For decades, consumers living with food allergies have relied on warning statements such as “May contain” or “May contain traces of…” to help them make safe food choices. However, these statements have often been applied inconsistently, with different wording and approaches to risk used across the industry.
This inconsistency has real consequences. Some consumers avoid products that present little or no risk, while others become accustomed to seeing precautionary warnings so frequently that they no longer trust them. At the same time, food businesses have lacked a consistent, internationally recognised framework for deciding when a PAL statement is genuinely required.
The adoption of new international guidance on Precautionary Allergen Labelling (PAL) by the Codex Alimentarius Commission marks one of the most significant changes to global allergen management in recent years. Food businesses are now expected to demonstrate that decisions to use a PAL (“may contains”) statement are supported by a documented, science-based risk assessment.
For food service operators, completing and maintaining PAL risk assessments can be challenging. Food businesses must combine supplier information with site-specific operational risks, then keep assessments up to date as suppliers, ingredients, recipes and kitchen layouts change. For organisations managing hundreds of recipes across multiple sites, this can quickly become difficult to manage manually.
The new Codex guidance aims to change this by introducing a more consistent, evidence-based approach to precautionary allergen labelling, centred on documented risk assessment rather than precaution alone.
IN THIS ARTICLE, WE COVER 3 KEY AREAS-
PART 1: A BIG SHIFT IN GLOBAL FOOD ALLERGEN RULES
At its 49th Session in Geneva, the Codex Alimentarius Commission agreed to adopt a new global approach to Precautionary Allergen Labelling (PAL). This update aims to make “may contain” statements clearer, backed by science, and consistent for allergic consumers everywhere.
Food allergies affect an estimated 4.3% of the global population. Reactions can range from mild hives to life-threatening anaphylactic shock. Developed after seven joint expert discussions between the Food and Agriculture Organization (FAO) and the World Health Organization (WHO), the new guidelines set out a clear scientific method to decide when a PAL label is actually needed.
WHAT HAS CHANGED?
Previous guidance often led to broad use of “may contain” statements whenever an allergen was handled on-site. The updated Codex guidance supports a risk-based approach: PAL should only be used where a residual cross-contact risk remains after appropriate controls and is supported by a risk assessment, rather than as a precautionary disclaimer.
Instead of using warnings as an excuse for poor cleaning or missing kitchen controls, the new rules state that food businesses must first:
- Identify where allergen hazards exist.
- Put proper allergen safety controls in place.
- Clean surfaces thoroughly to minimize cross-contact.
- Perform and write down a clear scientific risk assessment.
A precautionary allergen label (PAL) (may contain) should only be used when a documented risk assessment shows that a cross-contact risk remains after all reasonable control measures.
KEY FAO/WHO RESOURCES ON PRECAUTIONARY ALLERGEN LABELING
To support industry leaders and regulators in adopting this risk-based approach, in 2024 the FAO and WHO have published several critical tools, meeting reports, and technical guides. Use these assets to transition your allergen management frameworks successfully:
Scientific data to establish safe Reference Doses (RfDs).
Workflow to apply warnings using quantitative data.
PART 2: WHAT FOOD BUSINESSES NEED TO KNOW
We first need to understand some key terms and where cross-contact can happen.
WHERE DOES THE RISK COME FROM?
As a Food Business Operator (FBO), you must understand that allergen cross-contact risks come from two areas: your supply chain and/or your operations.
THE CONFUSION AROUND “VOLUNTARY”
A major source of confusion in the food industry is the word “voluntary” used in legislation. Food businesses can misunderstand this to mean that warning about cross-contact is completely optional, or that they do not need to report it at all.
Let’s go through some key food safety regulations and what they mean –
CORE LEGAL FRAMEWORKS & GUIDANCE
“Food shall not be placed on the market if it is unsafe.”
To determine if a food is safe, a business must assess all potential hazards, including cross-contact.
“Food information shall not be misleading, in particular as to the characteristics of the food, including its allergen content,” and “Food information shall be accurate, clear, and easy to understand for the consumer.”
Ignoring potential cross-contact risks could make food unsafe or misleading.
“Food business operators are responsible for assessing the need to provide precautionary allergen labelling and to ensure that it is not misleading for consumers,” and “Food businesses may voluntarily provide precautionary allergen labelling such as ‘may contain’ to help consumers make safe and informed choices where there is a risk of allergen cross-contact that cannot be removed through good allergen control practices.”
As a food business, you are responsible for assessing the risk, and informing your customers of any unavoidable risk.
“Advisory statements such as ‘may contain’ are voluntary. Firms may use them to alert consumers to possible cross-contact with allergens.”
Food businesses may use PAL to alert customers where risk exists.
The word “voluntary” is only used because regulators cannot mandate a warning that does not apply across the entire food supply chain. PAL are only required under specific circumstances.
However, the legal mandate is clear:
Businesses are responsible for assessing risk, and any risk that cannot be removed must be communicated.
If you have assessed your kitchen and there is no real cross-contact risk, you do not need – and should not use – a PAL label. If a risk assessment shows a real cross-contact risk that you cannot eliminate, communicating that hazard is required to make sure your food is safe and not misleading.
NEW RULES IN THE NETHERLANDS
Since January 1, 2026, the Netherlands introduced new precautionary allergen rules. The Dutch Food Safety Authority (NVWA) is actively checking labels and kitchen procedures under these standards:
- No more “just-in-case” labels: Putting a warning on a label “just to be safe” without a risk assessment is now illegal. If risk assessments show no risk of cross-contact, using PAL is not allowed.
- Strict Wording: Food businesses can only use two PAL statements on their packaging or menus:
1. “May contain [allergen]”2. “Not suitable for persons with [allergen] allergy/intolerance”Older wordings like “may contain traces of…” or “made in a factory that handles…” are not allowed.
- Higher cut-off limits: They have also officially adopted the “$\text{ED}_{05}$” reference dose. This is a scientific threshold designed to protect 95% of the allergic population from experiencing any reaction. As these limits are not as strict as the older target of $\text{ED}_{01}$ (99% of the population), this will reduce the use of PAL.
REMAINING CHALLENGES WITH PAL
While the Codex framework provides a helpful global reference, executing these rules in a busy kitchen or packing facility is difficult. Food businesses face several practical challenges:
1. Knowing how to do a risk assessment with the new $\text{ED}_{05}$ limit
With modern standards like the Dutch NVWA framework adopting the $\text{ED}_{05}$ limit (eliciting dose for 5% of the allergic population), operators may struggle to transition from visual hazard identification to complex mathematical risk characterization. Determining if cross-contact levels fall below or above the $\text{ED}_{05}$ threshold requires scientific precision, supplier intake validation, and consistent testing, presenting a significant hurdle for many culinary operations. Food service operators need to request this information from their suppliers in order to assess corss-contact from their supply chain, and communicate it to their customers where it cannot be eliminated.
2. Differences Between Kitchens and Sites
Managing multiple sites is complex. A large restaurant group or catering chain might use the exact same recipe across 50 different locations. However, the kitchens themselves are rarely identical. Some locations may have large, modern kitchens with separate prep stations for gluten-free or nut-free dishes. Other sites might have tiny kitchens with shared tables, shared ovens, and no room to separate ingredients. Food businesses need recipe and menu management (RMM) digital systems that allow managers to add or remove site-specific allergen warnings based on the physical setup of each individual kitchen.
3. Limited Space on Labels and Menus
Food labels are running out of physical space. When you combine mandatory ingredient lists, bolded allergen warnings, nutrition tables, and scientific cross-contamination statements, packaging becomes incredibly crowded. Printed allergen information on labels and menus are generally required by law, though QR codes and digital screens can help keep label and menus clean without overwhelming the customer.
4. Lack of Time and Resources to Document Assessments
A proper, science-based allergen risk assessment requires time, technical knowledge, and consistent training. Many small-to-medium food businesses struggle to complete risk assessments due to limited resources, high staff turnover in the kitchen, and lack of training on how to measure cross-contact risk. Digital systems can streamline collecting and maintaining digital records from suppliers and sites.
5. Knowing When to Redo Your Risk Assessments
An allergen assessment is not a one-time task. These need to be kept up to date and repeated when:
- You change a raw material supplier or an ingredient brand.
- You reformulate a recipe or add a new item to your menu.
- You change your kitchen layout, add new prep tables, or buy new machinery.
- An allergen incident, customer complaint, or product recall occurs.
- At a minimum, as part of your annual routine food safety check (HACCP review).
6. Real-world Kitchen Challenges
Beyond paperwork, real-world kitchens present dynamic daily physical challenges: shared deep fryers can contaminate cooking oil with gluten, human error during fast-paced services is common, and sudden supplier substitutions mean ingredients must be checked and menus updated immediately. High staff turnover in the industry mean that food businesses need to ensure that they have a set process with a digital trail in place to show due diligence.
KEY TAKEAWAYRISK ASSESSMENTS ARE KEY
PAL should only be used when a documented risk assessment proves there is an unavoidable allergen risk that cannot be managed through standard kitchen safety practices.
PART 3: HOW TO COMPLETE A RISK ASSESSMENT?
To help kitchens systematically evaluate and lower cross-contact risks before resorting to warning labels, food businesses should adopt this structured, five-step control workflow:
ELIMINATE
Eliminate avoidable cross-contact risks from the supply chain.
MINIMISE
Remove the allergen or substitute it with an alternative across your site and your supply chain.
RESTRICT
Restrict the extent and movement of remaining allergens within the physical layout of your site.
MANAGE
Implement operational procedures to reduce the day-to-day risk of accidental contamination.
LABEL
Where you have made every effort to minimise contamination but a risk remains, apply PAL.
HOW CAN FOOD BUSINESS OPERATORS AUTOMATE PAL?
With allergen laws tightening and the demand for science-based risk assessments growing, managing cross-contact risk on paper or static spreadsheets is no longer practical. Modern food operations rely heavily on digital SaaS platforms to secure their data from supplier to plate.
By digitizing ingredient specification sheets, cloud-based software platforms such as recipe and menu management (RMM) systems can monitor your supply chain and operations in real time. If a supplier updates an allergen warning on an ingredient, the platform automatically flags the change and updates every affected recipe, digital menu, and customer portal across the business.
These digital tools allow culinary and quality assurance teams to apply site-specific PAL overrides based on the physical capabilities of each kitchen.
This ensures that the warnings displayed to your guests reflect the true, physical state of the kitchen, reducing human error and keeping a digital trail to prove due diligence.
Interactive PAL Risk Assessment Calculator
Ready to transition from visual hazard guesses to precise quantitative analysis? Launch our free interactive PAL checker to as a screening to see if a PAL warning may be required.
Launch Interactive PAL CalculatorLOOKING AHEAD: THE GLOBAL DIRECTION
The guidelines adopted at the 49th Session of the Codex Alimentarius Commission signal a clear path forward for global allergen management. While international Codex texts are voluntary guidelines, they form the basis for upcoming local laws, health inspections, and international food trade standards.
By moving to documented, science-based allergen risk assessments and using modern software tools to track ingredients, food businesses can move past the confusion of “voluntary” labels. Ultimately, the success of these new guidelines will be measured by whether “may contain” declarations become more meaningful, consistent, and trusted by food-allergic consumers around the world.
REFERENCES
- 1. Codex Alimentarius Commission. General Standard for the Labelling of Pre-packaged Foods (CXS 1-1985), Annex on Precautionary Allergen Labelling.
- 2. Food and Agriculture Organization (FAO). Codex adopts new guidance on precautionary allergen labelling.
- 3. World Health Organization (WHO). Joint FAO/WHO Expert Consultations on Food Allergens.
- 4. Codex Alimentarius. Code of Practice on Food Allergen Management for Food Business Operators (CXC 80-2020).
- 5. Netherlands Food and Consumer Product Safety Authority (NVWA). New Dutch allergen policy (PAL) and Guidelines on cross-contact.
- 6. UK Food Standards Agency (FSA). Technical Guidance on Precautionary Allergen Labelling.
- 7. US Food and Drug Administration (FDA). Guidance for Industry: Questions and Answers Regarding Food Allergens.
- 8. Food and Agriculture Organization (FAO) & World Health Organization (WHO). In brief: risk assessment of food allergens: priority food allergens (B09010-eng.pdf).
- 9. Food and Agriculture Organization (FAO) & World Health Organization (WHO). In brief: food allergen reference doses (B09031-eng.pdf).
- 10. Food and Agriculture Organization (FAO) & World Health Organization (WHO). In brief: precautionary allergens labelling (PAL) (B09009-eng.pdf).
- 11. Food and Agriculture Organization (FAO). Video Guide: A new method to manage food allergens – a risk-based approach.
