Skip to main content
All Articles
POSSep 18, 2026

The 14 allergens: a reference for UK menus and kitchen teams

UK food law names 14 allergens that food businesses must declare when they are used as ingredients: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulphur dioxide and sulphites (above 10mg/kg or 10mg/litre), and tree nuts. The list comes from Annex II of Regulation (EU) No 1169/2011 on food information to consumers, which still applies across the UK, as assimilated law in Great Britain.

Restaurants, cafés, pubs and hotel kitchens have to tell customers when any of these is in the food or drink they serve. Some people react to other foods as well and need to ask about them; the legal duty to declare covers these 14.

What are the 14 allergens?

The descriptions follow Annex II and the FSA's Safer Food, Better Business pack for caterers, which is also the source of the examples of where each allergen turns up.

AllergenWhat it includesWhere it often turns up
CeleryCelery stalks, leaves and seeds, and celeriacSalads, soups, celery salt and some meat products
Cereals containing glutenWheat (including spelt and khorasan), rye, barley and oats, and their hybridsBread, pasta, pastry, batter, breadcrumbs, sauces, soups, stock cubes and food dusted with flour
CrustaceansPrawns, crab, lobster, scampi and shrimp pasteSeafood dishes and sauces made with shrimp paste
EggsEggs and egg productsCakes, mousses, sauces, pasta, quiche, mayonnaise and food brushed with egg
FishFish and fish productsSome salad dressings, pizzas, relishes, fish sauce, and some soy and Worcestershire sauces
LupinLupin seeds and flourSome breads and pastries
MilkMilk and milk products, including lactoseYoghurt, cream, cheese, butter, milk powder and milk glazes
MolluscsMussels, oysters, whelks, squid and land snailsSeafood dishes and oyster sauce
MustardLiquid mustard, mustard powder, mustard seeds and mustard cressDressings, marinades, soups, sauces, curries and meat products
PeanutsPeanuts and their products, a separate allergen from tree nutsSauces, cakes and desserts, groundnut oil and peanut flour
SesameSesame seeds and their productsBread, breadsticks, tahini, houmous and sesame oil
SoybeansSoya, including tofu, edamame, tempeh, soya flour and textured soya proteinSome ice cream, sauces, desserts, meat products and vegetarian products
Sulphur dioxide and sulphitesAbove 10mg/kg or 10mg/litre, measured as total sulphur dioxide in the product as consumedMeat products, fruit juice drinks, dried fruit and vegetables, wine and beer
Tree nutsAlmonds, hazelnuts, walnuts, cashews, pecans, Brazil nuts, pistachios and macadamia (Queensland) nutsSauces, desserts, crackers, bread, ice cream, marzipan, ground almonds and nut oils

Which allergens need extra care on a menu?

  • 'Cereals containing gluten' refers to the grains themselves, so name the grain, such as wheat or barley, and remember that spelt and khorasan are types of wheat.
  • Peanuts and tree nuts are separate allergens. Record them separately, and name the tree nut, for example almond or walnut.
  • Crustaceans and molluscs are separate too. Prawns and crab are crustaceans, while mussels, oysters and squid are molluscs.
  • Sulphites only have to be declared above 10mg/kg or 10mg/litre, so check wine, beer and dried fruit against the supplier's label.
  • Annex II exempts some highly processed derivatives, such as fully refined soybean oil, wheat-based glucose syrups and fish gelatine used to fine beer and wine. Check the exact wording before relying on an exemption.

What does the law require for food served in restaurants?

For non-prepacked food, such as meals in a restaurant or loose items on a counter, you must supply allergen information for every item that contains any of the 14 allergens. You can give it in writing or verbally. If staff give it verbally, a clear notice must tell customers where to find it, for example by asking a member of staff. However it is given, the information must be accurate and current.

Food that is prepacked for direct sale, meaning packed on your premises before the customer chooses it, needs a full label with the 14 allergens emphasised in the ingredients list. Our guide to Natasha's Law and PPDS food explains which products that covers. For phone and online orders, allergen information has to be available before the order is placed and again when the food is delivered.

The FSA's guidance covers England, Wales and Northern Ireland. Food Standards Scotland publishes guidance for businesses in Scotland.

What does the FSA's 2025 best practice guidance recommend?

In February 2025 the FSA published best practice guidance on allergen information for non-prepacked food. It recommends that written information covering all 14 allergens is easily available, supported by a conversation in which staff ask about the customer's requirements. The guidance says businesses are not required by law to follow it, and the legal minimum has not changed. In its annual science update for the September 2026 board meeting, the FSA said it is evaluating the guidance and that the findings will inform the design of future legislation, so check for changes.

Suggested formats include allergen information on the menu, a separate allergen matrix, or a label beside food on a counter, such as 'Chicken salad (contains: milk, egg, mustard)'. The guidance also recommends a written process so a customer's requirement reaches the person preparing the food, and the FSA offers free allergy symbols and signs to download. Our guide on how to build an allergen matrix sets out the matrix format step by step.

When should a kitchen use 'may contain' warnings?

Precautionary allergen labelling, such as 'may contain milk', is voluntary. FSA guidance says it should only be used when a risk assessment finds a risk of cross-contamination that cannot be controlled, and it should not replace good hygiene. Name the allergen: the government's labelling guidance says generic statements such as 'may contain allergens' should not be used. For non-prepacked food the warning can be given by staff or on a sign.

Pass on 'may contain' warnings from your suppliers' labels unless your own risk assessment supersedes them, and do not pair a 'may contain' warning with a 'free from' claim for the same allergen. A free-from claim tells customers the food is suitable for everyone with that allergy, so it needs controls that remove the risk of contamination.

What should staff do when a guest mentions an allergy?

  • Ask what the guest needs to avoid, then check the recipe and ingredient information for every part of the dish, including oils, dressings, glazes, sauces and garnishes.
  • Pass the requirement to the kitchen in writing when the person taking the order is not the person cooking.
  • Prepare the dish on cleaned surfaces with clean equipment, after washing hands. Cooking does not remove allergens.
  • If a mistake is made, start the dish again with fresh ingredients instead of picking the allergen out.
  • Keep the dish separate and labelled on the pass, and confirm with the guest that it meets their requirements when serving.
  • If there is a risk of cross-contamination you cannot control, tell the guest so they can decide whether to order.

If a customer shows signs of a severe reaction, the Safer Food, Better Business pack tells staff not to move them, to call 999 and say the customer could have anaphylaxis, to send someone outside to wait for the ambulance, and to help the customer get their adrenaline auto-injector if they carry one.

Tiquo can record allergy and dietary requirements on a customer profile, and service areas can prompt staff to ask about allergens when an order starts or when a dish with configured allergens is added. The warnings carry through to supported POS flows and kitchen outputs, so the person cooking sees what the person taking the order recorded. Those prompts rely on the allergen data you keep for each product, so your recipe information still has to be kept current.

This is general information. Check the FSA's allergen guidance for food businesses, or Food Standards Scotland's guidance in Scotland, and ask your local authority if you need advice on your menu.

© 2026 Tiquo. "Tiquo" and the Tiquo logo are registered trademarks of Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

A single platform for hotels, spas, classes, events, restaurants, and more.

Tiquo Ltd
London, UK

LinkedInTop Performer Spring

We use cookies

Choose whether to allow cookies for analytics and advertising. You can accept or decline them. Closing this notice declines them.

Learn more