Allergen Labelling in the UK: From 'May Contain' to Measured Risk
Walk the ambient aisle of any UK supermarket and count the 'may contain' statements. They are everywhere — on cereals, confectionery, snacks, sauces. Some are genuinely necessary. Many are precautionary in the loosest sense of the word: added because it felt safer than not adding them, not because any measurement or risk assessment was done.
That is about to change.
The Codex Alimentarius Commission is expected to adopt a new global standard for Precautionary Allergen Labelling (PAL) at its July 2026 meeting. The UK Food Standards Agency has indicated its support for the proposal. At the centre of it is a concept called ED05 — and if you manufacture food in the UK, you need to understand what it means for your allergen management programme before your next BRC audit.
Why the Current System Is Broken
The problem with 'may contain' is not that it exists. It is that it means different things on different products from different manufacturers. One business adds it after a full quantitative risk assessment. Another adds it because their site handles peanuts somewhere. A third adds it to everything as blanket legal protection, regardless of actual risk.
FSA research has confirmed what most food safety professionals already knew: consumers don't trust it. They can't tell the difference between a 'may contain' that reflects a genuine, quantified risk and one that's there purely defensively. The result is that genuinely at-risk consumers either avoid everything with a warning (restricting their diet unnecessarily) or ignore warnings altogether — which is far more dangerous.
The current UK guidance says PAL should only be used where a risk assessment has identified a cross-contamination risk that cannot be managed. But without defined thresholds, 'risk that cannot be managed' is interpreted entirely differently across the industry. There is no agreed point at which contamination is low enough that a warning is not needed.
What ED05 Actually Means
ED05 stands for Eliciting Dose at the 5th percentile. In plain English: it is the amount of a specific allergenic protein that is predicted to trigger an objective allergic reaction in 5% of individuals with that allergy.
The Codex Expert Consultation, drawing on clinical challenge data from thousands of subjects, established ED05-based Reference Doses for the priority allergens. These translate into specific milligram thresholds of allergenic protein per portion of food. The FSA's own research confirmed the recommended ED05 Reference Doses — for example, 2 mg of protein per portion for peanut, milk, and egg, and 1 mg per portion for most tree nuts.
The clinical evidence indicates that reactions at ED05 exposure levels are predominantly mild to moderate. The same review found no reports of fatal reactions at or below these levels in the published literature. That doesn't mean thresholds are risk-free — by definition, some allergic individuals will react — but it does provide a defensible, evidence-based line between 'risk that warrants a warning' and 'risk that has been managed to an acceptable level.'
It is also worth understanding where the UK currently sits. The FSA's Committee on Toxicity (COT) has expressed concern about the shift from ED01 (1% reaction threshold) to ED05, and has questioned whether the evidence base is sufficiently robust. The FSA's board position, heading into the Codex meeting in May 2026, is to support the ED05 proposal while acknowledging these concerns. This is not a done deal — but the direction of travel is clear, and UK manufacturers would be unwise to ignore it.
The VITAL Framework: How Thresholds Become Labelling Decisions
Understanding ED05 is one thing. Applying it in a factory producing 30 SKUs across shared lines is another. That is where the VITAL framework (Voluntary Incidental Trace Allergen Labelling) comes in.
Developed by the Allergen Bureau and now in its third version (VITAL 3.0), the framework provides a structured method for turning allergen test results into labelling decisions. It uses three inputs: the Reference Dose for the allergen, the concentration of that allergen measured in the finished product (via ELISA or equivalent), and the portion size.
The output is an Action Level classification:
- Below Action Level 1: The allergen concentration, when multiplied by the portion size, falls below the Reference Dose. No PAL statement is required.
- Between Action Level 1 and Action Level 2: The dose is at or approaching the Reference Dose. A PAL statement should be considered.
- Above Action Level 2: The dose exceeds the Reference Dose. A PAL statement is required.
A Worked Example
Take a 500g ready meal produced on a line that also handles milk-containing products. ELISA testing finds 12.5 mg/kg of milk protein in the finished product. The VITAL 3.0 Reference Dose for milk is 0.2 mg protein (ED05 basis: 2 mg per portion).
The calculation: 12.5 mg/kg × 0.5 kg (portion) = 6.25 mg milk protein delivered per portion.
The Reference Dose is 2 mg per portion. The measured dose is more than three times the Reference Dose. A 'may contain milk' statement is not just appropriate — it is required.
Now run the same calculation on a product where testing finds 2 mg/kg milk protein. The delivered dose per 500g portion is 1 mg — below the Reference Dose. Under a threshold-based system, that product would not require PAL. Today, many manufacturers would add it anyway.
That is the fundamental shift. Decisions based on evidence, not on precaution alone.
What This Means for Your Allergen Management Programme
If your current approach to cross-contamination is "we handle nuts on site, so everything gets a may contain," you are not compliant with BRC Issue 9 now — and you will be even further from compliant when thresholds become the norm.
BRC Issue 9 clause 5.3 already requires a documented allergen risk assessment. Clause 5.3.3 requires that PAL is only applied where the risk of cross-contact cannot be reduced to an acceptable level. What constitutes 'acceptable' is moving toward a quantified, defensible answer — not a judgment call.
Practically, this means three things need to be in place:
1. Quantitative allergen testing at the right points. You need actual measurements, not assumptions. ELISA methods are the standard tool for most allergens, though limitations exist for some (mustard, celery, and certain tree nuts are harder to quantify reliably at low concentrations). Testing should cover finished product and, where relevant, shared equipment after cleaning.
2. Documented risk assessments that link test results to labelling decisions. Testing alone is not enough. You need a documented process that takes the test result, applies the portion size calculation, and reaches a labelling decision with a clear audit trail. If an auditor asks why a product carries or does not carry a PAL statement, your answer needs to be a calculation, not a general policy.
3. Cleaning validation that supports your risk assessment. If your risk assessment relies on cleaning to remove allergen cross-contact below the Action Level, you need validated evidence that your cleaning procedure achieves that. Swab results from equipment surfaces, taken after cleaning, must support your claim. This is standard allergen cleaning validation — but it needs to be tied explicitly to your PAL decision-making process.
The Limitation Worth Knowing
Thresholds improve consistency and give manufacturers a defensible basis for their decisions. They do not eliminate risk for all allergic individuals. By definition, ED05 means that 5% of the allergic population may react at the reference dose level. The clinical evidence suggests these reactions are predominantly mild — but 'predominantly' is not 'always,' and some individuals have sensitivities that no population-level threshold can account for.
Good allergen management under a threshold-based system is not about finding the line and sitting on it. It is about reducing cross-contamination as far as reasonably practicable, then using testing and the VITAL framework to confirm that PAL decisions are evidence-based. The threshold sets the floor. Your job is to stay well below it.
Where SafetyCore Fits In
The shift to threshold-based PAL puts allergen documentation under greater scrutiny than ever. Auditors want to see the risk assessment, the test results, the calculation, and the labelling decision — all connected, all current, all version-controlled.
SafetyCore is built for exactly this kind of structured, auditable food safety management. Your HACCP plan in SafetyCore includes allergen hazard analysis at each process step — the system guides your team through identifying cross-contact risks, assessing their significance, and documenting the control measures in place. When those control measures include cleaning validation or allergen testing, that evidence is recorded in the same system, not scattered across spreadsheets and email threads.
When your BRC auditor arrives and asks to see your allergen risk assessment for line 3, you open SafetyCore. The hazard analysis, the control measures, the annual review sign-off — it is all there, with a full audit trail showing who reviewed it and when. No scrambling. No version confusion.
If you are still managing allergen risk assessments in Word documents or shared drives, now is a good time to change that. The regulatory direction is toward more rigorous, more evidenced documentation — and that is exactly what SafetyCore is designed to support.
See How SafetyCore Manages Allergen Risk →