One undeclared allergen on a plate can end a restaurant. Not the way health-code violations end restaurants — slowly, through reputation and repeat citations — but immediately, through anaphylaxis, an ambulance in the parking lot, and a lawsuit that outlasts the lease. Federal law under FALCPA and the FASTER Act now covers nine major allergens across all FDA-regulated packaged foods; the 2022 FDA Food Code extends the responsibility to unpackaged restaurant meals; and California's ADDE Act (SB 68), effective July 1, 2026, becomes the first state law to require written allergen disclosure on restaurant menus for chains with 20 or more locations. The regulatory floor is rising fast — and every kitchen, from independent to enterprise, needs a written allergen management checklist that survives a health-department walk-through and a plaintiff's discovery request. This guide walks the complete procedure, ingredient-to-plate. Book a free demo to see the digital allergen checklist running against a live restaurant workflow.
Added under the FASTER Act — enforceable in packaged foods since January 1, 2023
The Six Control Points Every Allergen Program Must Cover
An allergen management checklist is not a single form — it's a series of controls stitched across the operating day, from the receiving door to the guest ticket. Break the program into six control points, run each on its own frequency, and every point produces its own evidence trail. Miss any one and the whole system develops a blind spot the auditor will find.
Receiving & Ingredient Verification
Every incoming case checked against supplier allergen statement — no substitutions accepted without allergen review
Storage Segregation
Allergens on dedicated shelves, colour-coded containers, sealed and labelled — nothing above ready-to-eat items
Recipe & Batch Control
Every recipe carries its allergen matrix — no substitution without re-approval, no undocumented ingredient swap
Cross-Contact Prevention
Dedicated tools, colour-coded boards, hand wash with soap & water (not sanitizer), sequenced cook order
Cleaning Verification
Validated cleaning between allergen-run and next-run — swab-tested or visual per protocol, logged with photo
Service & Guest Communication
Written allergen matrix at every station, trained server response, ticket-level flag on any allergy declaration
Each control point is its own recurring checklist item with a specific owner. Receiving is on the AM lead. Storage on the sous chef. Recipes on the executive chef. Cross-contact and cleaning on line cooks with expo verification. Service on the FOH manager. Sign up free to load these six control-point templates into your allergen program.
Control Point Detail · Line-Level Checklist
The six control points expand into specific line items — what to check, what evidence to capture, and what the fail response looks like. This is the working checklist your kitchen leads run from.
CP1
Receiving & Ingredient Verification
Every delivery
Supplier allergen statement current and on file — no expired documentation
Case label matches PO — flag any substitution for allergen review before storage
Damaged or unsealed packaging rejected — cross-contact risk in transit
Ingredient logged in inventory with allergen tags visible to kitchen
CP2
Storage Segregation
Daily walk-through
Peanuts, tree nuts, sesame on dedicated shelves — never above other product
Allergen containers colour-coded and sealed after every use
Refrigerated allergens on bottom shelves to prevent drip-down contamination
All bulk decants labelled with product name, allergen list, and date
CP3
Recipe & Batch Control
Every menu change
Every recipe carries a 9-allergen matrix reviewed and signed by exec chef
No ingredient substitution without written re-approval and matrix update
Sauces, dressings, marinades — hidden allergens documented (soy in Worcestershire, wheat in soy sauce)
"May contain" precautionary flags applied where cross-contact cannot be guaranteed
CP4
Cross-Contact Prevention
Every service
Dedicated fryer for allergen-free items — no shared oil
Colour-coded cutting boards and knives per allergen family
Soap and water hand wash after allergen handling — sanitizer alone does not remove proteins
Allergen-flagged tickets cooked first, on a wiped-down station with fresh tools
CP5
Cleaning Verification
Between runs + end of day
Written cleaning SOP for surfaces, equipment, and utensils that contacted allergens
Visual verification photo captured before next-run start
ATP swab or allergen-specific test on high-risk shared equipment weekly
Cleaning cloths colour-coded and never reused across allergen zones
CP6
Service & Guest Communication
Every shift
Printed allergen matrix current, posted at expo, and available to any server on request
Server allergen-response script trained — never guess, always escalate to manager
Allergy flag on POS ticket triggers dedicated prep protocol in kitchen
Manager verification and hand-off on any allergen-flagged plate before it leaves the pass
Every Control Point on Every Shift — Without the Paperwork
Watch how OxMaint delivers the six-CP checklist to the right role at the right frequency — mobile capture, photo evidence, e-signatures, corrective work orders auto-fired on any fail. 30-minute walkthrough with your kitchen's actual layout.
Regulatory Layer · What Actually Applies to Your Kitchen
The regulatory picture in 2026 is a stack — federal baseline, FDA Food Code adopted by states, and state-level menu disclosure laws now emerging. Your allergen program has to answer to whichever layer is highest in your operating footprint. Multi-state chains inherit the strictest layer across every location.
Regulation
Scope
What It Requires
FALCPA
2004 · Federal
All FDA-regulated packaged foods
Plain-language declaration of the 8 (now 9) major allergens in ingredient list or "Contains" statement
FASTER Act
2021 · Federal
Packaged foods manufactured on or after Jan 1, 2023
Added sesame as the 9th major allergen requiring labelling
2022 FDA Food Code
Adopted by states
Retail food service — restaurants, institutions
Must be able to provide accurate allergen information for the 9 majors in unpackaged foods on request
CA SB 68 (ADDE Act)
Effective July 1, 2026
Chains with 20+ US locations operating in CA
Written allergen disclosure for the 9 majors on menus or at point of order
CT Public Act 23-115
Effective Jan 1, 2025
Connecticut food establishments
Post customer notification and train staff on allergen response procedures
IL Public Act 104-0090
Effective Jan 1, 2026
Illinois Certified Food Service Sanitation Managers
Allergen awareness training including gluten and celiac disease education
GFSI Schemes
SQF · BRCGS · FSSC 22000
Certification-holding operations
Documented allergen program, staff training, cross-contact control, validated cleaning, routine audits
The Cross-Contact Prevention Rulebook
Cross-contact — allergen transfer from one food to another via shared surface, tool, oil, or hand — is where most restaurant allergen incidents happen. It is not covered by "wipe down and move on," and it is not solved by sanitizer. The rulebook below is what a defensible kitchen actually enforces.
01
Soap & Water, Not Sanitizer
Sanitizer kills microbes but does not remove allergen proteins. Full soap-and-water hand wash is the only reliable method after handling any of the Big 9.
02
Colour-Coded Board & Knife System
Dedicated boards and knives per allergen family — the visual system prevents accidental reuse mid-service when speed pressure is highest.
03
No Shared Fryer Oil
Allergen proteins persist in frying oil. Gluten-free, peanut-free, or shellfish-free items need a dedicated fryer or an oven-cooked alternative — never a shared basket.
04
Allergen Plates First
Cook allergen-flagged tickets on a freshly wiped station with fresh tools, before the rest of the order. Sequencing removes the "one more thing to clean" pressure.
05
Manager Hand-Off at the Pass
Any allergen-flagged plate is manager-verified before leaving the pass — a second set of eyes on the ticket and the plate is what stops errors from reaching the guest.
06
Never Guess — Always Escalate
Servers uncertain about an ingredient escalate to the manager or exec chef. "I think it's dairy-free" has never been an acceptable answer and never will be.
The Hidden-Allergen Trap List
Most allergen incidents happen not through obvious ingredients but through the hidden ones — an allergen buried in a sauce, marinade, or garnish nobody thinks to check. The list below is what defensible allergen matrices flag by default.
Wheat
Soy sauce, teriyaki, malt vinegar, some prepared broths, beer battering, imitation crab
Soy
Worcestershire sauce, vegetable oils in fryers, cured meats, chocolate, many bread doughs
Milk / Dairy
Non-dairy creamer, deli meat casings, caramel colour, canned tuna, some hot dogs
Egg
Egg wash on breads, pasta enrichment, meatball binders, some wine finings, foam garnishes
Tree Nuts
Pesto, mole sauces, marzipan in desserts, some worcestershire variants, granola clusters
Sesame
Hummus, tahini in dressings, burger buns, hoisin sauce, some spice blends and dukkahs
Fish
Caesar dressing (anchovy), Worcestershire, oyster sauce, some enriched wines, umami pastes
Shellfish
Bouillon and stock bases, some Asian sauces, seafood extract in dips, glucosamine supplements
The hidden allergen only becomes visible when the recipe matrix is complete and current. Book a free demo to build recipe matrices that flag hidden allergens automatically at menu approval time.
Expert Perspective · What Turns Checklists Into Real Safety
The kitchens that have never sent an anaphylactic guest to a hospital have one habit in common: they treat the allergen checklist as a real-time operating tool, not an inspection artifact. That means the ticket with an allergen flag stops the line — the sous chef sees it, calls it out, the station clears, dedicated tools come out, the plate cooks first, the manager verifies at the pass. It's a 90-second pause in a busy service and it saves lives. When kitchens fail, it's rarely because they didn't have a checklist. It's because the checklist lived on paper in a binder nobody opened during Friday night dinner rush. Digital changes that — the flag rides on the ticket, the checklist steps show on the station screen, the manager sign-off is a tap not a signature on a form nobody archives. And the audit trail exists automatically. When the health inspector arrives and asks to see the last 60 days of allergen cleaning verifications, one filter returns them. That is the operating standard now.
Ticket-Level Flags
The allergy flag rides on the POS ticket into the kitchen — every station that touches the plate sees it, from the moment it lands.
Station-Screen Checklists
The cross-contact steps show on the line screen when the flagged ticket fires — no need to remember, no need to look up.
Manager Sign-Off Gate
The plate cannot leave the pass until a manager taps to verify — a hard gate, not a soft procedure, and it produces an audit record every time.
How OxMaint Runs the Allergen Management Program
OxMaint packages the six control points, the cleaning verification records, the recipe allergen matrices, and the corrective-action workflow into a single operational system. The kitchen team runs the checklist from a station tablet or phone. The corporate team sees the compliance rollup across every location. The health inspector or ADDE Act auditor gets a filtered, dated, photo-backed evidence pull on demand.
Mobile
Station-Based Capture
Each control point delivered to the right role — line cook, sous, FOH — on the device already at the station
Evidence
Photo & E-Signature
Cleaning verification photos, colour-coded storage photos, manager pass-verification signatures — all timestamped
Auto
Corrective Work Orders
Any fail — expired supplier statement, unlabelled decant, missed cleaning — auto-fires a work order with owner and SLA
Audit
One-Filter Evidence Pull
Health inspector arrives? Filter by date, location, control point — every log entry with evidence returns in seconds
Protect Every Guest. Defend Every Audit.
Stop running your allergen program on paper binders and hope. See how OxMaint turns every control point into evidence, every fail into a tracked corrective action, and every audit into a two-click filter — with the free forever plan available to test the full workflow.
Frequently Asked Questions
Does FALCPA apply to restaurants, or only to packaged foods?
FALCPA itself applies only to FDA-regulated packaged foods, not to unpackaged restaurant meals. However, the 2022 FDA Food Code — which most states have adopted or are adopting — requires restaurants to be able to provide accurate allergen information for the 9 major allergens in unpackaged foods on request. State laws are moving further: California's ADDE Act (SB 68), effective July 1, 2026, is the first state law requiring written allergen disclosure on restaurant menus for covered chains, and Connecticut, Illinois, Michigan, and Maryland have all enacted allergen-related restaurant requirements since 2023.
What are the 9 major food allergens under current federal law?
The 9 major allergens recognized by the FDA are milk, eggs, fish, shellfish (crustaceans), tree nuts, peanuts, wheat, soybeans, and sesame. The original 8 were defined by FALCPA in 2004; sesame was added under the FASTER Act, which took effect for labelling on January 1, 2023. In January 2025 the FDA published updated guidance narrowing the mandatory tree nut list from 23 to 12 species and removing coconut from mandatory labelling, though coconut remains a recognized allergen.
Sign up free to load the 9-allergen matrix into your recipe library.
Is sanitizer enough to remove allergens from surfaces and hands?
No. Sanitizer kills microbes but does not remove allergen proteins. Full soap-and-water hand wash is the only reliable method for removing allergens from hands after contact with any of the Big 9. Surfaces and equipment need a full cleaning cycle — physical removal with detergent and water, then rinse — not just a sanitizer wipe. This is one of the most frequently misunderstood allergen controls in restaurant kitchens and one of the most common health-inspection findings when audited.
How does California's ADDE Act (SB 68) change restaurant allergen requirements?
The ADDE Act was signed by Governor Newsom on October 13, 2025 and takes effect July 1, 2026. It requires food facilities with 20 or more US locations already subject to federal menu labelling rules to provide written notification of the 9 major allergens to guests in California. It's the first state-level menu allergen disclosure mandate in the US, and other states are expected to follow. If your chain is covered, meeting SB 68 depends on accurate ingredient data, current recipes, consistent menu outputs, and trained staff — all of which live inside the allergen management checklist.
Book a free demo to review your ADDE Act readiness.
What's the difference between an allergen and a food intolerance in restaurant operations?
A food allergy triggers an immune-system response and can be life-threatening — anaphylaxis is a medical emergency. A food intolerance (lactose, FODMAP sensitivity, non-celiac gluten sensitivity) causes discomfort but is not immune-mediated. Restaurant allergen protocols exist to prevent immune-response reactions, which is why cross-contact prevention is so strict — trace amounts can trigger anaphylaxis. Intolerance requests are also honoured but do not require the same cross-contact controls. When a guest declares a "food allergy," staff should always treat it at the allergy level, not the intolerance level, until told otherwise.
How does OxMaint help with allergen management compliance?
OxMaint operationalizes the six-control-point allergen program on mobile — station-based checklist delivery, photo and e-signature evidence on every check, auto-generated corrective work orders on any fail, recipe allergen matrix management, and a full audit trail queryable by date, location, and control point. Cleaning verifications, storage segregation walks, and manager pass-verification records all lock into the asset and location history, so a health inspector or ADDE Act auditor gets defensible evidence returned in seconds instead of a two-week reconstruction from binders. The free forever plan is available to test the full workflow before rollout.
