Allergens on the menu — what restaurants must do and how to label it

The duty to inform guests about allergens has applied across the EU since 13 December 2014, and it covers every venue that serves food — restaurants, bars, cafés, food trucks, patisseries and canteens. The size of the place makes no difference, nor does whether the dishes are prepared on site.

It is still one of the most neglected obligations in hospitality. Usually not out of bad faith — simply because nobody told the owner in what form the information has to be available. And that is the whole point of the rule.

This piece explains what exactly you need to have, what an inspection actually looks for, and how to organise it so you are not rebuilding everything every time a recipe changes.

What follows describes the legal position and industry practice, not legal advice. Penalty levels and procedural detail vary by member state and are worth confirming with your national food-safety authority.

Where the obligation comes from

The basis is Regulation (EU) No 1169/2011 of the European Parliament and of the Council on the provision of food information to consumers. Three parts matter for hospitality:

• Article 9(1)(c) — information on substances causing allergies or intolerances is mandatory food information,
• Article 44 — covers non-prepacked food, which is exactly what a restaurant serves. Member states may specify how the information is given, but the obligation itself is unconditional,
• Annex II — a closed list of 14 substances you must declare.

Article 44(2) lets each member state decide how the information reaches the guest, and they use that freedom differently. Spain (Royal Decree 126/2015, art. 6.5), Germany (LMIDV §4(4)) and Italy (Legislative Decree 231/2017, art. 19(8)) let staff give the information on request, but only with a written or electronic record on the premises and a visible notice telling guests to ask. France (Consumer Code art. R412-14) and Portugal (Decree-Law 26/2016, art. 4(3)) require a medium the guest can read directly, and Poland's sanitary inspectorate reads its 2014 labelling regulation the same way. The 14 substances are identical everywhere. The format is not.

The key conclusion: the EU regulation applies directly. There is no national act to wait for and no size threshold below which the duty stops applying.

The 14 allergens from Annex II

Two entries cause most of the surprises: celery, which is in practically every stock and spice blend, and sulphites, which restaurants serving wine routinely forget.

What form the information has to take

This is the part most venues get wrong.

The information must be available to the guest before they order, and the medium is set by national rules, not by the EU. Article 44 makes the information mandatory, Article 44(2) leaves the form to each member state, and none of the national rules below mentions QR codes. Within those rules, the usual media are:

• labels directly at the items in the menu (numbers or pictograms with a legend),
• a separate allergen card or table placed at each table or at the bar,
• information available electronically — for example a digital menu opened from a QR code,
• a visible notice saying where the full list is, if it is not printed in the menu itself.

Where speaking is not enough: in France, Portugal and Poland, "please ask your server" as the only method fails the duty, because the guest must be able to read the information unaided. Spain, Germany and Italy accept an oral answer, on three conditions: the dish-by-dish record exists in writing or electronically, inspectors and guests can see it on request, and a notice in the room says the information is available from staff. No member state accepts a server answering from memory. The record is the compliance; the server only delivers it.

That distinction has a practical consequence: a digital menu works next to a printed copy, not instead of it. Germany (LMIDV §4(3)) and Italy (Legislative Decree 231/2017, Article 19(8)) name electronic or digital systems explicitly, but Germany also requires a notice at the food or on the wall saying how to reach them, and Italy written documentation behind the digital one. Poland goes the other way: its food quality inspectorate IJHARS states that information given only through a QR code is not sufficient, and its Olsztyn branch calls sending restaurant guests to an app or website as the only source unacceptable, because not every guest has internet access. Allergens marked at every item of a QR menu are still the easiest record to keep current. A printed table or 1–2 printed menus at the bar, made from the same data, cover the guest without a phone.

Three labelling systems in practice

The numeric system

Numbers from Annex II sit next to each item, with a legend at the bottom of the page.

Fish soup (1, 3, 7, 9)                          €12

Advantage: takes no space. Drawback: the guest has to jump to the legend, and it only works if the legend is on the same page.

The pictogram system

Icons next to dishes — an ear of wheat, milk, an egg, a fish. Easier to read and language-independent, which matters with international guests. Drawback: with 14 allergens the icons get small and unreadable in print.

The full description at the item

Allergens written out under the dish name. Clearest for the guest, most expensive in print — which is why on paper it barely happens, and in a digital menu it is the standard, because space costs nothing.

Six mistakes that cost the most

1. An allergen table made once and never updated. The mustard supplier changed, the sauce recipe changed — the table stayed the same. The most common situation and the most dangerous.
2. Allergens only in the local-language version. A guest who does not read the language has no way to get the information. The duty is to convey the information to the consumer, not merely to possess it. If you serve tourists, see multilingual menus.
3. No information about cross-contamination. If you fry chips in the same oil as breaded fish, say so.
4. Allergens in the dine-in menu but not in takeaway and delivery. The duty covers takeaway and platform sales too.
5. Forgetting drinks. Wine, beer and some juices contain sulphites or gluten. The wine list is covered as well.
6. A new item without allergens. Specials and seasonal dishes need the list from day one, not from the moment somebody asks.

Cross-contamination

The mandatory declaration rules cover the ingredients of a dish. Cross-contamination — an allergen reaching a dish through shared equipment — is a separate question, but often the more important one for a guest with an allergy.

The practice that protects both the guest and the venue:

• work out where the risk actually is: a shared fryer, a shared board, a shared toaster, flour in the air while dough is worked,
• describe it in one sentence in the menu or in the table, instead of adding "may contain everything" to every item,
• do not use defensive warnings where there is no risk. "May contain traces" on every dish makes the information meaningless, and a guest with coeliac disease will order nothing at all.

The limit of that advice: if the kitchen has one station and one fryer for everything, an honest warning on most items is the only correct option — and then it is worth saying so plainly, along with which 3–4 dishes it does not apply to.

What an inspection checks

A routine food-safety inspection usually looks at three things:

1. Whether the list exists at all and whether the guest can reach it — directly, or through staff and a visible notice where the national rule allows that.
2. Whether it matches the recipes — an inspector can take a specific dish from the menu and compare it with the ingredient list.
3. Whether staff know where the list is and can produce it.

The third point fails surprisingly often: the document exists, it sits in the office, and the server does not know about it.

Fines are set nationally, so the same omission costs different amounts in different countries. Italy fines a missing allergen declaration on unpackaged food, restaurant dishes included, €3,000–24,000 (Legislative Decree 231/2017, art. 23(2)). In Germany a breach of LMIDV §4 is an administrative offence with a fine of up to €50,000 (LMIDV §6(4) with LFGB §60(5) no. 2). Spain treats insufficient or defective labelling as a minor offence, up to €5,000, and as a serious one, €5,001–20,000, when it creates a risk to public health (Law 17/2011, arts. 51 and 52). The more serious exposure appears when missing information leads to an allergic reaction — at that point civil liability comes into play.

How to set this up once, not at every change

The real practical problem is not producing the list but maintaining it. The kitchen changes a recipe, a new supplier arrives, the seasonal menu comes in — and the list stays as it was a year ago.

A process that holds up:

1. One source of truth. Allergens are attached to the dish in the same place the dish has its price and description. Not in a separate spreadsheet one person remembers.
2. Allergens are a required field when adding an item. You cannot add a dish without filling the list in.
3. Recipe change = allergen review. Written into the menu-change procedure, the same as costing.
4. The list publishes itself. One change is visible in the table menu, on the website and in the takeaway version — with no printing.

In WMenu allergens are attached to the menu item: the guest sees them next to the dish, in their own language, and you change them in the panel in seconds. There is no separate document that could drift away from reality — it is the same menu.

You can see it directly in the electronic restaurant menu or in menu engineering if you are reworking the whole card.

Frequently asked questions

Does a small venue or a food truck have to declare allergens?

Yes. Regulation 1169/2011 sets no size threshold. The duty covers anyone serving non-prepacked food to the final consumer.

Is it enough for the server to say it out loud?

It depends on the country, and never without a record. Spain, Germany and Italy allow an oral answer if a written or electronic allergen record is on the premises and a visible notice tells guests to ask. France, Portugal and Poland expect a list the guest can read before ordering. A server answering from memory fails everywhere.

Does a QR-code menu satisfy the requirement?

As the only medium, not everywhere. The EU regulation does not mention QR codes; each country sets the form. Germany and Italy name electronic systems, with a notice or written documentation alongside, while in Poland the inspectorate considers a QR code alone insufficient. Keep a printed table or menu on the premises, and make sure the QR menu opens before ordering without installing anything.

Do I have to write "may contain traces"?

That is not the mandatory declaration but voluntary information about cross-contamination risk. Give it where the risk genuinely exists, and do not use it as blanket cover on every item.

Do allergens apply to drinks and wine?

Yes, where they occur — most often sulphites in wine and gluten in beer. The drinks list carries the same duty as the food menu.

What about a daily special that changes every day?

The duty is identical. For an item that changes daily the simplest route is to keep it in a digital menu, or to post the allergen list for that item next to the specials board.