Allergen management for UK restaurants: Natasha's Law, the 14 allergens, and EHO readiness in 2026

TL;DR: Allergen management is the highest-risk compliance area for UK restaurants, carrying potential criminal liability under the Food Information Regulations 2014 and the Food Safety Act 1990. The 14 major allergens that must be declared are peanuts, tree nuts, milk, eggs, fish, shellfish, celery, mustard, sesame, soya, lupin, sulphites, molluscs, and cereals containing gluten. Natasha's Law, which came into force in England in October 2021, extended full allergen labelling requirements to food prepared and sold in the same place. For restaurants serving food to order, the obligation is to provide accurate, accessible allergen information for every dish whenever a customer asks, and to maintain the records that back it up. The operational system that makes this reliable has four parts: a live allergen matrix for your current menu, supplier allergen statements for every ingredient that could carry risk, staff training records evidencing allergen awareness, and documented procedures for handling customer allergen queries. This post sets out each layer, explains what EHO inspections look for, and describes the supplier discipline that most restaurant owners underestimate as a risk point.

Most compliance failures in a restaurant lead to a visit, a letter, a requirement to improve. Allergen failures can be fatal. The deaths of Natasha Ednan-Laperouse in 2016 and Owen Carey in 2017 both involved failures of allergen communication in food businesses. Both resulted in changes to the law, criminal investigations, and a sustained shift in regulatory expectations.

This is not framing designed to frighten. It is the context in which Environmental Health Officers (EHOs) now inspect, and in which enforcement decisions are made. An EHO who finds incomplete allergen records in 2026 is not working from a pre-2021 baseline. They are working from a post-Natasha's Law standard that expects systematic, current, verified documentation.

The law itself has not dramatically changed the substantive requirements. UK food businesses have been required to provide allergen information since 2014. What Natasha's Law changed is the specific application to food prepared and sold on the same premises (previously there was a verbal information provision that allowed restaurants to communicate allergens by word of mouth only). From October 2021, allergen information must be either written on the label, or on a written notice that directs the customer to ask a staff member who can provide written confirmation.

For practical purposes: if a customer asks about allergens, the answer must be accurate and must be traceable to a documented source. "I think it's fine" is not a compliant response.

The 14 allergens that must be declared under the Food Information Regulations are:

1. Cereals containing gluten (wheat, rye, barley, oats, spelt, kamut, and their hybridised strains).
2. Crustaceans (prawns, crab, lobster, crayfish).
3. Eggs.
4. Fish.
5. Peanuts.
6. Soya.
7. Milk (including lactose).
8. Tree nuts (almonds, hazelnuts, walnuts, cashews, pecans, Brazil nuts, pistachios, macadamias, and Queensland nuts).
9. Celery (including celeriac).
10. Mustard (including mustard leaves, mustard oil, mustard powder, and mustard seeds).
11. Sesame seeds.
12. Sulphur dioxide and sulphites (at concentrations above 10 mg/kg or 10 mg/litre).
13. Lupin (lupin flour and seeds are increasingly common in gluten-free products).
14. Molluscs (clams, mussels, oysters, scallops, snails).

Every dish on your menu must be assessed against all 14. The presence of any allergen, whether as a primary ingredient or as a component of a sauce, stock, seasoning, or garnish, must be recorded and communicated.

Your allergen matrix is a table that maps every dish on your current menu against all 14 allergens, indicating whether each allergen is present, possibly present (due to cross-contamination risk), or absent.

• Every dish currently served, including sides, sauces served separately, and dressings.
• Every allergen in each dish, traced to the specific ingredient that carries it (not just a yes/no tick, but a note of which ingredient is the source).
• A "may contain" designation for dishes where cross-contamination risk exists, even if the allergen is not a direct ingredient.
• A version date and a review procedure.

The matrix is only accurate as of its last review against your actual recipes and your current supplier ingredients. A dish that was gluten-free six months ago may not be gluten-free now if your supplier changed their breadcrumb specification without notifying you.

The discipline required: whenever your menu changes, the matrix changes. Whenever a supplier confirms a specification change, the matrix is reviewed. Dating the document and keeping previous versions means you can show the history of changes if it is ever relevant.

Most allergen incidents in food service involve a gap between the documented allergen information and the actual dish served. That gap usually has one of two causes: the recipe changed but the records did not, or the ingredient changed but the records were not updated because the supplier did not communicate the change clearly.

If you do nothing else this month in allergen management: audit every dish on your current menu against the ingredient list actually in use in your kitchen today. Not the menu from six months ago. Today's ingredients.

Most restaurant owners focus allergen effort on the customer-facing end: what is on the menu, what staff tell customers, how allergen queries are handled at the table. This is correct and necessary. But most disputes can be traced to supplier-side failure: an ingredient specification changes, the supplier does not proactively notify you, and your menu continues to state that the dish is free of an allergen it now contains.

Request written allergen statements from every supplier for every ingredient that could carry allergen risk. This means not just the obvious ones (your flour supplier, your dairy supplier) but the less obvious ones: your stock cube supplier, your sauce supplier, your seasoning blends. Many pre-made sauces, stocks, and seasonings contain celery, mustard, or sulphites at concentrations that require declaration.

When a supplier changes a product, get an updated allergen statement before the new product enters service. Do not assume that a product you have used for two years has the same specification. Request written confirmation when any product is reformulated or when you switch to a different variant of a product.

Keep supplier allergen statements on file with a date and a note of which dishes they inform. This creates the audit trail that demonstrates due diligence. If a customer claims an allergen reaction from a dish you documented as allergen-free, your supplier statement is evidence that you acted on accurate information.

Do not accept verbal allergen assurances from suppliers. A phone call in which a supplier tells you their product is gluten-free is not documentation. Ask for the written product specification or allergen declaration and file it.

The same rigour applies when you switch to a new supplier for an ingredient. Do not assume equivalence. Request the allergen statement before the product enters your kitchen.

Every member of staff who handles food, takes orders, or serves customers needs allergen awareness training. This includes front-of-house staff who may be asked about allergens at the table. The kitchen team needs more detailed training: how allergens are declared in your menu matrix, which dishes contain which allergens, and what the cross-contamination protocols are.

Training records must document: the person's name, the date of training, what was covered, and who delivered it. For formal allergen qualifications, include the certificate and provider name.

The procedure for handling an allergen query should be written down and trained to all staff. A model procedure:

1. The customer asks about an allergen in a specific dish.
2. Staff do not guess or answer from memory. They consult the written allergen information (your matrix or a front-of-house allergen reference document).
3. If the answer is clear from documentation, they provide it and note the query.
4. If there is any uncertainty (a supplier change they are not sure about, a dish they have not served before), they escalate to a supervisor or the kitchen before answering.
5. They never tell a customer a dish is safe if they are not certain, and they never tell a customer to "just pick out" an allergen from a dish.

Recording allergen queries does not need to be elaborate. A brief note on the booking record, the order slip, or a simple allergen query log is sufficient. The record exists to show that the conversation happened and that the information provided was based on your documented allergen matrix.

Declaring the allergens in each dish is the first layer. Preventing undeclared allergens from entering dishes through cross-contamination is the second layer, and it is where operational discipline matters most.

Written cross-contamination procedures should cover:

• Separate preparation equipment for dishes served to customers with allergen declarations (gluten-free pasta cooked in dedicated pots, served with dedicated utensils).
• Surface cleaning protocols between preparing allergen-containing and allergen-free dishes on the same surface.
• Oil and fryer discipline: if your fryer is used for breaded products, it cannot simultaneously be used for dishes declared gluten-free.
• Storage separation of allergen-containing ingredients (bulk peanut products stored away from other ingredients).
• Staff hand washing between handling allergen-containing and allergen-free foods.

These procedures must be written down and trained. Verbal instructions that are passed on informally are not sufficient: if staff turnover means the cross-contamination protocol is not communicated to new team members, the risk restarts with each new hire.

When an EHO inspects your premises and reviews allergen compliance, they are typically looking for:

• A current, dated allergen matrix covering your full menu.
• Evidence that supplier allergen statements exist and are recent.
• Staff training records showing allergen awareness training for front-of-house and kitchen staff.
• A written procedure for handling customer allergen queries.
• Written cross-contamination protocols.
• Evidence that the procedures are followed in practice (observation of kitchen practice, not just the existence of the documents).

EHO inspections look at whether your documentation reflects your actual operation or whether it is a set of templates that has never been applied. The question an inspector is asking is: if an allergen incident happened here, would there be a clear evidence trail showing that the business acted with reasonable care and followed documented procedures?

Paperwork for paperwork's sake is genuinely not the goal. The goal is a system where the documentation reflects what your kitchen actually does. An inspector who sees a half-completed allergen matrix from two years ago reads the situation differently from one who sees a current, dated matrix with evidence of recent supplier statement updates and staff training records from the past twelve months.

An honest counterpoint: some small restaurants feel that the documentation requirements are disproportionate to their scale. We'd say so plainly when that is true. A three-table pop-up with a fixed menu and no staff needs a simpler system than a 60-cover restaurant with a changing menu and a kitchen team. The principles are the same; the volume of documentation scales with complexity. What does not scale down is the legal obligation to have accurate allergen information available and to be able to demonstrate due diligence.

LaunchKit's restaurant business documents bundle includes allergen matrix worksheets structured for restaurant menus, supplier allergen statement request letters, staff allergen training record sheets, and a customer allergen query log. £19.99 for the Premium edition.

The bundle pairs with the restaurant MTD Compliance Kit (£16.99) for restaurant owners who want to address both their food safety documentation and their quarterly tax record-keeping in one go.

For the broader documentation context, including your HACCP system, temperature monitoring logs, cleaning schedules, and employment records, see essential business documents for UK restaurants.

For your tax and quarterly reporting obligations under MTD ITSA from April 2026, see Making Tax Digital for restaurant owners.

This article is general guidance, not legal advice. Allergen law is complex and enforcement consequences are serious. For your specific legal position, consult a solicitor or food safety consultant with experience in UK food law and Natasha's Law compliance.