Allergens on a QR menu: what UK law actually requires
Natasha’s Law, the 14 allergens, and which food must carry a full ingredient label rather than the information given another way — on a digital menu.
Allergen information on a digital menu is the one part of QR ordering with legal consequences, and it is the part suppliers are vaguest about. This is a plain summary of what the rules require in the UK, and what that means for a menu somebody reads on their phone.
This is a summary written by a software company, not legal advice. The authority is the Food Standards Agency, and your local authority's environmental health team will answer specific questions about your site — usually helpfully, and free.
The 14 allergens
UK law names fourteen: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soybeans, and sulphur dioxide or sulphites above 10mg/kg or 10mg/litre. Those are the ones with a legal duty attached. They are not the same list as the dietary preferences a guest might filter by, and conflating the two on a menu is how "vegan" ends up being treated as an allergen statement.
Two regimes, and which one you are in
Prepacked for direct sale — a full label
Since October 2021, food packed on the same premises from which it is sold — the sandwich made in the morning and put in the chiller, the salad pot on the counter — must carry the name of the food and a full ingredients list, with the fourteen allergens emphasised in the list. This is the change usually called Natasha's Law. A pot on a shelf with no label is the clearest way to get a visit.
Non-prepacked — the information must be available and signposted
Food made to order — the burger cooked when you ask for it — does not need a printed ingredients list. What it needs is for allergen information to be available, and for the fact that it is available to be signposted. It may be given verbally, provided there is a visible written notice telling the guest to ask.
What that means for the QR menu
A QR menu is a useful way to meet the signposting duty and a dangerous place to be sloppy, for one specific reason: a guest reading their phone will take what is on it as the answer, whether or not you intended it as the whole answer.
- Say what the list is. "Contains: milk, gluten" and "may contain" are different statements with different weight. A menu that shows tags with no explanation invites the reader to decide which one they are looking at.
- Signpost the human. The written notice duty does not go away because there is a screen. The menu should say plainly that a severe allergy should be raised with staff before ordering.
- Keep dietary and allergen separate. "Vegan" is a preference and a claim about ingredients; "contains milk" is a legal statement. A single tag row that mixes them will be read as one thing.
- Modifiers change the answer. If a guest can add cheese, the allergen picture changes with the pick. A menu that shows allergens for the base dish only is showing information about a dish nobody ordered.
- Somebody owns it. A named person per kitchen who updates the data when a recipe changes. Otherwise it is accurate on the day it is entered and decays quietly.
The question worth asking a supplier
Not "do you support allergens" — everyone says yes. Ask: when a guest picks an option that adds an allergen, what does the screen show before they add it to the basket? That single question separates a system where allergen data is attached to the thing being eaten from one where it is a text field on a menu item.
HelchPOS shows allergen and dietary information on the guest menu with the two kept apart, and prompts the guest about allergies before they order. The accuracy of what it shows is the kitchen's, and no software changes that.