Precautionary Allergen Labelling: A Cross-Contact Risk Log Built With AI

AI can help a small food producer prepare a may-contain decision, but it cannot make it. Use it to organise recipes, lines and cleaning records into a per-product log, then let a trained person decide, using your regulator's guidance. A statement belongs only where cross-contact risk stays after segregation and cleaning.

The common error is working backwards: someone asks a chatbot "does this need a may-contain label?" and gets a confident yes or no that rests on nothing about your premises. A decision about a label needs facts from your own kitchen or factory floor. The AI's job is to make you collect them in a consistent shape, spot gaps, and draft the paperwork.

Follow me on Instagram@sagnikteaches

What a precautionary statement is, and what it is not

A precautionary allergen statement is wording such as "may contain traces of sesame" on a pre-packed food. It warns that an allergen not in the recipe might still end up in the product through cross-contact: for example, flour dust drifting from a bench, a shared fryer, a scoop moved between tubs, or a mixer cleaned between batches. Ingredients are different. If sesame is in the recipe, it is declared as an ingredient, and no precautionary wording can replace that.

Connect on LinkedInSagnik Bhattacharya

In most regulatory systems these statements are voluntary. That is why they are such a mess on shop shelves. One national regulator's guidance, first published in September 2023 and still current when I read it in November 2026, says a statement should be used only when a risk assessment finds a risk of cross-contact that cannot be removed through risk management actions. It offers wording such as "may contain x" or "not suitable for consumers with a x allergy", warns that a blanket "may contain allergens" could mislead, and says a statement should not sit beside a free-from claim for the same allergen. It may be combined with a vegan or vegetarian label. I am paraphrasing; read the current text from your own food authority before you rely on it, because the rules differ by market and change.

Subscribe on YouTube@sagnikteaches

The logic behind it is sensible. People with allergies rely on labels to decide what is safe. If every product carries a warning, the warning stops carrying information, and allergic customers lose products they could eat. If you leave off a warning where a real risk exists, someone can be harmed. A documented decision is the only defence against both failures.

Why the log is per product, not per factory

Many small producers decide once for the whole site: "we handle nuts, so everything may contain nuts". That is the blunt version, and it is usually the wrong one. Cross-contact depends on what runs on which equipment, in what order, with what cleaning in between. A jar of chutney filled on a dedicated line on Monday morning has a different risk to a granola bar baked on a tray used for nut clusters at noon.

So the unit of the log is the SKU (the individual product line you sell), and for each one you record the allergen that might transfer, the route, how likely it is, how well you control it, and the conclusion. That per-SKU checklist sits on top of a recipe-level allergen matrix; if you do not have one yet, start with the allergen matrix tutorial and come back.

What AI is good for here, and where it stops

Use AI for the tasks that are about structure and consistency:

• Turning your messy notes about the production floor into one table row per SKU.
• Listing the routes of cross-contact for a described process, so you remember the shared scoop and the airborne flour.
• Spotting rows where evidence is missing, such as "cleaned" with no method recorded.
• Drafting the cleaning checks you will later validate.
• Producing a one-page summary for an auditor or a customer's technical team.

Do not use it for the things that carry the legal and safety weight:

• Deciding whether a risk is acceptable. A chatbot has never seen your equipment and cannot swab your line.
• Stating what the law requires in your market. Read the regulator's own page.
• Declaring a cleaning method effective. That needs testing on your premises.
• Inventing thresholds. If a figure appears in the answer, find where it comes from in published guidance, or delete it.

The wider issue of why a fluent answer can still be wrong is covered in AI hallucinations explained for business owners. For label work specifically, the comparison of AI label makers and manual checks shows where tools help and where they miss things.

One practical warning: do not paste your supplier's confidential specification documents into a consumer chatbot without checking its terms. What to check in an AI tool's privacy terms covers that.

The log: columns that earn their place

Keep the log in a spreadsheet. Every column should either feed the decision or prove it. This is a layout I would use for a small producer:

The route list is longer than most owners expect. The guidance I read names processing aids, raw material handling, storage, transport, people, cleaning, shared equipment, rework, air particles, the supply chain and packaging as sources to consider, and it even suggests telling your pest control provider about the site's allergen status so their products do not bring a new allergen in. It also points out that a powder spreads evenly through a product while seeds and nut pieces can form hot spots, so the physical form of an ingredient belongs in the route column too.

Notice the "Decision" column has three options, not two. The third, change the process, is often the cheapest answer. If one product carries a warning only because it shares a tray with a nut product on Thursdays, moving the Thursday run to the end of the day, with a full clean afterwards, might remove the need for the label entirely.

Main example: a small bakery with six products

Take an illustrative small bakery that sells six lines online and at markets: a plain sourdough loaf, a seeded loaf, cheese scones, a carrot cake, a flapjack and a gluten-free brownie. The premises handle wheat, milk, eggs, sesame (in the seeded loaf), and almonds (in the carrot cake topping). One oven, one mixer, two sets of tins.

Start by giving the AI your notes in plain words and asking it to build rows, not conclusions. A prompt along these lines works:

I run a small bakery. Below are my products, my equipment and my
production days. Build a table with one row per product. Columns:
product, allergens in the recipe, allergens handled elsewhere on site,
shared equipment, possible cross-contact routes, current controls
(only those I have written below), missing information.
Do NOT decide whether any product needs a precautionary label.
Do NOT invent controls I have not described. Where I have not told
you something, write "not provided".

Products: [paste list with recipes]
Equipment and layout: [paste description]
Production schedule: [paste schedule]
Cleaning: [paste what you currently do]

A realistic output (illustrative) for the brownie row looks like this:

Gluten-free brownie
Recipe allergens: egg, milk (butter)
Handled elsewhere on site: wheat, sesame, almond, egg, milk
Shared equipment: mixer, oven, baking tins (set B)
Routes: flour dust from sourdough production; residue in mixer bowl;
oven shelf contact with trays of seeded loaf; handler transfer
Controls provided: "tins washed in dishwasher", "wipe bench"
Missing: how the mixer bowl is cleaned; whether the brownie is baked
before or after the seeded loaf; any test of cleaning effectiveness

That output is useful because of the "Missing" line. What I would fix in it: it lists wheat as handled elsewhere, which matters because the product is sold as gluten-free, and the AI did not flag the bigger issue. A gluten-free claim has its own legal rules in many markets, and a gluten-free product made in a bakery full of wheat flour is exactly the case where a "free-from" promise needs strong evidence. So the log gets an extra manual note: "free-from claim present: check the regulator's rules for that claim before deciding anything else."

Now fill in the evidence yourself, by walking the floor. Say you find: the mixer is shared and rinsed with water between batches only; brownies are baked first thing in the morning, after the oven has been cleaned overnight; the dishwasher runs tins at a high temperature. Baking first is a recognised control: the guidance I read suggests preparing food from least to most allergenic, with gluten-free products at the start of the day. The rinsed mixer bowl is the weak point. The decision is not the AI's. You write it:

Residual risk: medium (mixer bowl rinsed, not washed with detergent)
Decision: change the process first. Use a dedicated bowl for the
brownie, colour-coded; wash all bowls with detergent; swab the dedicated
bowl and the oven shelf after cleaning for three runs. Review the
statement question after swab results.
Reviewer: [name], [date]

That is how the log should read: the decision is a plan with a date, not a vague label. If the swabs come back clean for three runs, you may keep the free-from claim and carry no statement. If they do not, you drop the claim and consider the statement for the specific allergen. The documented reasoning is what you show an inspector, a retail buyer or an insurer.

Validating cleaning: what the AI can help plan and what it cannot do

Validation means proving that your cleaning method removes the allergen to a level you can defend. It is a physical activity. The guidance I read describes validating cleaning with inspections that confirm no visible food, debris or residue, monitoring that staff clean properly, keeping records, and dismantling equipment where needed to reach powders, pastes and seeds. Many producers add swabs or rapid allergen test kits from a lab or kit supplier, taken at defined points after cleaning. AI cannot do any of that. It can help you plan the routine.

A planning prompt:

Here is my cleaning procedure for the mixer and the filling head
and the allergens that run on them. Suggest a validation plan as a
checklist: sampling points after cleaning, how many consecutive runs
to test, what to record, and who signs off. Mark every point where a
person must check the method against my regulator's guidance or my
test-kit supplier's instructions. Do not state any pass/fail
threshold.

The final sentence matters. Pass or fail limits depend on the test kit, the allergen and the guidance you follow. A model will happily make one up. A kit's instruction sheet or the regulator's page will give you the real one, and if you cannot find one, ask your local food enforcement officer or a food safety consultant before you decide. Thresholds are a live question internationally: Codex, the international food-standards body, has been working on a precautionary labelling standard that would set allergen thresholds at a level called ED05 (the dose at which about 5% of people with that allergy are predicted to react), and one national regulator's board has published a paper weighing whether to support it. Until your own regulator adopts a threshold and tells you how to apply it, a figure from a chatbot has no standing in your log. One more fact worth keeping in mind from the guidance: heating does not reliably destroy allergens, and roasting peanuts can make them more potent, so "it gets baked" is not a control.

Sample output from that prompt (illustrative) would list swab points such as "inside of bowl base, beater shaft collar, bowl lip", then "three consecutive production runs", then "record: date, operator, kit batch number, result photo". What you would fix: add the points the AI cannot know, like the gasket on your particular filler that traps paste, found only by taking the machine apart once with the person who cleans it.

Four more situations, each with a different answer

These are short illustrations to show how the same log leads to different decisions. All are fictional.

Case 1: a dedicated line, but a shared packing table

A jam maker's fruit jams run on one line with no allergens at all. Hazelnut spread runs on a separate kettle. Both are packed and labelled on the same table by the same two people. The route is handler transfer and packaging, not process. The log's answer might be: no statement on jam, but a colour-coded gloves and tools rule at the packing table plus a clean down between lines. The AI's contribution was to point out the packing table, because the owner's first draft described only the kettles.

Case 2: an ingredient that arrives with its own warning

A granola producer buys oats from a supplier whose specification says "may contain traces of wheat" because the mill also handles wheat. The risk is in the ingredient, not your kitchen. Your log row should record the supplier statement and the date of the specification. The guidance I read says precautionary information from ingredient suppliers should be passed on to the final consumer unless your own risk assessment supersedes it, so the default is to carry the warning through, and dropping it needs evidence from the supplier that you can show. See how AI can spot supplier specification changes that break labels, because suppliers change these statements without telling you.

Case 3: rework

A chocolatier melts misshapen hazelnut pralines and uses the melted mass in a plain filled chocolate. That is not cross-contact by accident; it is an ingredient. The allergen belongs in the recipe, so the product declares it as an ingredient. A log helps by having a "rework" column. If you do not have one, rework is the thing you miss.

Case 4: a seasonal product that runs once a year

A cake maker produces a marzipan stollen only in December. For eleven months, there is no almond on site. For one month there is, plus dust and handling. The log row shows "seasonal" and the cleaning step is a once-a-year deep clean in January. If the deep clean is the only control, the evidence needs to be strong. A seasonal pattern makes it tempting to say "we only do this in December so there is no issue", while the evidence for the January clean is actually the one that matters for February's products.

A realistic way the log goes wrong

A small producer asks a chatbot to "fill in the log" from a pasted recipe list. The model returns a tidy table with confident "Low risk" ratings and phrases such as "standard cleaning is sufficient". None of it came from the producer's premises. The producer signs it off because it looks finished. Three months later a retailer's technical audit asks for the swab results behind "sufficient". There are none.

The fault was not the tool. It was allowing the assistant to write the judgement column. The fix is built into the prompt above: the model may only organise what you provide and must write "not provided" for the rest. Then a person fills the evidence and decision columns by hand, with a date. If you find yourself pasting the AI's risk rating straight into the file, stop.

Wording once you have decided

If the log concludes a statement is justified, the wording should follow your regulator's guidance, so check it before printing. In the guidance I read, the suggested forms name the allergen ("may contain sesame" or "not suitable for consumers with a sesame allergy"), blanket wording such as "may contain allergens" is discouraged, and a statement should not appear on a product making a free-from claim for the same allergen. For food that is not pre-packed, the same guidance says the information can be given by staff or on signs instead of a label. Your market may differ. AI can draft options for you to pick from, though the choice is yours:

Draft three label wording options for a flapjack where the log
concludes there is an unavoidable cross-contact risk with sesame.
Keep each under 12 words. Use the specific allergen name. I will
check the wording against my regulator's current guidance, so do not
claim any option is compliant.

Make sure the wording matches what appears on your website listing and any marketplace page too. A statement on the pack that is missing from the online description is a common inconsistency, and one an allergic customer relies on when ordering. The same discipline applies to menus; allergen labels on printed menus shows the same checks in a restaurant setting.

Checking the log still works six months on

A log is a living record. These events should trigger a review of the affected rows:

• A new product or a recipe change, however small (a different chocolate, a new seed mix).
• A supplier substitution. "Same product, new brand" is a classic way an allergen appears.
• A change of equipment, layout or production order.
• A customer complaint or near miss.
• A change in the regulator's guidance.
• Any failed swab or test result.

Put a calendar reminder for a full review at a fixed interval of your choosing, say every six months, and ask the AI to compare this version with the last one for changes you may have missed. Give it both files and tell it to list differences only. A comparison is a structural task it handles well.

Test yourself with this quick audit after the first version is done. For each row: can someone find the recipe, the cleaning procedure and the evidence in under two minutes? If not, the record will not help you on the day it is needed. Time one row as a drill.

When this approach is the wrong tool

There are cases where a self-built log is not enough, and you should bring in a food safety consultant or your local food authority:

• You export to several markets with different rules.
• You make products for infants, or for medical or special diets.
• You have already had an allergen incident or a complaint.
• You are applying for a retail or certification scheme, which will have its own methods.
• You are unsure whether a production process counts as an unavoidable risk.

Even then, the log is useful, because it lets you walk into the conversation with organised facts rather than a verbal account. If you want a second pair of eyes on how to set up the AI side of that workflow without getting into trouble, that is the sort of thing my AI implementation consultation covers, and you can get in touch here.

A short run-through you can do this week

1. List every product you sell, with its recipe and its declared allergens. One hour.
2. List every allergen handled anywhere on site, and every item of shared equipment. One hour, walking the floor.
3. Run the structuring prompt above and read the "missing information" column first. Thirty minutes.
4. Go and get the missing facts: how things are actually cleaned, in what order, and by whom. Half a day.
5. Write the residual risk and decision columns by hand. One hour per five products.
6. Pick the two riskiest rows and plan a swab validation. Book the kit or lab.
7. Re-read your regulator's current guidance on precautionary statements and adjust.
8. Have the trained person sign each row with a date.

The total is about two working days for a six-product business, most of it spent walking around rather than typing. The AI saves a few hours on structure, and the discipline it imposes on the paperwork is the bigger gain. The decision, and the responsibility for it, stay with you.

Questions small producers ask about may-contain statements

Is a may-contain label a legal requirement?

Generally no. Precautionary statements are voluntary information in most places, which is exactly why regulators publish guidance on when they are justified. Voluntary wording must still not mislead, and declaring allergens that are ingredients is mandatory. Your local food authority can confirm how the rules apply to your product and where you sell it.

Can I put may contain on everything to be safe?

Regulator guidance warns against it. Excessive use limits allergic customers' choices and devalues the warning, which can push people into taking risks. The guidance I read also says a statement used where no genuine risk was found could be treated as misleading. It should follow from a documented risk you could not remove.

Does a may-contain label protect me if something goes wrong?

Do not assume it does. A label does not replace good practice, and a regulator or insurer may ask what controls you had. If the risk was avoidable, the label may not help. Ask your food authority or an insurance adviser about your own position.

Should I use may contain nuts or name the nut?

Name the allergen your risk assessment actually found, such as peanuts or hazelnuts. The guidance I read suggests wording in the form "may contain x" and warns that blanket statements such as "may contain allergens" could mislead, because they are unlikely to rest on an assessment of each allergen. Check your regulator's wording for the allergens you handle.

Can I add may contain to a product labelled free-from?

Regulator guidance advises against combining the two for the same allergen, because a free-from claim is a promise. If you cannot make that promise because of cross-contact, remove the free-from claim rather than adding a warning beside it. A may-contain statement can, however, sit alongside a vegan or vegetarian label.

Further reads

• Food Production Schedule: AI Plans Around Allergen Changeovers — Order production runs to cut allergen changeovers.
• Should an AI Chatbot Answer Allergen Questions for Your Restaurant? — See why allergen questions need care in customer chat.
• AI for Delis: Daily Specials, Platter Orders and Allergen Labels — Allergen labels for made-to-order food.
• AI in Food Service: A Four-Week Menu Cycle With Costs and Allergens — Track allergens across a repeating menu cycle.
• How to Catch Made-Up Figures in AI-Drafted Proposals — Methods for catching invented figures in AI drafts.
• Starting a Chocolate Business: Costing, Labels and Where to Sell With AI — Per-bar costing, allergen label checks and a margin comparison of farmers market, online and wholesale, with illustrative numbers.
• Personal Chef Client Intake Form: Allergies, Diets and Menus With AI — The fields a personal chef needs for allergies, diets and kitchen details, and how to turn the answers into a menu draft without exposing health data.
• AI in Food Retail: Jobs a Deli or Farm Shop Can Hand Over First — Six jobs a deli or farm shop can hand to AI, the hours each saves, the check that stays with staff, and the order to start in.
• Can AI Handle Restaurant Menu Translation Without Mistakes? — How to translate a restaurant menu with AI: keep dish names, back-translate every line and have allergen wording approved by a person before it is printed.
• AI Label Design for Small Food Producers: Legal Text Checks — A practical label workflow that separates creative layout drafts from the human checks needed before food packaging is printed.
• AI for a Pet Food Business: Labels, Subscriptions and Customer Replies — Draft pet food labels, handle subscription pause requests, and answer ingredient enquiries using practical AI workflows.
• AI for a Soap Maker: Batch Records, Ingredient Labels and Listings — A batch record template, an ingredient-list check against your safety assessment and listing copy that avoids skin-benefit claims.
• How to Pitch a Food Product to a Grocery Store: A Sell Sheet With AI — A one-page sell sheet for a grocery buyer, built from your costs and sales, with pack sizes, case price, margin, shelf life and a sampling plan.
• AI for a Beekeeping Business: 7 Jobs From Hive Logs to Honey Labels — Seven beekeeping jobs for AI, from turning field notes into hive logs to checking honey label wording before print.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: a national food regulator's guidance on precautionary allergen labelling (first published September 2023, read November 2026), its accompanying precautionary allergen labelling checklist, and the same regulator's board paper on the proposed Codex precautionary labelling standard and allergen thresholds.