Allergen management and Natasha's Law in UK hospitality
General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.
Allergen management under Natasha's Law means accurate labelling, verbal information and cross-contact controls that hold up under scrutiny.
Allergen management means being able to prove, for every dish on the menu, which of the 14 major allergens it contains and how you know that with certainty. The most common way this breaks down is not in the kitchen at all, but in the gap between a recipe change and the allergen matrix that is supposed to reflect it, so a dish that changed a month ago is still described to a customer as though nothing about it has moved.
What the law requires
Allergen management is built on a legal requirement that applies UK-wide, though it reaches food businesses through separate regulations in each nation: the Food Information Regulations 2014 in England, with equivalent instruments in Wales, Scotland and Northern Ireland, all giving effect to the same underlying rules on the 14 major allergens for every dish served, whether it is prepacked or made to order. Since 1 October 2021, food prepacked for direct sale (PPDS) has had to carry a full ingredients list on the label itself, with the 14 allergens emphasised, rather than that information being available only on request at the counter; the Food Standards Agency's PPDS labelling guidance sets out exactly what the label must contain, and the requirement itself sits in the Food Information Regulations 2014.
For anything made to order, the requirement takes a different form but carries the same weight. Verbal information must still be accurate, current and available on request, and it needs to come from someone who genuinely knows the answer rather than someone guessing under pressure at a busy pass. A vague reassurance is not a defence if something goes wrong, and neither is a member of staff who was never trained on the dish in question. The FSA's allergen guidance for food businesses sets out what an adequate system looks like in practice, and it is worth checking your own procedures against it directly rather than assuming they already match.
Where the system breaks down in practice
Most allergen incidents in hospitality trace back to a small number of recurring gaps, and very few of them involve a chef deliberately ignoring an allergy.
- Recipe changes that never reach the allergen matrix, so the document in the kitchen no longer matches what is actually served.
- Supplier substitutions that quietly introduce a new allergen, particularly in sauces, stocks and bought-in components that staff assume are unchanged.
- Verbal information that depends on whichever member of staff happens to be on shift, rather than a consistent, checked answer everyone gives the same way.
- Cross-contact during prep, cooking and service, where a shared fryer, board or utensil undoes an otherwise correctly written recipe.
- Paperwork that is technically up to date on paper but was never checked against the current menu before service began.
Supplier substitutions are a particular risk because they happen upstream of the kitchen, out of sight of the people plating the dish, which is why supplier approval and traceability checks matter as much as anything that happens at the pass.
Building an allergen management system that holds up
Reliable allergen management starts with a single source of truth that every member of staff, on every shift, is working from the same version of. That means an allergen matrix tied to the current menu, not a printed sheet from six months ago, updated on the same day a recipe or supplier changes and signed off before the dish goes back on the pass. A free allergen matrix builder is a reasonable starting point for venues that do not yet have a working version, or whose current one has drifted from what the kitchen actually serves.
That matrix needs to sit alongside clear labelling for PPDS items, so what is printed on the label matches what the matrix says on the day the item is made, not the day the recipe was first written. A recipe costing and allergens system that ties an allergen assessment to each ingredient can mark a dish as unassessed the moment it changes, and food safety software that generates the daily checklists and safer-food-style records around it closes the rest of the gap; neither is much use on its own, because a correct matrix nobody checked today is little better than an outdated one.
Cross-contact controls in the kitchen
Correct information on paper does not help a customer if the dish itself has picked up an allergen during preparation. Shared fryers, boards, utensils and even cloths can carry gluten, nuts or crustacea from one dish to another, and cross-contact is exactly the point where a well-written recipe can still fail in practice, regardless of how carefully the allergen matrix was completed. Dedicated equipment for the highest-risk allergens, clear separation of raw and ready-to-eat prep, and a documented cleaning step between allergen-free and standard dishes all reduce the risk without slowing service down significantly.
Storage matters as well. Ingredients that are decanted into unlabelled containers lose their allergen information the moment they leave the original packaging, which is why labelling in the dry store deserves the same attention as labelling on the pass, not less.
Verbal information and staff training
Verbal allergen information is only as reliable as the training behind it, and training that was delivered once, a year or two ago, to a member of staff who has since left, is not training at all in any meaningful sense. New starters need to know where the allergen matrix is before their first shift, existing staff need refreshers whenever the menu changes, and every session needs to be recorded so it can be shown to an inspector or produced after an incident. Training that scales across a team as it grows is harder to maintain informally than it looks, particularly across multiple sites or a high turnover of seasonal staff.
Recorded training also protects staff directly. A server who can point to a dated record showing they were trained on the current allergen matrix is in a far stronger position than one who was simply told to check with the kitchen when a customer asked a direct question.
Records as your due diligence defence
Allergen incidents that reach a court do not usually turn on whether a mistake happened, but on whether the business can show it had a reasonable system in place and actually followed it. Guidance on the due diligence defence under the Food Safety Act 1990 points to contemporaneous records, kept at the time rather than reconstructed afterwards once something has already gone wrong, as central to that case.
Those records include the allergen matrix in force on the day a dish was served, evidence of staff training, supplier confirmations for ingredients, and any corrective action taken when an error was spotted. Building that habit before it is needed, rather than after, is the substance of a due diligence record-keeping approach that actually stands up when it is tested.
Keeping the matrix, the label and the record aligned
The practical test of an allergen system is whether a recipe change made last month is already reflected in the matrix on the wall, the label on a PPDS item, and the training record for whoever is on shift today, without anyone having to go back and check three separate places. Zynthio covers these as separate modules rather than one combined record: recipe costing and allergens tags each dish against the 14 major allergens and lapses that assessment when an ingredient changes, food safety software carries the daily checklists and safer-food-style records an inspector asks to see, and training keeps a dated, named record of who was shown the current version. Used together they narrow the gap between what the kitchen actually serves and what the paperwork says it serves.
Frequently asked questions
Do we need written allergen information for dishes made to order, or is verbal enough?
Verbal information is legally acceptable for food made to order, but it must be accurate and given by someone who actually knows the answer rather than guessing. Most venues keep a written allergen matrix behind the scenes so staff can check before they answer, which reduces the risk of an inconsistent answer under pressure. Written back-up is not a legal requirement for made-to-order food, but in practice it is what makes verbal answers reliable.
What exactly does Natasha's Law require on a label?
For food prepacked for direct sale, the PPDS label must show the name of the food and a full ingredients list, with any of the 14 major allergens present emphasised, typically in bold. This applies to items such as sandwiches, salads and bakery goods made on-site and packed before a customer orders them, and it has applied since 1 October 2021.
How often should the allergen matrix be updated?
It should be updated every time a recipe, supplier or ingredient changes, not on a fixed schedule such as monthly or quarterly. In practice the person changing the recipe should also be responsible for updating the matrix before the dish goes back on the menu, and someone else should check that the update actually happened.
Who is legally responsible if a customer has an allergic reaction after eating in our venue?
Responsibility sits with the food business, and in a serious incident both the business and, in some cases, individual staff members can face investigation and prosecution. Having a reasonable, documented system in place and demonstrably followed is the basis of the due diligence defence, which is why records matter as much as the initial decision.
Do all 14 allergens need to be checked for every single dish, even simple ones?
Yes. The requirement covers every dish and every one of the 14 major allergens, regardless of how simple the dish looks, because ingredients such as stocks, sauces and garnishes often carry allergens that are not obvious from the dish's name. A dish with no allergens listed should reflect an actual check, not an assumption.