The 14 allergens: UK list, Natasha's Law and the rules for food businesses

The 14 allergens are the foods UK law says you must tell customers about whenever you use them as an ingredient: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soya, and sulphur dioxide and sulphites. The list comes from Annex II of Regulation 1169/2011 on food information to consumers. It applies in every UK nation, to every food business, from a market stall to a hotel chain.

The 14 allergens at a glance

• There are exactly 14. Other foods can cause reactions too. These are just the ones the law makes you declare, and the list hasn't changed since it started applying in December 2014.
• For loose food, like meals in a restaurant, the law lets you give allergen information any way you like, including verbally, as long as a sign tells customers to ask.
• Since 24 February 2025, the FSA's best practice for England, Wales and Northern Ireland is written allergen information backed up by a conversation. That's guidance, not law.
• Since 1 October 2021, "Natasha's Law" means food prepacked for direct sale (PPDS), like a sandwich you make and wrap before the customer chooses it, needs a full ingredients label with the allergens emphasised. It came in on the same day in all four nations.
• Getting it wrong is a crime. In the worst case, a restaurant owner went to prison for six years for manslaughter.

What are the 14 allergens?

Here's the full list, in the order of the law, with where each one tends to turn up in a kitchen. The legal wording and exemptions are from Annex II. The "often found in" column and the symbols are ours. We found no statutory UK symbol set for the 14 allergens: the law requires the allergen to be named, and symbols on their own don't meet that. Always check your own suppliers' specifications.

Two entries trip people up. Oats are on the list as a gluten cereal, even though some people with coeliac disease can eat them. And "nuts" means only the eight tree nuts named. Peanuts are a separate allergen, and coconut, pine nuts and chestnuts aren't on the list at all.

Where does the law come from?

The list sits in Regulation (EU) No 1169/2011, which the UK kept after Brexit. In Great Britain it's now "assimilated law" and is published on legislation.gov.uk. In Northern Ireland the EU version applies directly under the Windsor Framework, as the FSA's best practice guidance explains.

Three articles do most of the work:

• Article 9(1)(c) makes allergen information mandatory for food that's sold prepacked.
• Article 21 says how to show it on a label: in the ingredients list, emphasised "through a typeset that clearly distinguishes it", for example in bold.
• Article 44 makes it mandatory for food that isn't prepacked too, such as restaurant meals, deli counters and drinks made to order.

Each nation then has its own regulations that create the offences and set the rules for loose food:

The 13 December 2014 date is when Regulation 1169/2011's allergen rules started to apply across the EU, including the UK. In England and Wales "level 5" means an unlimited fine for offences committed since 12 March 2015. The penalty sits in regulation 11 of each nation's 2014 Regulations (England, Northern Ireland), which says a person guilty under regulation 10 is liable "to a fine not exceeding level 5 on the standard scale". In Scotland, section 225 of the Criminal Procedure (Scotland) Act 1995 sets level 5 at £5,000. In Northern Ireland, article 5 of the Fines and Penalties (NI) Order 1984 also sets level 5 at £5,000.

Loose food: what restaurants, cafés and takeaways must do

Most hospitality food is "non-prepacked". Think plated meals, buffets, pick-and-mix, a coffee made to order. For this food, regulation 5 of the 2014 English Regulations says you may make the allergen information available "by any means the operator chooses, including ... orally". The Welsh, Scottish and Northern Irish regulations say the same.

If you choose to tell customers verbally, you must show a notice saying that "details of that substance or product can be obtained by asking a member of staff". The notice goes on a label on the food, or on a menu, ticket or sign the customer can see where they choose.

That's the legal minimum. The FSA's best practice guidance, published on 24 February 2025 and applying to England, Wales and Northern Ireland, asks for more. It says businesses "should make allergen information easily available in writing for consumers and ensure staff are able to support this with a conversation", and that they "should ask all consumers whether they have any allergen requirements". The guidance is clear about its status: "You are not required by law to follow best practice guidance."

In practice, written means an allergen matrix, a recipe chart, an allergen booklet, or allergens marked on the menu. The FSA's Safer Food, Better Business pack for caterers includes an allergen recipe chart you can use. Labels for PPDS food also need dates: see date labelling.

Online and phone orders

For distance selling, the FSA guidance says written information should be available "both before the food is ordered and when it is delivered". On your own website it should be on the menu, or "no more than 'one click away'". On a delivery app, customers should be told where to find it before they order.

Natasha's Law: prepacked for direct sale food

Natasha Ednan-Laperouse was 15 when she died in July 2016 after eating a baguette from Pret a Manger at Heathrow Terminal 5. The coroner's Prevention of Future Deaths report records that it "contained unlabelled sesame" and that "There was no specific allergen information on the baguette packaging". At the time the law didn't require a label on food made and packed on site.

The law changed in all four nations on 1 October 2021. Food that's prepacked for direct sale now needs two things on the package or a label attached to it:

• the name of the food
• a full list of ingredients, with any of the 14 allergens emphasised

The English rule is regulation 5A of the 2014 Regulations. The Welsh, Scottish and Northern Irish versions are in the instruments in the table above. Regulation 5A in each nation also applies Article 16(2) to the ingredients list: England, Wales, Scotland and Northern Ireland. So a pack whose largest surface is under 10cm² can give the ingredients list "through other means" or on request. The allergens (Article 9(1)(c)) must still be on the pack. None of these rules apply to distance selling.

PPDS is food packed before the customer orders it, on the same premises where it's sold. Examples include:

• sandwiches and salads made in the morning and put in a chiller
• cakes boxed for a counter display
• burgers wrapped under a hot lamp before anyone orders
• meat or cheese portioned and wrapped at a deli counter ahead of time

Food packed after the customer orders it isn't PPDS, so a sandwich made to order and wrapped stays under the loose food rules. Food packed by one business and sold by another is fully prepacked and needs a full label from the manufacturer. Food Standards Scotland's PPDS guidance says allergens can be emphasised by "using a different text colour, writing the allergens in bold or underlining".

How to manage the 14 allergens in a kitchen

The law asks for accurate information. Most allergen mistakes come from small changes nobody passed on: a new supplier, a swapped sauce, a garnish added for one service. A sensible routine looks like this:

1. Get a written specification for every ingredient, including bought-in sauces, spice mixes and bread. Keep them with your approved supplier records.
2. Build an allergen matrix with every dish, side, sauce and special against all 14.
3. Check the matrix every time a recipe or supplier changes. Date it, and take the old version out of circulation.
4. Train every member of staff before they take an order or plate a dish. Pilla's in-house allergen training guide shows two ways to run and record it.
5. Flag allergy orders on the ticket and through to the kitchen. Make sure someone confirms the dish at the pass.
6. Control cross-contact: separate storage, clean equipment, separate utensils, fresh oil or a dedicated fryer where it matters. See safe food storage.
7. Never guess. If nobody knows, say "I'll check with the chef" and do it.

Allergens are part of your food safety system. They belong in your HACCP plan and your kitchen risk assessment, and an environmental health officer will look at them at inspection, which can affect your food hygiene rating. Some dishes carry particular allergen risks: see our training guides on high-risk foods, ready-to-eat foods, shellfish, fish, sushi and cold buffets.

"May contain" and "free from"

"May contain" warnings are voluntary. The law doesn't require them, and the FSA treats them as voluntary information in its allergen guidance for food businesses. Use one only where there is a real cross-contact risk you can't control. A blanket "may contain nuts" on everything narrows the menu for allergic customers for no reason.

"Free from" claims are different. If you say a dish is "gluten free" or "nut free", it has to be. "Gluten free" also has a legal meaning: under Regulation 828/2014, the food "contains no more than 20 mg/kg of gluten".

Enforcement and real cases

Allergen information is enforced by local authorities: environmental health or trading standards, depending on the council. Officers often run covert test purchases, ordering food while saying they have an allergy and sending it to a public analyst.

Under regulation 10 of the 2014 English Regulations, failing to give mandatory allergen information is an offence. More serious cases are charged as supplying unsafe food under each nation's food hygiene regulations, or under section 14 of the Food Safety Act 1990 in Great Britain. Where someone dies, the owner can face manslaughter. The hygiene regulations are named differently in each nation:

Improvement notices. Regulation 12 of the 2014 English Regulations lets officers serve an improvement notice under section 10 of the Food Safety Act 1990, for example requiring you to fix your loose-food allergen information under regulation 5 or your PPDS labels under regulation 5A. Failing to comply with the notice is itself an offence.

Companies, directors and managers. Schedule 4 to the same Regulations applies section 36 of the 1990 Act. Where a company's offence was committed "with the consent or connivance of, or to be attributable to any neglect on the part of" a director or manager, they're guilty too.

Due diligence defence. Schedule 4 also applies section 21. It's a defence to prove you "took all reasonable precautions and exercised all due diligence to avoid the commission of the offence". In practice that means written specifications, a current matrix and training records.

Time limits. For offences under the Food Safety Act 1990 that can go to the Crown Court, such as selling unsafe food under section 14, section 34 says no prosecution can begin after "three years from the commission of the offence; or one year from its discovery by the prosecutor, whichever is the earlier". The regulation 10 offence is different. Regulation 11 makes it punishable "on summary conviction" only, so the normal six-month limit applies: section 127(1) of the Magistrates' Courts Act 1980 in England and Wales, section 136 of the Criminal Procedure (Scotland) Act 1995 in Scotland, and article 19(1)(a) of the Magistrates' Courts (NI) Order 1981 in Northern Ireland.

Sentencing. In England and Wales, the Sentencing Council's food safety and hygiene guideline for organisations covers regulation 19(1) of the English 2013 Regulations, regulation 17(1) of the Welsh 2006 Regulations and regulation 4 of the General Food Regulations 2004. It has applied since 1 February 2016, with an offence range of £100 to £3 million. It doesn't list the Food Information Regulations offence. We found no equivalent guideline in Scotland or Northern Ireland.

Cases from the official record:

• R v Zaman (England, 2016, appeal 2017). Paul Wilson died after eating a takeaway from the Indian Garden in Easingwold. The waiter had told him the meal contained no nuts, but the owner had swapped almond powder for a cheaper mixed-nut powder that contained peanut. Mohammed Zaman was convicted at Teesside Crown Court of gross negligence manslaughter and six food safety offences, and jailed for six years, with concurrent terms of up to nine months on the food safety counts. The Court of Appeal heard the appeal on 12 October 2017 and dismissed the appeals against both conviction and sentence in its judgment of 8 November 2017. It said: "This was not a transitory act of negligence, but negligent behaviour that persisted over months." (para 79)
• EH Enterprise Ltd, Spice World, Crawley (England, 2024 and 2026). A West Sussex County Council officer ordered a lamb doner kebab in September 2024, asked if it contained milk and was told it didn't. Analysis found milk protein. This was a follow-up after an earlier conviction on 4 April 2024. On 26 February 2026 the company, its director and its manager pleaded guilty. The company was fined £1,000 plus a £400 surcharge, and each individual paid £704.
• 786mahbub Ltd, India Garden, Bognor Regis (England, 2026). Another West Sussex test purchase, on 8 January 2025, found milk protein in a Lamb Dhansak that staff had said was milk-free. The company and two individuals were found guilty at Brighton Magistrates' Court in March 2026. The council also noted the business "kept no written allergen or food safety training records, stating that staff were trained verbally".

We found no published allergen prosecution in Wales, Scotland or Northern Ireland from an official source in the time we searched. Our food standards legislation page covers two more English cases.

Common myths

Chefs, servers and owners keep getting caught out by the same four ideas.

"Saying 'ask staff about allergens' is enough." It's the legal minimum for loose food, but only if your staff can then give accurate answers. The test purchase cases above all started with a member of staff saying "no milk" without checking. On Reddit's r/TalesFromYourServer, one server's whole thread is a plea not to tell customers "don't worry, there's no (allergen) in that dish" from memory. In the same thread, another server wrote: "I ALWAYS mark allergy tickets for this exact reason, idc if the allergen is in it or not."

"Our allergen matrix is done." On X, a restaurant software account said it on 2 October 2026: "Your allergen matrix isn't finished when every box is filled." The question is whether tonight's team can trace a replacement sauce through every dish without relying on memory.

"Natasha's Law means every ingredient must be on every label." Only for PPDS food. A plated meal or a sandwich made to order doesn't need a label, though you still have to give allergen information.

"Only the 14 matter." They're the only ones the law makes you declare. A customer can be allergic to anything. If someone tells you about kiwi, it's the 15th allergen for that table.

Allergen checklist

• Written spec for every ingredient, including bought-in items.
• Allergen matrix covering every dish, side, sauce, drink and special, dated.
• A sign or menu note telling customers to ask, if you give information verbally.
• Written allergen information available, in line with FSA best practice.
• PPDS labels with the name, the full ingredients and allergens in bold, if you pre-pack.
• Online menus with allergen information before ordering.
• Allergy orders flagged from order to table.
• Training records for every member of staff.
• A process for supplier and recipe changes.

Owen's Law: is it coming?

Owen Carey died in 2017. His family campaign for "Owen's Law". The FSA's Annex G response (archived copy) (June 2022) lists the proposals in its remit: restaurants "required by law to label the fourteen regulated allergens on their menus with standardised symbols, numbers or words", to provide an allergen matrix for each dish, and to "ask each customer about allergen requirements on all occasions". The FSA said it supports better staff training and more standard written information. None of this is law. The closest thing is the FSA's non-statutory 2025 best practice guidance described above.

Recent and upcoming changes

• 13 December 2014: the 14 allergens become mandatory for all food, including loose food, under Regulation 1169/2011 and each nation's 2014 Regulations.
• 1 October 2021: Natasha's Law brings full ingredient labelling for PPDS food in England, Wales, Scotland and Northern Ireland.
• 1 January 2024: retained EU law becomes "assimilated law" in Great Britain. The list doesn't change.
• 24 February 2025: the FSA publishes best practice guidance asking for written allergen information plus a conversation, for England, Wales and Northern Ireland.

We found no change to the list of 14 itself, and no new legal duty for written information on loose food, in force by 14 October 2026.

FAQ

Do the 14 allergens apply to drinks?

Yes. Milk in a latte, sulphites in wine and gluten in beer all count. The FSA's guidance gives "drinks made to order in a coffee shop" as an example of non-prepacked food.

Do I need allergen information for free food?

Yes. The FSA says the rules apply "to all food supplied by food businesses, including when food is offered complimentarily or otherwise without charge", such as a free sample or a biscuit with a coffee.

Is a chalkboard saying "ask staff" legal?

For loose food, yes, if staff can then give accurate information. The FSA's 2025 best practice is to have the information in writing too.

What is the difference between an allergy and an intolerance?

An allergy involves the immune system and can cause anaphylaxis, which can kill. An intolerance, like lactose intolerance, doesn't involve the immune system and is usually less severe. Coeliac disease is an autoimmune reaction to gluten. The law treats them the same way: if one of the 14 is in the food, you must say so.