Skip to main content
All Articles
POSSep 12, 2026

How to build an allergen matrix for your menu

An allergen matrix is a table that lists every dish and drink on your menu against the 14 regulated allergens, with a mark wherever an item contains one. To build an allergen matrix, gather the recipe and ingredient information for every component of every dish, record which of the 14 allergens each one contains, have a second person check it, and update it whenever a recipe or supplier changes.

The FSA's best practice guidance names a separate allergen matrix as one way to give customers written allergen information for non-prepacked food, alongside allergen details on the menu itself. It is also the document front-of-house staff should reach for when a guest asks what is in a dish.

Why does a restaurant need an allergen matrix?

The law requires allergen information for every non-prepacked item that contains any of the 14 allergens. You can provide it verbally, with a notice telling customers how to get it, but staff can only answer accurately if the information is written down somewhere they trust. The FSA's 2025 best practice guidance for England, Wales and Northern Ireland goes further and recommends written information for all 14 allergens, supported by a conversation with staff. That guidance is not a legal requirement, though in a board paper published on 3 September 2026 the FSA said its evaluation of the guidance will inform the design of future legislation.

You do not have to design the format from scratch. The FSA publishes allergen templates, and its Safer Food, Better Business pack for caterers includes an allergen recipe chart for recording the allergens in each dish, plus individual allergen sheets for specials, for when an ingredient runs out and for passing information between shifts. Items packed on your premises before customers choose them need full labels as well, which our guide to Natasha's Law and PPDS food explains.

What information do you need before you start?

  • A standard recipe for every dish, so it is made to the same specification each time.
  • The product specification sheet or label for every bought-in ingredient, kept up to date.
  • Recipes or labels for components such as sauces, dressings, glazes, cooking oils and garnishes, which the FSA's caterers' pack tells kitchens to check, and for stocks and other bases.
  • Any 'may contain' warnings on supplier labels.
  • Your drinks list. Wine and beer can contain sulphites, and cream liqueurs contain milk.

Ask each supplier to tell you when a product's allergen content changes. The FSA's best practice guidance suggests getting suppliers to agree to this, as well as checking regularly whether ingredients have changed.

How should an allergen matrix be laid out?

Use one row per menu item and one column per allergen, with all 14 columns present. Mark every cell, for example 'Y' or 'N', so an empty cell never stands for 'not checked yet'. A few more conventions make the matrix easier to use:

  • Name the specific cereal and nut in the cell or a notes column, such as 'wheat', 'barley', 'almond' or 'walnut'. The FSA's own examples name the nut, as in 'nuts (almond)'.
  • Give each version of a dish its own row. If the kitchen makes a dish without a sauce for allergic guests, record that version and how it is prepared as a separate entry.
  • Keep precautionary warnings in a separate column, used only where a risk assessment or a supplier's label supports them.
  • Show the date, a version number and the name of the person who checked it.

This extract shows how four items might look for hypothetical recipes. A full matrix would show all 14 allergens as columns; here the allergens present are listed with the components they come from, which is the detail staff need when a guest asks for a change.

ItemAllergens presentWhere they come from
Caesar saladCereals containing gluten (wheat), eggs, fish, milk, mustardCroutons (wheat flour); dressing (egg yolk, anchovy, Parmesan, mustard)
Beef burger in a brioche bunCereals containing gluten (wheat), eggs, milk, sesame, mustardBun (wheat flour, egg, butter, sesame seeds); burger sauce (egg, mustard)
Sticky toffee puddingCereals containing gluten (wheat), eggs, milkSponge (wheat flour, egg, butter); toffee sauce (cream, butter)
House red wineSulphur dioxide and sulphitesDeclared on the producer's label

How do you keep the matrix accurate?

Have someone other than the author check every row against the recipes and specification sheets before the matrix goes into use. After that, update it whenever:

  • A recipe or menu item changes, including seasonal specials.
  • A supplier sends a substitute product or changes its recipe.
  • You switch supplier for any ingredient.
  • A new precautionary warning appears on a supplier's label.

Withdraw old copies from the floor when you publish a new version, so nobody picks up last month's sheet. The Safer Food, Better Business pack includes a regular review question asking whether allergen information has been updated to reflect menu or ingredient changes, which is a sensible check to build into your routine.

How should staff use the matrix during service?

Everyone serving food needs to know where the matrix is and how to read it. If allergen information is not on the menu, signpost it, for example with a notice saying a menu with allergen information is available from staff. When a guest declares an allergy, staff should check the matrix with them, record the requirement and pass it to the kitchen in writing if someone else is preparing the food. The server should confirm the dish meets the requirement when it is served.

For phone and online orders, allergen information must be available before the order is placed and when the food is delivered, so make the matrix, or the same details, available wherever customers order.

How should you train staff on allergens?

Food businesses must make sure staff receive training on allergens. The FSA offers free online food allergy and intolerance training in six modules, with a certificate for those who pass every module test. Use the matrix in your own training too: ask new starters to find the allergens in three dishes and explain how a guest's requirement reaches the kitchen.

In Tiquo, allergens are recorded on each product, and service areas can prompt staff about allergens when an order starts or when a product with configured allergens is added. The recorded requirements stay on the order and appear on supported POS flows and kitchen outputs, and customer profiles can hold allergies and dietary needs for later visits. Tiquo does not produce the matrix itself, and its prompts are only as accurate as the product data, so the matrix and your recipe checks remain the place to keep allergen information current.

This is general information based on FSA guidance for England, Wales and Northern Ireland. Businesses in Scotland should also check Food Standards Scotland's guidance, and your local authority food team can advise on your own menu.

© 2026 Tiquo. "Tiquo" and the Tiquo logo are registered trademarks of Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

A single platform for hotels, spas, classes, events, restaurants, and more.

Tiquo Ltd
London, UK

LinkedInTop Performer Spring

We use cookies

Choose whether to allow cookies for analytics and advertising. You can accept or decline them. Closing this notice declines them.

Learn more