Undeclared allergens are the leading cause of food recalls in the UK, and 2025 and 2026 show no sign of improvement. Root cause analyses submitted to the FSA identify allergens as the trigger for 38% of all recall incidents — ahead of pathogenic microorganisms (35%) and foreign bodies (16%). On 31 March 2026, 3D Trading recalled M&M's Pipoca popcorn after it emerged the 35g product, manufactured for the Brazilian market and over-stickered for UK sale, failed to declare peanuts, gluten, wheat, barley, and rye on its UK label. Every batch and every best-before date was included in the recall — a clear signal that this was a systemic undeclared allergen food recall failure in 2026, not an isolated mispacking incident. With 85 allergen alerts issued across the UK in 2025 alone, the question for any Technical Manager is not whether your operation is exposed to this risk. It is whether your current controls are structured to stop it reaching the consumer.
What Happened
On 31 March 2026, the Food Standards Agency issued allergy alert FSA-AA-20-2026 covering M&M's Pipoca popcorn distributed by 3D Trading. The product had been manufactured for the Brazilian market and given a UK over-label for domestic sale. That label omitted peanuts and gluten — including wheat, barley, and rye — allergens present in the original Brazilian formulation and required to be declared under UK allergen labelling law. The FSA recall covered all batches and all best-before dates. Customers with peanut or gluten intolerances were advised not to consume the product and to return it for a full refund.
The scope of the recall matters. When a recall covers all batches across all dates, it confirms the failure was embedded in the labelling process from the start — not caused by a single packaging error on one production run.
What Went Wrong — Root Cause Analysis
The M&M's Pipoca recall is a textbook import labelling control failure. Over-stickering a product manufactured to a foreign specification for re-sale in a different regulatory market is inherently high-risk. It creates an information gap between the source specification — which carries the allergen declaration for the country of manufacture — and the UK label, which must comply with UK food information requirements.
Under Codex Alimentarius CXC 1-1969 (Revised 2022), Principle 1 requires a thorough hazard analysis identifying all biological, chemical, and physical hazards associated with each ingredient and process step. Allergens are chemical hazards. For a business importing a product made to a foreign specification, the hazard analysis must explicitly address the risk of allergen discrepancy between the source country declaration and the UK re-label. The evidence from this recall is that step either was not completed or was not completed against the actual ingredient declaration from the Brazilian market.
Under BRC Global Standard for Food Safety Issue 9, Section 5.3 covers allergen management throughout the supply chain, including for traded goods not manufactured on site. Section 3.6 sets out supplier approval and specification requirements for traded products — these must include allergen declarations. For an imported product, the approved specification is the source document: if the specification was never obtained in the original language, or never reviewed for allergen content against UK labelling requirements, that gap is an allergen management PRP failure.
Labelling verification is a prerequisite programme (PRP) control — it is not a CCP. There is no critical limit you can measure at a process control point to detect a missing allergen on a printed label. The control is procedural: a documented comparison between the finished product label and the approved ingredient specification, completed and signed off before the product is approved for sale. The absence of that step, or its inadequate execution, is the most probable failure point here.
How This Should Have Been Prevented
Three specific controls would have stopped this recall. None require capital investment. All require documented procedure and disciplined implementation.
First: allergen review at the point of label creation. For any traded product manufactured outside the UK, the technical function must obtain the full ingredient specification in the language of the country of manufacture and have the allergen declarations reviewed by a competent person. The UK label is then checked line-by-line against that specification before sign-off. For the M&M's Pipoca recall, the Brazilian formulation contained peanuts and gluten. Those allergens needed to reach the UK label. They did not. A documented specification review would have caught the gap.
Second: a pre-release label verification check. Before any batch is released for sale, a physical product label is reviewed against the approved label specification. The check is recorded, signed, and retained. Any discrepancy triggers a hold and a formal investigation. This is not an additional bureaucratic layer — it is verification that the PRP worked. The FSA's targeted surveillance sampling found that 4% of products checked had undeclared allergens. That is 1 in 25. A pre-release check catches those cases before they reach the consumer.
Third: supplier specification management that covers allergen declarations for imported goods. BRC Issue 9, Section 3.6 requires specification management for all traded products including allergen status. For products sourced from international markets, that means obtaining the source country specification and mapping allergen declarations to UK requirements. A product declared as containing peanuts and gluten in Brazil cannot arrive on UK shelves with a label that omits both.
Strengthening Your Allergen Management System
The M&M's recall illustrates a structural gap that affects businesses well beyond importers and traders. Any UK food manufacturer that changes ingredient suppliers, introduces reformulations, or adds new product lines faces the same underlying risk: that allergen information from one part of the system fails to reach the finished label accurately. With 141 food recalls issued in the UK in 2025 — a 23% increase on 2024 — and allergens consistently the leading cause, this is not a peripheral risk. It is your most statistically likely recall trigger.
SafetyCore's HACCP builder requires a full ingredient declaration for each product formulation, with allergen status confirmed at the ingredient level. When a specification changes — new supplier, reformulation, substituted ingredient — the system flags the allergen impact across every product that ingredient appears in. You cannot proceed past that flag without documenting the review. That forces the same discipline that label verification requires: allergens must be positively accounted for at every stage, not assumed to be unchanged.
For businesses handling imported or traded goods, SafetyCore's prerequisite programme management links supplier specification control to label approval. The documented chain from source ingredient declaration through to approved UK label is held in an immutable audit trail, timestamped and locked. When an EHO or BRC auditor asks to see evidence of your allergen label verification process following a recall, that record exists and cannot be altered retrospectively.
SafetyCore's triggered review feature means that any significant change — new product introduction, ingredient substitution, supplier change — automatically initiates a structured HACCP review against Codex Step 12 and BRC clause 2.14. That review includes allergen impact assessment. A new imported product cannot be approved for sale without a documented allergen review signed off by the responsible person.
The M&M's Pipoca recall was not caused by a failure of food science. It was caused by a failure to check whether a Brazilian allergen declaration had been correctly transferred to a UK label. That check is a procedure. Procedures must be documented, trained, and verified.
Conclusion
The 85 allergen alerts issued across the UK in 2025 represent failures of documented procedure, not of technology or investment. The M&M's Pipoca recall is particularly instructive because the allergen risk was present in the source specification — it just never reached the UK label. This week, review your allergen management procedure against BRC Issue 9 Section 5.3. Specifically, confirm that your label verification process includes a documented comparison against the approved ingredient specification for every product — not just new lines, but existing products where specifications may have changed without triggering a formal label review. That review is the control. Without it documented and completed, the risk of an undeclared allergen recall is real.
If you're reviewing your allergen controls after reading this, SafetyCore structures the process from hazard analysis through to label verification and HACCP review. Start a free trial at safetycore.co.uk.
Reference: FSA Allergy Alert FSA-AA-20-2026: food.gov.uk/news-alerts/alert/fsa-aa-20-2026
LinkedIn summary: Undeclared allergens triggered 38% of UK food recalls in 2025 — and the M&M's Pipoca recall shows exactly how it happens. A product made for the Brazilian market was over-stickered for UK sale without correctly declaring peanuts and gluten. All batches recalled. The fix is procedural, not technical: a documented label verification against the source specification. I've written up the root cause and what the control system needs to look like. #FoodSafety #AllergenManagement #BRC