Food Allergen Control Plan for Restaurants and Small Kitchens

A food allergen control plan is a written set of procedures that keeps allergens out of food that should not contain them and gets accurate information to guests. Allergic reactions can be severe, and they happen fast. Unlike bacteria, allergens are not destroyed by cooking, so the controls are about knowing what is in each dish, keeping allergens separate and communicating clearly. This guide walks through building an allergen plan for a restaurant, food truck, caterer or small producer, with templates you can adapt.

The facts here come from FDA's food allergies page, the FDA Food Code 2022 and, for small producers, the allergen control requirements in 21 CFR part 117. Your state may have extra rules. Any plan you build is a draft for your health department to review.

The nine major food allergens

FDA identifies nine major food allergens:

1. Milk
2. Eggs
3. Fish, such as bass, flounder and cod
4. Crustacean shellfish, such as crab, lobster and shrimp
5. Tree nuts, such as almonds, walnuts and pecans
6. Peanuts
7. Wheat
8. Soybeans
9. Sesame

Sesame was added as the ninth major allergen by the FASTER Act, effective January 1, 2023. Many people are also allergic to other foods, such as mustard or celery, and some guests will ask about them. Your plan should focus on the nine but allow for other requests.

What the Food Code expects

The Food Code includes allergens in several places. The person in charge must be able to describe the major food allergens and the symptoms they can cause, and must ensure employees are trained in food allergy awareness as it relates to their duties. The Food Code also addresses cross-contact and labeling of packaged food. The 2022 edition includes provisions about informing consumers of major food allergens in unpackaged food. States adopt the code at different times and with changes, so check which version and which provisions apply to you.

Food allergen control plan: the six parts

A practical restaurant plan has six parts.

1. An allergen matrix

List every menu item down the side and the nine allergens across the top. Mark each allergen present. Include sauces, dressings, garnishes and fryer oil, which are where allergens often hide.

| Dish | Milk | Egg | Fish | Shellfish | Tree nuts | Peanut | Wheat | Soy | Sesame | |---|---|---|---|---|---|---|---|---|---| | Caesar salad | X | X | X | | | | X | | | | Pad thai | | X | X | X | | X | | X | | | Fries (shared fryer with shrimp) | | | | May contain | | | | | | | House burger | X | X | | | | | X | X | X |

Build it from the actual ingredient labels, not from memory. Caesar dressing usually contains anchovy and egg. Worcestershire sauce often contains fish. Many breads contain soy or sesame. Update the matrix whenever a recipe or supplier changes.

2. Receiving and storage

• Check labels on deliveries, especially when a supplier substitutes a product.
• Keep a copy of ingredient labels or spec sheets for each product.
• Store allergen ingredients so they cannot spill onto others, for example nuts and flours in sealed containers on lower shelves.
• Label bulk containers with the product name and allergens.

3. Prep and cooking controls

• Wash hands and change gloves before preparing an allergy order.
• Use clean, sanitized utensils, boards and pans. Some kitchens use a color, such as purple, for allergy-safe tools.
• Prepare allergy orders first or in a separate area when possible.
• Do not share fryer oil between allergen foods and allergy-safe foods if you claim the item is safe.
• Watch for shared items: grills, toasters, mixers, tongs, scoops, squeeze bottles.
• Remember that removing an allergen from a finished dish, such as picking nuts off a salad, does not make it safe.

4. Ordering and communication

• Servers ask about allergies when taking orders, or guests are invited to tell staff.
• Allergy orders are flagged on the ticket in a consistent way.
• The kitchen confirms the order can be made safely. If it cannot, the guest is told honestly.
• The person who prepared the order, or the manager, delivers it or confirms it at the pass.
• Staff never guess. If they are not sure, they ask the manager or check the matrix.

5. Labeling packaged food

If you package food for sale, such as grab-and-go items, bottled sauces or baked goods, labels must declare the major food allergens as required by federal labeling law and your state code. Even for food packaged on site, the Food Code expects labels on food packaged in the establishment that include major allergens. Check your state rules, and for wholesale products, check FDA labeling requirements.

6. Training and response

• Train every employee on the nine allergens, the matrix and their part of the process.
• Train servers on how to take and flag allergy orders.
• Train the manager on what to do if a guest reports a reaction: call 911 if symptoms are serious, do not delay, help the guest use their own epinephrine if they have it and ask for help, keep the remaining food, and record what happened.

See HACCP training for restaurant staff.

Why cross-contact matters

Cross-contamination usually refers to bacteria. Cross-contact refers to allergens. The difference matters because cooking kills many bacteria but does not destroy allergen proteins. A pan used to toast sesame seeds and then wiped out can still carry enough sesame to cause a reaction in a sensitive person. That is why the controls focus on clean equipment, separation and accurate information, not on temperature.

Allergen controls in a HACCP plan

In a restaurant HACCP plan, allergen control is usually a prerequisite program, not a CCP. It still belongs in the hazard analysis. When you list hazards for each step, include allergens as chemical hazards and note how they are controlled. For example:

| Step | Hazard | Control | |---|---|---| | Receiving | Undeclared allergen from supplier substitution | Check labels, update matrix | | Storage | Cross-contact from spills | Sealed containers, storage order | | Prep | Cross-contact from shared tools | Clean tools, allergy procedure | | Frying | Cross-contact in shared oil | Dedicated fryer or disclose | | Service | Wrong dish to allergic guest | Ticket flag, manager confirmation |

See hazard analysis examples and the seven HACCP principles explained.

Allergen controls for small producers under FSMA

If you are a registered food facility covered by FDA's preventive controls rule, allergen controls may be a required part of your written food safety plan. Part 117 lists food allergen controls as one type of preventive control, including procedures to protect food from allergen cross-contact and to label food correctly. Allergen controls do not require validation under part 117, but they do need monitoring, corrective actions and verification as appropriate. See HACCP vs FSMA and the cottage food HACCP plan.

A sample allergen procedure for the line

1. Ticket prints with the allergy flag.
2. Cook reads the flag aloud and confirms the allergen.
3. Cook checks the matrix to see if the dish can be made without the allergen.
4. If not, tell the manager, who informs the guest.
5. If yes, wash hands, change gloves.
6. Use clean tools from the allergy bin.
7. Cook in a clean pan, not the shared one.
8. Plate in a separate area; mark the plate.
9. Manager or cook confirms at the pass and delivers or hands directly to the server, who confirms with the guest.

Allergen controls for catering and food trucks

Caterers often serve buffets where guests serve themselves, which makes cross-contact more likely through shared serving spoons. Label each buffet item with its allergens, give each dish its own serving utensil, and offer pre-plated meals for guests with allergies collected in advance. See the HACCP plan for catering.

Food trucks have limited space and shared equipment. Be realistic about what you can control. A clear allergen list at the window and honest answers are better than promises you cannot keep. See the food truck HACCP plan.

Bakeries handle wheat, milk, eggs, nuts and sesame together, often with airborne flour. Disclose shared equipment and be careful with claims like "nut free." See the HACCP plan for bakery.

Allergens at the fryer, grill and toaster

Shared cooking equipment is where many restaurant allergen mistakes happen, because it is invisible on the plate. Fryer oil picks up proteins from everything cooked in it, so fries cooked in the same oil as breaded shrimp or battered fish can carry crustacean shellfish, fish, wheat, egg or milk. If you want to offer fries as safe for those allergies, you need a dedicated fryer and you need to keep it dedicated, even on a busy night. If you cannot, say so on the matrix and to the guest.

Flat-top grills and char grills hold residue from buttered buns, cheese and marinades. For an allergy order, clean a section of the flat-top or cook in a clean pan. Shared toasters and conveyor ovens can transfer wheat, sesame and milk from buns. Scoops in bulk bins, ladles in sauce wells and tongs on the line move from item to item all night. A simple rule helps: one utensil per item, and fresh tools from the allergy bin for every allergy order.

Allergen control during receiving and prep

Prep work creates many chances for cross-contact before service even starts. Plan the order of prep so allergen-free items are made first, then items with allergens, with cleaning between. Keep nuts, sesame seeds and flour in sealed containers and on low shelves so spills land on the floor rather than in other food. When you portion sauces into squeeze bottles, label each bottle with the name and date, so a cook cannot mistake a peanut sauce for a plain chili sauce in the rush. Label prepped components with their allergens if your menu has look-alike items.

Record keeping for allergen control

A restaurant allergen plan needs only a few records, but they help in an inspection and after any incident:

• the current allergen matrix with the date it was last reviewed
• the ingredient labels or spec sheets the matrix is based on
• training records showing staff were trained on allergens
• a short incident log for allergy complaints, near misses and reactions, with what was changed afterward

Keep these with your HACCP plan.

A note on precautionary statements

Some packaged ingredients carry statements like "may contain" or "made in a facility that also processes" an allergen. These statements are voluntary and not defined by federal law, so they are used inconsistently. Treat them as a sign of possible cross-contact and record them in your matrix, so staff can give guests accurate information.

Gluten free claims

Celiac disease is not an allergy, but many guests ask for gluten free food. FDA has a federal definition for gluten free claims on packaged food. For restaurants, FDA has said that it expects restaurants making gluten free claims to be consistent with the federal definition. If you offer gluten free items, use separate prep, avoid shared fryers and toasters, and train staff on what the claim means. If you cannot control cross-contact, say "made without gluten ingredients" and explain the risk, rather than "gluten free."

What to do when a guest has a reaction

Plan this before it happens:

• Take the guest seriously. Symptoms can include hives, swelling, trouble breathing, vomiting and dizziness.
• Call 911 for any serious symptoms.
• If the guest has an epinephrine auto-injector, help them access it. Follow local rules on what staff can do.
• Do not leave the guest alone.
• Keep the plate and remaining food.
• Write down what was ordered, what was served, who made it, and what happened.
• Review the incident and change procedures if needed.

Allergen plan review

Review the plan:

• when the menu changes
• when a supplier or product changes
• after any allergen incident or near miss
• at least once a year

Record each review. See HACCP verification and record keeping.

Who owns the allergen plan

Name one person, usually the chef or kitchen manager, as the owner of the allergen plan. That person keeps the matrix current, approves recipe and supplier changes, trains new staff on allergens and reviews any incident. In a small food truck or catering business this is often the owner. Having one named owner prevents the common gap where everyone assumes someone else updated the matrix after a menu change.

Common allergen mistakes

• Matrix from memory instead of labels.
• Supplier substitution not caught at receiving.
• Shared fryer with shellfish or other allergens not disclosed.
• Garnishes and sauces missed in the matrix.
• Picking off an allergen instead of remaking.
• Saying "allergen free" without being able to control cross-contact.
• No training for servers.

Building your allergen matrix step by step

Building the matrix is the most useful hour you will spend on allergen control. Start by printing your menu and pulling the ingredient label or spec sheet for every product you buy. Go through each dish, component by component: the protein, the marinade, the sauce, the garnish, the bread, the oil it is cooked in. For each component, read the label's "Contains" statement and ingredient list, and mark the allergens on the matrix.

Watch for ingredients that surprise people. Pesto often contains pine nuts or other tree nuts, and cheese. Many curry pastes include shrimp paste or fish sauce. Tahini and many dressings contain sesame. Some chocolate products are made on lines with nuts. Imitation crab usually contains fish and may contain egg and wheat. Store-bought stocks and bases can contain milk, soy or wheat.

When you finish, have someone else check a few dishes against the labels. Then post the matrix where cooks and servers can see it, and keep the labels in a binder so you can check again when a guest asks.

When suppliers change products

One of the most common causes of allergen mistakes is a change nobody noticed: a supplier substitutes a different brand of bread that contains sesame, or a sauce manufacturer changes its recipe. Build a habit at receiving: when a product looks different, has a new brand or a new label, read the allergen statement before it goes on the shelf. If it differs from what is in your matrix, update the matrix and tell the kitchen. Ask your main suppliers to tell you when they substitute.

Talking to guests honestly

Guests with food allergies rely on accurate information. Servers should listen, write the allergy on the ticket, and check with the kitchen rather than answering from memory. When the kitchen cannot make a dish safely, say so clearly and suggest something you can make. Most guests with allergies would rather hear "we can't guarantee that" than be told something that turns out to be wrong. Avoid casual reassurances like "it should be fine."

Allergen information on menus and online

Many restaurants now share allergen information on menus, websites and delivery apps. If you do, keep it accurate and up to date, and include a note that dishes are prepared in a shared kitchen. Delivery app descriptions are easy to forget when the recipe changes. Assign someone to update all channels whenever the matrix changes.

Building the plan

The HACCP builder includes allergens in the hazard analysis for each process and adds allergen controls to your plan, alongside cooking, cooling and holding CCPs. See the HACCP plan template and food safety plan. Try one process free or get every process in the Plan Pack. The plan is a draft for your health department to review.

Frequently asked questions

What are the 9 major food allergens?

Milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. Sesame became the ninth major allergen on January 1, 2023.

Is an allergen plan required for restaurants?

The Food Code requires the person in charge to know the major food allergens and ensure staff are trained in allergen awareness. A written allergen plan is not always required for restaurants, but it is the clearest way to meet these duties. Food facilities under FSMA may need written allergen preventive controls.

What is allergen cross-contact?

Cross-contact is when an allergen is unintentionally transferred to a food that should not contain it, for example through shared utensils, fryer oil, gloves or surfaces. Cooking does not remove allergens.

Can a restaurant guarantee a dish is allergen free?

Most cannot, because of shared kitchens. Be honest with guests about what you can and cannot control.