Allergen Labelling in the UK: From 'May Contain' to Measured Risk
Walk the ambient aisle of any UK supermarket and count the 'may contain' statements. They are everywhere (on cereals, confectionery, snacks, sauces. Some are genuinely necessary. Many are precautionary in the loosest sense of the word: added because it felt safer than not adding them, not because any measurement or risk assessment was done.
That is about to change.
The Codex Alimentarius Commission is anticipated to consider adoption of a new global standard for Precautionary Allergen Labelling (PAL) at its July 2026 meeting) though adoption is not yet confirmed. The UK Food Standards Agency has engaged with the proposal, though its position is qualified rather than a full endorsement. At the centre of it is a concept called ED05 (and if you manufacture food in the UK, you need to understand what it means for your allergen management programme before your next BRC audit.
Why the Current System Is Broken
The problem with 'may contain' is not that it exists. It is that it means different things on different products from different manufacturers. One business adds it after a full quantitative risk assessment. Another adds it because their site handles peanuts somewhere. A third adds it to everything as blanket legal protection, regardless of actual risk.
FSA research has confirmed what most food safety professionals already knew: consumers don't trust it. They can't tell the difference between a 'may contain' that reflects a genuine, quantified risk and one that's there purely defensively. The result is that genuinely at-risk consumers either avoid everything with a warning (restricting their diet unnecessarily) or ignore warnings altogether) which is far more dangerous.
The current UK guidance says PAL should only be used where a risk assessment has identified a cross-contamination risk that cannot be managed. But without defined thresholds, 'risk that cannot be managed' is interpreted entirely differently across the industry. There is no agreed point at which contamination is low enough that a warning is not needed.
What ED05 Actually Means
ED05 stands for Eliciting Dose at the 5th percentile. In plain English: it is the amount of a specific allergenic protein that is predicted to trigger an objective allergic reaction in 5% of individuals with that allergy.
The Codex Expert Consultation, drawing on clinical challenge data from thousands of subjects, established ED05-based Reference Doses for the priority allergens. These translate into specific milligram thresholds of allergenic protein per portion of food. The FSA's own scientific review engaged with the recommended ED05 Reference Doses (for example, 2 mg of allergenic protein per portion for peanut, milk, and egg, and 1 mg per portion for most tree nuts. It is important to note that these are framework guidance values derived from VITAL 4.0 modelling, not established UK regulatory limits.
The clinical evidence indicates that reactions at ED05 exposure levels are predominantly mild to moderate. Published challenge study data does not suggest a high incidence of severe reactions at these dose levels, though the evidence base has limitations) controlled challenge conditions differ from real-world exposure, and underreporting in the literature cannot be ruled out. That doesn't mean thresholds are risk-free (by definition, some allergic individuals will react) but they provide a more defensible, evidence-based basis for decision-making than no threshold at all.
It is also worth understanding where the UK currently sits. The FSA's Committee on Toxicity (COT) has expressed concern about the shift from ED01 (1% reaction threshold) to ED05, and has questioned whether the evidence base is sufficiently robust. The FSA's board position, heading into the Codex meeting in May 2026, is to support the ED05 proposal while acknowledging these concerns. This is not a done deal (but the direction of travel is clear, and UK manufacturers would be unwise to ignore it.
The VITAL Framework: How Thresholds Become Labelling Decisions
Understanding ED05 is one thing. Applying it in a factory producing 30 SKUs across shared lines is another. That is where the VITAL framework (Voluntary Incidental Trace Allergen Labelling) comes in.
Developed by the Allergen Bureau and now in its fourth version (VITAL 4.0), the framework provides a structured method for turning allergen test results into labelling decisions. It uses three inputs: the Reference Dose for the allergen, the concentration of that allergen measured in the finished product (via ELISA or equivalent), and the portion size.
The output is an Action Level classification:
- Below Action Level 1: The allergen concentration, when multiplied by the portion size, falls below the Reference Dose. VITAL guidance indicates PAL is not necessary.
- At or above Action Level 1, below Action Level 2: The dose is approaching the Reference Dose. VITAL guidance indicates PAL should be applied.
- Above Action Level 2: The dose exceeds the Reference Dose. VITAL guidance indicates PAL is required.
Note: VITAL is industry guidance, not a legal standard. Its application does not remove the need for a documented risk assessment, and it does not constitute regulatory compliance in itself.
A Worked Example
Take a 500g ready meal produced on a line that also handles milk-containing products. ELISA testing returns a result of 12.5 mg/kg of milk protein in the finished product.
The VITAL 4.0 ED05 Reference Dose for milk protein is 2 mg per portion. This is an absolute mass of protein, not a concentration. The calculation converts the ELISA result into the actual dose delivered in one portion, then compares that dose against the Reference Dose.
Step 1: Calculate the dose delivered per portion.
ELISA result: 12.5 mg/kg milk protein
Portion weight: 500g (0.5 kg)
Dose per portion: 12.5 mg/kg × 0.5 kg = 6.25 mg milk protein
Step 2: Compare against the Reference Dose.
Reference Dose: 2 mg per portion
Measured dose: 6.25 mg per portion
Result: 6.25 mg is more than three times the Reference Dose. A 'may contain milk' statement is required.
Now apply the same method to a product where testing returns 2 mg/kg milk protein.
Dose per portion: 2 mg/kg × 0.5 kg = 1 mg milk protein
Reference Dose: 2 mg per portion
Result: 1 mg is below the Reference Dose. Under a threshold-based system, this product would not require PAL. Today, many manufacturers would add it anyway.
That is the fundamental shift: decisions based on a documented calculation, not on precaution alone.
Note that the Reference Dose is fixed, but the threshold concentration varies with portion size. For a 250g portion, the threshold concentration would be 2 mg divided by 0.25 kg, giving 8 mg/kg. For a 100g portion, it would be 2 mg divided by 0.1 kg, giving 20 mg/kg. Portion size must always be defined before the calculation is run, and it must reflect the portion size as consumed, not the pack weight.
What This Means for Your Allergen Management Programme
If your current approach to cross-contamination is "we handle nuts on site, so everything gets a may contain," you are at significant risk of non-compliance with BRC Issue 9) and that risk increases as the industry moves toward threshold-based assessment. BRC Issue 9 does not mandate quantitative thresholds, but it does require that PAL decisions are justified by a documented risk assessment. A blanket approach with no underpinning assessment is difficult to defend under clause 5.3.
BRC Issue 9 clause 5.3 already requires a documented allergen risk assessment. Clause 5.3.3 requires that PAL is only applied where the risk of cross-contact cannot be reduced to an acceptable level. What constitutes 'acceptable' is moving toward a quantified, defensible answer (not a judgement call.
Practically, this means three things need to be in place:
1. Quantitative allergen testing at the right points. You need actual measurements, not assumptions. ELISA methods are the standard tool for most allergens, though limitations exist for some (mustard, celery, and certain tree nuts are harder to quantify reliably at low concentrations). Testing should cover finished product and, where relevant, shared equipment after cleaning.
2. Documented risk assessments that link test results to labelling decisions. Testing alone is not enough. You need a documented process that takes the test result, applies the portion size calculation, and reaches a labelling decision with a clear audit trail. If an auditor asks why a product carries or does not carry a PAL statement, your answer needs to be a calculation, not a general policy.
3. Cleaning validation that supports your risk assessment. If your risk assessment relies on cleaning to remove allergen cross-contact below the Action Level, you need validated evidence that your cleaning procedure achieves that. Swab results from equipment surfaces, taken after cleaning, must support your claim. This is standard allergen cleaning validation) but it needs to be tied explicitly to your PAL decision-making process.
The Limitation Worth Knowing
Thresholds improve consistency and give manufacturers a defensible basis for their decisions. They do not eliminate risk for all allergic individuals. By definition, ED05 means that 5% of the allergic population may react at the reference dose level. The clinical evidence suggests these reactions are predominantly mild (but 'predominantly' is not 'always,' and some individuals have sensitivities that no population-level threshold can account for.
Good allergen management under a threshold-based system is not about finding the line and sitting on it. It is about reducing cross-contamination as far as reasonably practicable, then using testing and the VITAL framework to confirm that PAL decisions are evidence-based. The threshold sets the floor. Your job is to stay well below it.
Where SafetyCore Fits In
The shift to threshold-based PAL puts allergen documentation under greater scrutiny than ever. Auditors want to see the risk assessment, the test results, the calculation, and the labelling decision) all connected, all current, all version-controlled.
SafetyCore is built for exactly this kind of structured, auditable food safety management. Your HACCP plan in SafetyCore includes allergen hazard analysis at each process step (the system guides your team through identifying cross-contact risks, assessing their significance, and documenting the control measures in place. When those control measures include cleaning validation or allergen testing, that evidence is recorded in the same system, not scattered across spreadsheets and email threads.
When your BRC auditor arrives and asks to see your allergen risk assessment for line 3, you open SafetyCore. The hazard analysis, the control measures, the annual review sign-off) it is all there, with a full audit trail showing who reviewed it and when. No scrambling. No version confusion.
If you are still managing allergen risk assessments in Word documents or shared drives, now is a good time to change that. The regulatory direction is toward more rigorous, more evidenced documentation (and that is exactly what SafetyCore is designed to support.
See How SafetyCore Manages Allergen Risk →