Food Safety
From "May Contain" to Quantified Risk: Building a Modern Risk-Based Allergen Management Program
The food industry is shifting from detection-based allergen testing to risk-based allergen management.
A negative allergen test result does not equal low consumer risk. Real risk assessment requires three data points: the concentration of allergen present, the portion size consumed and the dose at which a reaction occurs. The FAO/WHO has established reference doses (ED05 values) for priority allergens, and Codex (CCFL49, May 2026) has recommended adoption of risk-based precautionary allergen labelling guidelines built on these reference doses. The FDA is moving in the same direction, holding a public meeting on allergen thresholds in February 2026. Food manufacturers should prepare by linking allergen concentration, portion size and reference dose data, adding quantitative ELISA testing to high-risk lines and requesting quantitative allergen data from suppliers. A modern allergen program connects the right testing methods, from ATP and protein residue verification through quantitative ELISA and high-sensitivity PCR, into one practical, fit-for-purpose workflow.
In a recent Food Safety Magazine webinar sponsored by Hygiena®, Allergen Uncertainty: Risk Assessment, Reference Doses and Codex Management Guidance, Dr. Bert Popping shared a question a quality manager once asked him: "How do I know I'm not harming someone?"
The manager's allergen test results were negative. But negative results, he sensed, weren't actually telling him whether his consumers were safe.
Dr. Popping, CEO and Principal Consultant at FOCOS (Food Consulting Strategically) and a long-standing contributor to FAO/WHO expert consultations on allergen reference doses, used that moment to frame a bigger industry shift. The science is in place. The regulatory direction is set. What's missing in many facilities is a program built to bridge the gap between "the test came back clean" and "the consumer is protected."
This article examines why detection alone is no longer enough, what FAO/WHO reference doses mean for manufacturers and what a modern risk-based allergen program looks like in practice.
Why "May Contain" No Longer Cuts It
The "may contain" label was originally intended to warn consumers with allergies about possible cross-contact. But it doesn't quantify anything. It doesn't tell the consumer how much allergen may be present, how much of the product is likely to be eaten or whether the resulting dose is enough to trigger a reaction.
In practice, "may contain" has become a statement of uncertainty rather than a science-based description of risk. Often, it's more of a legal protection than a real risk characterization, which is why so many consumers find it hard to interpret and so many manufacturers struggle to justify it.
The deeper issue is that detection-based testing and risk-based management are not the same thing:
| Detection-based Testing | Risk-based Management |
| Binary result (present/absent) | Quantitative concentration in ppm |
| Method-defined threshold | Risk-defined threshold (reference dose) |
| No linkage to portion consumed | Exposure = concentration × portion size |
| No linkage to eliciting dose | Compared against FAO/WHO reference doses |
| Compliance-focused | Protection-focused |
A negative screening result is not the same as evidence of low risk.
The Science Is Already Here: FAO/WHO Reference Doses
A reference dose, specifically the ED05, is the amount of total allergen protein from a single eating occasion at which 5% of the sensitized population would be expected to experience an objective allergic reaction. Values are expressed in milligrams of total protein from the allergenic source.
Between 2020 and 2024, the FAO/WHO Expert Consultation established reference doses for the priority allergens, with gluten added through a follow-up consultation in November 2025.
| Priority Allergen | Recommended Reference Dose (mg) |
| Walnut, pecan, cashew, pistachio, almond | 1 |
| Milk, peanut, egg, hazelnut, sesame | 2 |
| Fish | 5 |
| Shrimp | 200 |
| Gluten-containing cereals | 4 |
A binary lateral flow test cannot answer the three questions a real risk assessment requires: what concentration is present, how much of the product is consumed and at what dose does a reaction occur?
- Concentration needs quantitative analysis.
- Portion size needs exposure data.
- The threshold is based on FAO/WHO reference doses.
Without all three, exposure cannot be properly assessed and the decision is only partially informed.
Where the Regulation Stands: Codex and FDA
Two parallel regulatory tracks are now moving in the same direction.
Codex. The Codex Committee on Food Labelling (CCFL) is actively considering whether to formally adopt FAO/WHO reference doses as the basis for threshold-informed precautionary allergen labeling. Draft Codex principles already frame PAL as something that should be used only when unintended allergen presence cannot be avoided or is below an action level based on reference doses.
FDA. In February 2026, the FDA hosted a Virtual Public Meeting and Listening Session on Food Allergen Thresholds and Their Potential Applications, gathering input from industry, consumer groups and healthcare professionals on how thresholds could be applied to risk assessments, labeling exemptions, compliance actions and guidance on cross-contact controls. This builds on the FDA's recent allergen regulatory activity, including the addition of sesame as the ninth major allergen in 2023 under the FASTER Act. While there's no mandatory threshold-based system in the U.S. yet, the regulatory direction is clearly active.
The question is no longer whether risk-based allergen management is coming. It's whether food manufacturers will be ready when it does.
What Fit-for-Purpose Testing Actually Means
A common question comes up at this point: which test should we use?
The honest answer: a method is neither good nor bad in isolation. It's either suitable or unsuitable for a defined purpose. Method selection without decision context isn't scientifically defensible.
To know whether a method is fit for purpose, ask four questions:
- Is it validated for this matrix?
- Is it validated for this allergen form?
- Is it validated for this analytical purpose (screening, supplier verification, exposure assessment)?
- Does it meet the limit of quantification required by the risk assessment?
If the answer to any one of these is no, the method may still be useful but not for that specific decision. This is also why no single endorsed list of methods can solve the problem of allergen. Method suitability depends on the product, the allergen form and the sensitivity required by the risk context.
Building a Modern Risk-Based Allergen Program
A modern allergen program isn't about adding more tests. It's about connecting the right methods into one practical workflow that supports quantified, defensible decisions.
Hygiena's A-to-P approach (ATP to PCR) is built around exactly this principle:
- Verify and Monitor. ATP and general protein residue tests (UltraSnap®, AllerSnap®) confirm cleaning effectiveness and support everyday allergen control.
- Validate and Trend. Quantitative ELISAs (AlerTox® ELISAs, GlutenTox® ELISA) provide the concentrations required for data-driven exposure assessment. This is where detection becomes risk characterization.
- Confirm and Investigate. Real-time PCR (BAX® System Q7, foodproof®) supports complex matrices, root cause analysis and added assurance.
- Connect with Data. SureTrend® Food Safety Management Platform consolidates every result - ATP, allergen, indicator organism, PCR, into one place. That's where allergen records become the kind of defensible documentation regulators will expect.
Three practical steps to start now, drawn from Dr. Popping's recommendations:
- Build a system that links allergen concentration, portion size and reference dose. These three elements are the core of any exposure assessment.
- Add regular quantitative ELISA testing to high-risk lines. This is what makes exposure measurable rather than assumed.
- Request quantitative allergen data from your suppliers. Risk assessment starts with raw materials, not the finished product.
None of these steps is radical. Together, they shift allergen control from detection toward quantified, defensible decision-making and they create records that support both internal decisions and regulatory justification.
From "May Contain: Uncertainty" to a Quantified, Managed, Defensible Allergen Program
The science to support this shift is already available. The regulatory direction is clear. What's needed now is implementation in company systems, in supplier relationships and ultimately in the way risk is characterized and managed.
The real challenge is no longer whether a risk-based approach is scientifically possible. It's whether your program is ready to operate this way consistently.
Want to talk through how a risk-based allergen program could fit your facility? Book a consultation with a Hygiena allergen specialist.
