Allergen-Safe Menu Design: Legal Compliance for Chefs

Allergen disclosure is legally required in most major restaurant jurisdictions. The lists vary slightly (EU 14, US Big 9, FSANZ 11, UK Natasha's Law), but the operational implication converges: every kitchen needs ingredient-level allergen knowledge per dish, cross-contact protocols, and a way to answer a server's "anyone with peanut allergy?" question instantly. Here's what each region requires, what the practices have in common, and how to design a menu that complies without becoming theatre.

The regulatory landscape

European Union — 14 allergens

Under EU Food Information for Consumers Regulation 1169/2011, food businesses must disclose 14 specified allergens when present:

Cereals containing gluten · Crustaceans · Eggs · Fish · Peanuts · Soybeans · Milk · Nuts (tree nuts) · Celery · Mustard · Sesame · Sulphur dioxide and sulphites (>10 mg/kg) · Lupin · Molluscs.

Required disclosure is at the point the food is offered for sale — menu, board, verbal on request. Pre-packed food has it on the label; non-pre-packed (restaurants) must be disclosable on request.

United States — Big 9

The FDA's Food Allergen Labeling and Consumer Protection Act (FALCPA), expanded by the FASTER Act 2021, defines 9 major allergens: Milk · Eggs · Fish · Shellfish (crustaceans) · Tree nuts · Peanuts · Wheat · Soybeans · Sesame.

Restaurants aren't held to the same packaged-food labeling standard but state-level requirements vary. Several states (Illinois, Massachusetts, others) have allergen training requirements for restaurant staff.

Australia / New Zealand — FSANZ Standard 1.2.3

Allergen declarations required under Food Standards Code 1.2.3. The PEAL/PEANUT/etc. list closely tracks the EU 14 with regional variations (e.g. sesame, soy, fish all listed).

United Kingdom — Natasha's Law (2021)

Following the death of Natasha Ednan-Laperouse from undisclosed sesame in a pre-packed sandwich, the UK introduced stricter PPDS (Pre-Packaged for Direct Sale) requirements: full ingredient list with allergens emphasised must be on the label of any food packaged on premises for direct sale. For restaurant à la carte, the same 14 allergens as the EU framework apply, with greater operational scrutiny since the law passed.

The practical convergence

Across all major frameworks, the operational requirement is the same: every dish, every ingredient — including sub-recipes and sauce components — needs to be allergen-mapped, and the information must be reliably retrievable when a guest or staff member asks. The specific list varies in length (9-14 items); the discipline doesn't.

Where chefs get it wrong

Sub-recipes that hide allergens

The lamb dish has no nuts. But the dukkah garnish (sub-recipe) has hazelnuts. The dressing on the side salad (sub-recipe) has mustard. The bread served alongside has wheat and sesame seeds. The menu shows "Lamb shoulder" with no allergen notation, because the chef listed only what they consider "in the dish" — and forgot the sub-recipe components count.

This is the single most common allergen disclosure failure. The fix is structural: any allergen present in a sub-recipe is automatically present in the parent recipe. Allergen mapping must cascade through sub-recipes.

Cross-contact assumed away

The recipe doesn't contain peanuts. But the same fryer cooked peanut-coated prawns yesterday. The same chopping board cut prawns this morning. The same tongs handled the bread basket with sesame seeds. Cross-contact (sometimes called cross-contamination, though the technical distinction matters for severe allergies) is the failure mode that turns a "peanut-free" dish into anaphylaxis.

Disclosure isn't enough; the kitchen needs a cross-contact protocol: dedicated boards, separate fryers or hot-fresh oil change, washed-down stations, gloves changed between handling.

Self-described "natural" or "may contain" hedging

"May contain traces of nuts" on the menu is sometimes a real protective disclosure, more often a legal cover for not actually knowing. Increasingly regulators view blanket "may contain" hedging as inadequate — if you genuinely cannot guarantee absence, you should say "this dish contains" or "this kitchen processes" with specifics. Vague hedging is being phased out by tighter regulation.

Verbal disclosure inconsistency

A guest asks the server about nuts in dish X. Server walks to kitchen. Chef says "no nuts." But the chef didn't check the dukkah sub-recipe. The guest eats the dish and reacts. The chef is liable. The server is liable. The restaurant is liable.

Verbal disclosure is the highest-risk channel because it depends on real-time recall under pressure. Written reference (allergen card per dish, accessible at the pass) reduces this risk substantially.

The free-from menu lens

Separate from individual-dish allergen disclosure, many kitchens benefit from a "free-from menu" capability: instantly producing a printable menu that contains only dishes free of specified allergens (e.g. for a coeliac group booking, a peanut-free children's birthday, a vegan-vegetarian event with mixed dietary needs).

The mental model: rather than ask the kitchen to invent gluten-free versions of every dish on the fly, identify which existing dishes are naturally gluten-free, and present that filtered list. This is faster, lower-risk, and more transparent than menu modifications.

Doing this manually requires re-reading every recipe's full ingredient list (including sub-recipes) per dietary request — slow and error-prone. Doing it systematically requires per-ingredient allergen flags that cascade through sub-recipes, and a filter that produces the result.

The 7 disclosure-and-control protocol

1. Per-ingredient allergen tagging. Every ingredient in your master list has explicit allergen flags. "Wheat flour" → gluten. "Almond" → tree nut. "Sesame seed" → sesame. No assumptions, explicit per-ingredient.
2. Sub-recipe cascade. When a recipe uses a sub-recipe, the sub-recipe's allergens automatically appear in the parent recipe's allergen list. This is structural in good costing/recipe software; manual in spreadsheets (and that's where errors creep in).
3. Per-dish allergen card at the pass. Allergen chips/icons visible at-a-glance for the chef during service.
4. Server reference — print the dish-level allergen matrix in a binder behind the bar. Servers consult, don't recall from memory.
5. Cross-contact protocol — written, posted, trained. Dedicated boards, fryer policy, glove changes, allergy ticket flag through the chit system.
6. Allergy ticket flag — POS or chit system must flag an allergy clearly; the kitchen must visibly acknowledge it (some kitchens use a separate red ticket holder).
7. Free-from print capability for group bookings — filter the existing menu by free-from criteria, print, hand to the host.

What "naturally free-from" beats "modified"

Two approaches to serving an allergic guest:

1. Modify an existing dish — "we can do the steak without the blue cheese butter." High-risk: requires real-time recipe modification, communicating through the line, the modification reaching every cook who touches the dish, no cross-contact from the original recipe's other components.
2. Recommend a naturally-free dish — "the lamb tagine has none of those allergens; would you like that?" Low-risk: the dish has been costed, prepped, and trained with the relevant ingredients only; no modification required.

The naturally-free approach is operationally safer and faster, but requires you to know which dishes are naturally free of which allergens — which brings you back to the structural mapping above. Without that mapping, every allergic guest forces option 1, which is where most allergen incidents originate.

What this looks like in practice

What to do this week

1. Audit your ingredient master for allergen flags. Are all 9-14 allergens explicitly tagged? Missing flags = silent risk.
2. Identify your top 10 dishes. Walk each one ingredient-by-ingredient (including sub-recipes) and write down all allergens present. Compare to your menu's current allergen disclosure. Reconcile gaps.
3. Build per-dish allergen cards. One card per dish, allergens listed by full name (not by code or icon only). Laminate. Mount at the pass.
4. Write a cross-contact protocol. One page. Post it. Train it. Annual refresher.
5. Identify 3-5 "naturally free-from" dishes on your current menu for each major allergen profile (gluten, dairy, nuts). These are your fast safe recommendations.
6. Brief your servers. When a guest declares an allergy: don't recall, refer. Pull the card, talk to the kitchen, confirm specifically.

The point

Allergen disclosure is a legal requirement in most major restaurant jurisdictions, but compliance isn't the real goal — keeping allergic guests safe is. The structural difference between a kitchen where allergic guests have a calm reliable experience and one where they're at risk isn't the chef's knowledge or care. It's whether the allergen information lives in someone's head or in a system anyone can reach.

Build the system: per-ingredient flags, sub-recipe cascade, per-dish cards, cross-contact protocol, naturally-free-from recommendations, server reference. None of it is expensive. All of it is the baseline that the lawsuits, deaths, and regulatory tightening of the last decade have made clear is the new minimum standard.

That's not a constraint on creative cooking. It's the foundation that lets creative cooking happen safely.