Codex Sets a Global 'May Contain' Standard: What the CAC49 Allergen Decision Means for Restaurants
The Codex Alimentarius Commission formally adopted risk-based PAL guidelines at its 49th session in Geneva on 7 July 2026. The EU is targeting a Q4 2027 harmonized regulation aligned with the new standard. For restaurants, the message is clear: documented per-dish allergen management is no longer optional.
The Codex Alimentarius Commission formally adopted internationally harmonized guidelines for precautionary allergen labeling (PAL) on 7 July 2026, at its 49th session (CAC49) in Geneva. The new guidelines — adopted as an annex to the General Standard for the Labeling of Pre-Packaged Foods — establish the first globally consistent framework for “may contain” and “produced in a facility that handles” statements. According to Food Safety Magazine, the US, UK, and EU have all announced they are opening national discussions on how to transpose the standard domestically.
TL;DR
- Codex CAC49 (7 July 2026) adopted the first global risk-based PAL standard — systematic thresholds and scientific risk assessment requirements for “may contain” statements.
- No more guesswork: warnings will only be permitted when cross-contamination risk “has been scientifically assessed and cannot be adequately controlled.”
- EU draft PAL regulation is targeting adoption in Q4 2027, explicitly aligning with the new Codex standard, per Food Safety Magazine (February 2026).
- Restaurant impact is indirect but real: the CAC49 decision accelerates national regulations, tightens ingredient supplier standards, and raises the bar for documented allergen communication across the entire food chain.
What Codex actually decided — and why it matters
Precautionary allergen labeling is the part of food safety that almost no one agrees on. “May contain traces of nuts” appears on everything from chocolate bars to oat biscuits, making it nearly impossible for allergic consumers to assess genuine risk. Until 7 July 2026, there were no internationally agreed rules on when such a statement was appropriate — each country handled it differently, and food businesses applied it inconsistently.
The CAC49 decision changes that baseline. The adopted framework requires PAL statements to be used only when the risk of unintended allergen presence has been scientifically assessed — not as a blanket liability shield. Businesses must demonstrate through documented risk assessments that cross-contamination risks cannot be adequately controlled before they are permitted to add a warning. The guidelines establish threshold levels and reference doses for priority allergens, giving food businesses a scientific basis for their decisions rather than a precautionary guess.
As Food Safety Magazine notes, the guidelines “address inconsistent allergen warnings across countries that have made it difficult for allergic consumers to assess actual food safety risks.”
EU is moving first — Q4 2027 adoption in sight
The European Commission was already ahead of the CAC49 vote. In early 2026, the Commission posted a draft harmonized PAL regulation with a Q4 2027 adoption target. Food Safety Magazine’s February 2026 analysis confirmed the draft explicitly aligns with Codex standards — meaning the CAC49 adoption now reinforces rather than redirects the EU’s timetable.
Once the EU regulation enters into force, food businesses operating across the EU — ingredient suppliers, producers, and food service operators — will need to:
- Conduct rigorous, documented risk assessments before applying any “may contain” statement.
- Justify the use of PAL with quantitative data on allergen presence where cross-contamination risks cannot be eliminated.
- Stop using “may contain” as a substitute for proper allergen prevention measures.
This matters for restaurants in two direct ways. First, your ingredient suppliers will be held to a much higher standard of PAL accuracy — which means the ingredient information flowing into your kitchen records will be more reliable. Second, the direction of travel in the EU and globally is toward documented, verifiable allergen communication at every point in the food chain, including food service.
EU Regulation 1169/2011 already requires restaurants and food service establishments to declare the 14 major allergens for non-prepacked foods, with information available in written form upon request. The EU’s PAL harmonization extends that framework to cover cross-contamination disclosures with the same scientific rigour.
What the allergen regulation wave looks like from a restaurant operator’s seat
The CAC49 decision sits atop an already active regulatory environment. In the US, California’s SB 68 (the ADDE Act) has required chain restaurants of 20+ locations to display written per-dish allergen disclosures since 1 July 2026. Maryland, New Jersey, Michigan, and Illinois have all introduced their own bills in 2026, with several targeting all restaurants regardless of size. Our overview of the US allergen legislation wave tracks the full state-by-state picture.
The EU’s 14-allergen declaration requirement for restaurant food is already in force under Regulation 1169/2011. The EU 2026 allergen awareness campaign, run by the European Commission’s Food Safety directorate, reinforces that written allergen information must be available on request in every food service setting across member states.
The Codex CAC49 standard ties these threads together: the same scientific risk-assessment logic that will govern “may contain” labels on packaged ingredients will increasingly apply to how restaurants communicate their own cross-contamination risks.
| Framework | Scope | Status | Timeline |
|---|---|---|---|
| EU Regulation 1169/2011 | 14 allergens, all restaurant food (non-prepacked) | In force | Written info on request, now |
| EU draft PAL harmonization | ”May contain” rules for all food businesses | Draft posted | Q4 2027 adoption |
| Codex CAC49 PAL guidelines | International standard (pre-packaged food, sets national baseline) | Adopted 7 Jul 2026 | National transposition varies |
| California SB 68 | Written per-dish allergen disclosure, chain restaurants | In effect 1 Jul 2026 | Enforcement underway |
| Maryland HB 181 / NJ SB 3394 | All restaurants, all allergens | Introduced 2026 | TBD if enacted |
What to do now
The regulatory direction is clear: documented, verifiable, per-dish allergen information is becoming the minimum expectation for food service operators worldwide. Waiting for each deadline is the most expensive approach.
Build your allergen register now. Map every dish against all relevant allergens — declared and cross-contamination risks. The EU’s 14-allergen requirement for non-prepacked foods is already law across every member state; the Codex and EU PAL frameworks add rigour to the cross-contamination side of that same obligation.
Review your supplier documentation. As PAL rules tighten, supplier “may contain” statements will become more precise and meaningful. Keep records updated and request ingredient specifications in writing.
Choose a menu system that makes updating instant. Recipe changes happen. A supplier changes a formulation, a cross-contamination risk emerges, or a dish is withdrawn. Static printed menus create a compliance gap between the change and the next reprint. A dynamic QR code menu with per-dish allergen tags closes that gap immediately — one update, reflected on every guest’s phone.
To get allergen information live on your menu today — tagged per dish, visible across 16 languages, and updateable the moment a recipe changes — you can start a free ShevaFood account and be ready before the next service.
Per-dish allergen tags, updated in real time
For a full picture of how digital QR menus work end to end, see our Complete Guide to QR Code Menus for Restaurants.
Frequently Asked Questions
PAL covers statements such as “may contain traces of peanuts” or “produced in a facility handling milk,” warning consumers of unintentional allergen presence from cross-contamination. Until 7 July 2026, no international standard governed their use, so businesses applied them inconsistently — sometimes as genuine safety warnings, sometimes as legal shields. The Codex CAC49 guidelines require a documented, risk-based scientific assessment before any PAL statement may be used.
Not immediately. The CAC49 guidelines target pre-packaged food manufacturers rather than restaurant kitchens. However, restaurants rely on packaged ingredients governed by these rules, face similar cross-contamination risks in their own kitchens, and will be affected as the EU (Q4 2027), US, and UK transpose the Codex standard into national regulations. The direction of all current restaurant allergen legislation — from California SB 68 to EU Regulation 1169/2011 — is toward documented, verifiable allergen communication at every point in the food chain.
The European Commission posted a draft harmonized PAL regulation in early 2026, with adoption targeted for Q4 2027. The draft explicitly aligns with the Codex standard adopted at CAC49. Once in force, EU food businesses will need rigorous documented risk assessments before applying any “may contain” statement. Restaurants in the EU are already subject to the 14-allergen declaration rules under Regulation 1169/2011; the PAL harmonization extends the same scientific framework to cross-contamination disclosures.
Build a complete, documented per-dish allergen register — including realistic cross-contamination risks from shared equipment or preparation surfaces. Review your ingredient suppliers’ PAL statements, since their accuracy will tighten under the new international standard. Use a dynamic digital menu that lets you update allergen information the moment a recipe or supplier specification changes, rather than waiting for the next reprint cycle.
Sources
- Codex Adopts Internationally Harmonized Precautionary Allergen Labeling at CAC49 — Food Safety Magazine , 7 July 2026
- EU Considers Adoption of Harmonized Precautionary Allergen Labeling Rules — Food Safety Magazine , 27 February 2026
- EU Food Safety Campaign 2026 — Allergies — European Commission — Food Safety
- Food Information to Consumers — EU Regulation 1169/2011 — European Commission — Food Safety
Tags
Related Articles
AI Menu Optimization in 2026: Three Launches That Show AI Has Moved Inside the Restaurant
California's Restaurant Allergen Law Goes Live July 1 — and Five More States Are Moving
