Celiac Disease and Gluten-Free Compliance: What Food Businesses Must Know
Celiac disease affects approximately 1 in 100 people in the UK and around 1 in 133 people in the United States, yet diagnosis rates remain stubbornly low — meaning many of your customers may be managi
Celiac disease affects approximately 1 in 100 people in the UK and around 1 in 133 people in the United States, yet diagnosis rates remain stubbornly low — meaning many of your customers may be managing the condition without a formal label. For food businesses, this creates a significant responsibility: the people most at risk from cross-contamination or mislabelled products may not even know to ask the right questions. When a customer with celiac disease consumes even trace amounts of gluten — as little as 10–50mg — they can trigger an autoimmune response that damages the small intestine and causes lasting harm. That harm is invisible to you at the point of sale, which is precisely what makes this area of compliance so serious.
The challenge for food business owners isn't just understanding what gluten is — it's knowing where it hides, how labelling laws work, what "gluten-free" actually means legally, and how to build operational practices that protect both your customers and your business. Many operators underestimate the gap between marketing a product as "gluten-free" and actually meeting the legal standard for that claim. That gap can expose you to enforcement action, civil liability, and irreparable reputational damage.
In this post, you'll learn what celiac disease means in a food business context, how UK and US gluten-free regulations differ, where cross-contamination risks are highest, and what practical steps you can take to manage compliance properly.
What Celiac Disease Actually Means for Your Business
Celiac disease is not a food intolerance in the conventional sense — it is a serious, lifelong autoimmune condition triggered by the ingestion of gluten, a protein found in wheat, barley, rye, and related grains. When someone with celiac disease eats gluten, their immune system attacks the lining of the small intestine, causing villous atrophy — a flattening of the tiny finger-like projections responsible for absorbing nutrients. The long-term consequences of repeated exposure include malnutrition, osteoporosis, neurological complications, and an increased risk of certain cancers. This is not an allergy that causes hives; it is a condition where a single poorly labelled product can cause months of recovery for a customer.
From a food business perspective, the key distinction to understand is that celiac disease is different from non-celiac gluten sensitivity (NCGS) and wheat allergy, though all three require attention. A customer with NCGS may tolerate small amounts of gluten without permanent harm, while someone with a wheat allergy is responding to wheat proteins specifically — not all gluten-containing grains. Celiac disease, by contrast, demands strict avoidance across all gluten sources, including barley-based drinks like beer and malt vinegar, which many operators overlook entirely. Understanding these distinctions helps you have more accurate conversations with customers and write more precise product descriptions.
The practical implication for your Shopify store or food business operation is that your labelling, ingredient transparency, and manufacturing processes must be held to a higher standard than general food hygiene alone. If a customer with celiac disease purchases a product from you based on incomplete or inaccurate allergen information, you bear legal and moral responsibility for the outcome. Building your compliance framework with celiac disease in mind — rather than bolting it on as an afterthought — is the only approach that actually protects people.
UK Gluten-Free Regulations: What the Law Actually Requires
In the UK, the legal framework for gluten-free claims is governed by EU Regulation No 828/2014, which was retained in UK law following Brexit. This regulation sets a clear threshold: a product may only be labelled "gluten-free" if it contains no more than 20 parts per million (ppm) of gluten. A secondary claim — "very low gluten" — applies to products containing between 21 and 100 ppm, though this category is rarely used in retail. These thresholds apply to finished products as sold, not to raw ingredients in isolation, which creates a layer of complexity for businesses that manufacture or assemble products from multiple components.
The Food Information for Consumers (FIC) Regulation, also retained in UK law, requires that the 14 major allergens — including cereals containing gluten (wheat, rye, barley, oats, spelt, and kamut) — be declared in a consistent, clearly emphasised format on prepacked foods. For foods sold non-prepacked, including catering and loose products sold in physical locations, you must be able to provide allergen information either in writing or verbally upon request, supported by written documentation. Online food businesses selling into the UK must also provide allergen information before purchase is completed — not just on delivery documentation.
Enforcement is carried out by Local Authority Trading Standards officers and Environmental Health Officers, who have powers to issue improvement notices, withdraw products from sale, and in serious cases pursue prosecution. Fines are unlimited in Crown Court proceedings, and the reputational consequences of an enforcement action or a product recall are typically far more damaging than the cost of getting compliance right in the first place. If you're operating a Shopify store selling food products in the UK, ensuring your product listings reflect accurate, legally compliant allergen information is not optional.
US Gluten-Free Regulations: The FDA Standard Explained
In the United States, the FDA's gluten-free labelling rule, finalised in 2013 and enforced from 2014, uses the same 20 ppm threshold as UK and EU law. Under this rule, foods labelled "gluten-free," "free of gluten," "without gluten," or "no gluten" must contain less than 20 ppm of gluten. The FDA does not require gluten-free testing or certification as a precondition of making the claim, but manufacturers are expected to demonstrate compliance if challenged — which means your records, supplier documentation, and testing protocols matter enormously. Failure to meet the standard after making the claim constitutes misbranding under the Federal Food, Drug, and Cosmetic Act.
One important nuance in the US context is the role of third-party certification bodies such as the Gluten-Free Certification Organization (GFCO), which certifies products to a stricter 10 ppm threshold. While certification is voluntary, it carries significant consumer trust value — particularly in the celiac community, where organisations like the Celiac Disease Foundation actively educate patients to look for certified products. If you're selling premium or health-focused food products in the US market, pursuing certification can differentiate your brand and provide an additional layer of legal defensibility.
For e-commerce food businesses operating across both markets — for example, a UK-based Shopify merchant selling to US customers — you need to be aware that ingredient declarations, serving size formats, and allergen labelling requirements differ between the two regimes. The 20 ppm gluten threshold is harmonised, but everything around it is not. Working with a food safety consultant or using a structured allergen management tool is strongly recommended if you are selling into multiple jurisdictions simultaneously.
Where Cross-Contamination Risk Is Highest
Cross-contamination is the mechanism through which most celiac reactions occur in food business settings, and it is far more insidious than straightforward mislabelling. In manufacturing environments, shared equipment — particularly mixers, conveyor belts, slicers, and packaging lines — can transfer gluten residues between products even when thorough cleaning procedures are in place. Studies have found that standard cleaning protocols reduce but do not always eliminate gluten transfer to below 20 ppm, particularly in high-volume bakery environments. If you produce both gluten-containing and gluten-free products, a formal Hazard Analysis and Critical Control Points (HACCP) assessment of your production line is essential.
In food retail and hospitality settings, the risks shift to shared preparation surfaces, utensils, frying oils, and serving equipment. A gluten-free bread roll placed in a shared toaster is no longer gluten-free. A pasta dish prepared with gluten-free pasta in water that previously cooked regular pasta carries a contamination risk. These scenarios are common in busy kitchens and catering operations, and they demonstrate why training is as important as any written procedure. Your staff need to understand not just what the rules are, but why they exist and what the consequences of getting it wrong look like for a customer with celiac disease.
For online food businesses, cross-contamination risk extends to your supply chain. If your supplier processes wheat on the same line as your gluten-free product, your finished product may not meet the legal threshold regardless of your own practices. Requesting allergen attestation letters and third-party test certificates from suppliers — and reviewing them regularly, not just at onboarding — is a baseline requirement for any business making a gluten-free claim.
Labelling Your Products Correctly: Practical Guidance
Getting your product labelling right requires more than listing ingredients accurately — it requires understanding how gluten sources can appear under different names and how to communicate risk transparently. Wheat appears in ingredient lists as wheat flour, wheat starch, wheat bran, durum, semolina, spelt, and kamut. Barley appears as barley malt, barley malt extract, and malt vinegar. Rye is less commonly disguised but still appears in some seeded bread blends and crispbreads. If any of these are present in your product, you cannot make a gluten-free claim and must ensure the allergen is emphasised in your ingredients list — typically via bold text under UK FIC rules.
For products that are genuinely free from gluten-containing ingredients but manufactured in a shared environment, the appropriate approach is a "may contain" advisory statement — for example, "May contain traces of wheat." These statements are voluntary under UK and US law but are widely used to manage liability and inform consumers. Be aware, however, that overusing precautionary allergen labelling can erode consumer trust; if every product carries a "may contain" warning regardless of actual risk, celiac customers will find your range unusable. Conduct a genuine risk assessment and reserve the advisory for products where cross-contamination is a realistic possibility.
Using a structured tool to manage allergen information across your product range helps ensure consistency and reduces the risk of human error. Allergen Matrix is designed specifically for Shopify food businesses, allowing you to document, manage, and display allergen data — including gluten status — accurately across your entire catalogue. When your product range evolves, reformulations update consistently rather than being missed in a manual process.
Building a Compliance Culture in Your Business
Compliance with gluten-free regulations is not a one-time exercise — it requires an ongoing culture of accuracy, accountability, and continuous review. Staff training is one of the most frequently cited gaps in food safety investigations, and in small businesses it is often the area that receives the least investment. Every person involved in your food operation — from purchasing to production to customer service — needs a baseline understanding of what celiac disease is, why gluten-free claims carry legal weight, and what to do if they are uncertain about a product. Training records should be documented and refreshed annually as a minimum.
Your supplier management process is equally important. Ingredient formulations change, manufacturing sites change, and allergen controls change — sometimes without proactive notification to customers. Establishing a formal review cadence with your key suppliers, including requesting updated allergen documentation at least annually and whenever a product specification changes, is a practical safeguard. Some larger food businesses include allergen management obligations as a contractual clause in their supplier agreements, which creates a formal obligation to notify downstream customers of any changes.
Finally, build a response protocol for customer enquiries and complaints related to celiac disease and gluten. If a customer contacts you to report a reaction, how quickly do you respond, who handles it, and what records do you keep? A documented complaints procedure not only supports regulatory compliance but also demonstrates good faith if an issue escalates. Treating every celiac-related query with the seriousness it deserves — rather than as a minor customer service issue — reflects both legal competence and genuine ethical responsibility.
Conclusion
Celiac disease represents one of the most legally and ethically significant compliance challenges for food businesses operating today. The 20 ppm threshold for gluten-free claims is consistent across UK and US markets, but the operational requirements for meeting and demonstrating that threshold are demanding — spanning ingredient sourcing, manufacturing controls, staff training, supplier management, and customer communication. Getting it right protects vulnerable customers from serious and lasting harm, and it protects your business from enforcement action, legal liability, and the reputational damage that follows a failure.
The key takeaways: understand the legal standard before making any gluten-free claim; assess cross-contamination risks honestly across your entire supply chain; train your team to understand why this matters, not just what the rules say; and use structured tools to manage allergen data accurately as your product range evolves. Compliance is not a box to tick — it is an ongoing operational discipline.
Try Allergen Matrix free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.