ALLERGEN LABELLING

The New Codex Rules on May Contain: Precautionary Allergen Labelling and the Reference Doses

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 15 min read

CAC49, the 49th Session of the Codex Alimentarius Commission, meeting in Geneva from 6 to 10 July 2026, added an annex to CXS 1-1985 titled “Guidelines on the use of precautionary allergen labelling”. It sets out when a “may contain” statement may be used, and it prints reference doses running from 1.0 mg to 200.0 mg of total protein from the allergenic food(s).

What did Codex change about “may contain” labelling in July 2026?

CAC49 added a new annex to CXS 1-1985, the General Standard for the Labelling of Prepackaged Foods, titled “Guidelines on the use of precautionary allergen labelling”. The published standard now carries ADOPTED 1985 CXS 1-1985 AMENDED 2026 on its cover. Sections 4.2.2, 4.3.4, 4.7.1(vii) and 8.1.3.1 were revised at the same session.

The standard’s own history note records the change: following decisions taken at the Forty-ninth Session in 2026, CXS 1-1985 was revised in those four sections and an annex on the guidelines on the use of precautionary allergen labelling was added. That annex sets out when a precautionary statement may be used and what has to happen before it is printed. Until it was adopted, the phrase “may contain” was governed on most sites by commercial caution and legal nerves rather than by a published rule.

Two other things came out of the same session and belong on your reading list. CXS 1-1985 was also amended on multipacks and joint presentations, covering how ingredient lists, net contents and date marking work where several packages are sold as one unit, which matters to anyone who sells variety packs, promotional twin packs or hamper style assortments. And CXC 80-2020, the allergen code of practice, was amended at the same session.

Get the session right, because most of the internet has it wrong. The July 2026 session was CAC49, held from 6 to 10 July 2026 at the Centre International de Conferences Geneve in Geneva, with roughly 600 delegates from 119 members. CAC48 was the earlier session, from 10 to 14 November 2025 at FAO headquarters in Rome. If a supplier document or a consultant’s slide deck attributes the precautionary allergen labelling annex to CAC48, that document was written from a secondary source and you should check everything else in it. Our full list of every Codex change from CAC48 and CAC49 covers the rest of the batch, and the ASC Codex and guidelines register holds 322 Codex texts and 60 other guidance documents with the 2025 and 2026 change log. Every Codex text is a free download from FAO. Nobody has to sell you one.

Why unrestricted “may contain” stopped protecting anybody

A precautionary statement was meant to warn an allergic consumer about an allergen that is not an ingredient but could be present through cross contact. Because no rule governed when it could be applied, it spread onto products that carried no realistic risk, and allergic consumers learned that the phrase carries no information. A warning that appears everywhere is read nowhere.

I see the consequence on both sides of the counter. On the factory side, a site with one shared line and a validated clean prints the same statement as a site with open powder handling and no changeover verification, because the wording costs nothing and feels safe. On the consumer side, a parent buying for a child with a peanut allergy either ignores the statement, which is dangerous, or obeys every one of them, which removes so much of the shelf that the family stops reading labels properly at all. Neither behaviour is what the statement was for.

A warning printed on everything is not caution. It is the sound of a decision nobody made.

There is a commercial cost too, and it lands on the manufacturer. Some retail and food service specifications restrict products carrying precautionary statements, and institutional supply is where I see it asked about most. Every unnecessary “may contain” you print may close a door that your process is already good enough to walk through. That is the argument I use with sites who think the phrase is free: it can carry a commercial cost you pay to avoid writing a risk assessment.

When does the Codex annex allow a precautionary statement?

The annex sets an order of operations. Allergen management measures come first. A risk assessment comes second. Precautionary allergen labelling is permitted only where that assessment shows the residual risk cannot be adequately controlled. In the annex’s own words, a PAL statement “shall commence with the words ‘may contain’ (or equivalent words such as ‘may be present’)”. It is the last step, not a cheap default.

Read that sequence carefully, because it inverts how most sites work. The common pattern is that the statement goes on the artwork at product development, and the allergen controls are built afterwards to whatever level the line allows. The annex expects the opposite. You control what can be controlled, you assess what is left, and only the part that survives both of those steps earns a place on the label. A statement applied before the assessment is not compliant with the logic of the annex, whatever the wording says.

1. Put the allergen management measures in place firstSegregation, production sequencing, validated changeover cleaning, rework control, supplier approval, staff movement and training. These are the measures the annex expects to be exhausted before any statement is considered.
2. Assess the residual risk that remainsScore each cross contact route with the control applied and validated. An unvalidated control does not reduce the residual score, and a control with no record is not a control.
3. Compare the residual exposure against the reference doseA reference dose is an eliciting dose, modelled from clinical challenge data across an allergic population and set at the point where only a defined small proportion is predicted to have an objective reaction. Some individuals react below it. It is never a no-effect level and never a safety guarantee. The annex prints these doses in milligrams of total protein from the allergenic food(s), and they are the yardstick against which the residual risk is judged.
4. Apply the statement only where the risk cannot be adequately controlledWhere the assessment shows the route is controlled, there is no statement. Where it does not, the statement goes on and begins with “may contain” or an equivalent phrase.
5. Record the reasoning against the specific productThe register entry names the unresolved route, the allergen, the control considered, the reason it is insufficient and the review date. That entry is what makes the label defensible in an audit or a claim.
6. Review when anything changesNew raw material, new supplier, new product on the line, layout change, equipment change, a positive verification result or an allergen complaint. Each of those reopens the decision, in both directions.

What are the Codex reference doses for allergens?

The annex prints them in milligrams of total protein from the allergenic food(s). Table A1, for IgE mediated food allergy, runs from 1.0 mg for most tree nuts, celery and mustard up to 200.0 mg for crustacea. Table A2, for coeliac disease, sets 4.0 mg of total gluten. The full table is below.

The annex captions them “Table A1: Reference doses for allergenic foods relevant to IgE-mediated food allergy risk analysis” and “Table A2: Reference dose for gluten relevant to coeliac disease risk analysis”.

Three points about how to read that table, because the misreadings are already circulating. First, the unit is total protein from the allergenic food, not product. A reference dose of 2.0 mg of milk protein is not 2.0 mg of milk powder, and converting between them needs the protein content of the material you actually use. Second, the differences between foods are real clinical differences, so the gap between 1.0 mg for cashew and 200.0 mg for crustacea reflects how the two allergic populations actually respond, and a site that applies a single internal threshold to every allergen is being both over cautious and under cautious at the same time. The percentile of the dose distribution chosen as the reference point is a different matter. That choice is a risk management judgement, and it is the same percentile for every food in the table, which is also why some individuals react below the dose printed against their allergen. Third, wheat appears twice, at 5.0 mg of total protein in Table A1 for wheat allergy and at 4.0 mg of total gluten in Table A2 for coeliac disease. They are different conditions with different tables, and your assessment may need both.

The practical use of the table is narrower than the excitement around it suggests. It gives you and your customer a shared yardstick for a conversation that used to be run on adjectives. When a buyer asks whether your line is clean enough to drop a precautionary statement, the honest answer has always been a technical one, and the annex now publishes numbers to anchor it. The burden shifts to whoever is claiming the risk is acceptable to show the arithmetic behind that claim.

How a reference dose becomes a decision on your line

A reference dose is a quantity of protein per eating occasion, not a concentration in a product. Turning it into a line decision needs three more things: how much of the product a consumer eats at one time, how much allergen protein could realistically transfer into a unit, and analytical evidence with a method fit for the matrix.

None of those three comes out of the annex. They come out of your own data.

The annex does not leave that arithmetic to you. It defines an action level and prints the formula. The action level, in milligrams of total protein from the allergenic food per kilogram of food, equals the reference dose in milligrams of total protein from the allergenic food divided by the amount of the food consumed in kilograms. It then says what to do with the answer. Precautionary allergen labelling shall be used where, following the application of appropriate mitigation measures, it is demonstrated that unintended presence of a food allergen is above the action level, and it should not be used where that presence is at or below the action level.

Keep the honesty about the inputs. An action level is only as good as the amount of food you assumed a consumer eats, the transfer estimate you used and the analytical method behind the result. Document all three, or the number is a guess in a suit.

The transfer estimate is usually the weakest link. Sites estimate how much residue a changeover leaves behind using nothing more than confidence in the cleaning procedure. If the clean has never been validated with an allergen specific method such as ELISA or a validated lateral flow test, there is no transfer estimate, only an opinion. A general protein swab or an ATP result tells you the surface is clean. Neither identifies a specific allergen protein, and neither belongs in the calculation.

A second trap sits inside the ELISA result itself. Kits do not all report on the same basis. Some report total protein from the allergenic source, some report the food itself, such as skim milk powder or whole egg, and gluten kits report gliadin, which is doubled to reach total gluten. A reference dose is expressed as total protein, so record the basis your kit reports on and convert the result before you compare it to a reference dose.

Is the Codex precautionary allergen labelling annex law in South Africa?

No. Regulation 43 of R146 of 2010 remains the South African allergen declaration rule and its list is unchanged. R146 contains no precautionary allergen labelling rule at all. The Codex annex reaches a South African site through export customers, certification schemes and customer specifications, and as the reference an expert or an importing authority will use where our own regulations are silent.

Be precise about this with your team, because both errors are expensive. Telling the board that Codex is now law creates a compliance project nobody asked for. Telling them Codex is irrelevant because it is not law leaves you unable to answer the first customer who quotes it. The accurate position is that R146 of 2010, Government Gazette 32975, 1 March 2010, made under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, is the law that binds your label in South Africa, and that the Codex annex is the international benchmark against which the reasonableness of your precautionary statement will be judged by everybody except a South African labelling inspector.

Four routes carry it onto your site in practice.

• Export customers and importing authorities. Where a destination market has no PAL rule of its own, Codex is what the authority and the buyer reach for. Our guide to importing food into South Africa covers the mirror image of this problem at our own border, where Port Health can detain a consignment
• Certification schemes and their customers. A customer specification that names the Codex annex becomes an auditable requirement the moment you sign it, and your certification body will then audit you against the specifications you have accepted
• Retailer and food service specifications. The buyer’s technical team will ask which precautionary statements you carry and why, and the reference dose table gives them a vocabulary for the question that did not exist before July 2026
• The expert view after an incident. Section 61 of the Consumer Protection Act 68 of 2008 imposes liability for harm caused by unsafe goods or by inadequate instructions or warnings, irrespective of negligence, and section 55 gives a consumer the right to safe, good quality goods. When an expert is asked what a reasonable manufacturer should have done, the published international text is the first document opened

That last route is the one I would plan around. Our South African food legislation guide sets out how the Acts and regulations fit together, and the ASC South African legislation register holds 413 instruments across 42 parent Acts if you need the primary text.

How the Codex list compares with the allergens R146 requires

Regulation 43 of R146 of 2010 lists the common allergens: egg, cow’s milk, crustaceans and molluscs, fish, peanuts, soybeans, tree nuts, and cereals containing gluten, which covers wheat, rye, barley, oats and hybrids such as spelt and kamut. Sulphur dioxide is not on that list. Regulation 38 requires it to be declared at 10 mg per kilogram or more, and at any level in certain cases.

See the allergens R146 of 2010 requires you to declare, set out in full in the allergen labelling guide.

The fourteen allergen list belongs to the European Union and has no legal standing here. I raise it in every allergen article because most of the matrices handed to me on South African sites were copied from a European template, and they carry celery, mustard, lupin and sesame as legal allergens while missing what R146 does require. The Codex reference dose table makes this worse, not better, because it names those same foods. A dose in Table A1 is a risk assessment number for a food that some markets regulate. It is not a South African declaration duty.

Regulation 43 of R146 of 2010 is the declaration rule and its list is unchanged. Our allergen labelling guide works through the declaration mechanics, and our list of common food labelling mistakes covers the artwork failures that sit alongside them.

What changed in CXC 80-2020, the allergen code of practice

CXC 80-2020, the Code of Practice on Food Allergen Management for Food Business Operators, was amended at CAC49. Its Introduction, Section 2.1 on scope and Section 2.3 on definitions were amended to align with the revisions to CXS 1-1985 adopted by CAC47 in 2024, on the list of foods and ingredients known to trigger food allergy or coeliac disease. The published text carries AMENDED 2026.

This is the quiet change that will catch sites out, because CXC 80-2020 is the document most allergen policies quote. If your policy opens by stating that it is based on the Codex Code of Practice on Food Allergen Management, CXC 80-2020, and then reproduces the 2020 scope statement and the 2020 definitions, the policy is now out of step with the current text. It is not wrong in its principles. It is quoting a version that has been superseded, and an auditor who has read the 2026 texts will notice within a minute of opening it. Note too that CXC 80-2020 carries no allergen list of its own. It refers to Sections 4.2.1.4 and 4.2.1.5 of CXS 1-1985.

The fix is small and worth doing before your next audit. Update the reference to the amended text, check that your defined terms for cross contact, allergen management and precautionary allergen labelling match the amended definitions, and check that the list of allergenic foods your policy names is described accurately for each market you sell into. That last one is where most policies drift, because they carry one list and pretend it works everywhere. Where you are uncertain of a Codex document reference, the ASC Codex and guidelines register carries the current codes with the change log, and every text is a free FAO download.

What an auditor reading the 2026 texts will ask to see

An auditor cannot audit you against Codex unless your own system or a customer specification adopts it. What an auditor will do is test whether your allergen decisions are current, evidenced and consistent. The 2026 annex gives them a sharper set of questions to ask about precautionary statements, and a blanket “may contain” is now the fastest way to invite all of them.

• A list of every product carrying a precautionary statement, with the specific cross contact route that justifies each one
• The risk assessment behind each statement, showing the control applied, its validation status and the residual score
• The products that do not carry a statement, and the assessment showing why they do not need one
• Validation evidence for the allergen clean, from an allergen specific method, not an ATP or general protein result
• Verification records at the frequency the assessment names, with changeover sign off and line clearance
• Supplier allergen declarations that are material specific rather than blanket, and the approval decision behind accepting a blanket one
• The production sequencing rule, who may deviate from it, and what happens to the clean when they do
• Rework records showing product, allergens carried, hold time, quantity added and destination batch
• Artwork approval records that reference the register entry, so process and label point at each other
• Training records by role, with evidence that the training was assessed for impact, as regulation 10(1) of R638 of 2018 requires of the person in charge

The conversation itself has changed shape. An auditor used to accept “we apply may contain as a precaution” because there was nothing to test it against, and the finding, if one was written at all, went against the absence of an allergen policy. Now the question is which route the statement covers, and whether the same reasoning was applied to the products that carry no statement. Consistency across the range is what is being tested, and a site that has assessed half its portfolio will fail that test faster than a site that has assessed none, because the inconsistency is visible on the shelf.

Scheme versions matter here, so use the right ones. BRCGS Global Standard Food Safety Issue 9, published 1 August 2022, is still the current issue and Issue 10 has not been released. FSSC 22000 Version 7 was published in May 2026 and has been endorsed by Global Accreditation Cooperation. SQF Edition 10 was published on 4 March 2026, but Edition 9 remains the edition sites are audited against, with SQFI stating that Edition 10 is still in GFSI benchmarking and will not take effect before 1 January 2027. IFS Food version 8 has been mandatory since 1 January 2024. Our BRCGS Issue 9 implementation guide and our FSSC 22000 Version 7 guide for South Africa cover what those versions expect around allergens.

How a reference dose changes an allergen risk assessment

A defensible assessment is a register, not a paragraph. Every cross contact route gets its own line, its own raw score, its named control with the document and record that prove it, its validation status, and its residual score. The label decision is taken from the residual score and the reasoning is written into the same row, so the artwork and the assessment point at each other.

For the method itself, see how to score a cross contact route.

The routes that carry almost every finding I write on a South African site are consistent: shared equipment with hollow sections and dead legs, rework, airborne powder transfer at tipping and blending, production sequencing that the planner can override, changeover cleaning that has never been validated, storage and decanting, staff and tool movement between zones, and packaging or artwork control. Each is a separate row. A single line reading “allergen cross contamination, controlled by cleaning” is not an assessment, and it will not survive a customer asking which of the reference doses your residual exposure sits under.

Keep the honesty discipline in the scoring. Consequence for an undeclared allergen reaching a consumer who reacts to it is severe by definition, so likelihood and control effectiveness are what carry the assessment. Where a control has not been validated, the residual score stays at the raw level, and where a control has no record it does not reduce the score at all. Those two rules are what stop a register from quietly agreeing with whatever the label already says, which is the failure mode I find most often when I am asked to review one.

Two supporting registers do the heavy lifting behind the allergen one. Cleaning is the control most often named and least often validated, and the Cleaning and Disinfection Risk Assessment Template (RA03) at R690 scores method, frequency and validation status for every changeover clean. Suppliers are the route by which somebody else’s unassessed risk arrives on your register, and the Supplier and Purchased Material Approval Risk Assessment Template (RA11) at R690 scores declarations, notification of formulation changes and certification status. Rework earns its own register too, and the Rework Risk Assessment Template (RA13) at R690 scores hold time, destination products and quantity records.

How to update your allergen policy, specifications and artwork

Work in one direction: text, then policy, then assessment, then specification, then artwork. The order matters because each document feeds the next, and sites that start at the artwork end up reprinting twice. Budget a day for the review and a week for the decisions, and do it before your next customer specification arrives rather than after.

1. Download the current textsCXS 1-1985 as amended 2026, including the new annex, and CXC 80-2020 as amended 2026. Both are free from FAO. Record the version and the date you downloaded them in your external document register.
2. Update the allergen policyCorrect the CXC 80-2020 reference, align the defined terms with the amended definitions, and state plainly that regulation 43 of R146 of 2010 governs the South African declaration while the Codex annex governs the precautionary decision logic.
3. List every precautionary statement you currently printOne line per product and per allergen. Most sites are surprised by the total, and by how many of the statements turn out to have no owner and no reason recorded anywhere.
4. Score the route behind each statementTake each one back to the specific cross contact route. Where the control is validated and the residual risk is controlled, the statement comes off. Where it is not, the statement stays and the register entry records exactly why.
5. Check the ones with no statementThe reverse test is the one that prevents a withdrawal. A route scored in the upper band with a partial control and a label carrying nothing is the pattern that ends in a product recall.
6. Update the specifications your customers holdIf a statement comes off or goes on, the customer specification is a contractual document and has to be reissued. Do not let the artwork change before the specification does.
7. Reissue the artwork and reconcile the old stockDestroy and record obsolete label stock, reconcile at line clearance, and keep the artwork approval referencing the register entry that justified the change.
8. Set the review trigger and train the rolesNew material, new supplier, new product, layout or equipment change, positive verification result, or complaint. Train the planner, the QA officer, the cleaner and the technologist to the part each of them owns.

If you would rather not run that yourself, this is exactly the kind of project ASC scopes as one figure: the line walk, the register, the policy rewrite, the product by product statement decision and the artwork review that follows. Browse the full set of registers in the risk assessment library or the the ASC toolkit and template shop, and the full course list at ASC Food Safety Training.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.