Is a QR code alone enough for allergen compliance?

Do not assume so. Requirements differ for packaged, prepacked-for-direct-sale, and non-prepacked food and by jurisdiction. Confirm required labels and disclosures with the relevant authority; provide an accessible non-digital route and a trained contact. The FDA model Food Code requires local adoption.

What is Natasha's Law and does it require QR codes on takeaway food?

Natasha's Law (in force in the UK since October 2021) requires foods prepacked for direct sale (PPDS), such as sandwiches or salads packaged on the premises before ordering, to carry full ingredient labels with allergens emphasized on the pack. A QR code alone is not enough for PPDS items.

How often should a restaurant update its digital allergen QR link?

Keep the printed URL stable where possible, but update verified information whenever recipes, suppliers, or cross-contact assessments change. Recheck access and permissions after hosting changes. Do not claim a dish is allergen-free when ingredient information is incomplete.

Can we use icons instead of text words in our allergen matrix?

Icons can help, but pair each one with a plain text label such as "Contains: peanuts, gluten", because icons can be misread or may not be recognized by every guest.

What should I do when a supplier changes a product?

Hold the new product, read its specification for allergens, edit the table, raise the version and date, brief servers and kitchen, and only then use it. Leave unknown cells as "ask staff" instead of guessing, and keep a dated record of who approved each version.

Should the matrix show cross-contact as well as ingredients?

Yes. Guests treat "contains" and "may be present from shared equipment" differently, so use separate columns. Vague "may contain" wording is unregulated for packaged food in the US, and a plain note about shared fryers or surfaces is clearer.

Does the US require allergen information on restaurant menus?

Federal law requires allergen labeling on packaged food, but dine-in rules are mostly set by state and local food codes. The FDA model Food Code calls for written notice of major allergens in unpackaged food where adopted. Ask your health department what applies to you.

Food Allergen QR Codes: Restaurant Compliance Guide

Q: What should the sign next to the code say?

Invite the conversation: tell guests with a serious allergy, intolerance or coeliac disease to speak to their server before ordering, say where the allergen table is, and offer a printed guide. Research suggests many people with allergies do not tell staff, so the sign should ask.

A food allergen QR code sends a guest to an online table showing which allergens each dish contains, and it supplements trained staff and printed information instead of replacing them. The advantage is upkeep: when a recipe or supplier changes, you edit one document and the same printed code keeps working.

This guide covers which rules apply to which kind of food, the allergens to list, how to build and host the table, what the sign beside the code should say, what research says about how guests and servers actually communicate, and how to keep the page correct when the kitchen changes. It is general information, not legal advice, so check your local requirements.

Which rules apply to which kind of food?

The first question is whether the food was packaged before the guest chose it. Packaged food carries its information on the pack. Food made to order is governed by local rules, and a QR page can be one part of how you meet them.

Decision diagram: food packed before the guest orders needs a label on the pack, while food made to order falls under local rules where a QR page can be one part. — Original diagram: packaged and made-to-order food follow different routes. A QR code alone does not satisfy packaged-food labeling.

The table below summarizes the main regimes. None of them bans a QR code as a way of giving information, and none says a digital page automatically satisfies labeling or disclosure duties. Details differ, so use the sources at the end.

Region and law	Allergens covered	QR codes	What else you need
EU: Regulation (EU) No 1169/2011	14 major allergens	Can be part of how you provide the information	Required allergen information must be available; member-state rules specify how information for non-prepacked food is provided
UK: Food Information Regulations, including Natasha's Law	14 major allergens	Useful for food made to order. Prepacked-for-direct-sale (PPDS) food needs full labels on the pack.	FSA best-practice guidance for non-prepacked food: written information that is always available, plus a conversation with staff
US: FALCPA and the FASTER Act	9 major allergens, with sesame added by the FASTER Act from 2023	These laws govern packaged-food labels. Dine-in disclosure is mostly set by state and local food codes, and a QR code is commonly used as an add-on.	Check the locally adopted food code. The FDA model Food Code (section 3-602.11) calls for written notice of major allergens in unpackaged food, but it applies only where a jurisdiction has adopted it
Australia and New Zealand: FSANZ	Set by the food standards code, which is being updated	Can supplement other information	Allergen information must be available on request, so check FSANZ's current guidance

Natasha's Law took effect in the UK on 1 October 2021 and requires PPDS food, such as a sandwich packed on the premises before the customer orders it, to carry a full ingredients list with allergens emphasised, for example in bold. Council and law-firm summaries differ on how it applies in each UK nation, so check with your local authority. In the US, the FDA's 2022 Food Code made sesame the ninth major allergen, effective 1 January 2023, and describes the written notice for unpackaged food as something that can take the form of menu notices, table tents, placards, brochures or other effective written means. The Food Code is a model, not federal law, so your health department decides what you must do.

There is also no federal US labeling rule for restaurant-type food in general, according to a University of Oregon law review article, and the FARE advocacy group has argued that menu labels cannot capture risks created by sourcing or kitchen cross-contact. FARE made that argument in 2025 against a California bill, SB 68, which it said could give a false sense of security. This article did not verify the bill's current status, so check it if you operate in California. For a menu that includes the allergen table, the restaurant menu page guide covers how to build the page so it stays readable on a small screen.

What do studies show about guests and servers?

The QR page works only if the conversation around it works. A study led by Scott Sicherer using the US National Peanut and Tree Nut Allergy Registry, as reported in trade coverage, found that fewer than 40% of people who had a reaction from a restaurant meal had told staff about their allergy before ordering. In the same work, about half of the reactions among people who were actively avoiding a food came from hidden allergens in sauces or sandwiches, and others came from cross-contact on shared equipment. A University of Calgary survey of servers found that 204 of them (64.6%) said they never or rarely asked customers whether they had a food allergy.

Two design lessons follow. A page that lists only the obvious ingredients misses the sauces and shared equipment where harm happens, so the matrix needs a column for cross-contact. And a sign that quietly offers data gives nothing to the many guests who never announce their allergy, so the wording has to ask. These are survey and registry findings, not a measure of how any one restaurant performs.

Which allergens should the matrix list?

Cover every allergen your local authority names, and mark both ingredients and cross-contact risk. Guests treat "contains" and "may be present because of shared equipment" very differently, so keep them in separate columns. Precautionary "may contain" wording on packaged food is voluntary and unregulated in the US, according to FARE, and FARE reports that 37 percent of consumers managing food allergy assume the wording reflects the level of risk. A plain-text notice about shared equipment in your kitchen is clearer than a vague phrase.

Allergen	EU and UK (14)	US (9)	Common kitchen cross-contact
Cereals containing gluten (wheat, rye, barley, oats)	Yes	Wheat only	Shared fryers, pasta water, shared chopping boards
Crustaceans and molluscs	Yes, as two categories	Crustacean shellfish	Shared woks, seafood stock, grill surfaces
Eggs and milk	Yes	Yes	Whisks, griddles, mayonnaise bases, butter glazes
Fish	Yes	Yes	Fish sauce, Caesar dressing, shared frying oil
Peanuts and tree nuts	Yes, as two categories	Yes, as two categories	Pesto, dessert toppings, shared bakery lines
Soybeans	Yes	Yes	Soy sauce, emulsifiers, cooking sprays, marinades
Sesame	Yes	Yes, added by the FASTER Act	Burger buns, tahini dressings, spice mixes
Celery, mustard, lupin, and sulphur dioxide/sulphites above 10 mg/kg or 10 mg/litre (as total SO2)	Yes	Not on the US major allergen list	Wine reductions, mustard dressings, stocks, cured meats

How do you build and host the allergen table?

A clear grid works best: dishes down the side, allergens across the top, and an unambiguous entry in every cell. It must open without a sign-up or an app.

Build the source in Google Sheets or Excel, with a row per dish and a column per allergen, plus a cross-contact column.
Verify ingredients against current recipes and supplier specifications before marking a dish. If information is unknown, mark the cell "ask staff" and ask the responsible food-safety lead; do not guess a cell value or imply that a dish is allergen-free.
Put a revision date, a version number and the name of the person who signed it off at the top.
Publish it as real text at a permanent HTTPS address, either on your own site (for example yourrestaurant.com/allergens) or as a published sheet.
Paste the address into the URL QR code generator and download an SVG for your menus and counter signs.
Test the printed code on two phones, and test the page with a screen reader or at high zoom.

A static code holds the address itself, so you never reprint the sign when a dish changes. You only update the page behind the address. If the page address might change, read do QR codes expire and static vs dynamic codes, then choose a stable address on your own domain.

What should the sign next to the code say?

Put a short written notice beside the code that tells guests with a serious allergy to speak to staff before ordering. The table is a reference, and the kitchen still has to confirm a dish for someone with a severe allergy.

A table sign with a heading, a request to tell the server about allergies, a schematic QR square, a typed address, a printed-guide offer and a revision date, with callouts. — Original diagram: anatomy of an allergen notice with a QR code. The cafe and address are invented.

"Allergen information for our dishes is available by scanning this QR code or by asking a member of our team. If you have a severe food allergy, an intolerance or coeliac disease, please tell your server before you order so our kitchen can take the right precautions. Printed allergen guides are available on request."

How does information get from the kitchen to the guest?

Think of five links: recipes and supplier specifications, the signed-off table, the web page, the printed code and sign, and the conversation with staff. A break in any one defeats the rest.

Chain of five links from supplier specification to a conversation with trained staff, with the places where the chain usually breaks. — Original diagram: the code is the fourth link in a five-step chain.

Assign an owner for each link. Front-of-house staff should know where the table lives and who handles a serious allergy question. The restaurant QR code guide shows where the allergen code sits among the other codes in a dining room.

What happens when a supplier changes a product?

Supplier substitutions are the most common way a correct table goes wrong. A short change-control routine prevents it: hold the new product, read its specification, edit the table, bump the version and date, brief the team, and only then use it.

Six-step timeline from supplier notice to serving the new product: hold, check, update, brief, serve, with guard rails below. — Original diagram: update the allergen table before the new product reaches a dish.

What mistakes cause problems?

Consider a small bistro that switches its house dressing supplier on a Friday. The new dressing contains mustard, which the old one did not. The head chef knows, the allergen table still shows the old row, and a Saturday server points a guest to the QR page when asked. The guest has a mustard allergy, reads the page, and orders the salad. Nothing in the process was careless on its own; the table simply had no owner on the day the product changed.

Uploading a phone photo of a paper chart. Guests cannot zoom, search or read it on a small screen. Use a real web page or table.
Marking unknown cells as safe. Leave them as "ask staff".
Hosting the table somewhere temporary. A trial account can expire, and the printed code would then lead to an error. Use your own domain or a stable cloud link.
Untrained front-of-house staff. Everyone who serves guests should know where to find the table and who to pass a serious allergy question to.
Relying on the QR code alone. Keep a printed table available for guests who do not use smartphones.
Using icons without words. Pair every icon with a text label such as "Contains: peanuts, gluten".

A launch checklist

Decide which of your foods are packaged and which are made to order, and read the rule for each.
Build the table with a cross-contact column and a named approver.
Publish it as accessible text on a permanent address.
Create and test the static code, then print the sign with the staff-conversation wording.
Train every server, and write down who answers severe-allergy questions.
Set the change-control routine and a review date.
Keep printed copies available.

Which allergen duties depend on your local authority?

It cannot tell you which adopted food code your health department enforces, how your kitchen's cross-contact risks should be assessed, or whether your local authority treats a QR page as sufficient written information. Those depend on your jurisdiction, your menu and your premises, so ask the authority or a qualified food-safety adviser.

This article is general guidance, not legal advice. Allergen-disclosure law differs by country and locality and changes over time. Confirm your obligations with your food-safety authority (FSA, FDA, FSANZ or a local equivalent), keep an accessible fallback and a trained contact available, and never infer that a QR page alone establishes compliance or that a dish is safe for a particular guest.