May contain: when to use precautionary allergen labels, and when you shouldn't
Between 6 and 10 July 2026, in Geneva, the Codex Alimentarius Commission adopted the first international standard for "may contain" allergen labels. It took years of scientific work by FAO and WHO expert committees to get there, and the FSA had already recommended supporting the approach in a board paper published June 2026.
Most UK food brands didn't notice. Which is a problem, because the standard confirms a direction of travel that many SME labels are on the wrong side of: precautionary allergen labelling is meant to be the output of a risk assessment, not an insurance sticker.
The uncomfortable starting point: "may contain" is voluntary, but not free
Around 6% of UK adults, roughly 2.4 million people, live with a clinically confirmed food allergy according to the FSA's Patterns and Prevalence of Adult Food Allergy report (May 2024). For them, a "may contain" statement isn't small print. It decides whether they can buy your product.
Here's what the current UK position actually says, per the FSA's technical guidance updated in September 2023:
A precautionary allergen label should only be used when a risk assessment has identified a genuine risk of allergen cross-contact that cannot be removed through risk management. Not "we haven't checked", not "the factory also handles nuts somewhere", but an assessed, unavoidable, residual risk.
The statement should name the specific allergen. "May contain peanuts" or "may contain milk", drawn from the 14 allergens regulated under UK food law. Generic statements like "may contain allergens" are considered potentially misleading, because no risk assessment could plausibly conclude that all 14 allergens pose a cross-contact risk.
And a product cannot carry a "free from" claim and a PAL for the same allergen. "Free from milk" plus "may contain milk" is a contradiction, and the FSA guidance says so explicitly. A free-from claim is a guarantee backed by validated controls; a PAL admits residual risk. Pick one, based on evidence.
Why "when in doubt, add a label" backfires
The instinct is understandable. A PAL feels like legal protection, and adding one costs nothing at artwork stage. But blanket PALs create three problems.
First, they can be challenged as misleading under food information law if there's no risk assessment behind them. Voluntary doesn't mean unregulated: once the statement is on pack, it has to be accurate and justifiable.
Second, they erode trust in the labels that matter. When "may contain" appears on everything, allergic consumers stop believing it, and the products with genuine cross-contact risk lose their warning power. The FSA has been explicit that overuse harms the consumers the labels exist to protect.
Third, they shrink your market for no reason. A "may contain milk" on a product with no assessed milk risk removes you from the basket of every milk-allergic household, and increasingly from free-from retail listings, without buying you any real protection.
What the CODEX standard changes
The new guidelines, adopted at CAC49 as an annex to the General Standard for the Labelling of Prepackaged Foods, do two big things.
They make the risk-assessment-first logic global. PAL should only appear when allergen management is in place and a scientific risk assessment still shows residual unintended allergen presence. That matches the FSA's existing position, which is partly why the FSA supported it.
And they introduce reference doses. The framework is built on ED05: the eliciting dose at which 5% of people with a given allergy would be likely to react. Products with potential cross-contact below the reference dose shouldn't carry a PAL at all; above it, they should. That turns "may contain" from a judgement call into something closer to a calculation, with defined thresholds for priority allergens including gluten.
What's confirmed: the standard is adopted, and the FSA supports the approach, including ED05 thresholds.
What's likely: UK guidance will move towards quantitative risk assessment over the next few years. The FSA's board papers on PAL and allergen thresholds signal exactly this direction.
What's still unclear: timing, and whether the UK implements reference doses through updated guidance or legislation. As of July 2026, nothing in UK law has changed yet. There is no new compliance deadline this month.
What this means for a food team
If you make prepacked food in the UK, the practical to-do list looks like this.
Audit every PAL you currently carry. For each one, can you point to a documented cross-contact risk assessment? If the honest answer is "it's been on the label since launch", that's the gap to close, either by doing the assessment or by removing the statement it doesn't support.
Check your statements name specific allergens. "May contain nuts" should be "may contain almonds" (or whichever of the 14 apply). If your artwork says "made in a factory that handles allergens", rewrite it.
Look for free-from contradictions. Any SKU carrying both a free-from claim and a PAL for the same allergen needs a decision, backed by testing, about which one is true.
Ask your suppliers harder questions. Your risk assessment is only as good as the ingredient specs feeding it. A supplier's own blanket PAL passed down the chain is exactly the pattern the CODEX framework is designed to end.
None of this requires waiting for UK implementation. The brands that align with risk-based PAL now will spend the transition period fine-tuning, not firefighting, when the thresholds land. If you formulate in Nibblr, your allergen declarations already sit alongside your recipe data, which makes the audit a report rather than a project.
Frequently asked questions
Is "may contain" labelling mandatory in the UK?
No. Precautionary allergen labelling is voluntary. But if you use it, FSA guidance says it must be based on a risk assessment showing an unavoidable risk of allergen cross-contact, and it must not be misleading. A PAL with no assessment behind it is a compliance risk, not protection.
Can I write "may contain nuts"?
FSA guidance says PAL statements should name the specific allergen from the 14 regulated under UK food law, for example "may contain peanuts" or "may contain almonds". "Nuts" spans multiple distinct allergens, and a blanket reference is considered poor practice.
Can a product be "free from milk" and "may contain milk"?
No. The FSA is explicit that a free-from claim and a PAL for the same allergen cannot appear together. A free-from claim guarantees absence backed by validated controls; a PAL declares residual risk. They contradict each other.
What is ED05?
ED05 is the eliciting dose at which 5% of people with a specific food allergy would be likely to experience a reaction. The CODEX precautionary allergen labelling framework, adopted in July 2026, uses ED05-based reference doses to decide when a "may contain" statement is warranted. In a June 2026 board paper, the FSA recommended supporting ED05 as the threshold basis, but this is not yet UK law.
Does the new CODEX standard change UK law?
Not yet. CODEX standards are international reference points, not domestic law. As of July 2026, UK requirements are unchanged, but the FSA formally supports the CODEX approach, so UK guidance is likely to move towards quantitative, threshold-based PAL over the coming years.
Do I need a "may contain" label on non-prepacked food?
No. For non-prepacked (loose) food, precautionary allergen information can be communicated by other means, such as signage at the point of sale or orally by staff, though it still needs to be accurate and based on actual risk.
Nibblr tracks the 14 regulated allergens across every recipe as you build it, so your declarations and your risk assessment work from the same data. Get started free.