Skip to content

How to audit your restaurant for the 14 EU allergens.

A practical, station-by-station audit you can run in an afternoon. Identifies hidden allergen sources, cross-contact risks, and the gaps that put restaurants on the wrong side of EU 1169/2011.

  • Crumb guide
  • Allergen operations
  • Updated

Most restaurants think they handle allergens well. Most restaurants are wrong. Not because the chef doesn’t care, but because allergens hide in places nobody thinks to look — the bouillon cube, the Worcestershire, the brioche bun brushed with butter, the ‘gluten-free’ soy sauce that contains wheat. EU Regulation 1169/2011 doesn’t care about intent. It cares about disclosure.

What follows is the audit we run with every Crumb customer in their first week. It takes one afternoon. It will surface things you didn’t know about your own kitchen.

Step 1 — Map every supplier, not every dish.

The instinct is to start at the menu. Don’t. Start at goods-in. Pull every supplier invoice from the last 30 days. For each line item, write down the product, the supplier, and the 14 EU allergens it contains and may contain. This is your ingredient register.

You’ll find duplicates — three suppliers for olive oil, two for cream, four flour brands rotated by availability. Note them. Cross-contact risk often lives in the swap.

Step 2 — Read every label. Every label.

The most-missed allergens in our audits, in order:

  • Sulphites in dried fruit, balsamic, peeled prawns, instant mash.
  • Mustard in vinaigrettes, mayonnaise, sausages, curry pastes.
  • Celery in stocks, bouillon, salt blends, even some baking powders.
  • Soya hidden as lecithin in chocolate, baked goods, and some ‘natural flavourings’.
  • Wheat in soy sauce (most varieties), beer, modified starch, malt vinegar.

If your stock comes from a supplier and arrives in a foil pack labeled ‘beef bouillon’, it almost certainly contains celery. If you finish a sauce with a splash of Worcestershire, you have just added fish to the dish. None of this is a problem if it’s declared. All of it is a problem if it isn’t.

Step 3 — Walk every station with the ingredient register.

Now you go to the kitchen. Station by station — sauce, garde manger, larder, pastry, grill — match what’s actually being used to what’s on your register. Three things will happen:

  1. You’ll find ingredients in use that aren’t on the register. Add them.
  2. You’ll find dishes plated near allergens they don’t ‘contain’. That’s may-contain territory.
  3. You’ll find at least one dish whose ingredient list on the menu is incomplete. Fix it.

Step 4 — Identify cross-contact zones.

The fryer is the obvious one. If you fry breaded items in the same oil as chips, your chips contain gluten — declare them as such. The same applies to grills used for both fish and meat, knives and boards used for both nuts and non-nuts, and the pasta water reused for vegetables.

Cross-contact isn’t a failure. Hiding cross-contact is. A guest with a peanut allergy needs to know your kitchen handles peanuts even if no dish on the menu contains them. ‘May contain peanuts’ is a legitimate disclosure, and Crumb has a separate UI affordance for it.

Step 5 — Lock the register, then build the menu from it.

The point of all of this: your menu should be derived from your ingredient register, not the other way around. When the chef adds a new dish, every ingredient is already on the register with its allergen profile. The dish’s allergen panel is computed, not typed. When a supplier changes — sulphites added to the prawns, palm oil dropped from the chocolate — you update the ingredient once and every dish using it inherits the change.

This is the model Crumb is built around. You can run it in a spreadsheet — many of our customers did before us. But the moment you have more than 30 ingredients and two menus, the spreadsheet starts to drift, and that’s when EHO finds the gap.

Bonus: the modification audit.

Once your register is solid, walk it one more time and ask the chef a single question per dish: what could this be made without?Not ‘what would this taste like without it’ — that’s a different conversation. Just: would the kitchen happily prepare this dish with the ingredient removed?

Flag every yes. In Crumb, those flags become the ‘can be made without’ markers on the guest menu. We’ve seen restaurants double their dairy-free coverage from this single exercise. Read why this matters →

What this is worth.

A clean ingredient register is the difference between an EHO inspection you walk into confident and one you spend the morning panicking about. It’s the difference between a guest with coeliac disease ordering three courses and a guest with coeliac disease ordering tap water. It’s the difference, in the worst case, between a regulatory fine and no regulatory fine at all.

One afternoon. That’s the cost. We’d recommend doing it before you shop for a digital menu — and if the digital menu you’re looking at doesn’t accept the register you build, look at a different one.

Frequently asked.

How long does an allergen audit take?
One afternoon for a single-menu restaurant once supplier invoices are gathered. Larger or multi-menu kitchens budget a half day per menu, plus one supplier review per quarter.
Do we need a separate register if our POS already lists allergens?
Yes. POS allergen flags are dish-level and don’t survive supplier swaps. The ingredient register is the source of truth — dish-level allergens should be derived from it, not maintained in parallel.
Does ‘may contain’ count as compliant under EU 1169/2011?
Cross-contact disclosure is permitted and recommended where the kitchen handles the allergen, even if a dish doesn’t contain it. Hiding cross-contact is the compliance failure, not declaring it.

Try Crumb free for 14 days.

Set up your first menu in under 20 minutes. No card required, cancel anytime.

No card required · 14 days free · Cancel anytime