Allergen management for restaurants: the complete 2026 guide

Short answer: allergen safety is a systems problem wearing a customer-service costume. The venues that handle it well do four things: maintain a dated allergen matrix (every dish × every declared allergen, including the sauces and the fryer), run named cross-contact routines in the kitchen (separation, flagged dockets, call-outs, one owner per allergen dish), give the floor team a script that checks the matrix instead of memory, and keep claims honest, especially “gluten-free” and “vegan”, where the difference between a marketing word and an operational guarantee is a coeliac customer’s health. In New Zealand the legal spine is the Food Act system plus plain-English allergen labelling on packaged food (fully in force since February 2026); the operational spine is below.

What the rules actually expect

Strip the legislation to its operating instructions and you get: know your ingredients (including supplier changes, the label on this week’s pesto may not match last week’s), declare accurately (on packaged labels, in plain English; across the counter, when asked, correctly), and manage cross-contact as part of your Food Control Plan. Verifiers increasingly ask to SEE the system: the matrix, the routines, the training record. Overseas the vocabulary shifts (Natasha’s Law labelling in the UK, the US big-nine declarations) but the three duties are the same everywhere: know, declare, separate.

The allergen matrix: one page that ends guessing

Three details make a matrix trustworthy. Hidden sources are listed (stocks, sauces, garnishes, marinades, the shared fryer, the asterisk above is a shared-oil note, which is exactly the kind of honesty that matters). It is dated and versioned, so the January copy taped to the pass dies when February’s menu changes. And it is in BOTH teams’ hands: the kitchen maintains it, the floor uses it, nobody relays from memory across a noisy pass. Rebuild it from supplier labels whenever a product or supplier changes, not just when the menu does, reformulated products are the classic silent failure.

Kitchen routines: separation you can name

• Allergen orders flagged on the docket and CALLED OUT at the pass, visibility is the control.
• Separate boards and utensils, or a full clean-down between, with clean hands and gloves at each transition.
• One person owns the allergen dish start to finish; handoffs are where contact happens.
• Dedicated fryer oil behind any gluten-free claim; shared oil means the matrix says so.
• Prep separation upstream: nut work away from general prep, allergen ingredients stored sealed and labelled.
• The routine written into the food safety checklist and the opening routine, so it survives staff turnover.

The front-of-house script

When a customer mentions an allergy, the worst response is warm vagueness. Train the sequence: acknowledge seriously (“thanks for telling me, we handle this properly”); check the matrix, never memory; flag the order explicitly to the kitchen and confirm it came back flagged; and where real uncertainty exists, say so plainly and offer alternatives rather than gambling on reassurance. Put the matrix behind the counter and in the ordering flow, your menu descriptions and online item pages should carry the same declarations, because a growing share of allergen conversations now happen at checkout, not at the table. Handled this way, allergy customers become some of your most loyal regulars: they remember the venue where nobody guessed.

Honest vegan and gluten-free menus

Dietary demand is real revenue, tables are chosen by their strictest member, so a credible vegan and gluten-free page wins the whole booking, but the claims must be operationally true. “Vegan” includes the stock, the butter in the pan and the fryer; “gluten-free” includes the oil and the clean-down, or it should say “no gluten-containing ingredients” with staff trained to explain the difference to coeliac customers. This is menu engineering as much as safety: a handful of genuinely strong dietary dishes (not sad afterthoughts) built from ingredients you already carry, marked clearly, and defended by the same matrix and routines as everything else.

Mistakes that put customers in danger

• Answering allergen questions from memory across a noisy pass.
• A matrix built once and never rebuilt when suppliers reformulate.
• Gluten-free claims over a shared fryer.
• “It should be fine”, the phrase that precedes every incident report.
• Training the kitchen but not the floor, when the floor is where the question lands first.

Frequently asked questions

What are restaurants legally required to do about allergens?
Two duties almost everywhere: know what is in your food, and tell customers accurately when asked. In New Zealand, packaged food must declare allergens in plain English on the label (the PEAL rules, now fully in force), and food businesses operating under a Food Control Plan must manage allergen cross-contact as part of it. For menu food, the practical standard is an accurate, current allergen matrix and staff who never guess. “I think it’s fine” is the sentence that ends up in incident reports.

Which allergens matter most?
The big declared group: peanuts, tree nuts, milk, egg, fish, crustacea, molluscs, soy, wheat/gluten, sesame, and added sulphites, with lupin also declared in this part of the world. Peanuts, tree nuts, shellfish and milk drive the most severe reactions. But the operational rule is simpler: every allergen on the declaration list is managed the same way, because the customer in front of you defines which one matters tonight.

What is an allergen matrix?
A grid: every menu item down the side, every declared allergen across the top, a mark in each cell that applies, including the sneaky sources (sauces, stocks, garnishes, fryer oil shared with battered items). It lives with the kitchen AND the floor team, gets updated the moment a recipe or supplier changes, and is dated so stale copies die. It converts “ask the chef” from a hopeful relay into a reliable lookup.

How do kitchens prevent cross-contact?
Separation and sequence: separate boards, utensils and prep areas for allergen-free orders (or thorough clean-down between), dedicated fryer oil where gluten-free claims are made, allergen orders flagged on the docket and called out loud, one person owning the dish from pan to pass, and clean hands and gloves at each transition. None of it is expensive; all of it fails silently unless it is a named routine rather than an intention.

What should staff say when a customer mentions an allergy?
A script, not improvisation: take it seriously and say so, check the matrix rather than memory, flag the order to the kitchen explicitly, confirm at the pass, and if genuine uncertainty remains, say honestly that you cannot guarantee the dish rather than gambling. Customers with allergies are loyal to venues that handle this well precisely because so many handle it vaguely, confidence here is a marketing asset wearing a safety vest.

Do dietary menus (vegan, gluten-free) need the same rigour?
The stakes differ, disappointing a vegan is not hospitalising a coeliac, but the systems are identical: accurate recipes, honest labels, cross-contact awareness, and staff who know rather than guess. Two honesty rules: “vegan option” means genuinely vegan including the stock and the fryer, and “gluten-free” claims need the dedicated-oil and clean-down discipline behind them, otherwise say “no gluten-containing ingredients” and explain the difference when asked.