How UK food businesses prove allergen control, from Natasha's Law labels to corrective actions

Auditors, regulators and retailers expect a UK food business to show records that prove each allergen control works. Allergen management and compliance software records allergen specifications, recipe and supplier changes, cross-contamination controls, label checks and corrective actions in one place, so each control can be shown on request.

UK food law requires the 14 major allergens to be declared, and for food prepacked for direct sale (PPDS) each one must be emphasized in a full ingredients list. Food Standards Agency (FSA) root cause analysis data shows allergen incidents are most often associated with labeling verification failures and weaknesses in quality control. That makes the records behind each control as important as the control itself. Five linked records form an allergen evidence chain: specification, change control, cross-contamination controls, label verification and corrective action.

How software turns allergen controls into retrievable evidence

One allergen audit trail runs from raw material intake to finished label

Allergen management software holds allergen data for every ingredient, recipe and supplier in one controlled place. Each change, check and corrective action can be time-stamped and attributed, which gives an auditor a single path from raw material intake to finished label. When that path sits inside a food safety management system that connects HACCP monitoring, CAPA and supplier food safety records, allergen evidence can be pulled alongside the rest of the quality record.

The FSA's best practice guidance for non-prepacked food includes an example allergen matrix and says allergen information must be regularly reviewed and updated so that it stays accurate. In software, the matrix can be generated from approved recipes and specifications instead of being typed and retyped by hand.

Spreadsheets and paper allergen matrices fail when ingredients, suppliers or recipes change

A spreadsheet allergen matrix reflects the last manual edit. When a supplier reformulates an ingredient, the matrix, the recipe and the label each need a separate update, and a single missed update can leave an allergen undeclared. Software can link specification, recipe and label so that a change in one is reviewed against the others.

UK allergen labeling requirements: Natasha's Law, the 14 major allergens and FSA guidance

What does Natasha's Law require for PPDS food?

Natasha's Law has applied across all four UK nations since 1 October 2021. Food prepacked for direct sale must carry the name of the food and a full ingredients list, with each of the 14 major allergens emphasized every time it appears. FSA labeling guidance for PPDS food allows emphasis through bold type, capital letters, contrasting colors or underlining.

Food counts as PPDS when the same business packs it before offering it to the final consumer on the same premises or site, as set out in the FSA technical guidance on food prepacked for direct sale. Precautionary allergen information from ingredient suppliers must also be passed on to the consumer. For the record-keeping side, Natasha's Law compliance software for ingredient traceability and record keeping is described on a dedicated page.

Which 14 major allergens must be declared in the UK?

The 14 major allergens are celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulfur dioxide and sulfites (above 10 parts per million) and tree nuts. Businesses selling beyond the UK can compare how food allergen regulations differ around the world before standardizing one allergen list across sites.

Is written allergen information mandatory for non-prepacked food in the UK?

No. For non-prepacked food, the minimum legal requirement is that allergen information is provided by any means, with a sign indicating when it will be provided verbally. The FSA recommends written allergen information supported by a conversation, but businesses are not required by law to follow best practice guidance, according to the FSA's best practice guidance for non-prepacked food, which applies to England, Northern Ireland and Wales.

Software helps with the best practice approach because written allergen information must stay accurate. The same guidance lists keeping records of ingredients, regularly checking whether ingredients have changed and checking with suppliers that their allergen information is accurate as ways to achieve this.

Why FSA incident data points to labeling verification and record gaps

FSA root cause data ties allergen incidents to labeling verification failures and weak quality control

The FSA was notified of 2,073 food and feed safety incidents in England, Northern Ireland and Wales during 2025/26, an increase of 14% on the previous year, and allergens were the second most commonly reported hazard, according to the FSA incidents and resilience annual report 2025/26. The FSA says it has limited reasoning to explain the increase and that it could reflect increased reporting.

The causes are clearer than the volume. The FSA strategy progress update states that root cause analysis data continue to show allergen incidents are most frequently associated with labeling verification failures and weaknesses in quality control, rather than novel or emerging hazards. The FSA 2024/25 incidents report names labeling and cross-contamination as the main causes of allergen incidents.

Recalls rose in 2025 to 141 products, up from 115 in 2024

UK food businesses issued 141 product recalls in 2025, up from 115 in 2024 and equivalent to one every two to three days, according to The Grocer's analysis of recall data.

The allergen evidence chain: five records auditors and retailers ask to see

Five linked records make up the allergen evidence chain, and a gap in any one weakens the rest, because an auditor can trace a claim back through each record in turn.

Certification standards ask for the same discipline. The GFSI Benchmarking Requirements v2024 require an allergen management plan to be established, implemented and maintained, including a risk assessment of allergen cross-contact, implemented controls to reduce or eliminate that risk and labeling in compliance with the allergen labeling legislation of the country of intended sale (requirement FSM 16.1 in the GFSI key changes document). The same document lists a documented change management procedure, with particular emphasis on changes that could impact food safety (FSM 27).

Specifications and supplier declarations show what is in every ingredient

Each ingredient needs a current, approved specification that declares its allergens, including any precautionary allergen information from the supplier. FSA guidance says businesses should use approved suppliers, check that suppliers provide accurate allergen information and ask them to report allergen changes. Supplier assessments, structured training and internal audits sit around this record, as covered in the guide to allergen management covering specification management, training, audits and complaint handling.

Documented change control stops an undeclared allergen entering a recipe

Every recipe, supplier or process change needs a recorded allergen impact check before release. FSA PPDS guidance says businesses should have processes in place to update label information when a supplier changes or an ingredient changes. The guide to what changed in GFSI v2024 for change management, food defense, food fraud and allergen management covers the certification side.

Cross-contamination controls rest on a documented cross-contact risk assessment

The FSA says precautionary allergen information should be provided only where a real risk of allergen cross-contact has been identified through a thorough risk assessment and cannot be removed through risk management actions such as segregation and cleaning. Records of the assessment, the segregation and the cleaning are what show the risk was managed. The 13-step guide to validating cleaning procedures for BRCGS, SQF and GFSI explains how to test whether a cleaning procedure works.

Label verification confirms the pack matches the recipe

Label checks compare the printed allergen emphasis and ingredients list against the approved recipe before a run is released. The FSA notes that allergen incidents often occur alongside labeling issues because the allergen is not declared on the label, which is the failure this record is designed to catch.

Corrective action records show the root cause, the owner and whether the fix worked

A corrective action record names the root cause, the action, the owner and the closure date, and shows whether the fix worked. Held as one linked record, it can be shown to an auditor without reconstructing the history from separate files.

The table below sets out what each link must prove, a failure to look for and what allergen management software should capture.

Evidence link	What it must prove	Failure to look for	What software should capture
Specification and supplier declaration	Current allergen declaration for every ingredient	Supplier allergen information not checked or not updated	Versioned specification with supplier sign-off and review dates
Change control	Allergen review of every recipe, supplier or process change	Ingredient substitution made without allergen review	Change record with allergen impact check, approver and date
Cross-contamination controls	Cross-contact risk assessed and controlled	Precautionary labeling used without a documented risk assessment	Risk assessment, segregation and cleaning records linked to each product
Label verification	Pack matches the approved recipe	Allergen not declared or emphasized on the label	Label check against the recipe with recorded sign-off
Corrective action	Root cause found and fix confirmed	Action closed without confirming it worked	Linked corrective action with root cause, owner and closure evidence

Questions to answer before you roll out allergen software

Before rollout, check data capture, ownership and the audit trail

• Does every ingredient hold a versioned allergen declaration with a named approver?
• Does a recipe or supplier change require an allergen impact check before release?
• Is label content checked against the approved recipe with a recorded sign-off?
• Is the cross-contact risk assessment stored with the cleaning and segregation records?
• Can all allergen records for one batch be retrieved in minutes?

Test the allergen audit trail with one real supplier change

Run a supplier reformulation through the process from specification to label and confirm that each link in the evidence chain updates and is attributed. A process that needs manual reconciliation at any step will struggle when an auditor asks for the same record.

Allergen compliance depends on five records that can be shown on demand

Allergen compliance software earns its place where it produces the five records of the evidence chain: current specifications, reviewed changes, documented cross-contamination controls, verified labels and closed corrective actions. UK labeling law sets what must be declared and FSA data shows where allergen failures originate. GFSI v2024 sets what certification programs expect of an allergen plan. A business that can show all five records for any product on demand holds the evidence that allergen compliance rests on.