How to Manage Allergens in a Cake Shop: A Practical UK Guide for Bakeries

27 Aug

Learn how UK cake shops and bakeries should manage allergens, cross-contact, labels, bespoke orders, Natasha’s Law, staff training and customer communication.

For a cake shop, allergen management is not an occasional compliance task. It is part of taking orders, buying ingredients, preparing cakes, decorating products, packaging them, selling online and handing the finished order to the customer.

A typical celebration cake could contain flour, eggs, butter, cream, chocolate, nuts, soya or ingredients produced in facilities where other allergens are handled. Add bespoke requests such as “dairy-free”, “eggless”, “gluten-free” or “nut-free”, and allergen management can quickly become one of the most important responsibilities in your bakery.

UK food businesses must provide customers with accurate information about regulated allergens and manage allergens effectively when preparing and selling food. Staff also need appropriate allergen training.

This guide explains what cake shop and bakery owners need to know, how to build a practical allergen-management process and where the greatest risks can occur.

Why allergen management matters so much in a cake shop

Cake businesses routinely work with some of the UK's most common regulated allergens.

A single kitchen may contain wheat flour, eggs, milk, almonds, hazelnuts, peanuts, sesame, soya and dozens of compound ingredients such as chocolate, sprinkles, fillings, fondant, flavourings and decorations.

That means allergen information cannot simply exist inside the owner's head.

Your front-of-house staff need to understand it. Your bakers and decorators need access to it. Your online order information needs to reflect it. And if a supplier changes an ingredient, the information you provide customers may need to change too.

Food allergies can cause serious and potentially life-threatening reactions. Cooking a product does not necessarily remove an allergen, so preventing exposure depends on knowing what is in your products and controlling cross-contact correctly.

What are the 14 allergens cake shops need to know about?

UK food law identifies 14 allergens that businesses must declare when they are used as ingredients.

Although some are much more common in bakeries than others, cake shop owners and staff should understand all 14.

Regulated allergen:

Cereals containing gluten: Wheat flour, rye, barley, oats, biscuits, cake crumbs
Eggs: Sponge cakes, meringue, mayonnaise-based savoury products, glazes
Milk: Butter, cream, chocolate, ganache, icing, condensed milk
Nuts: Almonds, hazelnuts, walnuts, pistachios, pecans, cashews
Peanuts: Peanut butter, toppings, confectionery and some flavourings
Soya: Chocolate, emulsifiers and some dairy alternatives
Sesame: Seeds, tahini, breads and some decorative ingredients
Lupin: Some specialist flours and bakery products
Sulphur dioxide / sulphites: Certain dried fruits and preserved ingredients when above the regulated level
Celery: More likely in savoury bakery products
Mustard: Savoury fillings, sauces and prepared ingredients
Fish: Some savoury products or specialist ingredients
Crustaceans: Less common but possible in savoury bakery/catering operations
Molluscs: Less common but still one of the regulated allergens

The legal requirement concerns these 14 regulated allergens, but customers can be allergic or intolerant to other ingredients too.

For cake businesses, the allergens you are likely to deal with most frequently include gluten-containing cereals, eggs, milk, nuts, peanuts and soya.

Start with an allergen matrix for every product you sell

One of the most practical ways to manage allergens is to create an allergen matrix.

An allergen matrix lists each product you sell and identifies which of the 14 regulated allergens it contains.

This is only an example. Your matrix must be based on the ingredients and supplier information used by your own business.

The Food Standards Agency provides allergen-matrix resources specifically to help food businesses record written allergen information. The FSA recommends that written allergen information is available for non-prepacked food and that it is supported by a conversation with the customer.

The matrix should become a working business document rather than something created once and forgotten.

If your chocolate supplier changes, check the new specification.
If you switch sprinkles, check them.
If you introduce a new filling, check it.
If a baker changes a recipe, update the matrix.

The information you give customers is only useful if it reflects what is actually being used in the kitchen.

Don't assume an ingredient is safe because you've used it before

Supplier changes are one of the easiest ways for allergen information to become inaccurate.

Imagine your usual white chocolate is unavailable and someone buys another brand.

The cake may look and taste almost identical, but the new manufacturer's ingredients and precautionary allergen information could be different.

The same problem can happen with:

Chocolate
Fondant
Food colouring
Cake mixes
Sprinkles
Biscuits
Flavourings
Sauces
Fillings
Edible decorations
Plant-based alternatives

This is why ingredient labels and product specifications should be checked when deliveries arrive.

Official guidance recommends checking deliveries, keeping ingredients appropriately labelled and ensuring allergen information is updated when ingredients or recipes change.

Be especially careful with bespoke cake orders

Bespoke cakes create an additional challenge because the final product can differ from your standard menu.

A customer might order:

“Chocolate sponge with Oreo filling, white chocolate ganache, fondant, macarons and personalised decorations.”

Your standard chocolate-cake allergen record may no longer cover the finished product.

Every additional component matters.

The biscuits might contain soya.
The macarons could contain almonds.
The chocolate could contain milk and soya.
The edible decorations could have their own ingredient and allergen information.
The filling might have changed supplier since the last order.

For bespoke cakes, allergen checking should therefore be connected to the actual final specification of the order, rather than relying only on the name of the base cake.

This is also why clear order records are important. When a customer tells you about an allergy or intolerance, the information should not disappear inside a WhatsApp conversation or handwritten note that the person preparing the cake never sees.

Never guess when a customer asks about an allergy

Suppose a customer asks:

“Does this cake contain nuts?”

The wrong response is:

“I don't think so.”

The correct approach is to check your documented ingredient and allergen information.

Staff should understand that allergen questions are different from ordinary product questions.

If they are uncertain, they should stop and check with the person responsible for allergen management rather than guessing. Government guidance says businesses should have procedures explaining how staff respond to allergen questions, verify information before answering and know what to do when they are unsure.

That process needs to include whoever takes orders through your counter, telephone, website, email, Instagram, Facebook, WhatsApp or other channels.

Understand the difference between “contains” and “may contain”

These statements mean different things.

If almonds are deliberately used to make a cake, nuts are an ingredient and the appropriate allergen information needs to be provided.

A statement such as “may contain nuts” is precautionary allergen labelling. It relates to a genuine risk of unintended allergen cross-contact that cannot be sufficiently controlled.

Official guidance says precautionary allergen labelling should follow a risk assessment and should not simply be used as a substitute for good allergen-management procedures. General statements such as “may contain allergens” should not be used as a catch-all warning.

Putting “may contain all allergens” on everything isn't an effective allergen-management strategy.

Cross-contact can happen very easily in a bakery

Consider what happens during an ordinary working day.

A mixer is used for an almond cake.
A spatula spreads peanut butter frosting.
Flour becomes airborne.
Cake crumbs remain on a worktop.
A decorator handles a nut topping and then starts another cake.
A scoop is moved between ingredient containers.
A knife is reused.

Those are all points where allergens could potentially transfer from one product to another.

The FSA recommends measures including cleaning utensils, washing hands between preparation activities, separating ingredients, and keeping ingredients and prepared foods in closed and labelled containers.

In a busy bakery, allergen controls therefore need to be designed around the actual production environment rather than simply writing a policy.

Can you call a cake “nut-free”, “dairy-free” or “allergen-free”?

Be very careful with free-from claims.

A customer asking for a cake “without nuts” isn't necessarily asking the same thing as someone with a severe nut allergy asking whether you can guarantee a nut-free cake.

Official UK guidance says that “free-from” or “allergen-free” claims represent a guarantee that the specified allergen is not present. Businesses making those claims need strict processes to prevent cross-contamination. If the business cannot remove the cross-contamination risk, it should not make the free-from claim.

This is particularly important for small cake shops using the same kitchen, equipment, mixers and surfaces for products containing multiple allergens.

Your staff need to understand the distinction between:

“This recipe doesn't use peanuts as an ingredient.”

and

“This product is peanut-free.”

They are not automatically the same statement.

Vegan does not automatically mean allergen-free

Another common misunderstanding concerns vegan products.

A vegan cake may contain allergens such as:

Gluten
Soya
Nuts
Peanuts
Sesame

And even though a vegan recipe may not intentionally contain milk or egg, the production environment or supplied ingredients may introduce cross-contact considerations.

Government guidance specifically notes that vegan labelling does not guarantee that a product is free from a particular allergen.

So staff should never tell a customer with a milk allergy, for example, that a product is automatically safe simply because it is vegan.

What is Natasha's Law and does it apply to cake shops?

Cake shops need to understand Prepacked for Direct Sale, usually shortened to PPDS.

PPDS food is food that is packaged at the same premises from which it is sold and is placed into that packaging before the customer selects or orders it.

A bakery example could be cakes or pastries packaged on-site and placed out for customers to choose.

Since 1 October 2021, PPDS foods across the UK have required a label showing the name of the food and a full ingredients list, with any of the 14 regulated allergens emphasised within that list. These requirements are commonly referred to as Natasha's Law.

A simplified example might look like:

Chocolate Brownie

Ingredients: Sugar, WHEAT flour, EGGS, butter (MILK), cocoa powder, chocolate [cocoa mass, sugar, cocoa butter, emulsifier (SOYA lecithin)].

The precise label needs to reflect the actual product and comply with applicable labelling requirements.

Does every boxed cake count as PPDS?

Not necessarily.

Whether a product is PPDS depends on factors including where, when and how it is packaged in relation to the sale.

For example, a boxed cupcake sitting on your counter before the customer chooses it may be treated differently from a cake placed into a box after a customer orders it.

Because bakery operating models vary considerably, businesses should use current FSA or Food Standards Scotland guidance to determine which rules apply to their particular products. The FSA provides a specific decision tool and sector guidance for bakers.

Do not assume that putting something into a cake box automatically tells you which labelling category applies.

What about loose cakes and products sold from the counter?

A cake or pastry sold loose is generally handled as non-prepacked food.

You still need to provide information about the presence of any of the 14 regulated allergens used as ingredients.

For non-prepacked food, allergen information can be given in writing or verbally, provided the required signposting and processes are in place. Current FSA best practice is for businesses to make written allergen information available and support it with a conversation with the customer.

For a cake shop, a written allergen matrix available to staff can be a very effective way of supporting this.

What about cake orders placed online, over the phone or through social media?

This is especially important for modern cake shops.

An order made through your website, Instagram, Facebook, telephone or another remote channel may count as distance selling.

Where food is sold through distance selling, required allergen information needs to be available before the customer completes the purchase and again when the food is delivered.

For example, a cake shop might provide allergen information on the product page or during the ordering conversation, then provide the relevant information again with the finished order.

This is an area where bakery businesses relying heavily on Instagram DMs and WhatsApp orders should be particularly careful.

The convenience of informal ordering shouldn't result in informal allergen management.

Train everyone, not only the baker

The person mixing the cake is not the only employee who needs allergen awareness.

Someone answering Instagram messages could receive an allergy question.
Someone working at the till could change an order.
Someone packing cakes could put the wrong label on the box.
Someone taking a telephone order could forget to record an allergy.
Someone handing over the cake could give the wrong product to the customer.

UK food businesses are expected to make sure staff receive appropriate allergen training for their roles. The Food Standards Agency and Food Standards Scotland both provide free online allergen training resources.

One member of the team should also have clear responsibility for maintaining allergen information and ensuring procedures are followed.

Create an allergen process for every customer order

For a bespoke cake business, a strong process might look like this:

Customer orders → allergy requirements recorded → recipe and ingredients checked → customer given accurate information → production team alerted → cake prepared using the appropriate controls → order clearly identified → final handover checked

The important part is that allergen information follows the order through the business. It shouldn't rely on one employee remembering a conversation that happened three weeks earlier. This becomes particularly important for wedding cakes, birthday cakes and large celebration orders that may be placed weeks or months before they are produced.

Don't forget decorations, toppers and outsourced products

Not everything on a cake is necessarily manufactured in your own kitchen.

You may buy:

Edible cake toppers
Macarons
Chocolate decorations
Biscuits
Sprinkles
Sauces
Fondant figures
Cake charms
Printed edible images
Ready-made fillings

If an item is used as part of the finished product, its relevant ingredient and allergen information matters too.

Keep supplier information accessible and make sure staff know that a decoration shouldn't be added to an allergy-related order simply because it appears harmless.

Keep your allergen records up to date

Allergen management works best when it is part of everyday bakery operations.

A useful internal rule is:

No ingredient change without an allergen check.

If your supplier substitutes a product, check it.
If your recipe changes, update it.
If you launch a seasonal cake, record it.
If you introduce a new topping, check it.
If a product is discontinued and replaced, update the corresponding records.

The FSA recommends recording allergen information using sources such as supplier specification sheets, ingredient labels and recipes, and keeping that information current.

A practical cake shop allergen checklist

Before considering your allergen process complete, check that:

Every standard cake and bakery product has accurate allergen information.
You have a system for checking allergen information for bespoke cakes.
Staff understand all 14 regulated allergens.
Ingredient specifications and original labels are retained or accessible.
Supplier substitutions trigger a new allergen check.
Written allergen information is available to staff and customers where appropriate.
Staff know they must never guess when answering an allergy question.
Allergy requirements are recorded clearly against customer orders.
Kitchen staff can easily identify allergy-related orders.
Procedures exist to reduce cross-contact during storage, preparation, decorating and packaging.
Free-from claims are only made where the business can support them.
PPDS products are correctly identified and labelled where applicable.
Online and telephone customers receive required allergen information before purchase and again when required at delivery.
Staff receive regular allergen training.
Someone has clear responsibility for maintaining the allergen-management system.

How better order management can support safer bakery operations

Many independent cake shops still manage bespoke orders through combinations of paper forms, WhatsApp, Instagram messages, spreadsheets, phone calls and handwritten notes.

That makes important customer information easier to miss.

A customer may tell one member of staff:

“My daughter has a severe nut allergy.”

But if that information stays inside an Instagram conversation while the production team works from a separate paper order sheet, the bakery has created an unnecessary communication risk.

This is one reason modern cake businesses benefit from keeping customer and order information organised in one place.

Tolloz is being built specifically for cake shops and bakeries, helping businesses manage customer orders, order details, collection information, customer communication, payments and customer records through a more connected system.

Tolloz does not replace your legal responsibilities, allergen-management system, staff training or food safety procedures. Instead, the goal is to remove unnecessary fragmentation from running a modern cake business.

Because when an important customer requirement is recorded, the people responsible for fulfilling that order should be able to find it.

Get Started

Cake shop allergen management FAQs

What allergens must a cake shop declare in the UK?

UK food businesses must provide information when any of the 14 regulated allergens are used as ingredients. These include cereals containing gluten, eggs, milk, nuts, peanuts, soya and sesame, along with celery, crustaceans, fish, lupin, molluscs, mustard and sulphur dioxide/sulphites above the specified level.

What are the most common allergens found in cakes?

Common allergens in cakes include wheat or other gluten-containing cereals, eggs, milk, nuts, peanuts and soya. However, the actual allergens depend on the recipe, decorations, fillings and ingredients used by the individual bakery.

Does a cake shop need an allergen chart?

An allergen matrix is a practical method of keeping written allergen information for products. The Food Standards Agency provides downloadable allergen matrices and recommends written allergen information for non-prepacked foods supported by conversations with customers.

Do I have to list allergens on cakes sold loose?

You must make information available about any of the 14 regulated allergens used as ingredients. For non-prepacked foods, the way this information is provided differs from fully prepacked or PPDS products. Current FSA best practice recommends written allergen information supported by a conversation.

What is Natasha's Law for bakeries?

Natasha's Law refers to rules introduced across the UK from 1 October 2021 requiring food that qualifies as prepacked for direct sale to carry the name of the food and a full ingredients list with regulated allergens emphasised.

Are cupcakes in boxes considered PPDS?

They can be, depending on when and where they were packaged and how they are offered for sale. Businesses should check the official PPDS guidance or decision tool rather than assuming every boxed product is treated the same way.

Can I say a cake is nut-free if I don't use nuts in the recipe?

Not necessarily. A free-from claim requires appropriate controls around the specified allergen. If you cannot adequately control the cross-contact risk, official guidance says you should not make a free-from claim.

Does vegan mean dairy-free for someone with a milk allergy?

A vegan claim should not be treated as an allergen-free guarantee. Official guidance specifically warns that vegan labelling does not guarantee a food is free from a particular allergen.

Do online cake shops need to provide allergen information?

Yes. For distance selling, allergen information must be made available before the purchase is completed and again when the food is delivered.

Do cake shop employees need allergen training?

Food businesses need to ensure staff are appropriately trained to manage allergens within their roles. Free allergen training is available from the Food Standards Agency and Food Standards Scotland.

Make allergen management part of how your bakery operates

Managing allergens isn't just about putting a notice beside the till.

It starts when ingredients arrive at your bakery and continues through recipe management, storage, preparation, decorating, taking orders, customer communication, packaging, delivery and collection.

The safest process is one that your team follows every day.

Know what's in your products. Keep your information current. Train your staff. Record allergy requirements clearly. Never guess. And make sure information follows the customer order from the moment it is placed until the cake is collected or delivered.

Better systems won't replace food safety expertise, but they can help remove the communication gaps that make running a growing bakery harder.

Rise by Tolloz brings together practical guides, insights and tools to help modern bakery and cake shop owners run better organised, more profitable businesses.

Ready to simplify your bakery operations?

Discover Tolloz, the all-in-one business platform being built specifically for bakeries and cake shops.