What Happened
On 18 April 2026, Marks & Spencer recalled Authentic Greek Yoghurt with Vanilla (500g, use by 12 May 2026) due to undeclared gluten. This wasn't a contamination incident — it was a manufacturing control failure. For a dairy technical manager, this recall illustrates a critical vulnerability in allergen management systems: the gap between what's supposed to be in a product and what actually gets labelled on the pack.
M&S Authentic Greek Yoghurt with Vanilla was recalled because the product formulation — whether through ingredient specification drift, supplier change, or supplier documentation failure — contained gluten, but the label did not declare it. Consumers with coeliac disease or gluten sensitivity would have bought the product believing it was safe. The FSA alert (April 2026) classified this as a food safety issue requiring immediate consumer warning and product withdrawal.
The affected batch was use-by 12 May 2026. Consumers were advised not to consume the product and to return it to the retailer for a refund. This was a precautionary withdrawal — no adverse events were reported — but represents exactly the kind of control failure that enforcement authorities and customers take most seriously in dairy manufacturing.
What Went Wrong — The Root Cause
This failure sits at the intersection of two HACCP application steps that many dairy manufacturers still don't integrate properly: hazard analysis (Codex Step 3) and verification of control measures (Codex Step 11).
Under Codex CXC 1-1969 (Rev. 2022), gluten is a significant hazard for any product that may contain it — even in trace amounts from ingredients or processing. This means it must appear in the hazard analysis and be subject to control. For a yoghurt product, the control measure is straightforward: ingredient specification and supplier verification. This is a Prerequisite Programme (PRP), not a CCP. Cleaning of processing equipment between gluten-containing and gluten-free products would also be a PRP.
The M&S recall suggests one or more of these PRP controls failed:
- Ingredient specification drift: A vanilla flavouring, thickener, or other minor ingredient specification changed, and the supplier's declaration wasn't updated or wasn't reviewed by the yoghurt manufacturer.
- Supplier documentation failure: The ingredient supplier's safety data sheet or allergen declaration was not accurate or not communicated to the technical team.
- Artwork control failure: The reformulated product was made correctly (without gluten), but the label artwork was not updated, creating a mismatch between product and pack. This would be a failure of Codex Step 3 (hazard analysis — failure to identify the hazard) combined with artwork control, which is part of the product specification PRP under BRC Issue 9 clause 4.5.
- No verification audit: Verification of allergen control should include periodic testing of finished product or, at minimum, a documented review of ingredient supplier certifications and allergen declarations at a set frequency (typically quarterly or before any ingredient change). This may not have been done, or results were not acted upon.
BRC Issue 9 clause 2.7 (Hazard Analysis) requires that "significant hazards" identified in the hazard analysis must include allergens known to be present in the product or present in raw materials or supplied ingredients. If gluten was not listed as a significant hazard because the company believed no gluten-containing ingredients were used, and then an ingredient changed without updating the hazard analysis, the system collapsed.
How This Should Have Been Prevented
Allergen control in dairy manufacturing requires three parallel systems: specification, supplier verification, and artwork lock-down. Here's what a food safety professional should do this week:
1. Ingredient Specification Review (immediate)
Pull every ingredient supplier's allergen declaration for every product. Cross-reference against your product specification and hazard analysis. For gluten specifically, check not just the primary ingredient (milk, cultures, vanilla), but processing aids, emulsifiers, thickeners, and flavourings. Gluten can hide in modified starch, malt flavouring, or hydrolysed proteins. If your supplier says "gluten-free" but the allergen matrix is blank or vague, escalate it — get a certified allergen statement in writing.
2. Supplier Audit Schedule (next 30 days)
Schedule a formal supplier review with your primary ingredient suppliers. Require them to declare all allergens in their product, not just the obvious ones. Document this in a supplier approval form (BRC 2.2.2 covers this). Include a requirement that the supplier must notify you within 24 hours if ingredient specification changes. Too many recalls happen because a supplier updated a formula and sent a new technical sheet that never reached the quality team.
3. Artwork Lock-Down and Verification (ongoing)
Before artwork goes to print, have it verified against the current product specification by someone other than the person who wrote it. This is verification, and it should be documented. Include allergen declarations as a specific verification checkpoint. Any discrepancy — product is gluten-free, but label says "may contain gluten" — stops the artwork. Keep an audit trail of approved artwork versions and the date each artwork was made current in production.
4. Periodic Testing (quarterly minimum)
For high-risk allergens (gluten, milk, tree nuts), consider periodic finished product testing. This is expensive, but for a major brand with a large consumer base, the cost of testing (£200–500 per test) is trivial compared to the cost of a national recall. ELISA testing for gluten is fast and reliable.
Strengthening Your HACCP System
SafetyCore's hazard analysis builder forces you to identify every significant hazard and assign it to a control category: CCP, OPRP, or PRP. For allergen hazards, this means you cannot skip the question "Is gluten present in this product or any ingredient?" If the answer is no, you must document why (ingredient specification, supplier verification, cleaning protocol) and then assign responsibility for ongoing verification. If the answer is uncertain, the system won't let you sign off.
SafetyCore's supplier and ingredient module links every ingredient directly to the hazard it controls. So when a supplier's allergen status changes, you can run a verification report showing which products are affected and which control measures need to be checked. The platform also enforces a verification schedule for supplier approvals and allergen declarations — it flags overdue reviews automatically.
Finally, SafetyCore's artwork control checklist ties label claims directly to the product specification and hazard analysis. Before artwork is approved, the system prompts you to confirm allergen declarations match the current ingredient specification. This is the kind of structured checkpoint that stops M&S-style mismatches before they happen.
Conclusion
The M&S Greek Yoghurt recall is not a story about contamination or negligence — it's a story about control drift. A system that was probably adequate once (ingredient specs, supplier approval, artwork review) broke because one ingredient changed, or one piece of documentation didn't flow from supplier to technical team to artwork. For a dairy technical manager reviewing this incident, the action is clear: audit your ingredient specifications this week, verify your supplier allergen declarations in writing, and lock down your artwork approval process. Allergen hazards are PRPs, and PRPs don't get second chances.
Reference: Food Standards Agency alerts