in the allergen management system — what they are responsible for, what they should do if they notice an error or a change that might affect allergen information, and how to respond to customer allergen queries. Training must be documented and refreshed when processes change.
6. Documentation and records
An allergen management system that exists only in people's heads is not a system — it is a collection of intentions. Documentation is what turns good intentions into a defensible, auditable process. Records should include: supplier allergen declarations, recipe allergen calculations, label version history, staff training records, and records of any allergen incidents or near-misses. These records are what an EHO will ask to see during an inspection, and they are what you will need if you ever have to defend your procedures following an allergen incident.
Legal requirements for allergen management in the UK
UK allergen law is not a single piece of legislation — it is a framework of overlapping regulations, each imposing specific obligations. Understanding which laws apply to your business, and what they specifically require, is the starting point for building a compliant allergen management system.
The Food Information Regulations 2014 (FIR 2014) are the primary allergen labelling legislation in the UK. They implement the requirements of EU Regulation 1169/2011 (retained in UK law post-Brexit) and require declaration of the 14 major allergens whenever they are present as an ingredient or sub-ingredient in any food product. For packaged food, allergens must be emphasised (typically in bold) within the full ingredients list. For loose or unpackaged food, businesses must make allergen information available on request — either in writing or verbally — and must have a documented procedure for providing it.
Natasha's Law, which came into force on 1 October 2021, amended FIR 2014 to require full ingredient and allergen labelling on all food that is pre-packed for direct sale (PPDS). This was the most significant change to UK allergen labelling law since the original 2014 regulations, and it affects a wide range of small food businesses that previously did not need to label their products. If you sell food that you package on your own premises before the customer orders it — sandwiches, cakes, ready meals, meal prep boxes — Natasha's Law almost certainly applies to you. See our Natasha's Law complete guide for full details.
The FSA's Allergen Guidance for Food Businesses is not legislation, but it sets out the Food Standards Agency's expectations for how businesses should manage allergens in practice. Environmental health officers use this guidance as a benchmark when assessing whether a business's allergen management is adequate. Following the guidance provides a strong defence against enforcement action and helps demonstrate due diligence if an allergen incident occurs.
Local authority enforcement is the practical reality of allergen law. Environmental health officers have powers to inspect food businesses, review records, sample products and take enforcement action for non-compliance. Enforcement priorities vary by local authority, but allergen management has become a higher priority for EHOs in the years since Natasha's Law came into force, particularly for food businesses that sell PPDS products or have complex allergen profiles.
Building your allergen information database
The allergen information database is the engine of your allergen management system. Without accurate, comprehensive ingredient allergen data, you cannot produce accurate recipe allergen declarations, and without accurate recipe declarations you cannot produce accurate labels. Getting this foundation right is the most important single step in building your allergen management system.
Getting allergen declarations from suppliers
For every ingredient or bought-in product you use, you need a current allergen declaration from the supplier. This should be a formal document — typically a product specification sheet or a separate allergen statement — that confirms which of the 14 major allergens are present in the ingredient and, where relevant, which are present due to cross-contamination risk. Verbal confirmations from sales representatives are not adequate and should not be recorded as your primary allergen evidence.
When requesting supplier allergen declarations, ask for: the full ingredients list for the product; a confirmed allergen declaration covering all 14 UK allergens; any cross-contamination risks (i.e., allergens present in the facility but not as ingredients); and a statement that you will be notified of any reformulation or change to the allergen status of the product. Not all suppliers will proactively notify you of changes — build a process for regular review.
What to check when you receive a declaration
Do not simply file supplier declarations without reading them. Check that the declaration covers all 14 UK allergens (not just the most common ones). Check that it matches what you know about the ingredient — if a declaration says "contains: none" for a product you suspected might contain soy, investigate before accepting it. Check the date — an undated or old specification may not reflect the current product formulation. And check that the supplier contact details are included so you can query anything that is unclear.
What to do when suppliers change ingredients
This is one of the highest-risk points in allergen management. A supplier reformulation can silently introduce a new allergen into a product you have been using for years — and your allergen declaration will not reflect the change unless you catch it. Build a process for identifying supplier changes: check product labels when new deliveries arrive, set up supplier notification agreements where possible, and conduct a scheduled review of all supplier specifications at least annually. Any change should trigger a review of every recipe that uses the affected ingredient.
Using barcode scanning to speed up data entry
For food businesses with large ingredient inventories, manually entering allergen data for every ingredient is time-consuming. FoodCore's barcode scanning feature allows you to scan a product barcode and pre-populate the ingredient record with allergen data — dramatically reducing setup time. This is particularly useful for businesses that regularly add new ingredients to their inventory. See how this works as part of FoodCore's broader recipe management software.
Recipe allergen management
Once your ingredient database is accurate and complete, the next step is calculating the allergen profile of each recipe. This is where most allergen errors occur in practice — not in the ingredient data itself, but in the translation of ingredient data into recipe-level allergen information.
Ingredient-level tracking vs recipe-level tracking
Recipe-level allergen tracking means recording allergens at the finished product level — maintaining a list that says "Product A contains: milk, eggs, wheat". This approach is quick to set up but breaks down in two common situations: when an ingredient changes (you must manually check which products are affected and update each one) and when you add a new ingredient (you must manually check every recipe it goes into and update each one). The risk of missing an update is high.
Ingredient-level tracking means recording allergens for each individual ingredient and automatically calculating the allergen profile of every recipe based on the ingredients it contains. When an ingredient's allergen profile changes, every affected recipe updates automatically. This is the approach taken by purpose-built allergen management software — and it is the only approach that provides reliable allergen accuracy at scale. For an overview of how software supports this, see our post on allergen management for food businesses.
Why ingredient-level tracking is essential
Consider a business with 40 recipes, 12 of which contain a bought-in stock paste. If the supplier changes the formulation of that paste and adds celery (a major allergen), with ingredient-level tracking the change is made once — to the stock paste ingredient record — and all 12 affected recipes update automatically. With recipe-level tracking, someone must manually identify all 12 recipes, update each one, and then regenerate or reprint the labels for each affected product. In a busy kitchen, this manual process is precisely where allergen errors go undetected.
Handling compound and sub-recipes
Many recipes contain compound ingredients — bought-in products with their own sub-ingredient lists, or in-house sub-recipes (a sauce, a pastry base, a spice blend) that are used in multiple finished products. Your allergen management system must handle multi-level ingredient nesting correctly. This means tracking allergens through sub-recipes to finished products, and ensuring that a change in a sub-recipe propagates through to every finished product that uses it. FoodCore's allergen matrix software handles this automatically through unlimited recipe nesting levels.
Cross-contamination controls
Cross-contamination — the unintentional transfer of allergens from one product or surface to another — is a significant allergen risk for food businesses that produce both allergen-containing and allergen-free products, or that work with highly allergenic ingredients like nuts, sesame or gluten.
The difference between "contains" and "may contain"
A "contains" declaration on a food label means that allergen is intentionally present as an ingredient in the recipe. This is a mandatory declaration under UK food law and must appear in the full ingredients list with the allergen name emphasised. A "may contain" statement is a voluntary Precautionary Allergen Label (PAL) indicating a risk of unintentional cross-contamination — meaning the allergen is not in the recipe, but may be present in the product due to the production environment.
"May contain" should only be used where there is a genuine, assessed cross-contamination risk that cannot be adequately controlled. It should not be used as a blanket disclaimer to avoid managing cross-contamination properly. The FSA's guidance on Precautionary Allergen Labelling (PAL) makes clear that "may contain" should not be applied without an allergen risk assessment demonstrating that cross-contamination risk exists and cannot be practically eliminated.
When to use a precautionary allergen label
You should consider applying a "may contain" label when: the same equipment is used for allergen-containing and allergen-free products without validated cleaning in between; allergen-containing and allergen-free ingredients are stored in proximity in a way that creates a contamination risk; airborne allergen particles (for example, from flour) could deposit on products that do not contain that allergen as an ingredient; or you cannot fully control the allergen status of a raw material from a supplier whose production facilities handle multiple allergens.
Equipment cleaning between allergen runs
If you produce allergen-free products on equipment also used for allergen-containing products, your cleaning protocol must be capable of reducing allergen residues to an acceptable level. "Acceptable" depends on the allergen and the claim you are making. For a general "no nuts added" product, a thorough wash with hot soapy water may be sufficient. For a product making a "gluten-free" claim under the legal threshold (less than 20ppm), you will need to validate that your cleaning procedure achieves the required reduction. Validation typically involves allergen swab testing of cleaned surfaces before production of the allergen-free product.
Storage segregation
Allergen-containing ingredients should be stored separately from allergen-free ingredients, ideally in sealed containers and on separate shelves. Loose allergens — nuts, sesame seeds, flour — are particularly risky because they can transfer through spillage, scooping or airborne dispersal. Label all storage containers clearly, and train staff to return allergen-containing ingredients to their designated storage areas after use.
Allergen labelling
Labelling is the point at which your allergen management system communicates with your customers. For food businesses selling PPDS food, allergen labelling under Natasha's Law is a specific legal requirement: every PPDS product must carry a full ingredients list with all 14 allergens emphasised in bold. For pre-packed manufactured food sold to retailers or other businesses, different labelling rules apply but the requirement for allergen emphasis is the same.
PPDS requirements
Under Natasha's Law, every PPDS product — food that is packaged at the same premises where it is sold, before the customer orders it — must display: (1) the name of the food, and (2) a full ingredients list in descending order by weight with allergens emphasised. This applies regardless of business size, and there is no exemption for sole traders, home bakers or market stalls. For a detailed breakdown of exactly what a compliant PPDS label must include, see our Natasha's Law complete guide.
Software that generates labels automatically
Generating labels manually — from a Word template or Canva design — creates a structural risk: the label is a separate document from the recipe, and the two can fall out of sync when a recipe changes. Purpose-built food labelling software generates labels directly from recipe data, so the label always reflects the current recipe. Allergens are automatically bolded within the ingredients list, and the list is automatically ordered by weight. When a recipe changes, the label updates immediately. FoodCore's Natasha's Law labelling software is built specifically for this purpose, designed for small UK food businesses that need reliable PPDS label generation without a compliance team.
Staff training and competency
A well-designed allergen management system can still fail if the people responsible for implementing it lack the knowledge to do so correctly. Staff training is a legal requirement — the FSA's allergen guidance requires that all food handlers receive appropriate instruction and training in food allergen management relevant to their role.
Minimum training requirements
All staff involved in food preparation, production, labelling or customer service should be able to: identify the 14 major allergens by name; understand what the business's allergen management procedures require of them specifically; know how to respond if a customer asks about allergens in a product; know what to do if they notice an error in allergen information or a change that might affect a product's allergen profile; and know not to make assumptions about allergen status — if in doubt, check.
For staff who interact directly with customers, training should also cover how to handle allergen requests from customers with serious allergies — including when it is appropriate to say "I don't know, let me find out" rather than giving a potentially incorrect answer.
Documenting training
Training records must be kept for every member of staff, showing what training they received and when. A signed training record for each staff member is the minimum documentation requirement. Records should be dated and should specify the content covered, not just "allergen training". If you use a third-party training provider or an online course, keep a record of the course certificate or completion confirmation.
Refresher training when recipes or processes change
Training is not a one-time event. Any time a significant change is made to the menu, recipes or allergen management procedures, relevant staff should receive a briefing on what has changed and what it means for their role. Changes that always require a training refresh include: introduction of a new major allergen into the menu, a change to cross-contamination procedures, a new product that introduces new allergen risks, and any allergen incident or near-miss that reveals a gap in existing procedures.
Allergen audit and review
An allergen management system is only effective if it is maintained. Regular audit and review is what ensures your system remains accurate and current as your business evolves.
How often to review
At a minimum, a full review of your allergen management system should take place annually. This review should cover: whether all supplier allergen declarations are current and match the products you are currently using; whether recipe allergen data is accurate and up to date; whether cross-contamination controls are still appropriate for your current production environment; whether labelling is correct for your current product range; and whether training records are complete and current.
What triggers an out-of-cycle review
Several events should trigger an immediate allergen review outside the scheduled annual cycle: a new supplier or a change of supplier for an existing ingredient; a supplier notification that a product has been reformulated; a new product being introduced to your range; a significant change to your production processes (new equipment, changes to layout, new shared processes); any customer allergen complaint; and any near-miss identified internally — for example, an error in a label that was caught before the product was sold.
Documentation of reviews
Every allergen review should produce a written record: when the review took place, what was reviewed, what was found, and what action was taken. This documentation demonstrates to an EHO that your allergen management is an active, maintained process — not a one-off setup that has been left to go stale. It is also crucial evidence if an allergen incident occurs after a review has taken place, demonstrating that your procedures were current and appropriate.
Digital vs paper allergen management systems
Small food businesses typically manage their allergen information in one of three ways: paper records and manual labels, spreadsheets, or purpose-built allergen management software. Each approach has a different risk profile and different implications for what an EHO will see when they inspect your business.
Paper records and manual labels are the highest-risk approach. There is no automatic link between ingredient data and recipe data, no automatic link between recipe data and labels, and no version control. Updates require manually finding and editing multiple documents. The risk of a label falling out of sync with the current recipe is high, and the risk of an allergen being missed in a manual calculation is significant.
Spreadsheets are an improvement over paper records if well-designed, but still carry significant risks. A well-constructed allergen spreadsheet can link ingredient allergen data to recipe calculations, but it requires careful maintenance and discipline to keep current. Spreadsheets have no version history, no audit trail, and no alert when an ingredient changes. For businesses with more than 10–15 recipes or a regularly changing menu, spreadsheet-based allergen management becomes increasingly risky as complexity grows.
Purpose-built allergen management software provides ingredient-level tracking with automatic propagation to recipes, automatic label generation, audit trails and version history. An EHO reviewing a business using purpose-built software will typically find it easier to verify that allergen information is current and accurate — because the records are structured, timestamped and complete. For any food business subject to Natasha's Law or with a complex recipe range, software is now the de facto standard for allergen management. FoodCore's allergen matrix software is designed specifically for this purpose, with all six components of an allergen management system built in.
Allergen management system: frequently asked questions
What is an allergen management system?
An allergen management system is the complete set of processes, records, controls and communications your business uses to identify allergens in every product you sell and ensure that information is accurate, up to date and properly communicated to customers. It encompasses your ingredient information database, recipe allergen records, cross-contamination controls, labelling procedures, staff training programme and documentation review cycle.
Is an allergen management system legally required?
UK food law does not require a specific "allergen management system" by name, but the obligations it imposes effectively require one. The Food Information Regulations 2014, Natasha's Law and the Food Safety Act 1990 together require food businesses to accurately declare allergens, maintain accurate ingredient records, label PPDS food with full ingredient and allergen information, and have documented procedures to demonstrate how compliance is maintained. An EHO inspecting your business will assess whether your allergen management is systematic and documented.
How often should I update my allergen information?
Your allergen information should be updated every time anything changes that could affect the allergen profile of a product — including a new ingredient, a supplier change, a recipe reformulation, or a change to your production processes. Beyond reactive updates, best practice is to conduct a full review of all product allergen information at least every 12 months, or more frequently if your menu or product range rotates regularly.
What should I do if a customer has an allergic reaction?
If a customer reports an allergic reaction after consuming your food: (1) ensure the customer gets appropriate medical help immediately; (2) retain a sample of the product and the batch if possible; (3) record all details of the incident; (4) review the product's allergen declaration against the actual ingredients used; (5) notify your local authority environmental health team — you are legally required to cooperate with any investigation. Do not destroy records or products until the incident has been fully investigated.
Do I need separate equipment for allergen-free products?
You are not legally required to have dedicated equipment for allergen-free production, but if you claim a product is free from a specific allergen, you must be able to substantiate that claim. If you share equipment between allergen-containing and allergen-free production, you must validate that your cleaning procedures eliminate cross-contamination to an appropriate level. For high-risk claims such as gluten-free products for coeliac customers, dedicated equipment or validated cleaning is strongly recommended.
What does "may contain" mean legally?
"May contain" is a Precautionary Allergen Label (PAL) used to warn consumers of the risk of unintentional allergen cross-contamination. There is no legal requirement to use "may contain" statements — they should only be used where there is a genuine, assessed risk of cross-contamination that cannot be eliminated. "May contain" does not replace the mandatory ingredients list and allergen declaration, and should not be used as a catch-all to avoid managing allergen risks properly.
Further resources
- FSA allergen guidance for food businesses
- Natasha's Law complete guide for UK food businesses
- Allergen management checklist for food businesses
- Allergen management in small kitchens
- FoodCore allergen matrix software
- FoodCore food labelling software
- FoodCore Natasha's Law labelling software
- FoodCore recipe management software
FoodCore is kitchen management software built for small UK food businesses. We handle recipe costing, Natasha's Law labels, allergen matrices and order tracking.
Get started free →