Only one of 45 Dubai-style chocolate samples passed every test the Food Standards Agency ran. The other 44 failed on labelling, and several carried peanut or sesame that the pack never declared. That is the headline finding of the FSA's sixth annual retail surveillance survey, published on 2 July 2026, and it reads as a direct test of your food authenticity and allergen verification controls. If you manufacture, import or pack any product where the recipe or the species can be swapped, the survey asks a question your HACCP plan should already answer: how do you prove the label is true?
What the survey found
Between July and December 2025 the FSA sampled 845 products from national supermarkets, independent retailers and online sellers, targeting areas where it already suspected non-compliance. Most were safe and correctly labelled. The failures clustered in three places.
Dubai-style chocolate was the worst. Of 45 samples, 42 had labelling problems: missing or incorrect use-by and best-before dates, allergens not clearly highlighted, ingredients listed out of order, and no UK importer details. The undeclared allergens included peanut and sesame, either of which can put a sensitised consumer in hospital at trace levels.
Goat meat told a different story. Of 40 samples, 20 contained only sheep, one was a sheep and goat mix, and one was entirely deer. The FSA passed the findings to the National Food Crime Unit.
Slush-ice drinks showed ongoing issues with glycerol levels and missing in-store warning notices, following the revised glycerol guidance the FSA issued in July 2025. The full detail sits in the FSA's published survey.
Where food authenticity and allergen verification break down
Two separate control failures sit behind these numbers, and they fail in different places.
The allergen failures are a labelling and artwork control breakdown. An undeclared allergen almost never means the allergen was a surprise. It means the declaration process did not catch it: artwork approved without an allergen cross-check, a recipe change that never reached the label, or an imported pack placed on the UK market before anyone verified the ingredient list against the actual formulation. Codex Principle 1 treats allergens as a chemical hazard, and BRC Issue 9 clause 5.3 requires allergen management to run from raw material through to the finished label. The pack is the last control point. When it is wrong, the consumer has no defence.
The goat meat failures are food fraud, and they fail at supplier assurance. Selling sheep as goat is economically motivated substitution. BRC clause 2.7.1 requires hazard analysis to consider fraud and adulteration, and clause 5.4 covers product authenticity and chain of custody. Neither works without a vulnerability assessment that flags which raw materials are worth faking, backed by testing or supplier controls proportionate to that risk. Species substitution is one of the oldest frauds in the trade. A business that never authenticity-tests a high-value species is trusting a certificate it has not challenged.
The HACCP perspective
Getting the classification right changes what you do about it.
Allergen control on a label is a prerequisite programme, not a CCP. BRC clause 2.2 lists allergen management among the prerequisites. That classification matters. A CCP carries a measurable critical limit you monitor as the process runs, while label accuracy is held by procedure, approval and verification. Calling it a PRP does not make it less important. It tells you the control is document and process control, so your verification has to be a real cross-check against the formulation rather than a signature on a proof.
Authenticity is a vulnerability, and it enters the plan through hazard analysis under BRC 2.7.1. You assess it for likelihood and severity like any other hazard, then control it through supplier approval (clause 3.5) and, where the risk justifies it, through testing. The 2020 revision of Codex CXC 1-1969 sharpened both points, raising the profile of allergen cross-contact controls and keeping fraud inside the hazard analysis rather than parked outside it. The common thread is verification. Both failures are cases where a control existed on paper and nobody proved it was working.
How this could have been prevented
Four checks a Technical Manager can run this week, without waiting for an audit:
- Pull your five highest-risk allergen products and compare the current approved artwork against the live recipe specification. Confirm every allergen in the formulation appears on the label and is emphasised. Date the check.
- For any bought-in or imported finished product you place on the UK market, verify the ingredient list against the supplier specification and confirm UK importer details are present. Do not assume the incoming label is right.
- Rank your raw materials by fraud vulnerability, not by volume. Species, origin claims, organic status and high-value ingredients rise to the top. For anything high-risk, ask what evidence you hold beyond the supplier's word.
- Check that your last artwork or recipe change triggered a review of the allergen declaration. If the change control record and the label do not line up, you have found the gap before an inspector does.
Where SafetyCore fits
SafetyCore is built around the HACCP plan and its reviews, which is exactly where both of these failures live.
Its Hazard Analysis module handles chemical hazards including allergens, with severity and likelihood scoring, so an allergen is assessed and recorded against the process step where it enters. Fraud and adulteration sit in the same analysis, which is where BRC 2.7.1 expects them. Prerequisite Programmes for allergen management and supplier approval link to those risk assessments, so the control and the reason for it stay connected instead of living in separate files.
When intelligence like this FSA survey lands, a Triggered Review lets you reopen the relevant hazard analysis and record what you checked and changed, with the Audit Trail timestamping every approval. The Hazard Library gives you a consistent starting point for allergen and authenticity hazards across products, and the BRC-ready PDF export turns the record into something an auditor can read. None of this monitors your line or tracks a batch. It holds the plan, the reasoning, and the evidence that your controls were reviewed against a real risk.
Final thought
The FSA called this a targeted survey of suspect areas, not a verdict on UK food, and that is fair. But every failure it found was a control that existed and went unverified. The label said one thing, the product was another, and nobody caught the gap before it reached a shelf. Your allergen declarations and your authenticity claims are only as good as the last time someone proved them true. Pick five products and prove it this week.