Allergen Cross-Contact: FASTER Act and the Big 9

Allergen cross-contact documentation for grocery retail: a problem most stores don't know they have until discovery requests arrive

There is a genre of business problem where the downside is catastrophic, the fix is mostly boring paperwork, and almost nobody does the boring paperwork until something goes very wrong. Allergen cross-contact documentation in grocery retail is squarely in that genre. Roughly 90,000 Americans visit emergency rooms every year because of food allergies, and a meaningful fraction of those incidents trace back to prepared foods at retail — your deli counter, your in-store bakery, your hot bar. The legal and regulatory framework governing allergens is surprisingly well-developed (more on that shortly), but the typical grocery store's actual documentation practices lag so far behind the requirements that most operators are, functionally, running uninsured against one of the more predictable liability risks in food retail.

I want to walk through why this problem is shaped the way it is, why in-store food preparation creates risks that are categorically different from selling pre-packaged goods off a shelf, and what the documentation systems that actually protect you look like in practice. If you manage a grocery store with deli or bakery operations, this is probably the most consequential operational gap you are not thinking about.

The legal scaffolding you are already standing on

Congress passed the Food Allergen Labeling and Consumer Protection Act (FALCPA) in 2004, which mandated that packaged foods must declare the presence of eight major allergens — milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, and soybeans — responsible for roughly 90% of allergic reactions. For almost two decades, that was the list. Then the FASTER Act (Food Allergy Safety, Treatment, Education, and Research Act) added sesame as the ninth major allergen, effective January 1, 2023, with no grace period. One day sesame was an unregulated ingredient; the next day it carried the same labeling and control obligations as peanuts.

The sesame addition is worth dwelling on because it illustrates how these regulatory changes intersect with retail operations in ways that are not immediately obvious. Sesame is everywhere in a grocery deli and bakery: it is on burger buns and bagels, in tahini-based dressings and hummus, scattered as garnish on salads, baked into bread. If your bakery produces sesame-topped rolls on the same surface where you later shape plain dinner rolls, you have a cross-contact problem that did not legally exist the week before. Stores that were not tracking sesame as an allergen (which was most of them, because they were not required to) suddenly needed updated allergen control plans, revised cleaning protocols, and retrained staff. Many stores, candidly, still have not caught up.

The distinction between cross-contact and cross-contamination matters here, and it is not just semantic pedantry. Cross-contamination is a microbial hazard — raw chicken drips onto lettuce, you cook the lettuce, the pathogen dies, problem solved. Cross-contact is an allergen hazard — peanut residue transfers to turkey on a shared slicer, you cook that turkey, the peanut protein survives completely intact because allergen proteins are heat-stable, and somebody with a peanut allergy is now in danger. You cannot cook your way out of an allergen cross-contact problem. The only controls are prevention through physical separation, dedicated equipment, or validated cleaning — which means the only evidence that you prevented it is documentation.

Why your deli and bakery are different from the center-store aisles

A can of soup sitting on a shelf has an allergen declaration printed by a manufacturer with a quality assurance department, a regulatory affairs team, and (in most cases) a GFSI-benchmarked food safety program. Your liability exposure from that can is close to zero. But the moment your deli counter wraps a sandwich in plastic film, labels it, and places it in a refrigerated case for grab-and-go sale, you have become the manufacturer — with all the labeling obligations that implies.

This is where the most common and most dangerous misconception in grocery food safety lives. Many retailers believe that because food is prepared in-house, it is somehow exempt from the allergen labeling rules that apply to packaged goods. It is not. FDA regulations are clear: if your store packages and labels a food product for sale and that product leaves the immediate point of preparation to be sold elsewhere in the store, the label must include a complete ingredient list with major allergen declarations. The only exemption is for food sold directly at the point of preparation without packaging — a made-to-order sandwich handed across the deli counter to the customer who ordered it. The moment you wrap it, sticker it, and put it in a case, you are subject to the same rules as Kraft or General Mills (minus, perhaps, the budget for regulatory compliance staff).

The practical implications of this are significant. A single deli sandwich can easily contain five or six of the nine major allergens: wheat and sesame in the bread, milk proteins in the cheese and potentially in the deli meat itself (sodium caseinate is a common ingredient in processed turkey), eggs in the mayo, soy in various condiments. If your deli rotates among three different mayonnaise suppliers over the course of a year — which is extremely common in retail, where purchasing decisions often follow promotional pricing — your allergen declarations can silently become inaccurate because the new mayo contains soy lecithin and the old one did not, or vice versa. Nobody changed the recipe. Nobody made a mistake. The supply chain shifted underneath you and your labels drifted out of compliance.

The cross-contact scenarios that keep food safety directors up at night

If you spend time in deli and bakery operations (I have spent more time than most people would consider recreational), you start to see cross-contact risks everywhere, because they genuinely are everywhere. The deli slicer is the canonical example and for good reason: a slicer that cuts Swiss cheese at 9 AM and turkey breast at 10 AM has transferred milk protein to the turkey unless allergen-specific cleaning happened in between. Not a wipe-down. Not a quick rinse. A full disassembly-detergent-scrub-rinse-dry cycle, because the blade is not the only contact surface — the guard, the carriage, the feed mechanism all touch food and all accumulate residue in crevices that a damp cloth will never reach.

But slicers are only the beginning. Your bakery mixer that made almond croissant dough at 6 AM and plain French bread dough at 8 AM has the same problem. Your fryer that cooked breaded chicken tenders (wheat) at 11 AM and french fries at 11:30 has transferred wheat protein into the fry oil, and that protein will persist for the rest of the day, contaminating every subsequent batch of fries. Your salad bar, where a customer used the walnut spoon to serve themselves rice pilaf and then put it back in the wrong container, has just created a tree nut cross-contact event that you will never know about unless someone has a reaction.

And then there is airborne transfer, which is the cross-contact vector that is hardest to control and that most retail operations do not even think about. Flour dust is a real and measurable source of wheat allergen exposure. If your bakery is open to the sales floor (as many are, because the visual and aromatic appeal of a working bakery is a major driver of store traffic), flour particulate settles on surfaces, on products, and potentially on customers. Nut dust from grinding or chopping operations behaves similarly. These are not theoretical risks — they are measurable, they are documented in the food science literature, and they are the kind of thing a plaintiffs' expert witness will testify about at length.

What a plaintiffs' attorney is actually looking for

Here is where I want to be contrarian about how most grocery operators think about allergen documentation, because the conventional framing is wrong. The conventional framing is: "We need documentation because the FDA might inspect us." The correct framing is: "We need documentation because when (not if) someone has an allergic reaction to something from our deli or bakery, a plaintiffs' attorney is going to subpoena every record we have, and the quality of our documentation will determine whether we settle for five figures or seven."

Plaintiffs' attorneys in food allergy cases have a well-established discovery playbook, and they are looking for specific gaps. They will request your ingredient specifications — the allergen statements and spec sheets from every supplier for every ingredient that went into the product their client ate. They want to see batch records showing when the product was made, what ingredients were used, and which equipment was involved. They want cleaning logs — not generic "cleaned daily" entries, but time-stamped records showing that allergen-specific cleaning was performed on the specific piece of equipment used to produce the implicated product at the time relevant to the claim. They want training records demonstrating that the employee who made or handled the product was trained on allergen control procedures, with documentation of what was covered, whether the employee demonstrated understanding, and when they were last retrained. And they want your allergen control plan — a written document identifying the allergen risks in your operation, the controls you have implemented, and how you verify those controls are working.

The devastating moment in an allergen liability case is not when the plaintiff's attorney proves that cross-contact occurred. It is when they demonstrate that you had no system in place to prevent it, no records to show you tried, and no way to determine what happened. At that point, your defense collapses to "we follow good practices," which is not a legal standard and which will not survive cross-examination against medical records showing anaphylaxis.

The documentation gap is a data architecture problem, not a cleaning problem

Most grocery operators, when they think about allergen safety at all, think about it as a cleaning problem. It is not, or rather, it is not primarily a cleaning problem. It is a data architecture problem. Cleaning is one control among several, and cleaning without documentation is cleaning that, for legal and regulatory purposes, did not happen. (This is the food safety equivalent of "if it isn't in version control, it doesn't exist." The analogy is closer than you might think.)

The documentation system that actually protects you has several interlocking components, and the key word is "interlocking." Isolated records — a cleaning log here, a training sign-in sheet there, ingredient specs in a binder somewhere — are almost as useless as no records at all, because they cannot be connected to each other. When your flour supplier notifies you that lot number 2847-A may contain undeclared almond protein from cross-contact at the mill, you need to trace that specific lot through your receiving records to your bakery production logs to your finished goods batches to your sales records. You need to know which products were made with that flour, which lots of finished goods are affected, which are still in inventory, and which have already been sold. With lot-level traceability, you recall six dozen muffins from Tuesday's bake. Without it, you recall everything your bakery produced for the two weeks that flour was in your facility — hundreds of products, most of them perfectly safe, all of them now destined for the dumpster while your customers read about it on social media.

The same logic applies to supplier change management, which is the allergen documentation failure mode that I think is most underappreciated. Your bakery has been buying the same chocolate chips for three years. Your cookie labels accurately declare wheat, milk, and eggs. Then your supplier quietly reformulates the chips to include soy lecithin — a common emulsifier — and does not notify you because they are not required to notify you (supplier notification requirements are contractual, not regulatory, and most retail buyers do not have allergen change notification clauses in their purchasing agreements). Your cookie labels are now wrong. They have been wrong for weeks. A customer with a soy allergy has been buying your cookies for months on the strength of the label that says they contain no soy. The only thing standing between you and a lawsuit is a system that proactively pulls updated spec sheets from suppliers and cross-references them against your product labels — the kind of system that almost no grocery retailer has in place.

Precautionary labeling is not a get-out-of-jail-free card

There is a temptation, which I have seen many retailers succumb to, to slap "may contain" warnings on everything and call it a day. "May contain peanuts, tree nuts, milk, wheat, soy, eggs, fish, shellfish, sesame" — the full nine, on every product, regardless of actual risk. This feels like it should be protective, and it is the allergen equivalent of shrink-wrapping your entire house in bubble wrap. It is also, increasingly, a strategy that creates as many problems as it solves.

FDA's guidance is clear that precautionary labeling should only be used when there is a genuine cross-contact risk that cannot be eliminated through good manufacturing practices. If you can prevent cross-contact by cleaning your slicer properly between cheese and turkey (and you can), then labeling your turkey "may contain milk" instead of actually cleaning the slicer is not a compliant approach — it is a confession that you are not managing the risk. Meanwhile, universal precautionary labeling excludes allergic consumers from products that could be safe for them with proper controls, which is both ethically questionable and, in some interpretations, potentially actionable as misleading labeling. The defensible position is not maximum disclaimers; it is documented controls with cleaning validation and batch records demonstrating that you are actively managing cross-contact risk, supplemented by precautionary labeling only where genuine residual risk remains after you have done everything practicable.

Building the system that will actually save you

The allergen control system that works in retail — and by "works" I mean both prevents reactions and survives legal scrutiny — is less glamorous than you might hope. It starts with knowing what you have: every product you produce in-house, every ingredient in every product, and the allergen status of every ingredient as confirmed by current supplier documentation. This is the allergen hazard assessment, and it is genuinely tedious work, and it is also the foundation without which everything else is theater.

From that foundation, you map where cross-contact can occur. Every piece of shared equipment, every shared prep surface, every production sequence where an allergen-containing product and an allergen-free product touch the same thing. Then you decide on your control strategy for each risk point — dedicating equipment where volume justifies it, scheduling allergen-free production before allergen-containing production where it does not, and implementing validated cleaning protocols for the (many) situations where neither separation nor scheduling is practical. The cleaning protocol itself requires disassembly of equipment to access all food-contact surfaces, detergent with mechanical scrubbing action (water alone does not remove protein, and hot water alone does not either, despite widespread belief to the contrary), a clean water rinse, and drying. And then, critically, periodic verification with allergen test kits — lateral flow immunoassay swabs, similar in technology to a pregnancy test — that confirm your cleaning is actually achieving allergen removal to below detectable levels, not just making surfaces look clean.

All of this gets documented in real time, not reconstructed from memory at the end of a shift or (worse) at the end of a week. The cleaning log entry includes the specific equipment, the time, the employee who performed the cleaning, and — if you are doing this properly — the results of any verification testing. The batch record links the finished product to its ingredients, including supplier lot codes where available. The training record documents not just that an employee attended a session but what was covered, whether comprehension was verified, and when refresher training is due. These records connect to each other so that when someone asks "what happened on Tuesday at 2 PM on slicer number 3," you can answer the question completely and credibly.

The gap between retailers who handle allergen incidents as contained, manageable events and retailers for whom an allergen incident becomes an existential crisis is almost entirely a function of whether this documentation infrastructure exists. The cleaning procedures themselves are not particularly difficult or expensive. The ingredient tracking is not rocket science. The training is straightforward. What is hard is doing all of it consistently, connecting the records to each other, and maintaining the system through employee turnover and supplier changes and the thousand daily urgencies that compete for a store manager's attention. That is the actual problem, and it is fundamentally a systems and data problem, not a food safety knowledge problem.

ShelfLifePro helps grocery retailers with deli and bakery operations build exactly this kind of connected documentation system — batch-level ingredient traceability, allergen management, cleaning records, and production logs that actually link to each other. If your store prepares food in-house, [take a look at what we do for food and beverage operations](/food-beverage).